CVEs published February 19, 2026
389 CVEs were published on February 19, 2026: 26 critical, 78 high. Browse them by severity, product and exploitation status.
- Published
- 389
- Critical
- 26
- High
- 78
- Medium
- 275
- Low
- 10
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 126
Most affected products
- Comodo Dome Firewall
- 29
- openclaw
- 19
- GFI Software MailEssentials AI
- 18
- SPIP
- 10
- Dell Unisphere for PowerMax · Dell PowerMax
- 5
- NesterSoft WorkTime
- 5
- Dell PowerProtect Data Manager
- 4
- gogs · gogs.io/gogs
- 4
- go-ethereum · github.com/ethereum/go-ethereum
- 3
- Hyland Alfresco Transformation Service · Hyland Alfresco Co…
- 3
Critical 26
- CVE-2026-27476RustFly 2.0.0 Command Injection via UDP Remote ControlBixat RustFly
- CVE-2026-27475SPIP < 4.4.9 Insecure DeserializationSPIP
- CVE-2026-2409Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delinea Cloud Suite allows Argument…Delinea Cloud Suite
- CVE-2026-26339Hyland Alfresco Transformation Service Argument Injection RCEHyland Alfresco Transformation Service · Hyland Alfresco Co…
- CVE-2026-26030Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code executionmicrosoft semantic-kernel · semantic-kernel
- CVE-2026-24834Kata Container to Guest micro VM privilege escalationkata-containers · github.com/kata-containers/kata-container…
- CVE-2026-26016Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorizationpterodactyl panel · pterodactyl/panel
- CVE-2025-71243SPIP Saisies Plugin < 5.11.1 Remote Code ExecutionSPIP Saisies pour formulaire
- CVE-2025-9953SQLi in Database Software's Databank Accreditation SoftwareDATABASE Software Training Consulting Databank Accreditatio…
- CVE-2025-8350Authentication Bypass with Redirect in BiEticaret Software's BiEticaret CMSInrove Software and Internet Services BiEticaret CMS
- CVE-2025-15559Unauthenticated OS Command Injection in NesterSoft WorkTimeNesterSoft WorkTime
- CVE-2025-13590Authenticated arbitrary file upload via a System REST API requiring administrator permission.WSO2 API Manager · WSO2 API Control Plane +4
- CVE-2026-23549WordPress WpEvently plugin <= 5.1.1 - PHP Object Injection vulnerabilitymagepeopleteam WpEvently
- CVE-2026-23542WordPress Grand Restaurant theme <= 7.0.10 - PHP Object Injection vulnerabilityThemeGoods Grand Restaurant
- CVE-2026-1994s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeoverclavaque s2Member – Excellent for All Kinds of Memberships,…
- CVE-2026-2731Unauthenticated RCE in Dynamicweb 9 and Dynamicweb 8DynamicWeb
- CVE-2025-13851Buyent Theme (with Buyent Classified Plugin) <= 1.0.7 - Unauthenticated Privilege Escalation via User Registrationscriptsbundle Buyent
- CVE-2026-0926Prodigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]prodigycommerce Prodigy Commerce
- CVE-2025-13563Lizza LMS Pro <= 1.0.3 - Unauthenticated Privilege EscalationBuddhaThemes Lizza LMS Pro
- CVE-2026-1405Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Uploadfranchidesign Slider Future
- CVE-2025-15586OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw which if exploited can…OpenGamePanel OGP-Website
- CVE-2025-12882Clasifico Listing <= 2.0 - Unauthenticated Privilege EscalationSmartDataSoft Clasifico Listing
- CVE-2026-2686SECCN Dingcheng G10 session_login.cgi qq os command injectionSECCN Dingcheng G10
- CVE-2025-55853SoftVision webPDF before 10.0.2 is vulnerable to Server-Side Request Forgery (SSRF).
- CVE-2025-67304In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user.
- CVE-2025-67305In RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user.
High 78
- CVE-2026-26959ADB Explorer Vulnerable to RCE via Insufficient Input ValidationAlex4SSB ADB-Explorer
- CVE-2026-27002OpenClaw: Docker container escape via unvalidated bind mount config injectionopenclaw
- CVE-2026-27001OpenClaw: Unsanitized CWD path injection into LLM promptsopenclaw
- CVE-2026-26329OpenClaw has a path traversal in browser upload allows local file readopenclaw
- CVE-2026-26327OpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinningopenclaw
- CVE-2026-26325OpenClaw Node host system.run rawCommand/command mismatch can bypass allowlist/approvalsopenclaw
- CVE-2026-26324OpenClaw has a SSRF guard bypass via full-form IPv4-mapped IPv6 (loopback / metadata reachable)openclaw
- CVE-2026-26323OpenClaw has a command injection in maintainer clawtributors updateropenclaw
- CVE-2025-9208Stored-XSS vulnerability discovered in OpenText WSM Management Server.OpenText™ Web Site Management Server
- CVE-2025-13672Reflected Cross-Site Scripting discovered in OpenText WSM Management Server.OpenText™ Web Site Management Server
- CVE-2026-26322OpenClaw Gateway tool allowed unrestricted gatewayUrl overrideopenclaw
- CVE-2026-26321OpenClaw has a local file disclosure via sendMediaFeishu in Feishu extensionopenclaw
- CVE-2026-26320OpenClaw macOS deep link confirmation truncation can conceal executed agent messageopenclaw
- CVE-2025-8054Path Traversal vulnerability have been discovered in OpenText™ XM Fax.OpenText™ XM Fax
- CVE-2026-21535Microsoft Teams Information Disclosure VulnerabilityMicrosoft Teams
- CVE-2026-26319OpenClaw has Missing Webhook Authentication in Telnyx Provider Allowing Unauthenticated Requestsopenclaw
- CVE-2026-26317OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpointsopenclaw · clawdbot
- CVE-2026-26316OpenClaw has BlueBubbles webhook auth bypass via loopback proxy trustopenclaw · @openclaw/bluebubbles
- CVE-2026-26275httpsig-hyper has Improper Digest Verification that May Allow Message Integrity Bypassjunkurihara httpsig-rs · httpsig-hyper
- CVE-2026-26314Go Ethereum affected by DoS via malicious p2p messagego-ethereum · github.com/ethereum/go-ethereum
- CVE-2026-26286SillyTavern has Server-Side Request Forgery (SSRF) via Asset Download Endpoint that Allows Reading Internal ServicesSillyTavern
- CVE-2026-27343WordPress Airtifact theme <= 1.2.91 - Local File Inclusion vulnerabilityVanKarWai Airtifact
