Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-13 03:43Z
2026-03-25
2026-03-25 18:16Z
HIGH

CVE-2026-30587 — Seafile Seafile_server: Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-30587

Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows authenticated remote attackers to inject malicious JavaScript payloads via the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags CVSSv3.1 8.7 (HIGH) · EPSS 18th percentile

CWECWE 79VNDStoredVNDSeafileTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-03-25
2026-03-25 18:16Z
HIGH

CVE-2025-67030 — Codehaus-plexus Plexus-utils: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67030

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code CVSSv3.1 8.8 (HIGH) · EPSS 50th percentile

CWECWE 22VNDCodehaus PlexusTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-03-25
2026-03-25 17:17Z
CRIT

CVE-2026-32573 — Control: Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32573

Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue affects Nelio AB Testing: from n/a through <= 8.2.7. CVSSv3.1 9.1 (CRITICAL) · EPSS 18th percentile

CWECWE 94TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-03-25
2026-03-25 17:17Z
CRIT

CVE-2026-32539 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32539

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Revisions revisionary allows Blind SQL Injection.This issue affects PublishPress Revisions: from n/a through <= 3.7.23. CVSSv3.1 9.3 (CRITICAL) · EPSS 12th percentile

CWECWE 89TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-03-25
2026-03-25 17:17Z
CRIT

CVE-2026-32536 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in halfdata Green Downloads halfdata-paypal-green-downloads allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32536

Unrestricted Upload of File with Dangerous Type vulnerability in halfdata Green Downloads halfdata-paypal-green-downloads allows Using Malicious Files.This issue affects Green Downloads: from n/a through <= 2.08. CVSSv3.1 9.9 (CRITICAL) · EPSS 15th percentile

CWECWE 434TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-03-25
2026-03-25 17:17Z
HIGH

CVE-2026-32534 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32534

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through <= 3.0.3. CVSSv3.1 8.5 (HIGH) · EPSS 10th percentile

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-03-25
2026-03-25 17:17Z
HIGH

CVE-2026-32531 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32531

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kunco kunco allows PHP Local File Inclusion.This issue affects Kunco: from n/a through < 1.4.5. CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-03-25
2026-03-25 17:17Z
HIGH

CVE-2026-32530 — Incorrect: Privilege Assignment vulnerability in WPFunnels Creator LMS creatorlms allows Privilege Escalation.This issue affects

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32530

Incorrect Privilege Assignment vulnerability in WPFunnels Creator LMS creatorlms allows Privilege Escalation.This issue affects Creator LMS: from n/a through <= 1.1.18. CVSSv3.1 8.8 (HIGH) · EPSS 13th percentile

CWECWE 266TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-03-25
2026-03-25 17:17Z
CRIT

CVE-2026-32525 — Control: Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters JetFormBuilder jetformbuilder allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32525

Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through <= 3.5.6.1. CVSSv3.1 9.9 (CRITICAL) · EPSS 17th percentile

CWECWE 94TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-03-25
2026-03-25 17:17Z
CRIT

CVE-2026-32524 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow Photo Engine wplr-sync

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32524

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow Photo Engine wplr-sync allows Upload a Web Shell to a Web Server.This issue affects Photo Engine: from n/a through <= 6.4.9. CVSSv3.1 9.1 (CRITICAL) · EPSS 16th percentile

CWECWE 434TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-03-25
2026-03-25 17:17Z
CRIT

CVE-2026-32523 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in denishua WPJAM Basic wpjam-basic allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32523

Unrestricted Upload of File with Dangerous Type vulnerability in denishua WPJAM Basic wpjam-basic allows Using Malicious Files.This issue affects WPJAM Basic: from n/a through <= 6.9.2. CVSSv3.1 9.9 (CRITICAL) · EPSS 15th percentile

CWECWE 434TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-03-25
2026-03-25 17:17Z
HIGH

CVE-2026-32522 — Limitation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32522

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish WooCommerce Support Ticket System woocommerce-support-ticket-system allows Path Traversal.This issue affects WooCommerce Support Ticket System: from n/a through < 18.5. CVSSv3.1 8.6 (HIGH) · EPSS 20th percentile

CWECWE 22TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-03-25
2026-03-25 17:17Z
CRIT

CVE-2026-32520 — Incorrect: Privilege Assignment vulnerability in Andrew Munro / AffiliateWP RewardsWP rewardswp allows Privilege Escalation.This

