Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
7.6 HIGH
CVE-2026-69189 — Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolv…

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments…

hoppscotch | Remote | Authentication
Aug 18, 2026 Sep 16, 2026
Aug 18, 2026
Sep 16, 2026
2.0 LOW
CVE-2026-68939 — Pyenv: Glob/wildcard metacharacters bypass is_version_safe(), causing silent version/inte…

Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENV_V…

pyenv | Path Traversal
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
6.3 MEDIUM
CVE-2026-68568 — WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.

masterstudy_lms | Remote | Authorization
Aug 18, 2026 Aug 20, 2026
Aug 18, 2026
Aug 20, 2026
7.1 HIGH
CVE-2026-68567 — WordPress Convert Pro plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Convert Pro <= 1.0.1 versions.

Remote | Cross-Site Scripting
Aug 18, 2026 Aug 20, 2026
Aug 18, 2026
Aug 20, 2026
6.5 MEDIUM
CVE-2026-68565 — WordPress GeoDirectory plugin <= 2.8.172 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.

geodirectory | Remote | Cross-Site Scripting
Aug 18, 2026 Aug 20, 2026
Aug 18, 2026
Aug 20, 2026
8.8 HIGH
CVE-2026-66793 — Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary contain…

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn reso…

advanced_cluster_management_for_kubernetes | Remote | Authorization
Aug 18, 2026 Aug 27, 2026
Aug 18, 2026
Aug 27, 2026
6.5 MEDIUM
CVE-2026-66679 — WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.

appointment_hour_booking | Remote | Authorization
Aug 18, 2026 Aug 20, 2026
Aug 18, 2026
Aug 20, 2026
7.1 HIGH
CVE-2026-66667 — WordPress Templately plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.

templately | Remote | Cross-Site Scripting
Aug 18, 2026 Aug 20, 2026
Aug 18, 2026
Aug 20, 2026
6.5 MEDIUM
CVE-2026-66651 — WordPress MultiVendorX plugin <= 5.0.14 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MultiVendorX <= 5.0.14 versions.

multivendorx | Remote | Authorization
Aug 18, 2026 Aug 20, 2026
Aug 18, 2026
Aug 20, 2026
6.5 MEDIUM
CVE-2026-66646 — WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.

Remote | Cross-Site Scripting
Aug 18, 2026 Aug 20, 2026
Aug 18, 2026
Aug 20, 2026
6.5 MEDIUM
CVE-2026-66645 — WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabil…

Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.

Remote | Cross-Site Scripting
Aug 18, 2026 Aug 20, 2026
Aug 18, 2026
Aug 20, 2026
6.5 MEDIUM
CVE-2026-66644 — WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.

typing_effect | Remote | Cross-Site Scripting
Aug 18, 2026 Aug 20, 2026
Aug 18, 2026
Aug 20, 2026
6.5 MEDIUM
CVE-2026-66643 — WordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.

shortcode | Remote | Cross-Site Scripting
Aug 18, 2026 Aug 20, 2026
Aug 18, 2026
Aug 20, 2026
6.5 MEDIUM
CVE-2026-66641 — WordPress Video Conferencing with Zoom plugin <= 4.6.8 - Cross Site Scripting (XSS) vulne…

Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.

video_conferencing_with_zoom | Remote | Cross-Site Scripting
Aug 18, 2026 Aug 20, 2026
Aug 18, 2026
Aug 20, 2026
6.5 MEDIUM
CVE-2026-66640 — WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.

Remote | Cross-Site Scripting
Aug 18, 2026 Aug 20, 2026
Aug 18, 2026
Aug 20, 2026
6.5 MEDIUM
CVE-2026-66639 — WordPress WPZOOM Forms – Contact Form plugin for Gutenberg plugin <= 2.0.4 - Cross Site S…

Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions.

Remote | Cross-Site Scripting
Aug 18, 2026 Aug 20, 2026
Aug 18, 2026
Aug 20, 2026
6.5 MEDIUM
CVE-2026-66638 — WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vul…

Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.

frontend_admin | Remote | Cross-Site Scripting
Aug 18, 2026 Aug 20, 2026
Aug 18, 2026
Aug 20, 2026
6.5 MEDIUM
CVE-2026-66637 — WordPress Featured Video Plus plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.

Remote | Cross-Site Scripting
Aug 18, 2026 Aug 20, 2026
Aug 18, 2026
Aug 20, 2026
6.5 MEDIUM
CVE-2026-66636 — WordPress Wise Chat plugin <= 3.4 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Wise Chat <= 3.4 versions.

wise_chat | Remote | Cross-Site Scripting
Aug 18, 2026 Aug 20, 2026
Aug 18, 2026
Aug 20, 2026
7.4 HIGH
CVE-2026-66635 — WordPress Slider by 10Web plugin <= 1.2.62 - CSRF to Arbitrary File Deletion vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Slider by 10Web <= 1.2.62 versions.

slider | Remote | Cross-Site Request Forgery
Aug 18, 2026 Aug 20, 2026
Aug 18, 2026
Aug 20, 2026
Showing 20 of 14714 Results