Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
47180
Total
3801
Critical
14071
High
13766
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-68460 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential deadlock in f2fs_balance_fs() When the f2fs filesystem space is nearly exhausted, we … | Aug 15, 2026 |
| CVE-2026-68459 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() When we mount device w/ gc_merge … | Aug 15, 2026 |
| CVE-2026-68458 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: binder: cache secctx size before release zeroes it binder_transaction() bounds the scatter-gather buffer area with … | Aug 15, 2026 |
| CVE-2026-68457 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for FSCTL mutations SET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION operate on an open … | Aug 15, 2026 |
| CVE-2026-68456 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() ueagle-atm uses the asynchronous request_firmware_nowait() in … | Aug 15, 2026 |
| CVE-2026-68455 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: liveupdate: validate session type before performing operation The sessions ioctls are not applicable to all … | Aug 15, 2026 |
| CVE-2026-18807 | UNKNOWN | — | The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to … | Aug 15, 2026 |
| CVE-2026-18216 | UNKNOWN | — | The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a … | Aug 15, 2026 |
| CVE-2026-16611 | UNKNOWN | — | The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, … | Aug 15, 2026 |
| CVE-2026-16541 | UNKNOWN | — | The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester … | Aug 15, 2026 |
| CVE-2026-16007 | UNKNOWN | — | AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in … | Aug 15, 2026 |
| CVE-2026-14230 | UNKNOWN | — | The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce … | Aug 15, 2026 |
| CVE-2026-14229 | UNKNOWN | — | The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its … | Aug 15, 2026 |
| CVE-2026-18387 | MEDIUM | 6.5 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tag_query' parameter in all versions up … | Aug 15, 2026 |
| CVE-2026-17090 | MEDIUM | 6.4 | The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Button Module 'button' (Button … | Aug 15, 2026 |
| CVE-2026-16586 | MEDIUM | 6.5 | The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles … | Aug 15, 2026 |
| CVE-2026-16146 | MEDIUM | 4.9 | The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via Pattern JSON Keys/Values in … | Aug 15, 2026 |
| CVE-2026-16145 | HIGH | 7.2 | The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in … | Aug 15, 2026 |
| CVE-2026-16094 | MEDIUM | 4.9 | The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in … | Aug 15, 2026 |
| CVE-2026-15993 | MEDIUM | 5.3 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via '{username}' Placeholder … | Aug 15, 2026 |
| CVE-2026-15948 | MEDIUM | 6.4 | The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions … | Aug 15, 2026 |
| CVE-2026-15453 | MEDIUM | 6.5 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versions … | Aug 15, 2026 |
| CVE-2026-13360 | HIGH | 7.2 | The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in … | Aug 15, 2026 |
| CVE-2026-8840 | MEDIUM | 5.3 | The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due … | Aug 15, 2026 |
| CVE-2026-16080 | MEDIUM | 6.5 | The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'post_title' parameter in all versions up to, and including, … | Aug 15, 2026 |