Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
47944
Total
3850
Critical
14243
High
13921
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-28008 | CRITICAL | 9.8 | Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions. | Aug 13, 2026 |
| CVE-2026-28004 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions. | Aug 13, 2026 |
| CVE-2026-28003 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions. | Aug 13, 2026 |
| CVE-2026-28002 | HIGH | 8.5 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from … | Aug 13, 2026 |
| CVE-2026-28001 | CRITICAL | 9.3 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | Aug 13, 2026 |
| CVE-2026-27999 | MEDIUM | 6.5 | Subscriber Broken Access Control in Tourfic <= 2.23.1 versions. | Aug 13, 2026 |
| CVE-2026-27544 | CRITICAL | 10.0 | Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions. | Aug 13, 2026 |
| CVE-2026-27543 | HIGH | 8.1 | Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions. | Aug 13, 2026 |
| CVE-2026-27539 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions. | Aug 13, 2026 |
| CVE-2026-27538 | HIGH | 7.5 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | Aug 13, 2026 |
| CVE-2026-27537 | MEDIUM | 6.5 | Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions. | Aug 13, 2026 |
| CVE-2026-27536 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions. | Aug 13, 2026 |
| CVE-2026-27535 | HIGH | 7.1 | Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions. | Aug 13, 2026 |
| CVE-2026-27380 | HIGH | 7.2 | Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions. | Aug 13, 2026 |
| CVE-2026-27345 | HIGH | 7.5 | Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions. | Aug 13, 2026 |
| CVE-2026-21832 | MEDIUM | 4.3 | HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to … | Aug 13, 2026 |
| CVE-2026-19716 | UNKNOWN | — | Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser … | Aug 13, 2026 |
| CVE-2025-62318 | LOW | 3.7 | HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured … | Aug 13, 2026 |
| CVE-2025-62315 | LOW | 3.4 | HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted … | Aug 13, 2026 |
| CVE-2025-62314 | MEDIUM | 5.6 | HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting … | Aug 13, 2026 |
| CVE-2026-73585 | MEDIUM | 6.3 | A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. … | Aug 13, 2026 |
| CVE-2026-73584 | MEDIUM | 6.3 | A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in … | Aug 13, 2026 |
| CVE-2026-73583 | MEDIUM | 6.6 | A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication … | Aug 13, 2026 |
| CVE-2026-6471 | HIGH | 7.2 | Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, … | Aug 13, 2026 |
| CVE-2026-6470 | MEDIUM | 4.3 | Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a … | Aug 13, 2026 |