Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50589
Total
4065
Critical
14978
High
14744
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-12697 | MEDIUM | 5.4 | The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing … | Jul 31, 2026 |
| CVE-2026-12695 | HIGH | 8.1 | The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an … | Jul 31, 2026 |
| CVE-2026-12376 | MEDIUM | 4.3 | The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access … | Jul 31, 2026 |
| CVE-2026-12251 | HIGH | 8.1 | The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration … | Jul 31, 2026 |
| CVE-2026-63223 | CRITICAL | 9.8 | CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename … | Jul 31, 2026 |
| CVE-2026-63222 | HIGH | 7.5 | CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote … | Jul 31, 2026 |
| CVE-2026-63221 | CRITICAL | 9.4 | CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring … | Jul 31, 2026 |
| CVE-2026-56673 | HIGH | 7.5 | ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folder_paths.get_annotated_filepath and exists_annotated_filepath join workflow-controlled annotated filenames to … | Jul 31, 2026 |
| CVE-2026-56672 | HIGH | 8.2 | ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} served user-controlled HTML and SVG files with extension-derived content types, … | Jul 31, 2026 |
| CVE-2026-56671 | HIGH | 7.5 | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, get_model_preview in app/model_manager.py joins an unrestricted filename route … | Jul 31, 2026 |
| CVE-2026-56670 | HIGH | 8.2 | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpoint served uploaded SVG files inline … | Jul 31, 2026 |
| CVE-2026-63220 | MEDIUM | 4.8 | CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request, allowing an … | Jul 31, 2026 |
| CVE-2026-62323 | MEDIUM | 6.3 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does … | Jul 31, 2026 |
| CVE-2026-55502 | HIGH | 7.1 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and … | Jul 31, 2026 |
| CVE-2026-55499 | MEDIUM | 4.3 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent … | Jul 31, 2026 |
| CVE-2026-55497 | MEDIUM | 6.5 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but do … | Jul 31, 2026 |
| CVE-2026-55496 | MEDIUM | 4.3 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at … | Jul 31, 2026 |
| CVE-2026-55495 | MEDIUM | 4.3 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT_RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than … | Jul 31, 2026 |
| CVE-2026-43833 | UNKNOWN | — | Full details and mitigation steps are currently restricted and will be published at a later date. | Jul 31, 2026 |
| CVE-2026-43832 | HIGH | 7.5 | Full details and mitigation steps are currently restricted and will be published at a later date. | Jul 31, 2026 |
| CVE-2026-43831 | HIGH | 7.5 | Full details and mitigation steps are currently restricted and will be published at a later date. | Jul 31, 2026 |
| CVE-2026-43830 | CRITICAL | 9.8 | Full details and mitigation steps are currently restricted and will be published at a later date. | Jul 31, 2026 |
| CVE-2026-43829 | HIGH | 7.5 | Full details and mitigation steps are currently restricted and will be published at a later date. | Jul 31, 2026 |
| CVE-2026-6890 | UNKNOWN | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Jul 31, 2026 |
| CVE-2026-6889 | UNKNOWN | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Jul 31, 2026 |