Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
6.5 MEDIUM
CVE-2026-125831 — WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.2 - Cross Site Scripting (XSS) …

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Sto…

Remote | Cross-Site Scripting
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
4.3 MEDIUM
CVE-2026-125834 — WordPress Imagify plugin <= 2.3.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Media Imagify imagify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imagify: from n/a through 2.3.4.

Remote | Authorization
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
5.3 MEDIUM
CVE-2026-125827 — WordPress Event Tickets plugin <= 5.31.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: fro…

Remote | Authorization
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
8.5 HIGH
CVE-2026-125811 — WordPress myCred plugin <= 4.0.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in myCred myCred mycred allows Blind SQL Injection.This issue affects myCred: from n/a through 4.0.2.

Remote | Injection
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
4.3 MEDIUM
CVE-2026-125810 — WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

Remote | Authorization
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
6.5 MEDIUM
CVE-2026-125809 — WordPress myCred plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred mycred allows Stored XSS.This issue affects myCred: from n/a through 4.0.2.

Remote | Cross-Site Scripting
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
5.3 MEDIUM
CVE-2026-125440 — WordPress s2Member plugin <= 261106 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cristián Lávaque s2Member s2member allows Code Injection.This issue affects s2Member: from n/a through 2…

Remote | Cross-Site Scripting
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
4.3 MEDIUM
CVE-2026-124412 — WordPress Slim SEO plugin <= 4.11.5 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in eLightUp Slim SEO slim-seo allows Code Injection.This issue affects Slim SEO: from n/a through 4.11.5.

Remote | Cross-Site Scripting
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
8.1 HIGH
CVE-2026-111547 — Dell PowerStore Out-of-Bounds Read Vulnerability

Dell PowerStore contains an out-of-bounds read vulnerability. An attacker could exploit this vulnerability, potentially leading to denial of service or limited information disclosure.

powerstore_500t powerstore_1000t powerstore_1200t powerstore_3200t powerstore_3000t powerstore_5200t +6 more | Remote | Information Disclosure
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
5.3 MEDIUM
CVE-2026-125821 — WordPress MapSVG plugin <= 9.0.4 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Code Injection.This issue…

Remote | Cross-Site Scripting
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
6.5 MEDIUM
CVE-2026-125835 — WordPress JetTabs plugin <= 2.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.This issue affects JetTabs: from n/a through 2.3.5.

jettabs | Remote | Cross-Site Scripting
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
5.3 MEDIUM
CVE-2026-124409 — WordPress CURCY plugin <= 2.2.21 - Broken Access Control vulnerability

Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.21.

curcy | Remote | Authorization
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
6.5 MEDIUM
CVE-2026-125807 — WordPress HT Mega plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HTMega HT Mega ht-mega-for-elementor allows Stored XSS.This issue affects HT Mega: from n/a throu…

Remote | Cross-Site Scripting
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
5.3 MEDIUM
CVE-2026-125808 — WordPress HT Mega plugin <= 3.2.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in HTMega HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HT Mega: from n/a through 3.2.8.

Remote | Authorization
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
6.5 MEDIUM
CVE-2026-125824 — WordPress WP Go Maps plugin <= 10.1.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Go Maps WP Go Maps wp-google-maps allows Stored XSS.This issue affects WP Go Maps: from n/a th…

Remote | Cross-Site Scripting
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
6.5 MEDIUM
CVE-2026-119102 — AI Command Filters On Any Property Bypassing Column Allowlist

In Telerik UI for Blazor, versions v12.0.0 through 15.2.0, an improper input validation vulnerability exists, where the Grid, TreeList and Gantt's AI command filters on any model property, bypassing …

Remote | Authorization
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
5.3 MEDIUM
CVE-2026-125819 — WordPress Gutenberg Blocks plugin <= 3.7.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks: fr…

gutenberg_blocks | Remote | Authorization
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
7.5 HIGH
CVE-2026-118976 — Path Traversal in Telerik UI for Blazor Demo's Chat AI Integration Example

In Progress® Telerik® UI for Blazor versions v11.1.0 through v14.0.0, the demo application's Chat AI Integration example contains a relative path traversal vulnerability that could allow an attacker …

Remote | Path Traversal
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
6.8 MEDIUM
CVE-2026-128910 — DJI AeroScope Mobile: Hard-coded root password on the serial console

Use of hard-coded credentials (CWE-798) on the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40,…

| Authentication
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
8.8 HIGH
CVE-2026-128909 — DJI AeroScope Mobile: Firmware updates are not signature-verified

Improper verification of cryptographic signature (CWE-347) in the firmware update handler of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703)…

| Cryptography
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
Showing 20 of 17198 Results