Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
49165
Total
3939
Critical
14577
High
14341
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-21059 | UNKNOWN | — | Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege. | Aug 10, 2026 |
| CVE-2026-21058 | UNKNOWN | — | Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege. | Aug 10, 2026 |
| CVE-2026-19089 | UNKNOWN | — | The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its … | Aug 10, 2026 |
| CVE-2026-19077 | UNKNOWN | — | The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role … | Aug 10, 2026 |
| CVE-2026-19075 | UNKNOWN | — | All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post's `mp4` meta value … | Aug 10, 2026 |
| CVE-2026-19074 | UNKNOWN | — | The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensitive information exposure via … | Aug 10, 2026 |
| CVE-2026-19053 | CRITICAL | 9.1 | The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated … | Aug 10, 2026 |
| CVE-2026-19049 | UNKNOWN | — | The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on … | Aug 10, 2026 |
| CVE-2026-18960 | UNKNOWN | — | The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an … | Aug 10, 2026 |
| CVE-2026-18946 | HIGH | 7.5 | The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a … | Aug 10, 2026 |
| CVE-2026-18934 | UNKNOWN | — | The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job … | Aug 10, 2026 |
| CVE-2026-18786 | UNKNOWN | — | The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised … | Aug 10, 2026 |
| CVE-2026-18666 | UNKNOWN | — | The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users … | Aug 10, 2026 |
| CVE-2026-18470 | HIGH | 7.5 | The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not … | Aug 10, 2026 |
| CVE-2026-18469 | UNKNOWN | — | The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification … | Aug 10, 2026 |
| CVE-2026-18468 | UNKNOWN | — | The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the … | Aug 10, 2026 |
| CVE-2026-18200 | UNKNOWN | — | The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, … | Aug 10, 2026 |
| CVE-2026-18030 | UNKNOWN | — | The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form … | Aug 10, 2026 |
| CVE-2026-17542 | HIGH | 7.5 | The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, … | Aug 10, 2026 |
| CVE-2026-17541 | HIGH | 7.5 | The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its … | Aug 10, 2026 |
| CVE-2026-17540 | UNKNOWN | — | The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read … | Aug 10, 2026 |
| CVE-2026-17023 | UNKNOWN | — | The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization … | Aug 10, 2026 |
| CVE-2026-17022 | HIGH | 7.5 | The Salon Booking System WordPress plugin through 10.30.33 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing … | Aug 10, 2026 |
| CVE-2026-17021 | UNKNOWN | — | The Salon Booking System WordPress plugin through 10.30.33 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership … | Aug 10, 2026 |
| CVE-2026-17020 | UNKNOWN | — | The Salon Booking System WordPress plugin through 10.30.33 does not verify that a requested booking belongs to the caller on one of its REST API … | Aug 10, 2026 |