Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
49177
Total
3940
Critical
14579
High
14345
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-15047 | UNKNOWN | — | The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access … | Aug 10, 2026 |
| CVE-2026-14941 | UNKNOWN | — | The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal … | Aug 10, 2026 |
| CVE-2026-14860 | UNKNOWN | — | The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make … | Aug 10, 2026 |
| CVE-2026-14293 | UNKNOWN | — | The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does … | Aug 10, 2026 |
| CVE-2026-14238 | UNKNOWN | — | The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database … | Aug 10, 2026 |
| CVE-2026-14237 | UNKNOWN | — | The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant … | Aug 10, 2026 |
| CVE-2026-14211 | UNKNOWN | — | The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose … | Aug 10, 2026 |
| CVE-2026-14206 | HIGH | 7.5 | The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated … | Aug 10, 2026 |
| CVE-2026-13701 | MEDIUM | 4.8 | The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the … | Aug 10, 2026 |
| CVE-2026-13600 | UNKNOWN | — | The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled … | Aug 10, 2026 |
| CVE-2026-13170 | UNKNOWN | — | The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with … | Aug 10, 2026 |
| CVE-2026-13133 | UNKNOWN | — | A vulnerability has been identified in LineInst.exe (LINE for Windows) prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure … | Aug 10, 2026 |
| CVE-2026-12971 | UNKNOWN | — | The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce … | Aug 10, 2026 |
| CVE-2026-12570 | MEDIUM | 5.5 | A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. … | Aug 10, 2026 |
| CVE-2026-17519 | UNKNOWN | — | Rejected reason: This is rejected. | Aug 10, 2026 |
| CVE-2026-72522 | MEDIUM | 6.2 | libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in … | Aug 10, 2026 |
| CVE-2026-19389 | HIGH | 7.1 | Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA … | Aug 10, 2026 |
| CVE-2026-19387 | HIGH | 7.6 | A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count … | Aug 10, 2026 |
| CVE-2026-19384 | HIGH | 7.3 | A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=set_appointment. This manipulation … | Aug 10, 2026 |
| CVE-2026-19383 | MEDIUM | 4.7 | A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shell_exec of the file /app/saipackage/install/upload of the component Plugin … | Aug 10, 2026 |
| CVE-2026-19382 | LOW | 2.3 | A weakness has been identified in Almico Speedfan 4.52. This affects the function KiSystemCall64 in the library speedfan.sys of the component MSR Index Handler. Executing … | Aug 10, 2026 |
| CVE-2026-19381 | HIGH | 7.8 | A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacted element is an unknown function in the library NTIOLib_KSFX.sys … | Aug 10, 2026 |
| CVE-2026-19380 | LOW | 2.3 | A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipulation leads to improper … | Aug 10, 2026 |
| CVE-2026-19379 | HIGH | 7.3 | A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation … | Aug 10, 2026 |
| CVE-2026-19378 | MEDIUM | 4.3 | A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument … | Aug 10, 2026 |