Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50169
Total
4054
Critical
14909
High
14667
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-15006 | HIGH | 7.5 | The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up … | Aug 01, 2026 |
| CVE-2026-13362 | MEDIUM | 6.4 | The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via _sp_form_code Post Meta in all versions up to, and including, … | Aug 01, 2026 |
| CVE-2026-9044 | UNKNOWN | — | An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary … | Jul 31, 2026 |
| CVE-2026-54909 | MEDIUM | 5.3 | pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response … | Jul 31, 2026 |
| CVE-2026-54787 | LOW | 3.1 | sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window … | Jul 31, 2026 |
| CVE-2026-54785 | MEDIUM | 6.2 | gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode … | Jul 31, 2026 |
| CVE-2026-54768 | UNKNOWN | — | WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class … | Jul 31, 2026 |
| CVE-2026-53573 | UNKNOWN | — | GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an … | Jul 31, 2026 |
| CVE-2026-45377 | MEDIUM | 6.5 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data flow requires the requester … | Jul 31, 2026 |
| CVE-2026-45376 | MEDIUM | 5.5 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into … | Jul 31, 2026 |
| CVE-2026-45330 | MEDIUM | 4.9 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending … | Jul 31, 2026 |
| CVE-2026-34641 | HIGH | 7.8 | Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of … | Jul 31, 2026 |
| CVE-2026-68771 | CRITICAL | 9.8 | ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted … | Jul 31, 2026 |
| CVE-2026-52371 | UNKNOWN | — | A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request. | Jul 31, 2026 |
| CVE-2026-52232 | UNKNOWN | — | A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attackers to execute arbitrary Javascript in … | Jul 31, 2026 |
| CVE-2026-52134 | UNKNOWN | — | An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a captured GOOSE frame. | Jul 31, 2026 |
| CVE-2026-51953 | UNKNOWN | — | An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components | Jul 31, 2026 |
| CVE-2026-45086 | MEDIUM | 5.4 | Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics … | Jul 31, 2026 |
| CVE-2026-68770 | CRITICAL | 9.8 | sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within … | Jul 31, 2026 |
| CVE-2026-65981 | HIGH | 7.1 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with … | Jul 31, 2026 |
| CVE-2026-51785 | UNKNOWN | — | An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request | Jul 31, 2026 |
| CVE-2026-50986 | UNKNOWN | — | PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). The payment validation controller has no CSRF token. An attacker can confirm an … | Jul 31, 2026 |
| CVE-2026-38713 | UNKNOWN | — | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command … | Jul 31, 2026 |
| CVE-2026-38710 | UNKNOWN | — | TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows attackers to execute arbitrary commands … | Jul 31, 2026 |
| CVE-2026-38708 | UNKNOWN | — | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command … | Jul 31, 2026 |