Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
0.0 NA
CVE-2026-15985 — Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication…

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebas…

| Authentication
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
5.3 MEDIUM
CVE-2026-63041 — Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers

Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain …

apisix | Remote | Authorization
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-18080 — ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticate…

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the save_attach…

| Path Traversal
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-3235 — WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauth…

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_access' function due to missing validation on…

| Authorization
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-5092 — Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data …

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customapi action handler in versions up to, and including, 12.8.9. This is…

| Cross-Site Scripting
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
9.6 CRITICAL
CVE-2026-77532 — Ubiquiti EdgeMAX EdgeSwitch Buffer Overflow Vulnerability

A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a Remote Code Execution on such device.

| Memory Corruption
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
9.8 CRITICAL
CVE-2026-77557 — UniFi Protect AI Key Improper Access Control Vulnerability

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the device.

Remote | Authorization
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
10.0 CRITICAL
CVE-2026-77554 — UniFi Talk Application Command Injection Vulnerability

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on the host device.

Remote | Injection
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
9.9 CRITICAL
CVE-2026-77553 — UniFi Access Application Improper Access Control Privilege Escalation

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device.

Remote | Authorization
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
9.8 CRITICAL
CVE-2026-77552 — UniFi Enterprise Audio/Video Bridge Command Injection Vulnerability

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Bridge to execute a Command Injection on the device.

Remote | Injection
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
9.0 CRITICAL
CVE-2026-77551 — UniFi Connect Display Cast Pro Improper Access Control Privilege Escalation

A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Connect Display Cast Pro to escalate privileges on the …

Remote | Authorization
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
10.0 CRITICAL
CVE-2026-77550 — UniFi OS Improper Neutralization of CRLF Sequences Vulnerability

A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi …

Remote | Authentication
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
9.0 CRITICAL
CVE-2026-77549 — UniFi OS CRLF Injection Authentication Bypass

A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass …

Remote | Authentication
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
8.2 HIGH
CVE-2026-80206 — NLTK 3.10.2 Regular Expression Denial of Service via tgrep

NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /r…

Remote | Denial of Service
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
8.7 HIGH
CVE-2026-80205 — NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without va…

Remote | Denial of Service
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
9.3 CRITICAL
CVE-2026-80204 — Grav before 1.0.18 Authentication Bypass via Scoped API Key

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController when deciding whether a page's security/per…

grav | Remote | Authorization
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
9.8 CRITICAL
CVE-2026-80203 — Grav before 1.0.18 Authentication Bypass via Scoped API Key

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The ch…

grav | Remote | Authorization
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
9.9 CRITICAL
CVE-2026-77548 — UniFi Protect Application Command Injection Vulnerability

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host …

Remote | Injection
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
9.9 CRITICAL
CVE-2026-77547 — UniFi Access Application Command Injection Vulnerability

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host d…

Remote | Injection
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
9.9 CRITICAL
CVE-2026-77546 — UniFi Access Application Command Injection Vulnerability

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host d…

Remote | Injection
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
Showing 20 of 12301 Results