Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
5.5 MEDIUM
CVE-2026-16910 — Quay: ssrf in red hat quay notification webhooks (slack/generic)

A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administr…

openshift quay openshift | Remote | Server-Side Request Forgery
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
7.3 HIGH
CVE-2026-16519 — GeoVision GV-IP Device Utility DLL Search Order Hijacking Vulnerability

A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more dynamic-link libraries (DLLs) from an unsafe search path, allowing a …

gv-ip_device_utility | Misconfiguration
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
6.4 MEDIUM
CVE-2026-15755 — Open User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sh…

The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficien…

Remote | Cross-Site Scripting
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
6.4 MEDIUM
CVE-2026-15665 — Fluent Support <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'r…

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute in all versions up to, and inclu…

Remote | Cross-Site Scripting
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
6.4 MEDIUM
CVE-2026-15653 — Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backe…

The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backend-title' parameter in all versions up to, and incl…

Remote | Cross-Site Scripting
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
6.4 MEDIUM
CVE-2026-15648 — Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scriptin…

The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'width' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sani…

brands_for_woocommerce | Remote | Cross-Site Scripting
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
6.4 MEDIUM
CVE-2026-15464 — WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via …

The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute in all versions up to, and including, 2.3.2 due to insufficient input sa…

wp_hotel_booking | Remote | Cross-Site Scripting
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
6.4 MEDIUM
CVE-2026-15334 — Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ico…

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon.view' Block Attribute i…

Remote | Cross-Site Scripting
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
6.4 MEDIUM
CVE-2026-15333 — Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'coz…

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cozyCustomFont' Block Attrib…

Remote | Cross-Site Scripting
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
5.3 MEDIUM
CVE-2026-12654 — Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticate…

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying tha…

Remote | Authorization
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
0.0 NA
CVE-2026-63317 — Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor …

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache…

opennlp | Misconfiguration
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
0.0 NA
CVE-2026-15346 — VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'cat…

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'category_id' parameter in all versions up to, and including, 1.8.13 due to insu…

| Cross-Site Scripting
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
0.0 NA
CVE-2026-15739 — Rich Showcase for Google Reviews <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Sit…

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insuffic…

| Cross-Site Scripting
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
0.0 NA
CVE-2026-15821 — SureDash <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortco…

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.10.0 due to ins…

| Cross-Site Scripting
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
1.8 LOW
CVE-2026-56392 — Heap-based Buffer Overflow in GNU coreutils

GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calcula…

coreutils | Memory Corruption
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
4.6 MEDIUM
CVE-2026-56391 — Out‑of‑bounds Read in GNU coreutils

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte len…

coreutils | Memory Corruption
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
9.8 CRITICAL
CVE-2026-15704 — CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSy…

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC m…

Remote | Authorization
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
0.0 NA
CVE-2026-14603 — WowOptin < 1.4.38 - Unauthenticated Opt-in Deactivation and Template Row Injection

The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to disable all of the site's opt-in forms and …

| Authorization
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
7.8 HIGH
CVE-2026-14172 — Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated E…

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as …

insightvm nexpose insight_agent | Authorization
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
0.0 NA
CVE-2026-12981 — CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset

The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, inc…

| Authentication
Jul 24, 2026 Jul 24, 2026
Jul 24, 2026
Jul 24, 2026
Showing 20 of 9724 Results