🔥 Trending CVEs - Last 30 Days

This vulnerability in Key Systems Inc Global Facilities Management Software allows remote attackers to access sensitive information through the sid qu...

This stored cross-site scripting (XSS) vulnerability in the PixelYourSite WordPress plugin allows attackers to inject malicious scripts that execute w...

This DOM-based cross-site scripting (XSS) vulnerability in the PhotoMe WordPress theme allows attackers to inject malicious scripts into web pages vie...

This vulnerability allows attackers to inject malicious scripts into web pages generated by the Grand Conference WordPress theme. When users visit a s...

This is a reflected cross-site scripting (XSS) vulnerability in the Link Whisper Free WordPress plugin. Attackers can inject malicious scripts via cra...

This vulnerability allows attackers to inject malicious scripts into web pages through the Visitor Maps Extended Referer Field WordPress plugin. When ...

This vulnerability allows attackers to inject malicious scripts into web pages generated by the Diamond WordPress theme, which are then executed in vi...

This CVE describes a missing authorization vulnerability in the WooCommerce Bulk Product Editor plugin that allows attackers to exploit incorrectly co...

This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users through DOM-based cross-site scripting (XSS) in t...

This stored cross-site scripting (XSS) vulnerability in the NEX-Forms WordPress plugin allows attackers to inject malicious scripts into web pages tha...

This vulnerability allows attackers to inject malicious scripts into web pages generated by the NEX-Forms WordPress plugin. When users visit a special...

This vulnerability allows attackers to inject malicious scripts into web pages generated by the GhostPool Aardvark WordPress theme. When users visit a...

This CVE describes a reflected cross-site scripting (XSS) vulnerability in the WordPress Simple Archive Generator plugin. Attackers can inject malicio...

This reflected cross-site scripting (XSS) vulnerability in the Membee Login WordPress plugin allows attackers to inject malicious scripts into web pag...

This vulnerability allows attackers to inject malicious scripts into web pages generated by the Asynchronous Javascript WordPress plugin. When users v...

This vulnerability allows attackers to inject malicious scripts into the amr cron manager WordPress plugin, which are then reflected back to users' br...

This CVE describes a reflected cross-site scripting (XSS) vulnerability in the Widget Logic Visual WordPress plugin. Attackers can inject malicious sc...

This is a reflected cross-site scripting (XSS) vulnerability in the Crocoblock JetEngine WordPress plugin. It allows attackers to inject malicious scr...

This Cross-Site Scripting (XSS) vulnerability in the RealMag777 GMap Targeting WordPress plugin allows attackers to inject malicious scripts into web ...

This vulnerability allows attackers to inject malicious scripts into web pages generated by the Educare WordPress plugin. When users visit a specially...

This is a reflected cross-site scripting (XSS) vulnerability in the FluentCart WordPress plugin. Attackers can inject malicious scripts via crafted UR...

This is a reflected cross-site scripting (XSS) vulnerability in the WP Wizard Cloak WordPress plugin that allows attackers to inject malicious scripts...

This stored cross-site scripting (XSS) vulnerability in the WordPress Easy Taxonomy Images plugin allows attackers to inject malicious scripts into we...

CVE-2026-26960 is a path traversal vulnerability in node-tar that allows attackers to create hardlinks pointing outside the extraction directory when ...

This CVE describes a Missing Authorization vulnerability in CMSMasters Content Composer WordPress plugin that allows attackers to bypass access contro...

StorageGRID versions with Single Sign-on enabled and configured to use Microsoft Entra ID are vulnerable to Server-Side Request Forgery (SSRF). This a...

IBM Db2 databases running vulnerable versions are susceptible to XML external entity injection (XXE) attacks when processing XML data. This allows rem...

This CVE describes a privacy vulnerability in Apple operating systems where an app could potentially identify what other apps a user has installed, ex...

This CVE describes a sandbox escape vulnerability in multiple Apple operating systems where an app can bypass its security restrictions. It affects us...

This vulnerability allows applications to bypass certain privacy preferences on Apple operating systems, potentially accessing sensitive user data wit...

This CVE describes an out-of-bounds memory access vulnerability in Apple's media file processing across multiple operating systems. Attackers can craf...

CVE-2026-25999 is an improper access control vulnerability in Klaw (Apache Kafka management portal) that allows unauthorized users to reset or delete ...

A local privilege escalation vulnerability in Fortinet FortiClient for Windows allows low-privileged attackers to write arbitrary files with elevated ...

CVE-2025-11142 is an OS command injection vulnerability in Axis camera VAPIX API's mediaclip.cgi endpoint that allows authenticated attackers with ope...

This vulnerability in UltraVNC 1.6.4.0 on Windows involves an uncontrolled search path weakness in cryptbase.dll that could allow local attackers to e...

This vulnerability allows local attackers to escalate privileges on TensorFlow installations by exploiting an insecure plugin loading mechanism. Attac...

A Use After Free vulnerability in Apache Arrow C++ allows memory corruption when reading Arrow IPC files with pre-buffering enabled. This affects C++ ...

This CVE describes a DLL hijacking vulnerability in Flos Freeware Notepad2 versions 4.2.22 through 4.2.25. Attackers can exploit uncontrolled search p...

This vulnerability in Unidocs ezPDF DRM Reader and ezPDF Reader allows local attackers to exploit an uncontrolled search path issue in SHFOLDER.dll, p...

A race condition vulnerability in Apple operating systems allows malicious applications to potentially gain root privileges. This affects users runnin...

A path traversal vulnerability in BusyBox's archive extraction utilities allows attackers to create malicious archives that, when extracted under spec...

CVE-2026-21508 is an improper authentication vulnerability in Windows Storage that allows authenticated attackers to elevate privileges locally. This ...

This vulnerability involves a use-after-free flaw in the Windows Mailslot File System that allows an authenticated attacker to execute arbitrary code ...

This vulnerability is a use-after-free flaw in Windows Ancillary Function Driver for WinSock that allows an authenticated attacker to execute arbitrar...

A race condition vulnerability in Windows Subsystem for Linux allows authenticated local attackers to escalate privileges by exploiting improper synch...

This vulnerability in Artifex MuPDF on Windows allows local attackers to exploit an uncontrolled search path issue in the get_system_dpi function. Att...