- CVE-2026-26318systeminformation has Command Injection via Unsanitized `locate` Output in `versions()`sebhildebrandt systeminformation · systeminformation
- CVE-2026-26280Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry pathsebhildebrandt systeminformation · systeminformation
- CVE-2026-26278fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)NaturalIntelligence fast-xml-parser · fast-xml-parser
Show all 78 entriesShow fewer entries
- CVE-2026-27013Fabric.js Affected by Stored XSS via SVG Exportfabricjs fabric.js · fabric
- CVE-2026-26267rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collidestellar rs-soroban-sdk · soroban-sdk-macros
- CVE-2026-26205opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`open-policy-agent opa-envoy-plugin · github.com/open-policy…
- CVE-2026-26202Penpot has Arbitrary File Read via create-font-variant RPC endpointpenpot
- CVE-2026-26201emp3r0r Affected by Concurrent Map Access DoS (panic/crash)jm33-m0 emp3r0r · github.com/jm33-m0/emp3r0r/core
- CVE-2026-26200HDF5 Affected by H5T__conv_struct_opt Heap Buffer OverflowHDFGroup hdf5
- CVE-2026-26193Open WebUI vulnerable to Stored XSS via iFrame embeds in response messagesopen-webui
- CVE-2026-26192Open WebUI vulnerable to Stored XSS via iFrame in citations modelopen-webui
- CVE-2026-26063CediPay Affected by Improper Input Validation in Payment Processingxpertforextradeinc CediPay · cedipay-core
- CVE-2026-26337Hyland Alfresco Transformation Service Absolute Path Traversal Arbitrary File Read and SSRFHyland Alfresco Transformation Service · Hyland Alfresco Co…
- CVE-2026-2232Product Table and List Builder for WooCommerce Lite <= 4.6.2 - Unauthenticated Time-Based SQL Injection via 'search' Parameterwcproducttable Product Table and List Builder for WooCommer…
- CVE-2026-1581wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injectiontomdever wpForo Forum
- CVE-2026-26336Hyland Alfresco Improper Authorization Arbitrary File ReadHyland Alfresco Enterprise · Hyland Alfresco Community
- CVE-2026-25998strongMan vulnerable to private credential recovery due to key and counter reusestrongswan strongMan
- CVE-2026-25940jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)parallax jsPDF · jspdf
- CVE-2026-26345SPIP < 4.4.8 Cross-Site Scripting in Public AreaSPIP
- CVE-2026-2274Arbitrary File Read and SSRF in Google AppSheetAppSheet Web
- CVE-2026-25755jsPDF has PDF Object Injection via Unsanitized Input in addJS Methodparallax jsPDF · jspdf
- CVE-2026-25535jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensionsparallax jsPDF · jspdf
- CVE-2025-9062IDOR in MeCODE Informatics' EnvantyMeCODE Informatics and Engineering Services Envanty
- CVE-2025-15561Local Privilege Escalation in NesterSoft WorkTimeNesterSoft WorkTime
- CVE-2025-15560SQL Injection in NesterSoft WorkTimeNesterSoft WorkTime
- CVE-2025-12107Server-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code ExecutionWSO2 Identity Server
- CVE-2026-22267Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability.Dell PowerProtect Data Manager
- CVE-2026-26358Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability.Dell Unisphere for PowerMax · Dell PowerMax
- CVE-2026-26360Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability.Dell Unisphere for PowerMax · Dell PowerMax
- CVE-2026-26359Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability.Dell Unisphere for PowerMax · Dell PowerMax
- CVE-2026-27052WordPress Sales Countdown Timer for WooCommerce and WordPress plugin < 1.1.9 - Local File Inclusion vulnerabilityvillatheme Sales Countdown Timer for WooCommerce and WordPr…
- CVE-2026-25418WordPress Bit Form plugin <= 2.21.10 - SQL Injection vulnerabilityBit Apps Bit Form
- CVE-2026-25378WordPress Nelio AB Testing plugin <= 8.2.4 - SQL Injection vulnerabilityNelio Software Nelio AB Testing
- CVE-2026-25326WordPress CMSMasters Content Composer plugin <= 1.4.5 - Local File Inclusion vulnerabilityCMSMasters Content Composer
- CVE-2026-25316WordPress CartFlows plugin <= 2.1.19 - PHP Object Injection vulnerabilityBrainstorm Force CartFlows
- CVE-2026-23805WordPress Media Search Enhanced plugin <= 0.9.1 - SQL Injection vulnerabilityYoren Chang Media Search Enhanced
- CVE-2026-23803WordPress Smart Auto Upload Images plugin <= 1.2.2 - Server Side Request Forgery (SSRF) vulnerabilityBurhan Nasir Smart Auto Upload Images
- CVE-2026-23547WordPress CMSMasters Content Composer plugin <= 2.5.8 - Broken Access Control vulnerabilityCMSMasters Content Composer
- CVE-2026-23544WordPress Valenti theme <= 5.6.3.5 - PHP Object Injection vulnerabilitycodetipi Valenti
- CVE-2026-23541WordPress Mail Mint plugin <= 1.19.4 - Broken Access Control vulnerabilityWPFunnels Mail Mint
- CVE-2026-22333WordPress YITH WooCommerce Compare plugin <= 3.6.0 - Deserialization of untrusted data vulnerabilityYITHEMES YITH WooCommerce Compare
- CVE-2026-26362Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability.Dell Unisphere for PowerMax · Dell PowerMax
- CVE-2025-14452WP Customer Reviews <= 3.7.5 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameterbompus WP Customer Reviews
- CVE-2026-0974Orderable <= 1.20.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin InstallationOrderable – Restaurant & Food Ordering System
- CVE-2025-13603WP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Read via .htaccess Manipulationhusainali52 WP AUDIO GALLERY
- CVE-2025-4521IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via…themeatelier IDonate – Blood Donation, Request And Donor Ma…
- CVE-2025-12975CTX Feed – WooCommerce Product Feed Manager <= 6.6.11 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installationwahid0003 Product Feed Manager for WooCommerce – CTX Feed –…
- CVE-2026-0912Toret Manager <= 1.2.7 - Authenticated (Subscriber+) Arbitrary Options Update via AJAX actionsToret Manager
- CVE-2025-15041BackWPup <= 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Updatewp_media BackWPup – WordPress Backup & Restore Plugin
