Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
9.8 CRITICAL
CVE-2026-12227 — Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vc…

The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-template` parameter. This makes it possible f…

visual_composer_website_builder | Remote | Path Traversal
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
7.8 HIGH
CVE-2026-97185 — Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to…

enterprise_linux enterprise_linux | Memory Corruption
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
8.8 HIGH
CVE-2026-85682 — YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Tak…

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wp_rest nonce to window.opener via po…

yop_poll | Remote | Authentication
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
6.5 MEDIUM
CVE-2026-78313 — Improper Access Control in DIAEnergie

Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.

diaenergie | Remote | Authorization
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
9.1 CRITICAL
CVE-2026-78312 — Path Traversal in DIAEnergie

Path Traversal in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.

diaenergie | Remote | Path Traversal
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
8.8 HIGH
CVE-2026-78311 — SQL Injection in DIAEnergie

SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.

diaenergie | Remote | Injection
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
4.3 MEDIUM
CVE-2026-78310 — Authorization Bypass Through User-Controlled Key in DIAEnergie

Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.

diaenergie | Remote | Authorization
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
8.8 HIGH
CVE-2026-78309 — SQL Injection in DIAEnergie

SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.

diaenergie | Remote | Injection
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
9.8 CRITICAL
CVE-2026-78308 — Authentication Bypass in DIAEnergie

Improper Authentication vulnerability in DIAEnergie allows Authentication Bypass. This issue affects DIAEnergie: before 1.11.00.022.

diaenergie | Remote | Authentication
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
7.5 HIGH
CVE-2026-77193 — eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrar…

The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it possible for una…

Remote | Path Traversal
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
6.9 MEDIUM
CVE-2026-97181 — ezGlobal|GPM LIGHT - Sensitive Data Exposure

GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can directly access system logs.

Remote | Information Disclosure
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
6.9 MEDIUM
CVE-2026-87739 — PaperCut MF/NG: User permissions are not evaluated on report generation

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials,…

Remote | Authentication
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
7.3 HIGH
CVE-2026-82077 — PaperCut NG/MF: Remote Code Execution via Scan2Fax

An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to exec…

Remote | Path Traversal
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
5.9 MEDIUM
CVE-2026-81645 — Graphics Module Out-of-Bounds Read Vulnerability

Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability.

harmonyos | Memory Corruption
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
3.8 LOW
CVE-2026-11744 — PaperCut Hive Embedded App for Ricoh: Javascript injection

An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process bef…

| Injection
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
6.6 MEDIUM
CVE-2026-97177 — Keycloak-services: keycloak-services: generic user update bypasses denied reset-password …

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations dur…

single_sign-on build_of_keycloak | Remote | Authorization
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
4.2 MEDIUM
CVE-2026-97176 — Keycloak-services: keycloak-services: essential acr requirement silently bypassed via coo…

A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security l…

single_sign-on build_of_keycloak | Remote | Authentication
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
4.3 MEDIUM
CVE-2026-93662 — Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via …

The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read …

events_manager | Remote | Authorization
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
2.7 LOW
CVE-2026-93661 — Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR

The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event…

events_manager | Remote | Authorization
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
6.8 MEDIUM
CVE-2026-89005 — WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Cont…

wpematico_rss_feed_fetcher | Remote | Cross-Site Scripting
Sep 24, 2026 Sep 24, 2026
Sep 24, 2026
Sep 24, 2026
Showing 20 of 14298 Results