Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
45395
Total
3650
Critical
13467
High
13391
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-73351 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions. | Aug 18, 2026 |
| CVE-2026-73350 | HIGH | 8.2 | Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions. | Aug 18, 2026 |
| CVE-2026-73348 | MEDIUM | 6.5 | Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. | Aug 18, 2026 |
| CVE-2026-73345 | HIGH | 7.1 | Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions. | Aug 18, 2026 |
| CVE-2026-73343 | CRITICAL | 10.0 | Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions. | Aug 18, 2026 |
| CVE-2026-73342 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions. | Aug 18, 2026 |
| CVE-2026-73341 | CRITICAL | 9.8 | Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions. | Aug 18, 2026 |
| CVE-2026-73339 | CRITICAL | 9.3 | Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions. | Aug 18, 2026 |
| CVE-2026-73338 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions. | Aug 18, 2026 |
| CVE-2026-73190 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in WPDM – Premium Packages <= 7.0.5 versions. | Aug 18, 2026 |
| CVE-2026-73189 | MEDIUM | 6.5 | Subscriber Insecure Direct Object References (IDOR) in WP Crowdfunding < 2.2.1 versions. | Aug 18, 2026 |
| CVE-2026-73187 | CRITICAL | 9.3 | Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions. | Aug 18, 2026 |
| CVE-2026-73181 | HIGH | 7.5 | Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions. | Aug 18, 2026 |
| CVE-2026-71539 | UNKNOWN | — | n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to … | Aug 18, 2026 |
| CVE-2026-70657 | MEDIUM | 4.3 | Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key … | Aug 18, 2026 |
| CVE-2026-69189 | HIGH | 7.6 | Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose … | Aug 18, 2026 |
| CVE-2026-68939 | UNKNOWN | — | Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENV_VERSION expansion in libexec/pyenv-version-name, … | Aug 18, 2026 |
| CVE-2026-68568 | MEDIUM | 6.3 | Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions. | Aug 18, 2026 |
| CVE-2026-68567 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Convert Pro <= 1.0.1 versions. | Aug 18, 2026 |
| CVE-2026-68565 | MEDIUM | 6.5 | Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions. | Aug 18, 2026 |
| CVE-2026-66793 | HIGH | 8.8 | A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn … | Aug 18, 2026 |
| CVE-2026-66679 | MEDIUM | 6.5 | Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions. | Aug 18, 2026 |
| CVE-2026-66667 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions. | Aug 18, 2026 |
| CVE-2026-66651 | MEDIUM | 6.5 | Unauthenticated Broken Access Control in MultiVendorX <= 5.0.14 versions. | Aug 18, 2026 |
| CVE-2026-66646 | MEDIUM | 6.5 | Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions. | Aug 18, 2026 |