- CVE-2025-12845Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated…essekia Tablesome Table – Contact Form DB – WPForms, CF7, G…
- CVE-2025-12821NewsBlogger <= 0.2.5.6 - 0.2.5.9 - Cross-Site Request Forgery to Arbitrary Plugin Installationspicethemes NewsBlogger
- CVE-2025-12707Library Management System <= 3.2.1 - Unauthenticated SQL Injectionowthub Library Management System
- CVE-2025-11754Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.1.2…wplegalpages Cookie Banner for GDPR / CCPA – WPLP Cookie Co…
- CVE-2026-25474OpenClaw has a Telegram webhook request forgery (missing `channels.telegram.webhookSecret`) → auth bypassopenclaw
- CVE-2026-25232Gogs has a Protected Branch Deletion Bypass in Web Interfacegogs · gogs.io/gogs
- CVE-2025-4960macOS Local Privilege Escalation via Improper Authorization Handling in EPSON Printer Controller InstallerEPSON Printer Controller Installer
Medium, low and unrated 285
- CVE-2026-26964Windmill Exposes Workspace Slack OAuth Client Secrets to Non-Admin Workspace Memberswindmill-labs windmill
- CVE-2026-26963Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabledcilium · github.com/cilium/cilium
- CVE-2026-27009OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injectionopenclaw
- CVE-2026-27008OpenClaw hardened the skill download target directory validationopenclaw
- CVE-2026-27007OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreationopenclaw
- CVE-2026-27004OpenClaw session tool visibility hardening and Telegram webhook secret fallbackopenclaw
- CVE-2026-27003OpenClaw: Telegram bot token exposure via logsopenclaw
- CVE-2026-2350Tanium addressed an insertion of sensitive information into log file vulnerability in Interact and TDS.Tanium Interact · Tanium TDS
- CVE-2026-1292Tanium addressed an insertion of sensitive information into log file vulnerability in Trends.Tanium Trends
- CVE-2026-2605Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS.Tanium TanOS
- CVE-2026-2408Use-after-free in Cloud WorkloadsTanium Cloud Workloads
- CVE-2026-2435ASSET-7706Tanium Asset
- CVE-2026-26972OpenClaw has a Path Traversal in Browser Download Functionalityopenclaw
- CVE-2026-26328OpenClaw iMessage group allowlist authorization inherited DM pairing-store identitiesopenclaw · clawdbot
- CVE-2026-26958filippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identityFiloSottile filippo.io/edwards25519 · filippo.io/edwards255…
- CVE-2026-26326OpenClaw skills.status could leak secrets to operator.read clientsopenclaw
- CVE-2026-26953Pi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Tablepi-hole web
- CVE-2026-26952Pi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag Attributepi-hole web
- CVE-2026-1658Content spoofing vulnerability discovered in OpenText™ Directory ServicesOpenText™ Directory Services
- CVE-2025-13671Cross Site request forgery vulnerability discovered in OpenText WSM Management Server.OpenText™ Web Site Management Server
- CVE-2026-24122Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlookedsigstore cosign · github.com/sigstore/cosign +2
- CVE-2025-8055SSRF vulnerability have been discovered in OpenText™ XM FaxOpenText™ XM Fax
- CVE-2026-26315Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshakego-ethereum · github.com/ethereum/go-ethereum
- CVE-2026-26313Go Ethereum affected by DoS via malicious p2p messagego-ethereum · github.com/ethereum/go-ethereum
- CVE-2026-26312Stalwart Mail Server has Out-of-Memory Denial of Service via Malformed Nested MIME Messagesstalwartlabs stalwart
Show all 285 entriesShow fewer entries
- CVE-2026-27114NanaZip has ROMFS Archive Infinite LoopM2Team NanaZip
- CVE-2026-27014NanZip has ROMFS Archive Infinite Loop / Stack OverflowM2Team NanaZip
- CVE-2026-26282NanaZip has DotNet Single file OOB Heap ReadM2Team NanaZip
- CVE-2026-27440WordPress myCred plugin <= 2.9.7.6 - Cross Site Scripting (XSS) vulnerabilitySaad Iqbal myCred
- CVE-2026-27387WordPress DirectoryPress plugin <= 3.6.26 - Broken Access Control vulnerabilityDesigninvento DirectoryPress
- CVE-2026-27368WordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin <= 6.19.8 - Broken Access Control vulnerabilityComing Soon Page, Under Construction & Maintenance Mode by…
- CVE-2026-27360WordPress Photo Gallery by 10Web plugin <= 1.8.38 - Cross Site Scripting (XSS) vulnerabilityPhoto Gallery by 10Web
- CVE-2026-27328WordPress EduBlink theme <= 2.0.7 - Broken Access Control vulnerabilityDevsBlink EduBlink
- CVE-2026-27327WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerabilityYayCommerce YayMail
- GHSA-8QM3-746X-R74Rdevalue `uneval`ed code can create objects with polluted prototypes when `eval`eddevalue
- CVE-2026-2738Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote…OpenVPN ovpn-dco-win
- CVE-2026-26203PJSIP's pjmedia-video has use-after-free in H264 packetizer when packetizing fragmented NALpjsip pjmedia-video
- CVE-2026-26189Trivy Action has a script injection via sourced env file in composite actionaquasecurity trivy-action · aquasecurity/trivy-action
- CVE-2026-26059ChurchCRM has Stored Cross-Site Scripting (XSS) in GroupEditor.phpChurchCRM CRM
- CVE-2026-26057Skill Scanner Unsecured Network Binding Vulnerabilitycisco-ai-defense skill-scanner · cisco-ai-skill-scanner
- CVE-2026-27474SPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix)SPIP
- CVE-2026-27473SPIP < 4.4.9 Stored Cross-Site Scripting via Syndicated SitesSPIP
- CVE-2026-27472SPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated SitesSPIP
- CVE-2026-23621GFI MailEssentials AI < 22.4 ListServer.IsPathExist() Absolute Directory Traversal to File EnumerationGFI Software MailEssentials AI
- CVE-2026-23620GFI MailEssentials AI < 22.4 ListServer.IsDBExist() Absolute Directory Traversal to File EnumerationGFI Software MailEssentials AI
- CVE-2026-23619GFI MailEssentials AI < 22.4 General Settings Local Domains Domain Description Stored XSSGFI Software MailEssentials AI
