Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
42183
Total
3433
Critical
12465
High
12416
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-59680 | HIGH | 8.0 | An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, get_password_term() in src/include/users/dialogs.rb read the shadowLastChange and … | Sep 01, 2026 |
| CVE-2026-25706 | HIGH | 7.5 | Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree … | Sep 01, 2026 |
| CVE-2026-19914 | HIGH | 7.2 | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_order' parameter in all versions up to, and including, 2.12.1 due … | Sep 01, 2026 |
| CVE-2026-16788 | MEDIUM | 6.4 | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_projects_output Shortcode in all versions up to, … | Sep 01, 2026 |
| CVE-2026-16786 | MEDIUM | 6.4 | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode in all versions up to, … | Sep 01, 2026 |
| CVE-2026-15101 | MEDIUM | 6.4 | The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 … | Sep 01, 2026 |
| CVE-2026-78363 | MEDIUM | 4.8 | The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a … | Sep 01, 2026 |
| CVE-2026-74916 | MEDIUM | 6.5 | The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages … | Sep 01, 2026 |
| CVE-2026-13611 | MEDIUM | 5.3 | The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster … | Sep 01, 2026 |
| CVE-2026-78319 | UNKNOWN | — | A service running on the affected products contains a potential Time-of-Check Time-of-Use (TOCTOU) race condition. An unauthenticated remote attacker could exploit this race condition to … | Sep 01, 2026 |
| CVE-2026-83772 | CRITICAL | 9.9 | A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function c_set_reports_decode of the file mail-report.sh of … | Sep 01, 2026 |
| CVE-2026-77189 | MEDIUM | 6.5 | The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulnerable to generic SQL Injection via 'order' … | Sep 01, 2026 |
| CVE-2026-75980 | MEDIUM | 6.4 | The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute … | Sep 01, 2026 |
| CVE-2026-75964 | MEDIUM | 6.1 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via … | Sep 01, 2026 |
| CVE-2026-18488 | MEDIUM | 6.4 | The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) in all versions up to, and including, 2.1.51 … | Sep 01, 2026 |
| CVE-2026-83744 | MEDIUM | 4.3 | A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHostSafe of the file app/Services/Pdf/Purify.php of the … | Sep 01, 2026 |
| CVE-2026-83743 | MEDIUM | 6.3 | A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor … | Sep 01, 2026 |
| CVE-2026-82747 | UNKNOWN | — | Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an access_type :runtime read … | Sep 01, 2026 |
| CVE-2026-77823 | MEDIUM | 4.9 | The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export_order_csv AJAX action in versions up to, and including, … | Sep 01, 2026 |
| CVE-2026-76006 | MEDIUM | 4.9 | The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions … | Sep 01, 2026 |
| CVE-2026-75965 | MEDIUM | 6.4 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via … | Sep 01, 2026 |
| CVE-2026-75921 | HIGH | 7.2 | The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to … | Sep 01, 2026 |
| CVE-2026-19952 | HIGH | 7.5 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in … | Sep 01, 2026 |
| CVE-2026-19948 | MEDIUM | 5.3 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization … | Sep 01, 2026 |
| CVE-2026-19806 | HIGH | 8.8 | The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator … | Sep 01, 2026 |