Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.0 HIGH
CVE-2026-74848 — Apache APISIX: Cross-user response poisoning in serverless plugins

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' response…

apisix | Remote | Misconfiguration
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
8.7 HIGH
CVE-2026-75005 — Apache APISIX: Unauthenticated CPU-exhaustion DoS

Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes. This issue a…

apisix | Remote | Denial of Service
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
7.0 HIGH
CVE-2026-75020 — Apache APISIX: ldap-auth plugin cross-subtree identity impersonation

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can auth…

apisix | Remote | Injection
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
8.8 HIGH
CVE-2026-81625 — Stack buffer overflow in Greenbone OS and openvas-scanner

A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger a stack buffer overflow and gain full access on the compromi…

Remote | Memory Corruption
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
8.5 HIGH
CVE-2026-81277 — WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability

Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.

Remote | Injection
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
5.3 MEDIUM
CVE-2026-81276 — WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.

Remote | Authorization
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
5.3 MEDIUM
CVE-2026-81274 — WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability

Subscriber Broken Access Control in Ditty <= 3.1.67 versions.

ditty | Remote | Authorization
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
8.1 HIGH
CVE-2026-81273 — WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerabi…

Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.

Remote | Cross-Site Request Forgery
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
4.9 MEDIUM
CVE-2026-81272 — WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability

Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.

Remote | Authorization
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
8.8 HIGH
CVE-2026-81271 — WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.

Remote | Cross-Site Request Forgery
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
7.5 HIGH
CVE-2026-80433 — WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerabili…

Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.

Remote | Information Disclosure
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
7.1 HIGH
CVE-2026-78293 — WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.

Remote | Cross-Site Scripting
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
9.8 CRITICAL
CVE-2026-78292 — WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.

hash_form | Remote | Injection
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
7.1 HIGH
CVE-2026-78289 — WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.

Remote | Cross-Site Scripting
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
9.3 CRITICAL
CVE-2026-78288 — WordPress Beautiful Taxonomy Filters plugin <= 2.4.6 - SQL Injection vulnerability

Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.

Remote | Injection
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
9.8 CRITICAL
CVE-2026-78286 — WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.

geo_controller | Remote | Injection
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
8.5 HIGH
CVE-2026-78285 — WordPress Like Button Rating plugin <= 2.6.61 - SQL Injection vulnerability

Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions.

like_button_rating | Remote | Injection
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
7.1 HIGH
CVE-2026-78283 — WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulne…

Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.

Remote | Cross-Site Scripting
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
7.1 HIGH
CVE-2026-78281 — WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.

Remote | Cross-Site Scripting
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
7.2 HIGH
CVE-2026-78276 — WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability

Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.

Remote | Injection
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Showing 20 of 12261 Results