cve.bz

New CVEs this week, the last 7 days, newest first, page 32

Filter

The new CVEs published in the last 7 days, newest first, with CVSS, EPSS, CISA KEV and public exploits for each. Refreshed every few minutes. Narrow it: in CISA KEV · critical. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, Patch Tuesday

  1. 8.8CVE-2026-125839EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in webriti ElitePress elitepress allows Cross Site Request Forgery.This issue affects ElitePress: from n/a through 3.2.1.

  2. 8.8CVE-2026-125838EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in webriti Quality quality allows Cross Site Request Forgery.This issue affects Quality: from n/a through 3.3.

  3. 8.5CVE-2026-123040EPSS 0.2%

    An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not including, 5.5.6 installed, running as the user trueconf (by exploiting some other vulnerability), can …

  4. 6.8CVE-2026-0470EPSS 0.1%

    Null pointer dereference in AMD Embedded SPI Flash driver could allow a local user to potentially cause a loss of availability.

  5. –CVE-2026-94125EPSS 0.2%

    Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who…

  6. 5.3CVE-2026-126663EPSS 0.4%

    Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the {{image::}} insert tag. Attackers can embed …

  7. 7.1CVE-2026-126662EPSS 0.4%

    Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Mult…

  8. 8.7CVE-2026-126659EPSS 0.6%

    BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthenticated attackers to fill server storage by repeatedly creating anonymous blueprints. Attackers can send large requests to …

  9. 5.3CVE-2026-126658EPSS 0.2%

    ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deact…

  10. 9.1CVE-2026-126537EPSS 0.9%

    The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file read via S3/Dropbox/Google Drive exfiltration) in versions up to, and including, 3.3.36. The flaw spans NF_FU_Fields_Upload::p…

  11. 4.3CVE-2026-125782EPSS 0.2%

    Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPress Podcasting: from n/a through 11.18.2.

  12. 4.3CVE-2026-125778EPSS 0.3%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.This issue affects myCred: from n/a through 4.0.2.

  13. 5.3CVE-2026-125776EPSS 0.3%

    Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.6.

  14. 5.3CVE-2026-125767EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive Data.This issue affects Hubbub Lite: from n/a through 1.36.3.1.

  15. 5.3CVE-2026-125766EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in WPZOOM WPZOOM Social Feed Widget & Block instagram-widget-by-wpzoom allows Retrieve Embedded Sensitive Data.This issue affects WPZOOM Social Feed Widget & Block: from n/a t…

  16. 5.3CVE-2026-125763EPSS 0.3%

    Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0.

  17. 6.5CVE-2026-125762EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: fro…

  18. 5.3CVE-2026-125746EPSS 0.3%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ProPluginsLab Back In Stock Notifier for WooCommerce back-in-stock-notifier-for-woocommerce allows Code Injection.This issue affects Back In Sto…

  19. 6.5CVE-2026-125743EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Elements:…

  20. 6.5CVE-2026-125708EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: fro…

  21. 6.5CVE-2026-125454EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Passster content-protector allows Stored XSS.This issue affects Passster: from n/a through 4.3.21.

  22. 6.5CVE-2026-125450EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureRank surerank allows Stored XSS.This issue affects SureRank: from n/a through 1.10.3.

  23. 5.3CVE-2026-125448EPSS 0.3%

    Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.31.

  24. 8.8CVE-2026-125446EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Cross Site Request Forgery.This issue affects Edwiser Bridge: from n/a through 4.3.4.

  25. 4.3CVE-2026-125445EPSS 0.1%

    Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through 1.5.16.

  26. 4.3CVE-2026-125436EPSS 0.3%

    Missing Authorization vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Post Grid: from n/a through 7.9.9.

  27. 5.3CVE-2026-125435EPSS 0.4%

    Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects PowerPack Addons for Elementor: fro…

  28. 6.5CVE-2026-125433EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra futurio-extra allows Stored XSS.This issue affects Futurio Extra: from n/a through 2.0.25.

  29. 5.3CVE-2026-125431EPSS 0.3%

    Missing Authorization vulnerability in Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce tlp-food-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Food Menu – Restau…

  30. 5.3CVE-2026-125046EPSS 0.3%

    Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create: from n/a through 3.1.1.

  31. 6.5CVE-2026-125045EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John-Michael L'Allier Create mediavine-create allows Stored XSS.This issue affects Create: from n/a through 3.1.1.

  32. 6.3CVE-2026-124745EPSS 0.2%

    A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted …

  33. 6.3CVE-2026-124744EPSS 0.1%

    A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, …

  34. –CVE-2026-124496EPSS 0.2%

    The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended t…

  35. –CVE-2026-124495EPSS 0.2%

    When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, a…

  36. 4.3CVE-2026-124417EPSS 0.3%

    Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2.

  37. 4.3CVE-2026-124416EPSS 0.2%

    Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2.

  38. 6.5CVE-2026-124411EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.12.1.

  39. 4.3CVE-2026-124269EPSS 0.3%

    Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.51.0.

  40. 5.4CVE-2026-124263EPSS 0.1%

    Cross-Site Request Forgery (CSRF) vulnerability in plainware Locatoraid Store Locator locatoraid allows Cross Site Request Forgery.This issue affects Locatoraid Store Locator: from n/a through 3.9.75.

  41. 5.3CVE-2026-124262EPSS 0.3%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Igor Funa Ad Inserter ad-inserter allows Code Injection.This issue affects Ad Inserter: from n/a through 2.8.19.

  42. 5.3CVE-2026-124261EPSS 0.3%

    Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCo…

  43. 4.3CVE-2026-123481EPSS 0.3%

    Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit – WP Exten…

  44. 6.5CVE-2026-123480EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fullworks Plugins Display Eventbrite Events widget-for-eventbrite-api allows Stored XSS.This issue affects Display Eventbrite Events: fro…

  45. –CVE-2026-123374EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can …

  46. –CVE-2026-122300EPSS 0.2%

    Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor check…

  47. –CVE-2026-122096EPSS 0.2%

    Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java. Several deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application …

  48. 5.4CVE-2026-118414EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their …

  49. 5.4CVE-2026-118413EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's visitors. Blogroll links import…

  50. 3.1CVE-2026-118412EPSS 0.3%

    Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account …