Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
42775
Total
3467
Critical
12772
High
12580
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-81279 | MEDIUM | 5.4 | Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions. | Aug 27, 2026 |
| CVE-2026-81277 | HIGH | 8.5 | Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions. | Aug 27, 2026 |
| CVE-2026-81276 | MEDIUM | 5.3 | Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions. | Aug 27, 2026 |
| CVE-2026-81274 | MEDIUM | 5.3 | Subscriber Broken Access Control in Ditty <= 3.1.67 versions. | Aug 27, 2026 |
| CVE-2026-81273 | HIGH | 8.1 | Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions. | Aug 27, 2026 |
| CVE-2026-81272 | MEDIUM | 4.9 | Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions. | Aug 27, 2026 |
| CVE-2026-81271 | HIGH | 8.8 | Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions. | Aug 27, 2026 |
| CVE-2026-80433 | HIGH | 7.5 | Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions. | Aug 27, 2026 |
| CVE-2026-78293 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions. | Aug 27, 2026 |
| CVE-2026-78292 | CRITICAL | 9.8 | Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions. | Aug 27, 2026 |
| CVE-2026-78289 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions. | Aug 27, 2026 |
| CVE-2026-78288 | CRITICAL | 9.3 | Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions. | Aug 27, 2026 |
| CVE-2026-78286 | CRITICAL | 9.8 | Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions. | Aug 27, 2026 |
| CVE-2026-78285 | HIGH | 8.5 | Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions. | Aug 27, 2026 |
| CVE-2026-78283 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions. | Aug 27, 2026 |
| CVE-2026-78281 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions. | Aug 27, 2026 |
| CVE-2026-78276 | HIGH | 7.2 | Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions. | Aug 27, 2026 |
| CVE-2026-78275 | MEDIUM | 6.8 | Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions. | Aug 27, 2026 |
| CVE-2026-78274 | CRITICAL | 9.1 | Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions. | Aug 27, 2026 |
| CVE-2026-78273 | MEDIUM | 6.5 | Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions. | Aug 27, 2026 |
| CVE-2026-78271 | HIGH | 7.2 | Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions. | Aug 27, 2026 |
| CVE-2026-78261 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions. | Aug 27, 2026 |
| CVE-2026-78260 | CRITICAL | 9.3 | Unauthenticated SQL Injection in Epayco <= 8.4.6 versions. | Aug 27, 2026 |
| CVE-2026-78257 | HIGH | 8.8 | Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions. | Aug 27, 2026 |
| CVE-2026-75020 | UNKNOWN | — | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A caller who holds valid credentials for one entry … | Aug 27, 2026 |