Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
0.0 NA
CVE-2026-74445 — drm/vmwgfx: reject DX_BIND_QUERY without a DX context

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DX_BIND_QUERY without a DX context vmw_cmd_dx_bind_query() unconditionally dereferences sw_context->dx_ctx_nod…

| Memory Corruption
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
0.0 NA
CVE-2026-74444 — drm/vmwgfx: validate DRAW_PRIMITIVES header size before division

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division vmw_cmd_draw() computes maxnum = (header->size - sizeof(cmd->b…

| Memory Corruption
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
0.0 NA
CVE-2026-74443 — drm/vmwgfx: bound DMA command body size against suffix pointer

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmw_cmd_dma() locates the DMA suffix at (unsigned long) &cmd->bo…

| Memory Corruption
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
0.0 NA
CVE-2026-74442 — drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure Two paths through vmw_vkms_init() can leave vmw->crc_workq NULL wh…

| Misconfiguration
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
0.0 NA
CVE-2026-74441 — usb: typec: ucsi: Fix race condition and ordering in port unregistration

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Fix race condition and ordering in port unregistration A synchronization issue exists during port unregistratio…

| Race Condition
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
0.0 NA
CVE-2026-74440 — drm/xe: Wait on external BO kernel fences in exec IOCTL

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xe_exec_ioctl() only added the VM's dma-resv KE…

| Race Condition
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
0.0 NA
CVE-2026-73194 — DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated nu…

DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input by…

| Memory Corruption
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
0.0 NA
CVE-2026-73193 — DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an…

DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with …

| Memory Corruption
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
6.5 MEDIUM
CVE-2026-19894 — itsourcecode Hospital Management System viewmedicine.php sql injection

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewmedicine.php. Performing a manipulation of the argument delid resu…

hospital_management_system | Remote | Injection
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
3.1 LOW
CVE-2026-19893 — D-Link DIR-842 vsftpd vsftpd.conf default permission

A vulnerability was identified in D-Link DIR-842 2.01.B04. This impacts an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Such manipulation leads to incorrect default permissi…

Remote | Misconfiguration
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
6.5 MEDIUM
CVE-2026-12248 — WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' …

The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied…

Remote | Injection
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
0.0 NA
CVE-2026-73635 — Apache Struts: Unbounded growth of localized-text caches driven by the request locale

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request,…

struts | Denial of Service
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
0.0 NA
CVE-2026-73634 — Apache Struts: Unbounded read of a Content Security Policy violation report

Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory w…

struts | Denial of Service
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
0.0 NA
CVE-2026-73632 — Apache Struts: Shared serialization state in the JSON plugin

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content ass…

struts | Information Disclosure
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
0.0 NA
CVE-2026-73631 — Apache Struts: Shared parsing state in the JSON plugin

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one re…

struts | Information Disclosure
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
6.3 MEDIUM
CVE-2026-19891 — TRENDnet TEW-WLC100 IKE Phase 1 Aggressive Mode racoon.conf missing encryption

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the arg…

Remote | Cryptography
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
8.8 HIGH
CVE-2026-18438 — Templately <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code E…

The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, …

Remote | Authentication
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
9.8 CRITICAL
CVE-2026-16142 — TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Referen…

The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being registered for unauthe…

Remote | Authentication
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
7.5 HIGH
CVE-2026-15142 — Real Estate Manager Pro <= 12.8.6 - Authenticated (Subscriber+) Privilege Escalation via …

The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allow_attachmen…

Remote | Authorization
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
9.8 CRITICAL
CVE-2026-15826 — User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion…

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function callin…

profile_builder | Remote | Authentication
Aug 15, 2026 Aug 15, 2026
Aug 15, 2026
Aug 15, 2026
Showing 20 of 11344 Results