Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
0.0 NA
CVE-2026-18468 — Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Veri…

The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it ins…

| Authentication
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
0.0 NA
CVE-2026-13133 — LINE for Windows DLL Hijacking Vulnerability

A vulnerability has been identified in LineInst.exe (LINE for Windows) prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious…

| Misconfiguration
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
0.0 NA
CVE-2026-17019 — JetEngine < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG)

The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated att…

| Cross-Site Scripting
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
0.0 NA
CVE-2026-16299 — Single Sign On For TNG < 2.2.0 - Unauthenticated Arbitrary Password Reset

The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including ad…

| Authentication
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
0.0 NA
CVE-2026-16298 — FoodBoxBooker < 1.0.7 - Unauthenticated Arbitrary Password Reset

The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administr…

| Authentication
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
0.0 NA
CVE-2026-16257 — Arvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret …

The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type j…

| Authorization
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
0.0 NA
CVE-2026-18030 — Bricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Forms

The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated att…

| Authentication
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
0.0 NA
CVE-2026-17542 — Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector

The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse t…

| Authorization
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
0.0 NA
CVE-2026-17541 — Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file oper…

| Authorization
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
0.0 NA
CVE-2026-17540 — Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Com…

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files unde…

| Authorization
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
6.2 MEDIUM
CVE-2026-72522 — libexpat Out-of-Bounds Read and Infinite Loop

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.

| Memory Corruption
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
7.1 HIGH
CVE-2026-19389 — Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemu…

Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficie…

enterprise_linux enterprise_linux | Remote | Memory Corruption
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
7.6 HIGH
CVE-2026-19387 — Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec i…

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi…

enterprise_linux enterprise_linux | Remote | Memory Corruption
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
7.5 HIGH
CVE-2026-19384 — SourceCodester Simple Doctors Appointment System ajax.php set_appointment sql injection

A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=set_appointment. This manipulati…

simple_doctors_appointment_system | Remote | Injection
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
5.8 MEDIUM
CVE-2026-19383 — saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload

A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shell_exec of the file /app/saipackage/install/upload of the component Plugin Upload En…

Remote | Path Traversal
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
2.3 LOW
CVE-2026-19382 — Almico Speedfan MSR Index speedfan.sys KiSystemCall64 memory leak

A weakness has been identified in Almico Speedfan 4.52. This affects the function KiSystemCall64 in the library speedfan.sys of the component MSR Index Handler. Executing a manipulation can lead to m…

speedfan | Memory Corruption
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
7.8 HIGH
CVE-2026-19381 — Kingston FURY CTRL RGB Control Software Driver NTIOLib_KSFX.sys privileges management

A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacted element is an unknown function in the library NTIOLib_KSFX.sys of the component Driver. Performin…

Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
2.3 LOW
CVE-2026-19380 — Mullvad wireguard.sys IOCTL AdapterState reference count

A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipulation leads to improper update of referen…

wireguard.sys | Memory Corruption
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
7.5 HIGH
CVE-2026-19379 — EFM ipTIME AX8004M CGI Endpoint d.cgi popen os command injection

A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os co…

iptime_ax8004m | Remote | Injection
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
5.0 MEDIUM
CVE-2026-19378 — code-projects Task Management System CommentSave.php cross site scripting

A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/task_id/m…

task_management_system | Remote | Cross-Site Scripting
Aug 10, 2026 Aug 10, 2026
Aug 10, 2026
Aug 10, 2026
Showing 20 of 9517 Results