Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.5 HIGH
CVE-2026-2996 — Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Impr…

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw …

Remote | Authorization
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
10.0 CRITICAL
CVE-2026-76607 — Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.3

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.3 - ???.

Remote | Authorization
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
6.9 MEDIUM
CVE-2026-76609 — Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik <…

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.

Remote | Authorization
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
6.9 MEDIUM
CVE-2026-76608 — Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email add…

Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any access checks.

Remote | Authorization
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
8.7 HIGH
CVE-2026-76599 — Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix di…

Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements model allows listings of arbitrary databas…

Remote | Information Disclosure
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
6.9 MEDIUM
CVE-2026-76601 — Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks.

Remote | Authorization
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
8.6 HIGH
CVE-2026-70626 — NLTK before 3.9.4 Symlink Escape via CorpusReader

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because …

| Path Traversal
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
6.9 MEDIUM
CVE-2026-68768 — hashcat through 7.1.2 Heap Buffer Overflow in outfile_write() via Oversized Username

hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the fun…

| Memory Corruption
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
6.9 MEDIUM
CVE-2026-68767 — hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl()

hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds h…

| Memory Corruption
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
8.5 HIGH
CVE-2026-68766 — hashcat through 7.1.2 Arbitrary File Write via Restore File Option Injection

hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files…

| Misconfiguration
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
8.7 HIGH
CVE-2026-66393 — NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. …

Remote | Denial of Service
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
7.1 HIGH
CVE-2026-65915 — NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently ine…

Remote | Path Traversal
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
8.7 HIGH
CVE-2026-63312 — NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File Read

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers…

Remote | Path Traversal
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
6.9 MEDIUM
CVE-2026-63311 — NLTK before 3.10.0 SSRF via DNS Resolution Failure

NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py. The _resolve_hostname() helper c…

Remote | Server-Side Request Forgery
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
9.3 CRITICAL
CVE-2026-63310 — NLTK before 3.9.3 Missing Post-Download Integrity Verification

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject …

Remote | Supply Chain
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
8.7 HIGH
CVE-2026-62388 — NLTK before 3.10.0 Insecure Default Configuration pathsec

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and p…

Remote | Path Traversal
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
8.2 HIGH
CVE-2026-62385 — NLTK 3.9.4 Path Traversal via FrameNet and NKJP Readers

NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe se…

Remote | Path Traversal
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
8.7 HIGH
CVE-2026-62384 — NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with…

Remote | Path Traversal
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
6.8 MEDIUM
CVE-2026-62383 — nltk IPIPANCorpusReader Symlink Arbitrary File Read

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the …

| Path Traversal
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
6.9 MEDIUM
CVE-2026-62382 — PasswordPusher before v2.9.6 Authentication Bypass via Null Comparison

PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against current_user; for an anonym…

Remote | Authorization
Aug 22, 2026 Aug 22, 2026
Aug 22, 2026
Aug 22, 2026
Showing 20 of 11553 Results