Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
5.1 MEDIUM
CVE-2026-21020 — Android OmaCP Component Export Vulnerability

Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions.

| Authorization
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
8.9 HIGH
CVE-2026-21019 — Samsung Galaxy Watch Code Injection Vulnerability

Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege.

| Injection
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
6.8 MEDIUM
CVE-2026-21018 — Cisco SveService Buffer Overflow

Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code.

| Memory Corruption
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
5.1 MEDIUM
CVE-2026-21016 — Samsung LocationManager Privilege Escalation Vulnerability

Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.

| Authorization
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
6.8 MEDIUM
CVE-2026-21015 — Logitech FactoryCamera Privilege Escalation

Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier.

| Information Disclosure
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
4.4 MEDIUM
CVE-2025-9989 — Broadstreet <= 1.53.1 - Authenticated (Admin+) Stored Cross-Site Scripting

The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.53.1 due to insufficient input sanitization and output esc…

Remote | Cross-Site Scripting
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
5.4 MEDIUM
CVE-2026-7051 — Blog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authe…

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 8.9.0. This is due to a missing ownership verific…

Remote | Authorization
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
6.4 MEDIUM
CVE-2026-6828 — Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'per…

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permission_message' parameter in …

Remote | Cross-Site Scripting
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
5.3 MEDIUM
CVE-2025-9987 — Broadstreet <= 1.53.1 - Authenticated (Subscriber+) Information Disclosure

The Broadstreet plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.53.1 via the get_sponsored_meta() AJAX action. This makes it possible for …

Remote | Information Disclosure
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
6.4 MEDIUM
CVE-2026-6962 — Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 4.1.0 - Authenticated …

The Cost of Goods: Product Cost & Profit Calculator for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'alg_wc_cog_product_cost' and 'alg_wc_cog_produc…

Remote | Cross-Site Scripting
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
6.5 MEDIUM
CVE-2026-7619 — Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, a…

Remote | Injection
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
8.1 HIGH
CVE-2026-7635 — coreActivity: Activity Logging for WordPress <= 3.0 - Unauthenticated PHP Object Injectio…

The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0. This is due to the plugin failing to validate or…

Remote | Injection
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
4.3 MEDIUM
CVE-2025-9988 — Broadstreet <= 1.53.1 - Missing Authorization to Authenticated (Subscriber+) Advertiser C…

The Broadstreet plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the create_advertiser AJAX action in all versions up to, and including, 1.53.1. This mak…

Remote | Authorization
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
5.3 MEDIUM
CVE-2025-14755 — Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct…

The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct Object Reference (IDOR) in all versions up to, and including, 4.0.1 only when …

Remote | Authorization
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
7.2 HIGH
CVE-2026-6888 — SQL Injection Vulnerability

Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to execute arbitrary commands via a specific interface, potentially enabling the attacker to acc…

Remote | Injection
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
5.7 MEDIUM
CVE-2024-36315 — Intel x86 CPU Speculative Execution Information Disclosure Vulnerability

Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sensitive information, potentially resulting in loss of confide…

| Misconfiguration
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
8.5 HIGH
CVE-2025-61972 — AMD Secure Processor ASP Unprivileged SMN Code Execution

Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to gain arbitrary System Management Network (SMN) access, potentially resulting in arbitrary code executio…

| Authorization
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
5.9 MEDIUM
CVE-2025-61971 — AMD SEV-SNP MMIO Routing Configuration Modification Vulnerability

Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to modify MMIO routing configurations, potentially resulting in loss of SEV-SNP guest integrity.

| Misconfiguration
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
7.2 HIGH
CVE-2025-62627 — VMware ESXi Pointer Dereference Vulnerability

An untrusted pointer dereference in the ionic cloud driver for VMWare ESXi could allow an attacker with an unprivileged VM to read kernel memory or co-located guest VM memory, potentially resulting i…

| Memory Corruption
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
8.8 HIGH
CVE-2025-62624 — VMware ESXi Heap-Based Buffer Overflow Vulnerability

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

| Memory Corruption
May 13, 2026 May 13, 2026
May 13, 2026
May 13, 2026
Showing 20 of 6264 Results