Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50855
Total
4075
Critical
15116
High
14809
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-50642 | UNKNOWN | — | diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, … | Jul 29, 2026 |
| CVE-2026-4604 | MEDIUM | 5.3 | The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `kr_mr_store_settings()` function in … | Jul 29, 2026 |
| CVE-2026-18220 | HIGH | 7.8 | An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend (bfd/elf32-dlx.c) in GNU binutils. The dlx_rtype_to_howto() function maps ELF relocation types to … | Jul 29, 2026 |
| CVE-2026-16655 | HIGH | 7.2 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field … | Jul 29, 2026 |
| CVE-2026-16597 | HIGH | 7.2 | The GTM4WP – A Google Tag Manager (GTM) plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Billing Fields in … | Jul 29, 2026 |
| CVE-2026-14900 | CRITICAL | 9.8 | The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php … | Jul 29, 2026 |
| CVE-2026-14488 | CRITICAL | 9.1 | The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the MB Frontend Submission extension in versions up … | Jul 29, 2026 |
| CVE-2026-12895 | UNKNOWN | — | SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized … | Jul 29, 2026 |
| CVE-2026-65100 | MEDIUM | 4.8 | Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of … | Jul 29, 2026 |
| CVE-2026-59243 | CRITICAL | 9.8 | The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned … | Jul 29, 2026 |
| CVE-2026-58189 | HIGH | 7.5 | Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, … | Jul 29, 2026 |
| CVE-2026-58188 | HIGH | 8.2 | Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, … | Jul 29, 2026 |
| CVE-2026-58187 | LOW | 3.7 | The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic Server: from 8.0.0 … | Jul 29, 2026 |
| CVE-2026-58186 | HIGH | 7.5 | The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from … | Jul 29, 2026 |
| CVE-2026-58185 | MEDIUM | 5.9 | The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 … | Jul 29, 2026 |
| CVE-2026-58184 | HIGH | 8.2 | The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traffic Server: from … | Jul 29, 2026 |
| CVE-2026-58183 | MEDIUM | 5.9 | The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through … | Jul 29, 2026 |
| CVE-2026-58182 | HIGH | 8.6 | The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 … | Jul 29, 2026 |
| CVE-2026-58181 | HIGH | 7.5 | The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 … | Jul 29, 2026 |
| CVE-2026-58180 | HIGH | 7.5 | The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through … | Jul 29, 2026 |
| CVE-2026-58179 | HIGH | 8.1 | The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from … | Jul 29, 2026 |
| CVE-2026-58178 | HIGH | 7.5 | The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from … | Jul 29, 2026 |
| CVE-2026-58177 | HIGH | 8.1 | The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users … | Jul 29, 2026 |
| CVE-2026-58175 | HIGH | 7.5 | Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from … | Jul 29, 2026 |
| CVE-2026-58164 | HIGH | 7.5 | Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through … | Jul 29, 2026 |