Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.1 HIGH
CVE-2026-28082 — WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.

Remote | Cross-Site Scripting
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
9.8 CRITICAL
CVE-2026-28005 — WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vuln…

Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.

Remote | Authentication
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
6.5 MEDIUM
CVE-2026-25403 — WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vul…

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

Remote | Authorization
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
7.5 HIGH
CVE-2026-66712 — WordPress Simple Membership plugin <= 4.7.8 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.

Remote | Authorization
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
9.3 CRITICAL
CVE-2026-53976 — OpenChamber 1.11.7 Path Traversal File Read via allowOutsideWorkspace Parameter

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary fil…

Remote | Path Traversal
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
0.0 NA
CVE-2026-15246 — RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership pac…

| Authorization
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
6.8 MEDIUM
CVE-2026-64993 — Dell RVTools Collector Improper Certificate Validation Vulnerability

Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerability in the collector. A remote unauthenticated attacker could potentially exploit this vulnerability leadin…

Remote | Misconfiguration
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
9.8 CRITICAL
CVE-2026-5134 — SQLi in Loca Software's CMS

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: …

Remote | Injection
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
6.5 MEDIUM
CVE-2026-19041 — MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage c…

A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component N…

Remote | Injection
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
6.5 MEDIUM
CVE-2026-19040 — MissionSquad mcp-api dcrClients.ts server-side request forgery

A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side reques…

Remote | Server-Side Request Forgery
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
6.4 MEDIUM
CVE-2026-18501 — UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Wid…

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Subst…

Remote | Cross-Site Scripting
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
8.3 HIGH
CVE-2026-16731 — Authentication and authorization bypass via cryptographic timing side-channel attack in S…

OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid a…

Remote | Cryptography
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
4.3 MEDIUM
CVE-2026-16316 — Malformed IEC 61850 Sampled Values frames cause partial denial of service in StationGuard

OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values (SV) frame processing. A specially crafted SV frame can cause the affected process to ter…

| Denial of Service
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
8.7 HIGH
CVE-2026-16315 — Authentication and authorization bypass via cryptographic timing side-channel attack in S…

OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid a…

Remote | Cryptography
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
9.6 CRITICAL
CVE-2026-12605 — Eclipse GlassFish CSRF and SSRF Token Disclosure Vulnerability

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin…

glassfish | Remote | Cross-Site Request Forgery
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
0.0 NA
CVE-2026-19044 — LeeSinLiang godot-mcp create_scene/add_node index.ts executeOperation command injection

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component create_scene/add_node. This manipulatio…

| Injection
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
8.2 HIGH
CVE-2026-70637 — LightFTP 2.4 Data Race Condition via ABOR Command in ftpserv.c

LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authenticati…

lightftp | Remote | Race Condition
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
9.8 CRITICAL
CVE-2026-53975 — OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exe…

Remote | Injection
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
9.1 CRITICAL
CVE-2026-54489 — Dell Virtual Storage Integrator Sensitive Information Disclosure Vulnerability

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potential…

Remote | Information Disclosure
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
9.8 CRITICAL
CVE-2026-67261 — Dell Virtual Storage Integrator OS Command Injection Vulnerability

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could…

Remote | Injection
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
Showing 20 of 9981 Results