- CVE-2026-23618GFI MailEssentials AI < 22.4 Anti-Spam Spam Keyword Checking Subject Condition Stored XSSGFI Software MailEssentials AI
- CVE-2026-23617GFI MailEssentials AI < 22.4 Anti-Spam Spam Keyword Checking Body Condition Stored XSSGFI Software MailEssentials AI
- CVE-2026-23616GFI MailEssentials AI < 22.4 Anti-Spam Anti-Spoofing Description Stored XSSGFI Software MailEssentials AI
- CVE-2026-23615GFI MailEssentials AI < 22.4 Anti-Spam Sender Policy Framework Email Exceptions Description Stored XSSGFI Software MailEssentials AI
- CVE-2026-23614GFI MailEssentials AI < 22.4 Anti-Spam Sender Policy Framework IP Exceptions Description Stored XSSGFI Software MailEssentials AI
- CVE-2026-23613GFI MailEssentials AI < 22.4 Anti-Spam URI DNS Blocklist Domain Stored XSSGFI Software MailEssentials AI
- CVE-2026-23612GFI MailEssentials AI < 22.4 Anti-Spam IP DNS Blocklist Domain Stored XSSGFI Software MailEssentials AI
- CVE-2026-23611GFI MailEssentials AI < 22.4 Anti-Spam IP Blocklist Description Stored XSSGFI Software MailEssentials AI
- CVE-2026-23610GFI MailEssentials AI < 22.4 POP2Exchange POP3 Server Login Stored XSSGFI Software MailEssentials AI
- CVE-2026-23609GFI MailEssentials AI < 22.4 General Settings Perimeter SMTP Servers Description Stored XSSGFI Software MailEssentials AI
- CVE-2026-23608GFI MailEssentials AI < 22.4 Email Management Mail Monitoring Rule Stored XSSGFI Software MailEssentials AI
- CVE-2026-23607GFI MailEssentials AI < 22.4 Anti-Spam Whitelist Description Stored XSSGFI Software MailEssentials AI
- CVE-2026-23606GFI MailEssentials AI < 22.4 Advanced Content Filtering Rule Stored XSSGFI Software MailEssentials AI
- CVE-2026-23605GFI MailEssentials AI < 22.4 Attachment Filtering Rule Stored XSSGFI Software MailEssentials AI
- CVE-2026-23604GFI MailEssentials AI < 22.4 Keyword Filtering Rule Stored XSSGFI Software MailEssentials AI
- CVE-2026-2243Qemu-kvm: heap buffer out-of-bounds read in vmdk compressed grain parsingqemu · Red Hat Enterprise Linux +1
- CVE-2026-2817Spring Data Geode Insecure Temporary Directory UsageVMware Spring Data Geode · VMware Spring Data Gemfire
- CVE-2026-26338Hyland Alfresco Transformation Service SSRFHyland Alfresco Transformation Service · Hyland Alfresco Co…
- CVE-2026-25766Echo has a Windows path traversal via backslash in middleware.Static default filesystemlabstack echo · github.com/labstack/echo/v5
- CVE-2026-25739Indico affected by Cross-Site-Scripting via material uploadsindico
- CVE-2026-25738Indico has Server-Side Request Forgery (SSRF) in multiple placesindico
- CVE-2026-26223SPIP < 4.4.8 Cross-Site Scripting via Iframe Tags in Private AreaSPIP
- CVE-2025-71244SPIP < 4.4.5 Open Redirect via Login FormSPIP
- CVE-2025-71242SPIP < 4.3.6 Authorization Bypass Leading to Content DisclosureSPIP
- CVE-2025-71241SPIP < 4.3.6 Cross-Site Scripting in Private AreaSPIP
- CVE-2025-71240SPIP < 4.2.15 Cross-Site Scripting via Code TagsSPIP
- CVE-2026-25527changedetection.io vulnerable to unauthenticated static path traversaldgtlmoon changedetection.io · changedetection-io
- CVE-2019-25430Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via vpn_usersComodo Dome Firewall
- CVE-2019-25429Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via openvpn_advancedComodo Dome Firewall
- CVE-2019-25428Comodo Dome Firewall 2.7.0 Cross-Site Scripting via openvpn_usersComodo Dome Firewall
- CVE-2019-25427Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via antispywareComodo Dome Firewall
- CVE-2019-25426Comodo Dome Firewall 2.7.0 Cross-Site Scripting via dnsmasqComodo Dome Firewall
- CVE-2019-25425Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via smtpconfigComodo Dome Firewall
- CVE-2019-25424Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via https_exceptionsComodo Dome Firewall
- CVE-2019-25423Comodo Dome Firewall 2.7.0 Cross-Site Scripting via proxyconfigComodo Dome Firewall
- CVE-2019-25422Comodo Dome Firewall 2.7.0 Cross-Site Scripting via vpnfwComodo Dome Firewall
- CVE-2019-25421Comodo Dome Firewall 2.7.0 Cross-Site Scripting via policyfwComodo Dome Firewall
- CVE-2019-25420Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via snatComodo Dome Firewall
- CVE-2019-25419Comodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via scheduleComodo Dome Firewall
- CVE-2019-25418Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via fwgroupsComodo Dome Firewall
- CVE-2019-25417Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via QoS RulesComodo Dome Firewall
- CVE-2019-25416Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via device ParameterComodo Dome Firewall
- CVE-2019-25415Comodo Dome Firewall 2.7.0 Cross-Site Scripting via hotspot_permanent_usersComodo Dome Firewall
- CVE-2019-25414Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via ID Parameter AppidComodo Dome Firewall
- CVE-2019-25413Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via ID ParameterComodo Dome Firewall
- CVE-2019-25412Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via NTP_SERVER_LISTComodo Dome Firewall
- CVE-2019-25411Comodo Dome Firewall 2.7.0 Cross-Site Scripting via DHCPComodo Dome Firewall
- CVE-2019-25410Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via policy_routingComodo Dome Firewall
- CVE-2019-25409Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via routingComodo Dome Firewall
- CVE-2019-25408Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via netwizard2Comodo Dome Firewall
- CVE-2019-25407Comodo Dome Firewall 2.7.0 Cross-Site Scripting via backupscheduleComodo Dome Firewall
- CVE-2019-25406Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via organization ParameterComodo Dome Firewall
- CVE-2019-25405Comodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via license_activationComodo Dome Firewall
- CVE-2019-25404Comodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via adminsComodo Dome Firewall
- CVE-2019-25403Comodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via admin_profilesComodo Dome Firewall
