New CVEs this week, the last 7 days, newest first, page 76
Filter
The new CVEs published in the last 7 days, newest first, with CVSS, EPSS, CISA KEV and public exploits for each. Refreshed every few minutes. Narrow it: in CISA KEV · critical. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, Patch Tuesday
- 2.1CVE-2026-124503EPSS 0.5%
A vulnerability was identified in sooperset mcp-atlassian up to 0.24.0. This issue affects the function validate_safe_path of the file src/mcp_atlassian/utils/io.py. The manipulation of the argument path leads to path traversal. The attack…
- 7.8CVE-2026-104619EPSS 0.1%
Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation.
- 8.7CVE-2026-60046EPSS 0.3%
An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted.
- 6.9CVE-2026-60045EPSS 0.3%
A high privileged remote attacker can upload arbitrary files to a guessable location. This can result in a loss of availability and might be chained with other vulnerabilities.
- 8.7CVE-2026-60044EPSS 0.3%
The backups created by the application use a weak static password allowing an unauthenticated remote attacker to access their content. This can result in a total loss of confidentiality.
- 6.4CVE-2026-60043EPSS 0.4%
An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can…
- 6.9CVE-2026-60042EPSS 0.4%
An unauthenticated remote attacker can perform an authentication bypass on the com_check function, potentially triggering traffic on other systems and email alerts. This can result in some loss of availability due to higher system loads.
- 5.3CVE-2026-60041EPSS 0.2%
An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This ca…
- 8.7CVE-2026-60040EPSS 0.3%
An unauthenticated remote attacker can perform a DoS in the backends backup creation function. This can result in a total loss of availability.
- 8.6CVE-2026-60039EPSS 0.5%
A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 8.6CVE-2026-60038EPSS 0.5%
A high privileged remote attacker can perform an OpenSSL code injection in the backends ImportPKCS12 function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 8.6CVE-2026-60037EPSS 0.5%
A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 8.6CVE-2026-60036EPSS 0.5%
A high privileged remote attacker can perform a code injection in the backends patch activate function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 8.6CVE-2026-60035EPSS 0.5%
A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 7.5CVE-2026-120013EPSS 0.4%
The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value…
- 7.5CVE-2026-120012EPSS 0.3%
SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to app…
- 5.3CVE-2026-106025EPSS 0.2%
The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing un…
- 5.3CVE-2026-106007EPSS 0.2%
The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthenticated users to send an unlimited number of verification SMS messages to attacker-chosen phone nu…
- 6.8CVE-2026-125652EPSS 0.2%
A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider. The issue occurs when a user initiates a login after visiting the password reset pag…
- 7.2CVE-2026-93427EPSS 0.2%
The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field (Profile Cover) in all versions up to,…
- 7.2CVE-2026-84938EPSS 0.2%
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook → Media Upload Chain (ID3 Metadata / html_attributes) in all versions up to, and including, 3.16.1 …
- 8.1CVE-2026-76877EPSS 0.4%
The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the `process_iframe_request` function's language-per-domain SSO handler genera…
- 8.2CVE-2026-120513EPSS 0.5%
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all…
- 7.5CVE-2026-100386EPSS 0.8%
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.54 via the uacf7_wpcf7_mail_components function. This makes it possible for unauthenticated attackers t…
- 6.7CVE-2026-9063EPSS 0.1%
A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unauthorized code execution. This flaw can only be exploited after authenticating with an admin-privileged service account.
- 8.8CVE-2026-8372EPSS 0.2%
A vulnerability that could allow an attacker to gain unauthorized access.
- 8.3CVE-2026-63288EPSS 0.2%
A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer.
- 6.5CVE-2026-63287EPSS 0.2%
It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could be used to tamper with audit log creation in AXIS Camera Station.
- 6.5CVE-2026-63282EPSS 0.7%
Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege escalation.
- 8.8CVE-2026-4762EPSS 0.08%
A vulnerability to perform a privilege escalation attack on the server as a non-admin user.
- 5.3CVE-2026-14918EPSS 0.2%
The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content…
- 3.9CVE-2026-14543EPSS 0.1%
The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-pr…
- 6.7CVE-2026-14542EPSS 0.1%
The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege escalation. This flaw can only be exploited after authenticating with an admin-privileged service account.
- 4.3CVE-2026-13409EPSS 0.2%
The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw can only be exploited after authenticating with an operator or admin-privileged service account.
- 3.5CVE-2026-13387EPSS 0.1%
A vulnerability related to URL redirection handling during the sign-out flow that could allow a user to be redirected to unintended external content under specific conditions.
- 9.9CVE-2026-13312EPSS 0.3%
A vulnerability that could allow an attacker to compromise a system.
- 8.0CVE-2026-12964EPSS 0.2%
A vulnerability allowing for privileged escalation of the viewer account to gain administrator privileges.
- 7.4CVE-2026-12963EPSS 0.2%
A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server.
- 8.4CVE-2026-12389EPSS 0.4%
A vulnerability that could lead to a high privileged authenticated user performing a remote code execution attack.
- 5.9CVE-2026-119273EPSS 0.2%
The BulletProof Security WordPress plugin through 7.2 does not sufficiently protect its security log files or prevent sensitive authentication material from being written to them, relying on access controls that are not enforced under all …
- 5.5CVE-2026-110516EPSS 0.3%
The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users wi…
- 6.8CVE-2026-104676EPSS 0.2%
The Zion Builder WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before storing them in a publicly accessible location and serving them from the site's own origin, allowing authenticated use…
- 5.3CVE-2026-96769EPSS 0.2%
The Extend B2B - Companies and Users Management for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the register_company_api. This makes it possible for unaut…
- 7.3CVE-2026-92864EPSS 0.1%
Insecure Temporary File Vulnerability in Hitachi Dynamic Link Manager for AIX (for markets outside Japan) and Hitachi Dynamic Link Manager EX for AIX (for the Japanese market). This issue affects Hitachi Dynamic Link Manager for AIX: from…
- 7.0CVE-2026-92863EPSS 0.09%
Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for AIX (for the Japanese market). This issue affects Hitachi Dynamic Link Manager for AIX: before 9.0.4-01.
- 8.1CVE-2026-91764EPSS 0.1%
Improper Link Resolution Before File Access Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 6.1.1.-00 before 9.0.5-00.
- 8.2CVE-2026-91763EPSS 0.1%
UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 8.6.2.-00 before 9.0.5-00.
- 7.9CVE-2026-91762EPSS 0.1%
UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 8.5.3.-00 before 9.0.5-00.
- 8.2CVE-2026-91761EPSS 0.2%
UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 8.6.2.-00 before 9.0.5-00.
- 7.0CVE-2026-91760EPSS 0.10%
Heap-based Buffer Overflow Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00.