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32520

Incorrect Privilege Assignment vulnerability in Andrew Munro / AffiliateWP RewardsWP rewardswp allows Privilege Escalation.This issue affects RewardsWP: from n/a through <= 1.0.4. CVSSv3.1 9.8 (CRITICAL) · EPSS 17th percentile

CWECWE 266TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-25
2026-03-25 17:17Z
CRIT

CVE-2026-32519 — Incorrect: Privilege Assignment vulnerability in Bit Apps Bit SMTP bit-smtp allows Privilege Escalation.This issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32519

Incorrect Privilege Assignment vulnerability in Bit Apps Bit SMTP bit-smtp allows Privilege Escalation.This issue affects Bit SMTP: from n/a through <= 1.2.2. CVSSv3.1 9.0 (CRITICAL) · EPSS 17th percentile

CWECWE 266TYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2026-03-25
2026-03-25 17:17Z
HIGH

CVE-2026-32516 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32516

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Blind SQL Injection.This issue affects Miraculous Core Plugin: from n/a through < 2.1.2. CVSSv3.1 8.5 (HIGH) · EPSS 10th percentile

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-03-25
2026-03-25 17:17Z
HIGH

CVE-2026-32513 — Deserialization: of Untrusted Data vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows Object

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32513

Deserialization of Untrusted Data vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows Object Injection.This issue affects JS Archive List: from n/a through <= 6.1.7. CVSSv3.1 8.8 (HIGH) · EPSS 17th percentile

CWECWE 502TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-03-25
2026-03-25 17:17Z
CRIT

CVE-2026-32512 — Deserialization: of Untrusted Data vulnerability in Edge-Themes Pelicula pelicula-video-production-and-movie-theme allows Object Injection.This issue affects

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32512

Deserialization of Untrusted Data vulnerability in Edge-Themes Pelicula pelicula-video-production-and-movie-theme allows Object Injection.This issue affects Pelicula: from n/a through < 1.10. CVSSv3.1 9.8 (CRITICAL) · EPSS 17th percentile

CWECWE 502TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-25
2026-03-25 17:17Z
HIGH

CVE-2026-32505 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32505

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS Kiddy kiddy allows PHP Local File Inclusion.This issue affects Kiddy: from n/a through <= 2.0.8. CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-03-25
2026-03-25 17:17Z
HIGH

CVE-2026-32504 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32504

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS VintWood vintwood allows PHP Local File Inclusion.This issue affects VintWood: from n/a through <= 1.1.8. CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-03-25
2026-03-25 17:17Z
HIGH

CVE-2026-32503 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32503

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS Trendustry trendustry allows PHP Local File Inclusion.This issue affects Trendustry: from n/a through <= 1.1.4. CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-03-25
2026-03-25 17:17Z
CRIT

CVE-2026-32502 — Deserialization: of Untrusted Data vulnerability in Select-Themes Borgholm borgholm-marketing-agency-theme allows Object Injection.This issue affects

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32502

Deserialization of Untrusted Data vulnerability in Select-Themes Borgholm borgholm-marketing-agency-theme allows Object Injection.This issue affects Borgholm: from n/a through < 1.6. CVSSv3.1 9.8 (CRITICAL) · EPSS 17th percentile

CWECWE 502TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-25
2026-03-25 17:17Z
HIGH

CVE-2026-32500 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32500

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS MetaMax metamax allows PHP Local File Inclusion.This issue affects MetaMax: from n/a through <= 1.1.4. CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-03-25
2026-03-25 17:17Z
CRIT

CVE-2026-32499 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32499

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuantumCloud ChatBot chatbot allows Blind SQL Injection.This issue affects ChatBot: from n/a through <= 7.7.9. CVSSv3.1 9.3 (CRITICAL) · EPSS 12th percentile

CWECWE 89TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-03-25
2026-03-25 17:16Z
HIGH

CVE-2026-32488 — Incorrect: Privilege Assignment vulnerability in wpeverest User Registration user-registration allows Privilege Escalation.This issue affects

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32488

Incorrect Privilege Assignment vulnerability in wpeverest User Registration user-registration allows Privilege Escalation.This issue affects User Registration: from n/a through <= 4.4.9. CVSSv3.1 8.1 (HIGH) · EPSS 17th percentile

CWECWE 266TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-03-25
2026-03-25 17:16Z
HIGH

CVE-2026-32484 — Deserialization: of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32484

Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through <= 1.6.26. CVSSv3.1 8.8 (HIGH) · EPSS 17th percentile

CWECWE 502TYPVulnerability
8.8
CVSS v3.1
94
Edit Score