Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
28438
Total
2190
Critical
8535
High
8856
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-9807 | MEDIUM | 4.3 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain … | May 28, 2026 |
| CVE-2026-9804 | HIGH | 7.7 | A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. … | May 28, 2026 |
| CVE-2026-9015 | MEDIUM | 4.3 | The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to authorization bypass in all versions up … | May 28, 2026 |
| CVE-2026-8689 | MEDIUM | 4.3 | The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.11.14. This … | May 28, 2026 |
| CVE-2026-7526 | MEDIUM | 4.3 | The PDF Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.9.3 via the enqueue_block_assets. This makes … | May 28, 2026 |
| CVE-2026-7048 | MEDIUM | 6.5 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order_by' parameter in all … | May 28, 2026 |
| CVE-2026-6937 | MEDIUM | 5.3 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, … | May 28, 2026 |
| CVE-2026-6226 | HIGH | 8.8 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 3.29.2. This is due to … | May 28, 2026 |
| CVE-2026-4408 | CRITICAL | 9.0 | A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check … | May 28, 2026 |
| CVE-2026-4334 | MEDIUM | 6.4 | The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headline' parameter in the [shariff] shortcode in all versions up to, … | May 28, 2026 |
| CVE-2024-47097 | UNKNOWN | — | Cross Site Scripting vulnerability in Follet School Solutions Destiny before v22.0.1 AU1 allows a remote attacker to run arbitrary client-side code via the site parameter … | May 28, 2026 |
| CVE-2024-47096 | UNKNOWN | — | Cross Site Scripting vulnerability in Follet School Solutions Destiny before v22.0.1 AU1 allows a remote attacker to run arbitrary client-side code via the showSupportExpiredMessage parameter … | May 28, 2026 |
| CVE-2026-9806 | UNKNOWN | — | A stored cross-site scripting (XSS) vulnerability exists in the notification panel of CTI Transmute in versions prior to the patched release. Notification messages containing user-controlled … | May 28, 2026 |
| CVE-2026-9618 | MEDIUM | 4.3 | The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) plugin for WordPress is vulnerable to Cross-Site Request Forgery in … | May 28, 2026 |
| CVE-2026-9227 | HIGH | 8.8 | The GutenBee – Gutenberg Blocks plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.20.1 via the gutenbee_file_and_ext_json … | May 28, 2026 |
| CVE-2026-8682 | MEDIUM | 4.3 | The 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On plugin for WordPress is vulnerable to authorization bypass in all versions … | May 28, 2026 |
| CVE-2026-7862 | HIGH | 8.6 | The Eupago Gateway For Woocommerce WordPress plugin before 4.7.2 does not properly restrict access to its refund request handler, allowing unauthenticated attackers to initiate refunds … | May 28, 2026 |
| CVE-2026-7797 | HIGH | 7.5 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'append_where_sql' parameter in … | May 28, 2026 |
| CVE-2026-7660 | MEDIUM | 6.1 | The Easy Updates Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in versions up to, and including, 9.0.20 This … | May 28, 2026 |
| CVE-2026-7651 | MEDIUM | 5.3 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is … | May 28, 2026 |
| CVE-2026-7634 | HIGH | 7.2 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'User-Agent' header in all versions up to, and including, 5.4.11 due … | May 28, 2026 |
| CVE-2026-7621 | MEDIUM | 4.3 | The SMTP2GO for WordPress – Email Made Easy plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.16.0. This … | May 28, 2026 |
| CVE-2026-7552 | MEDIUM | 5.3 | The Geo Mashup plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.13.19. This is due to the plugin … | May 28, 2026 |
| CVE-2026-7052 | HIGH | 7.2 | The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'file_upload' parameter … | May 28, 2026 |
| CVE-2026-6455 | HIGH | 8.1 | The WP Contact Form 7 DB Handler plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Deletion via SQL Injection and … | May 28, 2026 |