- CVE-2019-25402Comodo Dome Firewall 2.7.0 Cross-Site Scripting via loginComodo Dome Firewall
- CVE-2025-15563Broken Access Control results in Denial of Service in NesterSoft WorkTimeNesterSoft WorkTime
- CVE-2025-15562Reflected Cross-Site Scripting in NesterSoft WorkTimeNesterSoft WorkTime
- CVE-2026-1219MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to…MP3 Audio Player – Music Player, Podcast Player & Radio by…
- CVE-2026-2718Dealia <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block AttributesDealia – Request a quote
- CVE-2026-2716Client Testimonial Slider <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Testimonial Heading' Settingamu02aftab Client Testimonial Slider
- CVE-2026-1461Simple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Valueswpinsider-1 Simple Membership
- CVE-2026-22268Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability.Dell PowerProtect Data Manager
- CVE-2026-22266Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel…Dell PowerProtect Data Manager
- CVE-2026-22269Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel…Dell PowerProtect Data Manager
- CVE-2025-41023Authentication bypass in AutoGPT de ThesamurThesamur AutoGPT
- CVE-2025-40697Reflected Cross-Site Scripting (XSS) in Lewe WebMeasureLewe WebMeasure
- CVE-2026-2736Reflected Cross-Site Scripting (XSS) vulnerability in Alkacon's OpenCmsAlkacon OpenCms
- CVE-2026-2735Stored Cross-Site Scripting (XSS) vulnerability in Alkacon's OpenCmsAlkacon OpenCms
- CVE-2026-27094WordPress CoBlocks plugin <= 3.1.16 - Cross Site Scripting (XSS) vulnerabilityGoDaddy CoBlocks
- CVE-2026-27092WordPress WPAdverts plugin <= 2.3.0 - Broken Access Control vulnerabilityGreg Winiarski WPAdverts
- CVE-2026-27090WordPress Kenta Companion plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerabilityWP Moose Kenta Companion
- CVE-2026-27074WordPress Shortcoder plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerabilityvaakash Shortcoder
- CVE-2026-27069WordPress Soledad theme <= 8.7.2 - Cross Site Scripting (XSS) vulnerabilityPenciDesign Soledad
- CVE-2026-27059WordPress Penci Recipe plugin <= 4.1 - Cross Site Scripting (XSS) vulnerabilityPenciDesign Penci Recipe
- CVE-2026-27058WordPress Penci Podcast plugin <= 1.7 - Cross Site Scripting (XSS) vulnerabilityPenciDesign Penci Podcast
- CVE-2026-27057WordPress Penci Filter Everything plugin <= 1.7 - Cross Site Scripting (XSS) vulnerabilityPenciDesign Penci Filter Everything
- CVE-2026-27055WordPress Penci AI SmartContent Creator plugin <= 2.0 - Broken Access Control vulnerabilityPenciDesign Penci AI SmartContent Creator
- CVE-2026-27050WordPress RealPress plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) vulnerabilityThimPress RealPress
- CVE-2026-27042WordPress NotificationX plugin <= 3.2.1 - Broken Access Control vulnerabilityWPDeveloper NotificationX
- CVE-2026-25473WordPress WZone plugin <= 14.0.31 - Broken Access Control vulnerabilityAA-Team WZone
- CVE-2026-25472WordPress Fusion Builder plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerabilityThemeFusion Fusion Builder
- CVE-2026-25463WordPress Wpresidence Core plugin <= 5.4.0 - Cross Site Scripting (XSS) vulnerabilityWpEstate Wpresidence Core
- CVE-2026-25459WordPress Sober theme <= 3.5.12 - Broken Access Control vulnerabilityuixthemes Sober
- CVE-2026-25453WordPress Advanced iFrame plugin <= 2025.10 - Cross Site Scripting (XSS) vulnerabilitymdempfle Advanced iFrame
- CVE-2026-25451WordPress Bold Page Builder plugin <= 5.6.9 - Cross Site Scripting (XSS) vulnerabilityboldthemes Bold Page Builder
- CVE-2026-25441WordPress LeadConnector plugin <= 3.0.21 - Broken Access Control vulnerabilityvarunvairavanlc LeadConnector
- CVE-2026-25432WordPress Omnipress plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerabilityomnipressteam Omnipress
- CVE-2026-25428WordPress TS Poll plugin <= 2.5.5 - Server Side Request Forgery (SSRF) vulnerabilitytotalsoft TS Poll
- CVE-2026-25423WordPress Real 3D FlipBook plugin <= 4.19.1 - Broken Access Control vulnerabilitycreativeinteractivemedia Real 3D FlipBook
- CVE-2026-25422WordPress Popularis Extra plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) vulnerabilityThemes4WP Popularis Extra
- CVE-2026-25420WordPress MailerLite plugin <= 1.7.18 - Broken Access Control vulnerabilityMailerLite
- CVE-2026-25419WordPress UpsellWP plugin <= 2.2.5 - Broken Access Control vulnerabilityflycart UpsellWP
- CVE-2026-25416WordPress News Kit Elementor Addons plugin <= 1.4.2 - Broken Access Control vulnerabilityblazethemes News Kit Elementor Addons
- CVE-2026-25415WordPress WPBookit Pro plugin <= 1.6.18 - Broken Access Control vulnerabilityiqonicdesign WPBookit Pro
- CVE-2026-25411WordPress Revision Manager TMC plugin <= 2.8.22 - Cross Site Request Forgery (CSRF) vulnerabilitythemastercut Revision Manager TMC
- CVE-2026-25410WordPress WP-CORS plugin <= 0.2.2 - Broken Access Control vulnerabilitytstephenson WP-CORS
- CVE-2026-25409WordPress JAMstack Deployments plugin <= 1.1.1 - Broken Access Control vulnerabilitycrgeary JAMstack Deployments
- CVE-2026-25408WordPress Broken Link Notifier plugin <= 1.3.5 - Broken Access Control vulnerabilityPluginRx Broken Link Notifier
- CVE-2026-25407WordPress Cookiebot plugin <= 4.6.4 - Broken Access Control vulnerabilityCookiebot
- CVE-2026-25404WordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerabilityAutomattic WP Job Manager
- CVE-2026-25402WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 16.011.0 - Broken Access Control vulnerabilityechoplugins Knowledge Base for Documentation, FAQs with AI…
- CVE-2026-25399WordPress Serious Slider plugin <= 1.2.7 - Broken Access Control vulnerabilityCryoutCreations Serious Slider
- CVE-2026-25395WordPress Business Roy theme <= 1.1.4 - Broken Access Control vulnerabilityikreatethemes Business Roy
- CVE-2026-25394WordPress Fitness FSE theme <= 1.0.6 - Broken Access Control vulnerabilitysparklewpthemes Fitness FSE
