Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
8.5 HIGH
CVE-2026-68959 — SKYSEA Client View and SKYMEC IT Manager Path Traversal Vulnerability

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is in…

| Path Traversal
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.5 HIGH
CVE-2026-68062 — SKYSEA Client View and SKYMEC IT Manager Path Traversal Vulnerability

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is in…

| Path Traversal
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.5 HIGH
CVE-2026-66109 — SKYSEA Client View and SKYMEC IT Manager Missing Authorization Vulnerability

A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected pr…

| Authorization
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.5 HIGH
CVE-2026-68960 — SKYSEA Client View and SKYMEC IT Manager Stack-Based Buffer Overflow

A stack-based buffer overflow vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affecte…

| Memory Corruption
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.5 HIGH
CVE-2026-69665 — SKYSEA Client View and SKYMEC IT Manager Improper Default Permissions Vulnerability

SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected …

| Misconfiguration
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.5 HIGH
CVE-2026-78654 — cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution

A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly contro…

Remote | Misconfiguration
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
3.3 LOW
CVE-2026-78638 — peerigon unzip-crx/unzip-crx-3 Archive Extraction index.js unzip path traversal

A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing a manipulation of the…

| Path Traversal
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.1 HIGH
CVE-2026-78478 — Måne <= 1.7 - Unauthenticated Local File Inclusion

The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary fil…

Remote | Path Traversal
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
9.8 CRITICAL
CVE-2026-78477 — Jawn <= 1.4.2 - Unauthenticated Privilege Escalation

The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to elevate their privileges to tha…

Remote | Authentication
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
6.5 MEDIUM
CVE-2026-78470 — WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of suff…

Remote | Injection
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
4.3 MEDIUM
CVE-2026-78467 — Fluent Support Pro <= 2.3.1 - Missing Authorization

The Fluent Support Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible fo…

Remote | Authorization
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
4.3 MEDIUM
CVE-2026-78466 — Fluent Boards Pro <= 2.0.11 - Authenticated (Subscriber+) Insecure Direct Object Reference

The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.11 due to missing validation on a user controlled key. This make…

Remote | Authorization
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-78656 — itsourcecode Sales and Inventory System cust_del.php sql injection

A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_del.php. The manipulation of the argument ID results in sql injection…

Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.5 HIGH
CVE-2026-78637 — Fdawgs node-poppler Argument Injection index.js pdfUnite argument injection

A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAt…

Remote | Injection
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
6.8 MEDIUM
CVE-2026-13215 — Zephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a cr…

The Zephyr ext2 filesystem driver fails to validate the s_log_block_size field of the on-disk superblock when mounting a filesystem. ext2_verify_disk_superblock() in subsys/fs/ext2/ext2_impl.c checks…

zephyr zephyr | Memory Corruption
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
9.8 CRITICAL
CVE-2026-13214 — Stack buffer overflow in OCPP GetConfiguration key parsing

The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in parse_getconfig_msg(). When handling a GetConfiguration request from the central system, the handler copied the…

zephyr zephyr | Memory Corruption
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
6.4 MEDIUM
CVE-2026-12561 — tagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_raw_html shortcode in all versions up to and including 5.4.5. This is due to insufficient input saniti…

composer | Remote | Cross-Site Scripting
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
6.4 MEDIUM
CVE-2026-76063 — FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_fe…

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfp_featured_video_url' parameter in all versions up to, and including, …

Remote | Cross-Site Scripting
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
4.3 MEDIUM
CVE-2026-75930 — FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post…

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly veri…

Remote | Authorization
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
6.4 MEDIUM
CVE-2026-19943 — Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title…

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.…

Remote | Cross-Site Scripting
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
Showing 20 of 11547 Results