Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
44710
Total
3597
Critical
13280
High
13130
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-78685 | HIGH | 8.8 | Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML … | Aug 25, 2026 |
| CVE-2026-75982 | MEDIUM | 4.4 | The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress_create_page AJAX … | Aug 25, 2026 |
| CVE-2026-75019 | MEDIUM | 6.4 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored … | Aug 25, 2026 |
| CVE-2026-10627 | MEDIUM | 5.3 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.4.0. … | Aug 25, 2026 |
| CVE-2025-9878 | MEDIUM | 6.4 | The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortcode … | Aug 25, 2026 |
| CVE-2026-78683 | CRITICAL | 9.6 | NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, … | Aug 25, 2026 |
| CVE-2026-78682 | HIGH | 7.5 | NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured. pathsec.urlopen validates the requested … | Aug 25, 2026 |
| CVE-2026-78681 | HIGH | 7.5 | NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with … | Aug 25, 2026 |
| CVE-2026-78680 | HIGH | 7.8 | NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent._repr_svg_, allowing attackers to execute arbitrary … | Aug 25, 2026 |
| CVE-2026-78679 | MEDIUM | 6.5 | GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a … | Aug 25, 2026 |
| CVE-2026-78678 | MEDIUM | 6.5 | GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by … | Aug 25, 2026 |
| CVE-2026-78677 | HIGH | 7.5 | GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separate_git_dir parameter … | Aug 25, 2026 |
| CVE-2026-78676 | CRITICAL | 9.8 | GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft … | Aug 25, 2026 |
| CVE-2026-78675 | HIGH | 8.4 | GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. … | Aug 25, 2026 |
| CVE-2026-76846 | HIGH | 7.5 | Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit … | Aug 25, 2026 |
| CVE-2026-76839 | MEDIUM | 6.5 | Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() methods that lack field filtering. Attackers with page-edit … | Aug 25, 2026 |
| CVE-2026-75575 | MEDIUM | 5.3 | Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method … | Aug 25, 2026 |
| CVE-2026-75574 | HIGH | 8.8 | The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write … | Aug 25, 2026 |
| CVE-2026-72702 | MEDIUM | 5.4 | Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored string prefix … | Aug 25, 2026 |
| CVE-2026-72701 | LOW | 3.7 | Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce() that uses non-constant-time string comparison with the === operator instead of hash_equals() for CSRF nonce … | Aug 25, 2026 |
| CVE-2026-72700 | HIGH | 7.5 | The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash_equals() … | Aug 25, 2026 |
| CVE-2026-72699 | MEDIUM | 5.3 | The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a … | Aug 25, 2026 |
| CVE-2026-72698 | MEDIUM | 6.5 | Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. … | Aug 25, 2026 |
| CVE-2026-72697 | MEDIUM | 6.5 | Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate … | Aug 25, 2026 |
| CVE-2026-72696 | HIGH | 8.4 | Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable … | Aug 25, 2026 |