Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
6.5 MEDIUM
CVE-2025-62745 — WordPress Team Showcase plugin <= 1.22.28 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Team Showcase allows Stored XSS. This issue affects Team Showcase: from n/a through …

Remote | Cross-Site Scripting
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
5.4 MEDIUM
CVE-2026-24586 — WordPress Newses theme <= 2.0.0.77 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themeansar Newses allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Newses: from n/a through 2.0.0.77.

Remote | Authorization
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
5.3 MEDIUM
CVE-2026-24592 — WordPress Auto Affiliate Links plugin <= 6.8.8.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Lucian Apostol Auto Affiliate Links allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Auto Affiliate Links: from n/a …

Remote | Authorization
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
0.0 NA
CVE-2026-9504 — GNU LibreDWG Dwggrep Utility dwggrep.c bit_convert_TU out-of-bounds

A weakness has been identified in GNU LibreDWG up to 0.14. Affected is the function bit_convert_TU of the file programs/dwggrep.c of the component Dwggrep Utility. This manipulation causes out-of-bou…

| Memory Corruption
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
4.3 MEDIUM
CVE-2026-24582 — WordPress FlexTable plugin <= 3.24.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPPOOL FlexTable allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FlexTable: from n/a through 3.24.0.

Remote | Authorization
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
4.3 MEDIUM
CVE-2026-24545 — WordPress QR Redirector plugin <= 2.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Nikki Blight QR Redirector allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects QR Redirector: from n/a through 2.0.3.

Remote | Authorization
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
6.5 MEDIUM
CVE-2026-24574 — WordPress Export WP Page to Static HTML/CSS plugin <= 6.0.0 - Cross Site Request Forgery …

Cross-Site Request Forgery (CSRF) vulnerability in Recorp Export WP Page to Static HTML/CSS allows Cross Site Request Forgery. This issue affects Export WP Page to Static HTML/CSS: from n/a through …

Remote | Cross-Site Request Forgery
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
4.3 MEDIUM
CVE-2026-24597 — WordPress Organization chart plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerab…

Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart allows Cross Site Request Forgery. This issue affects Organization chart: from n/a through 1.7.5.

Remote | Cross-Site Request Forgery
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
0.0 NA
CVE-2026-9503 — GNU LibreDWG DWG File decode.c dwg_next_entity null pointer dereference

A security flaw has been discovered in GNU LibreDWG up to 0.14. This impacts the function dwg_next_entity of the file src/decode.c of the component DWG File Handler. The manipulation results in null …

| Memory Corruption
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
0.0 NA
CVE-2026-9502 — GNU LibreDWG Dwgread Utility decode.c decompress_R2004_section heap-based overflow

A vulnerability was identified in GNU LibreDWG up to 0.14. This affects the function decompress_R2004_section of the file src/decode.c of the component Dwgread Utility. The manipulation leads to heap…

| Memory Corruption
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
0.0 NA
CVE-2026-9501 — GNU LibreDWG Dwgread Utility decode.c decompress_R2004_section assertion

A vulnerability was determined in GNU LibreDWG up to 0.14. The impacted element is the function decompress_R2004_section of the file src/decode.c of the component Dwgread Utility. Executing a manipul…

| Denial of Service
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
0.0 NONE
CVE-2026-48589 — Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow

Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value coul…

Remote | Information Disclosure
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
5.1 MEDIUM
CVE-2026-44598 — Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)

With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro. This issue affects Apache Shiro from 2.0-alpha…

Remote | Server-Side Request Forgery
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
5.9 MEDIUM
CVE-2026-43828 — Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set b…

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommen…

Remote | Misconfiguration
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
3.7 LOW
CVE-2026-48852 — PuTTY ECDSA Signature Verification Assertion Failure

PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification.

Remote | Cryptography
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
5.9 MEDIUM
CVE-2026-43827 — Apache Shiro: Session fixation: new session is not created after login by default

Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1…

Remote | Authentication
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
3.1 LOW
CVE-2026-48851 — PuTTY TELNET Icon Trust Indication Vulnerability

PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.

Remote | Misconfiguration
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
0.0 NA
CVE-2026-9500 — GNU LibreDWG Dwgread Utility decode.c read_2004_compressed_section heap-based overflow

A vulnerability was found in GNU LibreDWG up to 0.14. The affected element is the function read_2004_compressed_section of the file src/decode.c of the component Dwgread Utility. Performing a manipul…

| Memory Corruption
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
3.7 LOW
CVE-2026-48850 — PuTTY RSA KEX Double Free Vulnerability

PuTTY 0.72 before 0.84 has a double free in RSA KEX.

Remote | Memory Corruption
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
0.0 NA
CVE-2026-9498 — Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in…

A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handler. Such manipulation of the argument De…

| Injection
May 25, 2026 May 25, 2026
May 25, 2026
May 25, 2026
Showing 20 of 5841 Results