- CVE-2026-25393WordPress Hello FSE theme <= 1.0.6 - Broken Access Control vulnerabilitysparklewpthemes Hello FSE
- CVE-2026-25392WordPress Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress plugin <= 1.4.0 - Open…KaizenCoders Update URLs – Quick and Easy way to search old…
- CVE-2026-25391WordPress WP Wand plugin <= 1.3.07 - Broken Access Control vulnerabilityWP Grids WP Wand
- CVE-2026-25389WordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerabilityMetagauss EventPrime
- CVE-2026-25388WordPress Ads Pro plugin <= 5.0 - Broken Access Control vulnerabilityscripteo Ads Pro
- CVE-2026-25387WordPress Image Optimizer by Elementor plugin <= 1.7.1 - Broken Access Control vulnerabilityImage Optimizer by Elementor
- CVE-2026-25386WordPress Ally plugin <= 4.0.2 - Broken Access Control vulnerabilityElementor Ally
- CVE-2026-25385WordPress URL Shortify plugin <= 1.12.3 - Server Side Request Forgery (SSRF) vulnerabilityKaizenCoders URL Shortify
- CVE-2026-25384WordPress WP-Lister Lite for eBay plugin <= 3.8.5 - Broken Access Control vulnerabilityWP Lab WP-Lister Lite for eBay
- CVE-2026-25375WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.10 - Broken Access Control vulnerabilityWP Chill Image Photo Gallery Final Tiles Grid
- CVE-2026-25374WordPress Spa and Salon theme <= 1.3.2 - Broken Access Control vulnerabilityraratheme Spa and Salon
- CVE-2026-25372WordPress Academy LMS plugin <= 3.5.3 - Broken Access Control vulnerabilityKodezen Academy LMS
- CVE-2026-25370WordPress WP Compress plugin <= 6.60.28 - Broken Access Control vulnerabilityAresIT WP Compress
- CVE-2026-25368WordPress Calculated Fields Form plugin <= 5.4.4.1 - Broken Access Control vulnerabilitycodepeople Calculated Fields Form
- CVE-2026-25367WordPress CitiLights theme < 3.7.2 - Broken Access Control vulnerabilityNooTheme CitiLights
- CVE-2026-25364WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.8 - Broken Access Control vulnerabilityBoldGrid Client Invoicing by Sprout Invoices
- CVE-2026-25363WordPress FooGallery plugin <= 3.1.11 - Broken Access Control vulnerabilityFooPlugins FooGallery
- CVE-2026-25362WordPress FooGallery plugin <= 3.1.11 - Cross Site Scripting (XSS) vulnerabilityFooPlugins FooGallery
- CVE-2026-25348WordPress Download Alt Text AI plugin <= 1.10.15 - Broken Access Control vulnerabilityalttextai Download Alt Text AI
- CVE-2026-25343WordPress WP SMS plugin <= 7.1 - Cross Site Scripting (XSS) vulnerabilityVeronaLabs WP SMS
- CVE-2026-25338WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.7.4 - Broken Access Control vulnerabilityAys Pro AI ChatBot with ChatGPT and Content Generator by AYS
- CVE-2026-25337WordPress Coachify theme <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerabilitywpcoachify Coachify
- CVE-2026-25336WordPress Coachify theme <= 1.1.5 - Broken Access Control vulnerabilitywpcoachify Coachify
- CVE-2026-25335WordPress Secure Copy Content Protection and Content Locking plugin <= 5.0.0 - Broken Access Control vulnerabilityAys Pro Secure Copy Content Protection and Content Locking
- CVE-2026-25333WordPress Shopwell theme <= 1.0.11 - Broken Access Control vulnerabilityperegrinethemes Shopwell
- CVE-2026-25332WordPress Endless Posts Navigation plugin <= 2.2.9 - Broken Access Control vulnerabilityFahad Mahmood Endless Posts Navigation
- CVE-2026-25331WordPress WP Activity Log plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerabilityMelapress WP Activity Log
- CVE-2026-25330WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerabilityPublishPress Authors
- CVE-2026-25329WordPress Quiz And Survey Master plugin <= 10.3.4 - Broken Access Control vulnerabilityExpressTech Systems Quiz And Survey Master
- CVE-2026-25325WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.8 - Sensitive Data Exposure vulnerabilityrtCamp rtMedia for WordPress, BuddyPress and bbPress
- CVE-2026-25324WordPress Quiz And Survey Master plugin <= 10.3.4 - Insecure Direct Object References (IDOR) vulnerabilityExpressTech Systems Quiz And Survey Master
- CVE-2026-25323WordPress OSM plugin <= 6.1.12 - Broken Access Control vulnerabilityMiKa OSM
- CVE-2026-25322WordPress PublishPress Revisions plugin <= 3.7.22 - Cross Site Request Forgery (CSRF) vulnerabilityPublishPress Revisions
- CVE-2026-25321WordPress SupportCandy plugin <= 3.4.4 - Broken Access Control vulnerabilityPSM Plugins SupportCandy
- CVE-2026-25320WordPress Elementor Contact Form DB plugin <= 2.1.3 - Broken Access Control vulnerabilityCool Plugins Elementor Contact Form DB
- CVE-2026-25319WordPress Zita Elementor Site Library plugin <= 1.6.6 - Cross Site Request Forgery (CSRF) vulnerabilitywpzita Zita Elementor Site Library
- CVE-2026-25318WordPress WiserReview Product Reviews for WooCommerce plugin <= 2.9 - Broken Access Control vulnerabilityWisernotify team WiserReview Product Reviews for WooCommerce
- CVE-2026-25315WordPress hCaptcha for WP plugin <= 4.21.1 - Broken Access Control vulnerabilityhCaptcha for WP
- CVE-2026-25314WordPress TOP Table Of Contents plugin <= 1.3.31 - Broken Access Control vulnerabilityWP Messiah TOP Table Of Contents
- CVE-2026-25313WordPress FluentForm plugin <= 6.1.14 - Broken Access Control vulnerabilityShahjahan Jewel FluentForm
- CVE-2026-25311WordPress Autoshare for Twitter plugin <= 2.3.1 - Broken Access Control vulnerability10up Autoshare for Twitter
- CVE-2026-25310WordPress Extend Link plugin <= 2.0.0 - Server Side Request Forgery (SSRF) vulnerabilityAlobaidi Extend Link
- CVE-2026-25308WordPress Simple Membership plugin <= 4.6.9 - Broken Access Control vulnerabilitywp.insider Simple Membership
- CVE-2026-25307WordPress XStore Core plugin < 5.7 - Cross Site Scripting (XSS) vulnerability8theme XStore Core
- CVE-2026-25305WordPress XStore theme <= 9.6.4 - Cross Site Scripting (XSS) vulnerability8theme XStore
- CVE-2026-25008WordPress Ninja Tables plugin <= 5.2.5 - Sensitive Data Exposure vulnerabilityShahjahan Jewel Ninja Tables
