Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
4.3 MEDIUM
CVE-2026-18313 — rpcapd memory leak in libpcap before 1.10.7

rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under norm…

libpcap | Remote | Memory Corruption
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
5.0 MEDIUM
CVE-2026-18238 — OOBR in rpcap client in libpcap before 1.10.7

The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to trea…

libpcap | Remote | Memory Corruption
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
8.7 HIGH
CVE-2026-0799 — OOBR and OOBW in libpcap before 1.10.7

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate th…

libpcap | Memory Corruption
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
5.9 MEDIUM
CVE-2026-82752 — Ash string length constraints count graphemes, so a combining-mark string of any size pas…

Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it. Ash…

ash | Injection
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
5.1 MEDIUM
CVE-2026-86197 — Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox

Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors…

grav | Remote | Cross-Site Scripting
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
8.7 HIGH
CVE-2026-86196 — Grav API Plugin before 1.0.20 Authentication Bypass via Host Header

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attack…

grav grav-plugin-api | Remote | Server-Side Request Forgery
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
8.7 HIGH
CVE-2026-86195 — grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only removes nested super flags but fails to strip …

grav grav-plugin-api | Remote | Authorization
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
6.9 MEDIUM
CVE-2026-86194 — Grav Form Plugin before 9.1.22 Cross-Page Form Execution

Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpubli…

grav | Remote | Authorization
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
8.7 HIGH
CVE-2026-86193 — Grav API Plugin Authentication Bypass via Group-Inherited Super

grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access…

grav grav-plugin-api | Remote | Authorization
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
7.1 HIGH
CVE-2026-86192 — SiYuan before v3.8.2 Information Disclosure via Attribute-View

SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound t…

siyuan | Remote | Authorization
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
5.3 MEDIUM
CVE-2026-86191 — SiYuan before v3.8.2 Private Attribute View Key Enumeration

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions …

siyuan | Remote | Information Disclosure
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
9.3 CRITICAL
CVE-2026-86190 — WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to u…

avideo | Remote | Authorization
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
9.8 CRITICAL
CVE-2026-86189 — WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php

WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avid…

avideo | Remote | Path Traversal
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
7.2 HIGH
CVE-2026-86188 — AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callba…

avideo | Remote | Cross-Site Scripting
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
7.4 HIGH
CVE-2026-86187 — WWBN AVideo Weak PRNG Password Generation via External Login

WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover pla…

avideo | Remote | Cryptography
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
6.5 MEDIUM
CVE-2026-86186 — AVideo API Rate Limit Bypass via Bot User-Agent Header

AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can se…

avideo | Remote | Authentication
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
8.6 HIGH
CVE-2026-86185 — Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification Bypass

Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network po…

| Misconfiguration
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
9.8 CRITICAL
CVE-2026-86184 — Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is no…

lara_dashboard | Remote | Authentication
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
4.3 MEDIUM
CVE-2026-15550 — Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscribe…

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verificati…

Remote | Authorization
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
5.4 MEDIUM
CVE-2026-12843 — LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpo…

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an actio…

learndash | Remote | Authorization
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
Showing 20 of 12410 Results