Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
49732
Total
4014
Critical
14766
High
14490
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-71203 | MEDIUM | 5.3 | changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get() … | Aug 05, 2026 |
| CVE-2026-71202 | HIGH | 7.5 | The raster Rust crate's crop() function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the … | Aug 05, 2026 |
| CVE-2026-70378 | HIGH | 7.5 | imagecli's `carve <ratio>` pipeline operation (Carve::apply() in src/image_ops.rs) only asserts `ratio <= 1.0`, never validating that the ratio is positive. A negative ratio (e.g. -5) … | Aug 05, 2026 |
| CVE-2026-70377 | HIGH | 7.5 | imagecli's `scale <ratio>` pipeline operation (Scale::apply() in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the … | Aug 05, 2026 |
| CVE-2026-70376 | CRITICAL | 9.6 | Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain() in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token … | Aug 05, 2026 |
| CVE-2026-6972 | MEDIUM | 6.4 | The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `chart_size` attribute of the `skillwrapper` shortcode in all versions up … | Aug 05, 2026 |
| CVE-2026-6639 | HIGH | 7.5 | The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. … | Aug 05, 2026 |
| CVE-2026-6627 | HIGH | 8.2 | The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all … | Aug 05, 2026 |
| CVE-2026-6147 | HIGH | 8.8 | The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_replace_media() function in all versions … | Aug 05, 2026 |
| CVE-2026-6079 | HIGH | 7.3 | The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amd_ajax_target_task_manager() function in … | Aug 05, 2026 |
| CVE-2026-6020 | HIGH | 7.2 | The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. … | Aug 05, 2026 |
| CVE-2026-64581 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() xfrm_user_policy() clears the socket dst cache with __sk_dst_reset(), i.e. … | Aug 05, 2026 |
| CVE-2026-64580 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() On the error path … | Aug 05, 2026 |
| CVE-2026-64579 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert xfrm_hash_rebuild()'s first loop preallocates the bins/chains the … | Aug 05, 2026 |
| CVE-2026-64578 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound (chained) SMB2 … | Aug 05, 2026 |
| CVE-2026-64577 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() gtp1u_send_echo_resp() ignores skb_pull_data()'s return value. Its caller gtp1u_udp_encap_recv() only … | Aug 05, 2026 |
| CVE-2026-64576 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: nexthop: initialize extack in nh_res_bucket_migrate() nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to call_nexthop_res_bucket_notifiers(). When nh_notifier_res_bucket_info_init() fails … | Aug 05, 2026 |
| CVE-2026-64575 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpf_iter_tcp_batch() releases the current batch via … | Aug 05, 2026 |
| CVE-2026-64574 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: tear down new links on vif update error path When ieee80211_vif_update_links() adds new … | Aug 05, 2026 |
| CVE-2026-64573 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLV_TYPE_NVM branch of … | Aug 05, 2026 |
| CVE-2026-64572 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fib_alias with kfree_rcu() on insert error path fib_table_insert() publishes new_fa into the … | Aug 05, 2026 |
| CVE-2026-64571 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54_rx_eeprom_readback() p54_rx_eeprom_readback() copies the requested EEPROM slice out … | Aug 05, 2026 |
| CVE-2026-64570 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix fils_discovery double free on alloc failure ieee80211_set_fils_discovery() calls kfree_rcu() on the old … | Aug 05, 2026 |
| CVE-2026-64569 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed … | Aug 05, 2026 |
| CVE-2026-64568 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure ieee80211_set_unsol_bcast_probe_resp() calls kfree_rcu() on the old … | Aug 05, 2026 |