Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
9.0 CRITICAL
CVE-2026-73042 — SiYuan before v3.7.4 Remote Code Execution via Menu Metadata

SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can in…

Remote | Cross-Site Scripting
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
9.0 CRITICAL
CVE-2026-73041 — SiYuan before v3.7.4 Remote Code Execution via PDF Annotations

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute…

Remote | Cross-Site Scripting
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
4.0 MEDIUM
CVE-2026-19916 — code-projects Online Food Order System edit_food_items.php cross site scripting

A vulnerability was detected in code-projects Online Food Order System 1.0. The affected element is an unknown function of the file edit_food_items.php. Performing a manipulation of the argument dnam…

online_food_order_system | Remote | Cross-Site Scripting
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
6.3 MEDIUM
CVE-2026-19906 — pkp pkp-lib API Key Generation APIProfileForm.php setData entropy

A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the component API Key Generation. …

Remote | Cryptography
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
7.5 HIGH
CVE-2026-19905 — Jinher OA attendance_out_approve.aspx sql injection

A weakness has been identified in Jinher OA 1.0. Impacted is an unknown function of the file /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx. This manipulation of the argument httpOID causes…

oa | Remote | Injection
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
9.1 CRITICAL
CVE-2026-18855 — Link Library <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9…

Remote | Path Traversal
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
3.3 LOW
CVE-2026-19904 — SourceCodester Online Book Store System System Settings index.php site_settings cross sit…

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=site_settings of the component System Settings Modu…

online_book_store_system | Remote | Cross-Site Scripting
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
5.5 MEDIUM
CVE-2026-19903 — SourceCodester Online Clothing Store SQL Database Backup shopping.sql file access

A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to f…

online_clothing_store | Remote | Path Traversal
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
8.2 HIGH
CVE-2026-19901 — LB-LINK X-PRO easycwmp hard-coded credentials

A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is poss…

Remote | Authentication
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
9.8 CRITICAL
CVE-2026-19598 — Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Me…

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists be…

Remote | Authorization
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
8.2 HIGH
CVE-2026-19900 — LB-LINK X-PRO shadow hard-coded credentials

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible …

Remote | Authentication
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
7.5 HIGH
CVE-2026-19899 — SourceCodester Class and Exam Timetabling System edit_teacher.php sql injection

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /edit_teacher.php. Executing a manipulation of the argu…

class_and_exam_timetabling_system | Remote | Injection
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
3.7 LOW
CVE-2026-19898 — VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentic…

A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipu…

victoriametrics | Remote | Authentication
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
3.7 LOW
CVE-2026-19897 — mangroup dtale Login Endpoint auth.py login excessive authentication

A vulnerability has been found in mangroup dtale up to 3.22.0. This issue affects the function Login of the file dtale/auth.py of the component Login Endpoint. Such manipulation leads to improper res…

dtale | Remote | Authentication
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
3.7 LOW
CVE-2026-19896 — mangroup dtale Flask Session Cookie app.py build_secret_key random values

A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function build_secret_key of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes…

dtale | Remote | Cryptography
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
3.7 LOW
CVE-2026-19895 — opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authen…

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The man…

open_source_point_of_sale | Remote | Authentication
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
7.5 HIGH
CVE-2026-19474 — @fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upl…

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a cl…

Remote | Denial of Service
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
7.5 HIGH
CVE-2026-18549 — @fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its inte…

Remote | Denial of Service
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
8.1 HIGH
CVE-2026-18500 — @fastify/jwt vulnerable to authorization bypass via global secret overriding the per-requ…

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally con…

Remote | Authentication
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
4.2 MEDIUM
CVE-2026-18165 — @fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callb…

Remote | Cross-Site Request Forgery
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
Showing 20 of 11273 Results