Latest CVE Vulnerabilities – Page 4

6.5 MEDIUM

CVE-2026-17529 — AstrBotDevs AstrBot astr_main_agent.py authorization

A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The manipulation of the argument req.func_tool leads t…

Remote | Authorization

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

10.0 CRITICAL

CVE-2026-16812 — VeloCloud Orchestrator OS Command Injection

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may…

Remote | Authentication

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

9.1 CRITICAL

CVE-2025-50455 — EasyAppointments SQL Injection

SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vulnerability arises from unsanitized user input passe…

Remote | Injection

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

5.3 MEDIUM

CVE-2026-66477 — WordPress Gillion theme <= 4.13 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Gillion <= 4.13 versions.

Remote | Authorization

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

4.9 MEDIUM

CVE-2026-66476 — WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability

Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.

Remote | Path Traversal

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

5.9 MEDIUM

CVE-2026-66475 — WordPress Checkout Field Editor for WooCommerce – Checkout Manager plugin <= 3.0.5 …

Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce – Checkout Manager <= 3.0.5 versions.

Remote | Cross-Site Scripting

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

4.3 MEDIUM

CVE-2026-66474 — WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Reques…

Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.

Remote | Cross-Site Request Forgery

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

6.5 MEDIUM

CVE-2026-66448 — WordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.

gallery_photoblocks | Remote | Cross-Site Scripting

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

6.5 MEDIUM

CVE-2026-66445 — WordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.

open_user_map | Remote | Cross-Site Scripting

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

5.4 MEDIUM

CVE-2026-66442 — WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.

Remote | Authorization

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

5.3 MEDIUM

CVE-2026-66438 — WordPress Exclusive Addons Elementor plugin <= 2.8.0 - Sensitive Data Exposure vulnerabil…

Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions.

Remote | Information Disclosure

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

4.9 MEDIUM

CVE-2026-66437 — WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.

Remote | Server-Side Request Forgery

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

6.5 MEDIUM

CVE-2026-66434 — WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.33 - Cross…

Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.

Remote | Cross-Site Scripting

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

6.5 MEDIUM

CVE-2026-66433 — WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.

location_weather | Remote | Cross-Site Scripting

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

4.3 MEDIUM

CVE-2026-66428 — WordPress WP Google Review Slider plugin <= 18.4 - Cross Site Request Forgery (CSRF) vuln…

Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.

Remote | Cross-Site Request Forgery

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

7.6 HIGH

CVE-2026-66427 — WordPress WP Google Review Slider plugin <= 18.4 - SQL Injection vulnerability

Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.

Remote | Injection

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

8.7 HIGH

CVE-2026-66050 — NitroShare Desktop 0.3.4 Path Traversal via LAN File Transfer Server

NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending …

Remote | Path Traversal

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

5.0 MEDIUM

CVE-2026-65568 — WordPress Visual Composer Website Builder plugin <= 45.15.0 - Broken Access Control vulne…

Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.

Remote | Authorization

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

5.3 MEDIUM

CVE-2026-65567 — WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.

Remote | Authorization

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

5.3 MEDIUM

CVE-2026-65564 — WordPress MapPress Maps for WordPress plugin <= 2.97.6 - Sensitive Data Exposure vulnerab…

Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.

Remote | Information Disclosure

Jul 27, 2026 Jul 27, 2026

Jul 27, 2026

Browse by Apps

Latest CVE Feed

Cookie Preferences