Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
0.0 NA
CVE-2026-14212 — Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee …

| Authentication
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-13406 — Royal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowin…

| Information Disclosure
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-13404 — Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification v…

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor…

| Authorization
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-13172 — Eventin < 4.1.22 - Unauthenticated Unpublished Content Disclosure

The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draf…

| Authorization
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-58094 — TOCTOU race in POSIX shared memory large page configuration

The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated …

| Race Condition
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
4.3 MEDIUM
CVE-2026-79654 — Ketello: katello content view history api cross-organization authorization bypass

A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to vi…

satellite satellite | Remote | Authorization
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
9.3 CRITICAL
CVE-2026-15203 — Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and i…

Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and exec…

Remote | Authorization
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-58093 — Kernel use-after-free via tty ioctls

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed …

| Race Condition
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
7.2 HIGH
CVE-2026-19760 — WP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Hea…

The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient in…

Remote | Cross-Site Scripting
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-58097 — ppp(8): missing length validation in mp_SetEnddisc()

mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command inter…

| Memory Corruption
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-58096 — ppp(8): missing length validation in LcpDecodeConfig()

LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicio…

| Memory Corruption
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-58095 — ppp(8): incorrect length calculation in mp_Enddisc()

mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP …

| Memory Corruption
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
4.4 MEDIUM
CVE-2026-76149 — CorvusSKK Integer Overflow Vulnerability

CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file.

| Misconfiguration
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
7.8 HIGH
CVE-2026-76148 — CorvusSKK Code Injection Vulnerability

CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.

| Injection
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
5.3 MEDIUM
CVE-2026-73335 — Myna Point Improper Authorization Vulnerability

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user's Android device may exploit the aff…

| Authorization
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-58092 — Unauthorized credential switching

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary gro…

| Authorization
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-58091 — Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it i…

| Memory Corruption
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-58090 — Use-after-free in unix SOCK_STREAM message handling

The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leav…

| Memory Corruption
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-58089 — hwpmc fails to detach PMCs during exec credential transitions

When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled pr…

| Authorization
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
7.0 HIGH
CVE-2026-54467 — Trusted Firmware-M Mailbox Initialization Improper Input Validation

On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer.

Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
Showing 20 of 12296 Results