- CVE-2026-25006WordPress XStore theme <= 9.6.4 - Arbitrary Shortcode Execution vulnerability8theme XStore
- CVE-2026-25005WordPress Frontend File Manager plugin <= 23.5 - Insecure Direct Object References (IDOR) vulnerabilityN-Media Frontend File Manager
- CVE-2026-25004WordPress CM Business Directory plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerabilityCreativeMindsSolutions CM Business Directory
- CVE-2026-25003WordPress Client Portal plugin <= 1.2.1 - Broken Access Control vulnerabilitymadalin.ungureanu Client Portal
- CVE-2026-25000WordPress Wheel of Life plugin <= 1.2.0 - Broken Access Control vulnerabilityKraft Plugins Wheel of Life
- CVE-2026-24999WordPress Alma plugin <= 5.16.1 - Broken Access Control vulnerabilityAlma
- CVE-2026-24392WordPress HurryTimer plugin <= 2.14.2 - Cross Site Scripting (XSS) vulnerabilityNabil Lemsieh HurryTimer
- CVE-2026-24375WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.4 - Broken Access Control vulnerabilityWP Swings Ultimate Gift Cards For WooCommerce
- CVE-2026-23804WordPress Better Business Reviews plugin <= 0.1.1 - Broken Access Control vulnerabilityBBR Plugins Better Business Reviews
- CVE-2026-23548WordPress DirectoryPress plugin <= 3.6.25 - Broken Access Control vulnerabilityDesigninvento DirectoryPress
- CVE-2026-23545WordPress Aruba HiSpeed Cache plugin <= 3.0.4 - Broken Access Control vulnerabilityAruba.it Dev Aruba HiSpeed Cache
- CVE-2026-23543WordPress Essential Addons for Elementor plugin <= 6.5.5 - Broken Access Control vulnerabilityWPDeveloper Essential Addons for Elementor
- CVE-2026-22422WordPress Everest Forms plugin <= 3.4.1 - Arbitrary Shortcode Execution vulnerabilitywpeverest Everest Forms
- CVE-2026-27056WordPress iThemes Sync plugin <= 3.2.8 - Broken Access Control vulnerabilityStellarWP iThemes Sync
- CVE-2026-26361Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability.Dell Unisphere for PowerMax · Dell PowerMax
- CVE-2026-2733Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocolRed Hat build of Keycloak · Red Hat JBoss Enterprise App… +2
- CVE-2026-2711zhutoutoutousan worldquant-miner URL ssrf_proxy.py server-side request forgeryzhutoutoutousan worldquant-miner
- CVE-2026-2681Github.com/supranational/blst: blst cryptographic library: denial of service via out-of-bounds stack write in key generationblst
- CVE-2026-2709busy Callback app.js redirectbusy
- CVE-2026-2706code-projects Patient Record Management System fecalysis_not.php sql injectioncode-projects Patient Record Management System
- CVE-2026-2705Open Babel MOL2 File atom.h SetFormalCharge out-of-boundsOpen Babel · openbabel
- CVE-2026-1055TalkJS <= 0.1.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'welcomeMessage' ParameterTalkJS
- CVE-2026-0722Shield Security <= 21.0.8 - Cross-Site Request Forgery to SQL Injectionpaultgoodchild Shield: Blocks Bots, Protects Users, and Pre…
- CVE-2026-1373Easy Author Image <= 1.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Picture URLlawsonry Easy Author Image
- CVE-2026-2284News Element Elementor Blog Magazine <= 1.0.8 - Missing Authorization to Authenticated (Subscriber+) Data Losswebangon News Element Elementor Blog Magazine
- CVE-2026-1455Whatsiplus Scheduled Notification for Woocommerce <= 1.0.1 - Cross-Site Request Forgery to 'wsnfw_save_users_settings' AJAX ActionWhatsiplus Scheduled Notification for Woocommerce
- CVE-2025-14445Image Hotspot by DevVN <= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Metalevantoan Image Hotspot by DevVN
- CVE-2025-14357Mega Store Woocommerce <= 5.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation and Settings Changemisbahwp Mega Store Woocommerce
- CVE-2026-0561Shield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameterpaultgoodchild Shield: Blocks Bots, Protects Users, and Pre…
- CVE-2026-2504Dealia – Request a quote <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Plugin Configuration ResetDealia – Request a quote
- CVE-2025-14983Advanced Custom Fields: Font Awesome <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingmattkeys Advanced Custom Fields: Font Awesome Field
- CVE-2025-14167Remove Post Type Slug <= 1.0.2 - Cross-Site Request Forgery to Settings Updateakshayshah5189 Remove Post Type Slug
- CVE-2025-14270OneClick Chat to Order <= 1.0.9 - Missing Authorization to Authenticated (Editor+) Plugin Settings Updatewalterpinem OneClick Chat to Order
- CVE-2025-14851YaMaps for WordPress <= 0.6.40 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Parametersyhunter YaMaps for WordPress Plugin
- CVE-2026-1044Tennis Court Bookings <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings and Calendar Parametersrenoiriii Tennis Court Bookings
- CVE-2025-14427Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches <= 21.0.9 - Missing Authorization to Authenticated…paultgoodchild Shield: Blocks Bots, Protects Users, and Pre…
- CVE-2025-14864Virusdie <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) API Key DisclosureVirusdie – One-click website security
- CVE-2025-13091Shopire <= 1.0.57 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installwpfable Shopire
- CVE-2026-1043PostmarkApp Email Integrator <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settingsgagan0123 PostmarkApp Email Integrator
- CVE-2025-14076iXML – Google XML sitemap generator <= 0.6 - Reflected Cross-Site Scripting via 'iXML_email' Parametericount iXML – Google XML sitemap generator
- CVE-2025-14342SEO Plugin by Squirrly SEO <= 12.4.14 - Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnectioncifi SEO Plugin by Squirrly SEO
- CVE-2026-0549Groups <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcodeitthinx Groups
- CVE-2025-13738Easy Table of Contents <= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scriptingmagazine3 Easy Table of Contents
- CVE-2025-13438Page Title, Description & Open Graph Updater <= 1.02 - Cross-Site Request Forgery to Arbitrary Page Title Modificationdienodigital Page Title, Description & Open Graph Updater
