Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
28438
Total
2190
Critical
8535
High
8856
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-6427 | MEDIUM | 6.4 | The a3 Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.7.6 This is due to … | May 28, 2026 |
| CVE-2026-44604 | HIGH | 7.0 | A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, … | May 28, 2026 |
| CVE-2026-9803 | MEDIUM | 5.3 | A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with a … | May 28, 2026 |
| CVE-2026-9802 | MEDIUM | 6.8 | A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. … | May 28, 2026 |
| CVE-2026-9801 | MEDIUM | 4.9 | A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) … | May 28, 2026 |
| CVE-2026-9798 | MEDIUM | 4.3 | A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login … | May 28, 2026 |
| CVE-2026-9673 | MEDIUM | 6.8 | Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker … | May 28, 2026 |
| CVE-2026-9644 | MEDIUM | 6.4 | The LiveSmart Video Chat Live Video Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'livesmart_widget' shortcode in all versions up … | May 28, 2026 |
| CVE-2026-9009 | HIGH | 8.8 | The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the … | May 28, 2026 |
| CVE-2026-7533 | MEDIUM | 4.3 | The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.7. This is due to … | May 28, 2026 |
| CVE-2026-3173 | MEDIUM | 6.5 | The Meta Field Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.5.1. This is due … | May 28, 2026 |
| CVE-2026-9796 | MEDIUM | 6.5 | A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin … | May 28, 2026 |
| CVE-2026-9795 | HIGH | 7.3 | A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any … | May 28, 2026 |
| CVE-2026-9794 | MEDIUM | 5.3 | A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security … | May 28, 2026 |
| CVE-2026-9793 | MEDIUM | 5.9 | A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the … | May 28, 2026 |
| CVE-2026-9792 | MEDIUM | 6.5 | A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When certain condition providers (client-type, client-roles, client-attributes, client-scopes) are used to enforce … | May 28, 2026 |
| CVE-2026-9791 | MEDIUM | 4.3 | A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account … | May 28, 2026 |
| CVE-2026-9241 | MEDIUM | 4.3 | The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and … | May 28, 2026 |
| CVE-2026-9228 | MEDIUM | 4.3 | The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.16 … | May 28, 2026 |
| CVE-2026-7802 | HIGH | 8.8 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.2. This is due to … | May 28, 2026 |
| CVE-2026-5737 | MEDIUM | 6.5 | The Independent Analytics plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.14.9. This is due to a … | May 28, 2026 |
| CVE-2026-32999 | CRITICAL | 9.0 | Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a … | May 28, 2026 |
| CVE-2026-32998 | UNKNOWN | — | This vulnerability in Veeam Service Provider Console allows for remote code execution. | May 28, 2026 |
| CVE-2026-32997 | UNKNOWN | — | A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server. | May 28, 2026 |
| CVE-2026-32996 | UNKNOWN | — | This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation. | May 28, 2026 |