Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
5.3 MEDIUM
CVE-2026-9101 — "Apache Shellshock in CSV Parsing"

Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execu…

Remote | Misconfiguration
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
6.0 MEDIUM
CVE-2026-9100 — MongoDB C Driver GridFS API Malformed File Metadata Denial of Service/Information Leak

The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads t…

Remote | Memory Corruption
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
6.4 MEDIUM
CVE-2026-9087 — Keycloak Cross-Session Verification Bypass

A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream…

Remote | Authentication
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
7.2 HIGH
CVE-2026-7613 — Cost of Goods by PixelYourSite <= 1.2.12 - Unauthenticated Stored Cross-Site Scripting vi…

The Cost of Goods by PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csvdata[0][cost_of_goods_value]' parameter in versions up to, and including, 1.2.12 due t…

Remote | Cross-Site Scripting
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
0.0 NA
CVE-2026-44926 — InfoScale CmdServer Authentication Bypass

InfoScale CmdServer before 7.4.2 mishandles access control.

| Authorization
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
0.0 NA
CVE-2026-44925 — InfoScale Operations Manager CSRF Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in InfoScale v.9.1.3 Operations Manager (VIOM) allows an attacker to force the user with an active session into clicking a malicious HTML link, which t…

| Cross-Site Request Forgery
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
0.0 NA
CVE-2026-44924 — InfoScale VIOM Remote Cross-Site Scripting Vulnerability

InfoScale VIOM 9.1.3 allows XSS.

| Cross-Site Scripting
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
0.0 NA

SQL injection in InfoScale VIOM before v9.1.3 allows remote attackers to escalate privileges.

| Injection
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
10.0 CRITICAL
CVE-2026-20223 — Cisco Secure Workload Unauthorized API Access Vulnerability

A vulnerability in the&nbsp;access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site resources with the privileges of the&nbsp;S…

Remote | Authentication
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
6.3 MEDIUM
CVE-2026-20206 — Cisco ThousandEyes BrowserBot Command Injection Vulnerability

A vulnerability in the BrowserBot component of Cisco ThousandEyes Enterprise Agent could have allowed an authenticated, remote attacker to execute arbitrary commands on Agents on behalf of the Browse…

Remote | Injection
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
4.7 MEDIUM
CVE-2026-20199 — Cisco ThousandEyes Virtual Appliance SSL Certificate Command Execution Vulnerability

A vulnerability in the SSL certificate handling of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to execute commands on the underlying operating system as the roo…

Remote | Authentication
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
6.8 MEDIUM
CVE-2026-20171 — Cisco Nexus 3000 and 9000 Series Border Gateway Protocol Denial of Service Vulnerability

A vulnerability in the Border Gateway Protocol (BGP)&nbsp;enforce-first-as feature of&nbsp;Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow a…

Remote | Denial of Service
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
6.0 MEDIUM
CVE-2026-9084 — MISP OIDC authentication bypass via automatic email-based account linking under insecure …

MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecu…

| Authentication
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
9.1 CRITICAL
CVE-2026-8598 — Unauthenticated Export Service in ZKTeco CCTV Cameras

An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as op…

Remote | Information Disclosure
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
4.3 MEDIUM
CVE-2026-8488 — Allocation of resources without limits or throttling vulnerability in Progress Software M…

Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 20…

Remote | Denial of Service
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
6.5 MEDIUM
CVE-2026-8487 — Incorrect default permissions vulnerability in Progress Software MOVEit Automation

Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 befo…

Remote | Information Disclosure
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
5.3 MEDIUM
CVE-2026-8486 — Allocation of resources without limits or throttling vulnerability in Progress Software M…

Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 befor…

Remote | Denial of Service
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
7.6 HIGH
CVE-2026-5783 — Reflected XSS in Beyaz Computer's CityPLus

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Beyaz Computer Software Design Industry and Trade Ltd. Co. CityPLus allows Reflected XSS. This i…

Remote | Cross-Site Scripting
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
5.3 MEDIUM
CVE-2026-4293 — Kieback & Peter DDC Building Controllers Cross-site Scripting

The affected Kieback & Peter DDC building controllers are vulnerable to cross-site scripting, enabling JavaScript to be executed by the victim's browser, which allows the attacker to control the brow…

Remote | Cross-Site Scripting
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
7.5 HIGH
CVE-2026-39047 — EPSON L14150 Buffer Overflow Remote Code Execution

Buffer Overflow vulnerability in EPSON L14150 FL27PB allows a remote attacker to execute arbitrary code via the RAW Printing Service (JetDirect) on TCP port 9100

Remote | Memory Corruption
May 20, 2026 May 20, 2026
May 20, 2026
May 20, 2026
Showing 20 of 6411 Results