Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
8.1 HIGH
CVE-2026-40784 — WordPress FluentBoards plugin <= 1.91.2 - Insecure Direct Object References (IDOR) vulner…

Authorization Bypass Through User-Controlled Key vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff…

Remote | Authorization
Apr 15, 2026 Apr 15, 2026
Apr 15, 2026
Apr 15, 2026
5.3 MEDIUM
CVE-2026-40778 — WordPress Majestic Support plugin <= 1.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: …

majestic_support | Remote | Authorization
Apr 15, 2026 Apr 16, 2026
Apr 15, 2026
Apr 16, 2026
8.1 HIGH
CVE-2026-40764 — WordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) …

Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form by WPForms: from n/a through <= 1…

wpforms | Remote | Cross-Site Request Forgery
Apr 15, 2026 Apr 15, 2026
Apr 15, 2026
Apr 15, 2026
5.3 MEDIUM
CVE-2026-40763 — WordPress Royal Elementor Addons plugin <= 1.7.1056 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elemento…

royal_elementor_addons | Remote | Authorization
Apr 15, 2026 Apr 16, 2026
Apr 15, 2026
Apr 16, 2026
7.6 HIGH
CVE-2026-40745 — WordPress Element Pack Elementor Addons plugin <= 8.4.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Blind SQL Injection.This…

element_pack | Remote | Injection
Apr 15, 2026 Apr 15, 2026
Apr 15, 2026
Apr 15, 2026
8.5 HIGH
CVE-2026-40744 — WordPress Beaver Builder plugin <= 2.10.1.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Blind SQL Injection.This issue a…

beaver_builder | Remote | Injection
Apr 15, 2026 Apr 16, 2026
Apr 15, 2026
Apr 16, 2026
5.3 MEDIUM
CVE-2026-40742 — WordPress Nelio AB Testing plugin <= 8.2.8 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio AB Testing: fr…

nelio_ab_testing | Remote | Authorization
Apr 15, 2026 Apr 15, 2026
Apr 15, 2026
Apr 15, 2026
5.4 MEDIUM
CVE-2026-40740 — WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.7.

tutor_lms | Remote | Authorization
Apr 15, 2026 Apr 16, 2026
Apr 15, 2026
Apr 16, 2026
5.3 MEDIUM
CVE-2026-40737 — WordPress COMPE plugin <= 1.1.4 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme COMPE compe-woo-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect…

Remote | Authorization
Apr 15, 2026 Apr 15, 2026
Apr 15, 2026
Apr 15, 2026
6.5 MEDIUM
CVE-2026-40734 — WordPress Categories Images plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zahlan Categories Images categories-images allows DOM-Based XSS.This issue affects Categories Ima…

Remote | Cross-Site Scripting
Apr 15, 2026 Apr 16, 2026
Apr 15, 2026
Apr 16, 2026
0.0 NA
CVE-2026-40730 — WordPress ThemeGrill Demo Importer plugin <= 2.0.0.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeGri…

themegrill_demo_importer | Authorization
Apr 15, 2026 Apr 15, 2026
Apr 15, 2026
Apr 15, 2026
4.3 MEDIUM
CVE-2026-40729 — WordPress 3D viewer – Embed 3D Models plugin <= 1.8.5 - Broken Access Control vulnerabili…

Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D viewer – Embed 3D M…

Remote | Authorization
Apr 15, 2026 Apr 16, 2026
Apr 15, 2026
Apr 16, 2026
4.3 MEDIUM
CVE-2026-40728 — WordPress Magazine Blocks plugin <= 1.8.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in BlockArt Magazine Blocks magazine-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Magazine Blocks: from n/a th…

magazine_blocks | Remote | Authorization
Apr 15, 2026 Apr 15, 2026
Apr 15, 2026
Apr 15, 2026
9.0 CRITICAL
CVE-2026-33805 — @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-add…

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This al…

reply-from | Misconfiguration
Apr 15, 2026 Apr 17, 2026
Apr 15, 2026
Apr 17, 2026
7.5 HIGH
CVE-2026-30778 — Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive …

The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0. Users are recom…

skywalking | Remote | Information Disclosure
Apr 15, 2026 Apr 17, 2026
Apr 15, 2026
Apr 17, 2026
6.8 MEDIUM
CVE-2026-28741 — CSRF Protection Bypass Allows Updating a User's Authentication Method

Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to validate CSRF tokens on an authentication endpoint which allows an attacker to update a user's au…

mattermost_server | Remote | Cross-Site Request Forgery
Apr 15, 2026 Apr 17, 2026
Apr 15, 2026
Apr 17, 2026
2.7 LOW
CVE-2026-27769 — Connected Workspaces: Malicious remote server can manipulate arbitrary user's status

Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Wo…

mattermost_server | Remote | Authorization
Apr 15, 2026 Apr 17, 2026
Apr 15, 2026
Apr 17, 2026
10.0 CRITICAL
CVE-2026-5598 — Non-constant time comparisons risk private key leakage in FrodoKEM.

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). Non-constant time comparisons risk private key leakage in FrodoKEM. This issue affects BC…

Remote | Cryptography
Apr 15, 2026 Apr 17, 2026
Apr 15, 2026
Apr 17, 2026
10.0 CRITICAL
CVE-2026-5588 — PKIX draft CompositeVerifier accepts empty signature sequence as valid.

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules). PKIX draft CompositeVerifier accepts empty signature seque…

bouncy_castle_for_java | Remote | Cryptography
Apr 15, 2026 Apr 17, 2026
Apr 15, 2026
Apr 17, 2026
10.0 CRITICAL
CVE-2026-3505 — Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

Allocation of resources without limits or throttling vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules).This issue affects BC-JAVA: before 1.84. Unbounded PGP AEAD ch…

Remote | Denial of Service
Apr 15, 2026 Apr 17, 2026
Apr 15, 2026
Apr 17, 2026
Showing 20 of 6505 Results