Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
2.1 LOW
CVE-2026-66882 — Reflected XSS in AshAuthentication confirmation and magic link interaction forms

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmation and magic link interaction…

ash_authentication | Remote | Cross-Site Scripting
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.6 HIGH
CVE-2026-65633 — Purpose-limited JWT accepted as full bearer authentication in AshAuthentication

Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as full bearer API credentials when a resource uses stateless bearer-token verificat…

ash_authentication | Remote | Authentication
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
9.1 CRITICAL
CVE-2026-59769 — FA-50 Hard-Coded Credentials Vulnerability

FA-50 all versions contain hard-coded credentials. An attacker, who knows the credentials and has access to the vessel's internal network, can operate the settings screen using that credentials to a…

Remote | Authentication
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.7 HIGH
CVE-2026-19851 — Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 throu…

A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import.

Remote | Authentication
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
6.4 MEDIUM
CVE-2026-18512 — TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via App…

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor String…

Remote | Cross-Site Scripting
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.2 HIGH
CVE-2026-18328 — Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_de…

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error_description' parameter in all ver…

forminator | Remote | Cross-Site Scripting
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.2 HIGH
CVE-2026-18323 — Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Fiel…

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) in all versions up …

forminator | Remote | Cross-Site Scripting
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
6.4 MEDIUM
CVE-2026-18100 — MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_…

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mf_form_id' Widget Setting in all versions up to, …

Remote | Cross-Site Scripting
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.8 HIGH
CVE-2026-16601 — CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_r…

The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploa…

Remote | Authentication
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
6.5 MEDIUM
CVE-2026-78656 — itsourcecode Sales and Inventory System cust_del.php sql injection

A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_del.php. The manipulation of the argument ID results in sql injection…

sales_and_inventory_system | Remote | Injection
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.8 HIGH
CVE-2026-69665 — SKYSEA Client View and SKYMEC IT Manager Improper Default Permissions Vulnerability

SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected …

| Misconfiguration
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.5 HIGH
CVE-2026-68960 — SKYSEA Client View and SKYMEC IT Manager Stack-Based Buffer Overflow

A stack-based buffer overflow vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affecte…

Remote | Memory Corruption
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.5 HIGH
CVE-2026-68959 — SKYSEA Client View and SKYMEC IT Manager Path Traversal Vulnerability

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is in…

Remote | Path Traversal
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.5 HIGH
CVE-2026-68062 — SKYSEA Client View and SKYMEC IT Manager Path Traversal Vulnerability

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is in…

Remote | Path Traversal
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.8 HIGH
CVE-2026-66109 — SKYSEA Client View and SKYMEC IT Manager Missing Authorization Vulnerability

A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected pr…

| Authorization
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.5 HIGH
CVE-2026-78654 — cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution

A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly contro…

Remote | Misconfiguration
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
3.3 LOW
CVE-2026-78638 — peerigon unzip-crx/unzip-crx-3 Archive Extraction index.js unzip path traversal

A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing a manipulation of the…

| Path Traversal
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.1 HIGH
CVE-2026-78478 — Måne <= 1.7 - Unauthenticated Local File Inclusion

The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary fil…

Remote | Path Traversal
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
9.8 CRITICAL
CVE-2026-78477 — Jawn <= 1.4.2 - Unauthenticated Privilege Escalation

The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to elevate their privileges to tha…

Remote | Authentication
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
6.5 MEDIUM
CVE-2026-78470 — WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of suff…

Remote | Injection
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
Showing 20 of 11630 Results