Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
8.8 HIGH
CVE-2026-73784 — HPE IceWall products, Remote Bypass of Security Restrictions

A potential security vulnerability in HPE IceWall products could be exploited to tamper SAML response, allowing an attacker to impersonate another user.

Remote | Authentication
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
0.0 NA
CVE-2026-14566 — Advanced Customized Prompts <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tamper…

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowin…

| Authorization
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
0.0 NA
CVE-2026-14565 — Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configura…

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values …

| Cross-Site Scripting
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
0.0 NA
CVE-2026-14563 — Advanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover

The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing…

| Authentication
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
0.0 NA
CVE-2026-14562 — Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded atta…

| Authorization
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
0.0 NA
CVE-2026-14560 — Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unaut…

| Authentication
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
0.0 NA
CVE-2026-14559 — Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, includ…

| Authentication
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
6.9 MEDIUM
CVE-2026-13326 — Out-of-bounds read and integer underflow vulnerability in QNdefNfcTextRecord impacts Qt N…

An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag.

| Memory Corruption
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
0.0 NA
CVE-2025-15695 — GTranslate < 3.0.10 - Admin+ Stored XSS

The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as h…

| Cross-Site Scripting
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
4.1 MEDIUM
CVE-2026-89169 — live-boot dm-verity Security Bypass

live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing.

| Misconfiguration
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
2.9 LOW
CVE-2026-89162 — PCRE2 Information Disclosure Vulnerability

In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.

pcre2 | Information Disclosure
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
7.7 HIGH
CVE-2026-89060 — Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicl…

A flaw was found in multicluster-observability-addon. This vulnerability allows a managed-cluster identity to reference configuration resources outside its designated namespace. This can lead to the …

Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
9.8 CRITICAL
CVE-2026-8778 — MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Up…

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `mipl_…

Remote | Misconfiguration
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
7.4 HIGH
CVE-2026-89161 — PCRE2 Memory Corruption Vulnerability

In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.

pcre2 | Memory Corruption
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
3.7 LOW
CVE-2026-89160 — PCRE2 Out-of-Bounds Read

PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.

pcre2 | Remote | Memory Corruption
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
6.5 MEDIUM
CVE-2026-89158 — PCRE2 Integer Overflow and Out-of-Bounds Write

PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.

pcre2 | Remote | Memory Corruption
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
5.7 MEDIUM
CVE-2026-89157 — PCRE2 Out-of-Bounds Write

PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.

pcre2 | Memory Corruption
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
2.9 LOW
CVE-2026-89156 — PCRE2 Out-of-Bounds Read

PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.

pcre2 | Memory Corruption
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
6.1 MEDIUM
CVE-2026-84960 — WP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scripting

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including, 3.5.6 due to insufficient input saniti…

wp-members_membership_plugin | Remote | Cross-Site Scripting
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
7.2 HIGH
CVE-2026-81825 — Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting

The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, <= 20260811 due to insuffic…

Remote | Cross-Site Scripting
Sep 11, 2026 Sep 11, 2026
Sep 11, 2026
Sep 11, 2026
Showing 20 of 13420 Results