Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
0.0 NA
CVE-2026-12877 — Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attacker…

| Injection
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
0.0 NA
CVE-2026-12690 — ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authent…

| Authorization
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
0.0 NA
CVE-2026-12689 — ProfileGrid < 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tamper…

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-leve…

| Authorization
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
0.0 NA
CVE-2026-12688 — ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via Pa…

The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and…

| Authentication
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
0.0 NA
CVE-2026-12497 — ProfilePress < 4.16.18 - Unauthenticated Privilege Escalation via Registration Role Selec…

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.18 does not consistently enforce the role restriction configur…

| Authorization
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
8.8 HIGH
CVE-2026-16870 — Multiple Security Vulnerabilities in Snowflake libsnowflakeclient

Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file down…

Remote | Memory Corruption
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
7.4 HIGH
CVE-2026-66141 — Exim Pipe Transport Privilege Escalation

Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.

| Authorization
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
8.4 HIGH
CVE-2026-66140 — Exim Directory Traversal Privilege Escalation

Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.

| Path Traversal
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
4.8 MEDIUM
CVE-2026-66139 — OpenStack Zaqar Authentication Bypass

OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known.

Remote | Authentication
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
7.2 HIGH
CVE-2026-66138 — OpenStack Ironic Python Agent Command Injection Vulnerability

In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed config…

ironic_python_agent | Remote | Injection
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
5.5 MEDIUM
CVE-2026-54422 — OpenStack Ironic Python Agent Credential Disclosure Vulnerability

In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.

ironic_python_agent | Information Disclosure
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
6.4 MEDIUM
CVE-2026-6454 — Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripti…

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute val…

firelight_lightbox | Remote | Cross-Site Scripting
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
4.3 MEDIUM
CVE-2026-15420 — Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS F…

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plus_name' param…

Remote | Path Traversal
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
6.4 MEDIUM
CVE-2026-15100 — Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scr…

The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'searchnoresult' Block Attribute in all versions up to, and including, 5.0.32 due to insuf…

Remote | Cross-Site Scripting
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
5.3 MEDIUM
CVE-2026-13464 — Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Informati…

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' p…

Remote | Authorization
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
8.0 HIGH
CVE-2026-12736 — WPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Op…

The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1…

Remote | Authorization
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
6.5 MEDIUM
CVE-2026-11922 — Rate-limit Bypass in zenml-io/zenml

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded…

Remote | Misconfiguration
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
5.3 MEDIUM
CVE-2026-11354 — Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Rec…

The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthe…

participants_database | Remote | Information Disclosure
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
6.4 MEDIUM
CVE-2025-9205 — MapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user s…

Remote | Cross-Site Scripting
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
10.0 CRITICAL
CVE-2026-62825 — Azure Key Vault Elevation of Privilege Vulnerability

Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.

Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
Showing 20 of 9724 Results