Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
53238
Total
4231
Critical
15843
High
15500
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-21041 | UNKNOWN | — | Improper access control in SamsungSEAgentService prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information. | Jul 10, 2026 |
| CVE-2026-21040 | UNKNOWN | — | Improper access control in IAFDService prior to SMR Jul-2026 Release 1 allows local privileged attackers to use the privileged APIs. | Jul 10, 2026 |
| CVE-2026-21039 | UNKNOWN | — | Improper access control in Settings prior to SMR Jul-2026 Release 1 allows local attackers to configure Theft protection settings. | Jul 10, 2026 |
| CVE-2026-15332 | MEDIUM | 6.3 | A security flaw has been discovered in zhayujie CowAgent up to 2.1.0. The impacted element is an unknown function of the file channel/channel.py of the … | Jul 10, 2026 |
| CVE-2026-15331 | MEDIUM | 5.4 | A vulnerability was identified in zhayujie CowAgent up to 2.1.0. The affected element is the function _add_url/_add_package of the file agent/skills/service.py of the component Skill … | Jul 10, 2026 |
| CVE-2026-15330 | HIGH | 7.3 | A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function _build_image_content/_download_to_data_url of the file agent/tools/vision/vision.py of the component Vision Tool. Executing … | Jul 10, 2026 |
| CVE-2026-15302 | MEDIUM | 5.3 | The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes … | Jul 10, 2026 |
| CVE-2026-15301 | MEDIUM | 6.4 | The BuddyHolis TableSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder’ parameter in all versions up to, and including, 1.1.0 due … | Jul 10, 2026 |
| CVE-2026-15300 | CRITICAL | 9.1 | The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to, and including, … | Jul 10, 2026 |
| CVE-2026-15299 | MEDIUM | 6.4 | The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'weather_style' and 'move_direction' parameters of the Weather widget in … | Jul 10, 2026 |
| CVE-2026-15298 | HIGH | 7.2 | The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14.14. This is due to insufficient input … | Jul 10, 2026 |
| CVE-2026-15297 | MEDIUM | 6.1 | The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter … | Jul 10, 2026 |
| CVE-2026-15296 | MEDIUM | 6.4 | The affiliate-toolkit – WP Affiliate Plugin with Amazon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'atkp_product' shortcode in all versions … | Jul 10, 2026 |
| CVE-2026-15293 | HIGH | 8.0 | The WP Business Intelligence Lite plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.0. This is due to … | Jul 10, 2026 |
| CVE-2026-15292 | MEDIUM | 6.4 | The Sudoku Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background' parameter in the 'sudoku-sc' shortcode in all versions up to, … | Jul 10, 2026 |
| CVE-2026-15291 | HIGH | 7.5 | The Chat Help – Click to Chat Button & Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and … | Jul 10, 2026 |
| CVE-2026-15290 | HIGH | 7.5 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to blind SQL Injection via … | Jul 10, 2026 |
| CVE-2026-15289 | MEDIUM | 5.9 | The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpdevart_id’ parameter in all versions up to, and … | Jul 10, 2026 |
| CVE-2026-15288 | HIGH | 7.5 | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and … | Jul 10, 2026 |
| CVE-2026-15287 | MEDIUM | 6.5 | The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based SQL Injection via the order_by parameter in all versions up to, … | Jul 10, 2026 |
| CVE-2026-15286 | MEDIUM | 4.3 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to unauthorized post publication in all versions up … | Jul 10, 2026 |
| CVE-2026-15285 | MEDIUM | 6.4 | The Plus Addons for Elementor plugin for WordPress was vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the Button widget's `custom_attributes` setting in versions up … | Jul 10, 2026 |
| CVE-2026-15284 | MEDIUM | 6.4 | The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_page_id' parameter in versions up to, and including, 51.1.62 … | Jul 10, 2026 |
| CVE-2026-15283 | MEDIUM | 4.4 | The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.33 … | Jul 10, 2026 |
| CVE-2026-15282 | CRITICAL | 9.8 | The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachment' function in all versions … | Jul 10, 2026 |