[CVE_SUBSCRIPTIONS]

Receive alerts for specific vendors, products, or severities
📡 [FLUX RSS CVE]

Subscribe to the CVE feed

7 derniers jours

> FILTERS

> Last 7 Days

STATISTIQUES

Total CVE: 416900
> CVE-2026-73397 [CRITICAL 9.8]
[PUBLISHED: 2026-08-18] [EPSS 0.56%]
Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.
> CVE-2026-73396 [HIGH 7.1]
[PUBLISHED: 2026-08-18] [EPSS 0.40%]
Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.
> CVE-2026-73395 [MEDIUM 6.5]
[PUBLISHED: 2026-08-18] [EPSS 0.33%]
Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.
> CVE-2026-73393 [HIGH 7.1]
[PUBLISHED: 2026-08-18] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.
> CVE-2026-73392 [CRITICAL 9.3]
[PUBLISHED: 2026-08-18] [EPSS 0.38%]
Unauthenticated SQL Injection in Super Store Finder <= 7.8 versions.
> CVE-2026-73383 [MEDIUM 4.9]
[PUBLISHED: 2026-08-18] [EPSS 0.47%]
Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.
> CVE-2026-73382 [HIGH 7.1]
[PUBLISHED: 2026-08-18] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.2.0 versions.
> CVE-2026-73381 [CRITICAL 9.1]
[PUBLISHED: 2026-08-18] [EPSS 0.55%]
Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.
> CVE-2026-73380 [CRITICAL 9.8]
[PUBLISHED: 2026-08-18] [EPSS 0.56%]
Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
> CVE-2026-73379 [MEDIUM 6.5]
[PUBLISHED: 2026-08-18] [EPSS 0.29%]
Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.
> CVE-2026-73378 [HIGH 7.1]
[PUBLISHED: 2026-08-18] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.
> CVE-2026-73377 [HIGH 7.5]
[PUBLISHED: 2026-08-18] [EPSS 0.35%]
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.
> CVE-2026-73376 [CRITICAL 9.8]
[PUBLISHED: 2026-08-18] [EPSS 0.56%]
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
> CVE-2026-73375 [HIGH 7.1]
[PUBLISHED: 2026-08-18] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.
> CVE-2026-73367 [HIGH 7.2]
[PUBLISHED: 2026-08-18] [EPSS 0.33%]
Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.
> CVE-2026-73366 [CRITICAL 9.8]
[PUBLISHED: 2026-08-18] [EPSS 0.56%]
Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.
> CVE-2026-73365 [CRITICAL 9.3]
[PUBLISHED: 2026-08-18] [EPSS 0.40%]
Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.
> CVE-2026-73362 [HIGH 7.1]
[PUBLISHED: 2026-08-18] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.
> CVE-2026-73361 [HIGH 7.1]
[PUBLISHED: 2026-08-18] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.
> CVE-2026-73360 [HIGH 7.1]
[PUBLISHED: 2026-08-18] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.
> CVE-2026-73359 [MEDIUM 6.5]
[PUBLISHED: 2026-08-18] [EPSS 0.22%]
Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions.
> CVE-2026-73358 [HIGH 7.1]
[PUBLISHED: 2026-08-18] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.
> CVE-2026-73356 [HIGH 8.2]
[PUBLISHED: 2026-08-18] [EPSS 0.37%]
Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.
> CVE-2026-73355 [CRITICAL 9.3]
[PUBLISHED: 2026-08-18] [EPSS 0.40%]
Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.
> CVE-2026-73352 [MEDIUM 6.5]
[PUBLISHED: 2026-08-18] [EPSS 0.27%]
Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.
> CVE-2026-73351 [HIGH 7.1]
[PUBLISHED: 2026-08-18] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.
> CVE-2026-73350 [HIGH 8.2]
[PUBLISHED: 2026-08-18] [EPSS 0.41%]
Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.
> CVE-2026-73348 [MEDIUM 6.5]
[PUBLISHED: 2026-08-18] [EPSS 0.27%]
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
> CVE-2026-73345 [HIGH 7.1]
[PUBLISHED: 2026-08-18] [EPSS 0.29%]
Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions.
> CVE-2026-73343 [CRITICAL 10.0]
[PUBLISHED: 2026-08-18] [EPSS 0.86%]
Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
> CVE-2026-73342 [HIGH 7.1]
[PUBLISHED: 2026-08-18] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.
> CVE-2026-73341 [CRITICAL 9.8]
[PUBLISHED: 2026-08-18] [EPSS 0.56%]
Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.
> CVE-2026-73339 [CRITICAL 9.3]
[PUBLISHED: 2026-08-18] [EPSS 0.40%]
Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.
> CVE-2026-73338 [HIGH 7.1]
[PUBLISHED: 2026-08-18] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.
> CVE-2026-73190 [HIGH 7.1]
[PUBLISHED: 2026-08-18] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in WPDM – Premium Packages <= 7.0.5 versions.
> CVE-2026-73189 [MEDIUM 6.5]
[PUBLISHED: 2026-08-18] [EPSS 0.33%]
Subscriber Insecure Direct Object References (IDOR) in WP Crowdfunding < 2.2.1 versions.
> CVE-2026-73187 [CRITICAL 9.3]
[PUBLISHED: 2026-08-18] [EPSS 0.40%]
Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.
> CVE-2026-73181 [HIGH 7.5]
[PUBLISHED: 2026-08-18] [EPSS 0.50%]
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.
> CVE-2026-71539 [HIGH 8.9]
[PUBLISHED: 2026-08-18] [EPSS 0.31%]
n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a cust...
> CVE-2026-70657 [MEDIUM 4.3]
[PUBLISHED: 2026-08-18] [EPSS 0.33%]
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder even though both features are disabled by default...
> CVE-2026-69189 [HIGH 7.6]
[PUBLISHED: 2026-08-18] [EPSS 0.39%]
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistory...
> CVE-2026-68939 [LOW 2.0]
[PUBLISHED: 2026-08-18] [EPSS 0.17%]
Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENV_VERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix, libexec/py...
> CVE-2026-68568 [MEDIUM 6.3]
[PUBLISHED: 2026-08-18] [EPSS 0.26%]
Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.
> CVE-2026-68567 [HIGH 7.1]
[PUBLISHED: 2026-08-18] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in Convert Pro <= 1.0.1 versions.
> CVE-2026-68565 [MEDIUM 6.5]
[PUBLISHED: 2026-08-18] [EPSS 0.22%]
Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.
> CVE-2026-66793 [HIGH 8.8]
[PUBLISHED: 2026-08-18] [EPSS 0.81%]
A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled...
> CVE-2026-66679 [MEDIUM 6.5]
[PUBLISHED: 2026-08-18] [EPSS 0.35%]
Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.
> CVE-2026-66667 [HIGH 7.1]
[PUBLISHED: 2026-08-18] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.
> CVE-2026-66651 [MEDIUM 6.5]
[PUBLISHED: 2026-08-18] [EPSS 0.27%]
Unauthenticated Broken Access Control in MultiVendorX <= 5.0.14 versions.
> CVE-2026-66646 [MEDIUM 6.5]
[PUBLISHED: 2026-08-18] [EPSS 0.22%]
Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.