- CVE-2026-0556XO Event Calendar <= 3.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xo_event_field' shortcodeishitaka XO Event Calendar
- CVE-2026-1047salavat counter Plugin <= 0.9.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'image_url' Parametergoback2 salavat counter Plugin
- CVE-2025-13842Breadcrumb NavXT <= 7.5.0 - Missing Authorization to Sensitive Information Exposuremtekk Breadcrumb NavXT
- CVE-2025-13864Breeze – WordPress Cache Plugin <= 2.2.21 - Missing Authorization to Cache Deletioncloudways Breeze Cache
- CVE-2025-13617Apollo13 Framework Extension <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via `a13_alt_link` Parameterapollo13themes Apollo13 Framework Extensions
- CVE-2026-2282Slidorion <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Slidorion Settingshollandben Slidorion
- CVE-2025-13612Album and Image Gallery Plus Lightbox <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcodeessentialplugin Album and Image Gallery Plus Lightbox
- CVE-2025-13930Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletionquadlayers Checkout Field Manager (Checkout Manager) for Wo…
- CVE-2026-1646Advance Block Extend <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleColor Block Attributeiamjaydip Advance Block Extend
- CVE-2025-14294Razorpay for WooCommerce <= 4.7.8 - Missing Authentication to Unauthenticated Order ModificationRazorpay for WooCommerce
- CVE-2025-13413Country Blocker for AdSense <= 1.0 - Cross-Site Request Forgery to Settings Updatesoyrodriguez Country Blocker for AdSense
- CVE-2025-13732s2Member <= 251005 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeclavaque s2Member – Excellent for All Kinds of Memberships,…
- CVE-2025-13587Two Factor (2FA) Authentication via Email <= 1.9.8 - Two-Factor Authentication Bypass via tokenss88_uk Two Factor (2FA) Authentication via Email
- CVE-2026-2502xmlrpc attacks blocker <= 1.0 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For'yehudah xmlrpc attacks blocker
- CVE-2026-2704Open Babel CIF File transform3d.cpp DescribeAsString out-of-boundsOpen Babel · openbabel
- CVE-2026-2703xlnt-community xlnt Encrypted XLSX File base64.cpp decode_base64 off-by-onexlnt-community xlnt
- CVE-2026-2702Beetel 777VR1 WPA2 PSK hard-coded credentialsBeetel 777VR1
- CVE-2025-12500Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.1 - Unauthenticated Limited File Uploadquadlayers Checkout Field Manager (Checkout Manager) for Wo…
- CVE-2025-12081ACF Photo Gallery Field <= 3.0 - Missing Authorization to Authenticated (Subscriber+) Attachment Metadata Modificationnavzme ACF Photo Gallery Field
- CVE-2025-13048Official StatCounter Plugin <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via NicknameStatCounter – Free Real Time Visitor Stats
- CVE-2025-12117Renden <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Titlethinkupthemes Renden
- CVE-2025-13113Web Accessibility by accessiBe <= 2.11 - Unauthenticated Sensitive Information Exposureaccessibewp Web Accessibility by accessiBe
- CVE-2025-12884Advanced Ads – Ad Manager & AdSense <= 2.0.14 - Missing Authorization to Authenticated (Subscriber+) Ad Placements Updatemonetizemore Advanced Ads – Ad Manager & AdSense
- CVE-2025-12116Drift <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Titlethinkupthemes Drift
- CVE-2025-13079Popup Builder - Create highly converting, mobile friendly marketing popups. <= 4.4.2 - Improper Authorization to Unauthenticated…popupbuilder Popup Builder – Create highly converting, mobi…
- CVE-2025-12375Printful Integration for WooCommerce <= 2.2.11 - Authenticated (Contributor+) Server-Side Request ForgeryPrintful Integration for WooCommerce
- CVE-2025-12451Easy SVG Support <= 4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadbenjamin_zekavica Easy SVG Support
- CVE-2025-12172Mailchimp List Subscribe Form <= 2.0.0 - Cross-Site Request Forgery to Mailchimp List ChangeMailchimp List Subscribe Form
- CVE-2025-11706Aruba HiSpeed Cache <= 3.0.2 - Reflected Cross-Site Scriptingarubadev Aruba HiSpeed Cache
- CVE-2025-12448Smartsupp – live chat, AI shopping assistant and chatbots <= 3.9.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingSmartsupp – live chat, AI shopping assistant and chatbots
- CVE-2025-11725Aruba HiSpeed Cache <= 3.0.2 - Missing Authorization to Unauthenticated Plugin's Settings Modificationarubadev Aruba HiSpeed Cache
- CVE-2025-12027Mesmerize Companion <= 1.6.158 - Missing Authorization Authenticated (Subscriber+) Settings Updatehorearadu Mesmerize Companion
- CVE-2026-25229Gogs Authorization Bypass Allows Cross-Repository Label Modificationgogs · gogs.io/gogs
- CVE-2026-2693CoCoTeaNet CyreneAdmin System Info Endpoint getCount improper authorizationCoCoTeaNet CyreneAdmin
- CVE-2026-25242Gogs allows unauthenticated file uploadsgogs · gogs.io/gogs
- CVE-2026-2692CoCoTeaNet CyreneAdmin Image getAvatar path traversalCoCoTeaNet CyreneAdmin
- CVE-2026-25120Gogs Allows Cross-Repository Comment Deletion via DeleteCommentgogs · gogs.io/gogs
- CVE-2026-2691itsourcecode Event Management System manage_register.php sql injectionitsourcecode Event Management System
- CVE-2026-24764OpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptionsclawdbot · openclaw
- CVE-2026-2690itsourcecode Event Management System Admin Login ajax.php sql injectionitsourcecode Event Management System
- CVE-2026-2689itsourcecode Event Management System manage_booking.php sql injectionitsourcecode Event Management System
- CVE-2025-69674Buffer Overflow vulnerability in CDATA FD614GS3-R850 V3.2.7_P161006 (Build.0333.250211) allows an attacker to execute arbitrary code via…
- CVE-2025-69725An Open Redirect vulnerability in the go-chi/chi >=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to…github.com/go-chi/chi · github.com/go-chi/chi/v2 +3
- CVE-2026-26744A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd…