# CVEs published 2026-02-19

388 CVEs were published on February 19, 2026: 26 critical, 78 high. Days are UTC.

- [CVE-2026-26964](https://cve.now/CVE-2026-26964.md): Windmill Exposes Workspace Slack OAuth Client Secrets to Non-Admin Workspace Members (CVSS 2.7, windmill-labs windmill)
- [CVE-2026-26963](https://cve.now/CVE-2026-26963.md): Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled (CVSS 6.1, cilium · github.com/cilium/cilium)
- [CVE-2026-27009](https://cve.now/CVE-2026-27009.md): OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection (CVSS 5.8, openclaw)
- [CVE-2026-27008](https://cve.now/CVE-2026-27008.md): OpenClaw hardened the skill download target directory validation (CVSS 6.8, openclaw)
- [CVE-2026-27007](https://cve.now/CVE-2026-27007.md): OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation (CVSS 4.8, openclaw)
- [CVE-2026-27004](https://cve.now/CVE-2026-27004.md): OpenClaw session tool visibility hardening and Telegram webhook secret fallback (CVSS 6.9, openclaw)
- [CVE-2026-26959](https://cve.now/CVE-2026-26959.md): ADB Explorer Vulnerable to RCE via Insufficient Input Validation (CVSS 7.8, Alex4SSB ADB-Explorer)
- [CVE-2026-27003](https://cve.now/CVE-2026-27003.md): OpenClaw: Telegram bot token exposure via logs (CVSS 6.9, openclaw)
- [CVE-2026-27002](https://cve.now/CVE-2026-27002.md): OpenClaw: Docker container escape via unvalidated bind mount config injection (CVSS 7.7, openclaw)
- [CVE-2026-2350](https://cve.now/CVE-2026-2350.md): Tanium addressed an insertion of sensitive information into log file vulnerability in Interact and TDS. (CVSS 6.5, Tanium Interact · Tanium TDS)
- [CVE-2026-1292](https://cve.now/CVE-2026-1292.md): Tanium addressed an insertion of sensitive information into log file vulnerability in Trends. (CVSS 6.5, Tanium Trends)
- [CVE-2026-27001](https://cve.now/CVE-2026-27001.md): OpenClaw: Unsanitized CWD path injection into LLM prompts (CVSS 8.6, openclaw)
- [CVE-2026-2605](https://cve.now/CVE-2026-2605.md): Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS. (CVSS 5.3, Tanium TanOS)
- [CVE-2026-2408](https://cve.now/CVE-2026-2408.md): Use-after-free in Cloud Workloads (CVSS 4.7, Tanium Cloud Workloads)
- [CVE-2026-2435](https://cve.now/CVE-2026-2435.md): ASSET-7706 (CVSS 6.3, Tanium Asset)
- [CVE-2026-26972](https://cve.now/CVE-2026-26972.md): OpenClaw has a Path Traversal in Browser Download Functionality (CVSS 6.7, openclaw)
- [CVE-2026-26329](https://cve.now/CVE-2026-26329.md): OpenClaw has a path traversal in browser upload allows local file read (CVSS 7.1, openclaw)
- [CVE-2026-26328](https://cve.now/CVE-2026-26328.md): OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities (CVSS 6.5, openclaw · clawdbot)
- [CVE-2026-26958](https://cve.now/CVE-2026-26958.md): filippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity (CVSS 1.7, FiloSottile filippo.io/edwards25519 · filippo.io/edwards255…)
- [CVE-2026-26327](https://cve.now/CVE-2026-26327.md): OpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinning (CVSS 7.1, openclaw)
- [CVE-2026-26326](https://cve.now/CVE-2026-26326.md): OpenClaw skills.status could leak secrets to operator.read clients (CVSS 5.3, openclaw)
- [CVE-2026-26325](https://cve.now/CVE-2026-26325.md): OpenClaw Node host system.run rawCommand/command mismatch can bypass allowlist/approvals (CVSS 7.2, openclaw)
- [CVE-2026-26953](https://cve.now/CVE-2026-26953.md): Pi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Table (CVSS 5.4, pi-hole web)
- [CVE-2026-26324](https://cve.now/CVE-2026-26324.md): OpenClaw has a SSRF guard bypass via full-form IPv4-mapped IPv6 (loopback / metadata reachable) (CVSS 7.5, openclaw)
- [CVE-2026-26323](https://cve.now/CVE-2026-26323.md): OpenClaw has a command injection in maintainer clawtributors updater (CVSS 8.6, openclaw)
- [CVE-2026-26952](https://cve.now/CVE-2026-26952.md): Pi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag Attribute (CVSS 5.4, pi-hole web)
- [CVE-2026-1658](https://cve.now/CVE-2026-1658.md): Content spoofing vulnerability discovered in OpenText™ Directory Services (CVSS 5.3, OpenText™ Directory Services)
- [CVE-2025-9208](https://cve.now/CVE-2025-9208.md): Stored-XSS vulnerability discovered in OpenText WSM Management Server. (CVSS 7.5, OpenText™ Web Site Management Server)
- [CVE-2025-13671](https://cve.now/CVE-2025-13671.md): Cross Site request forgery vulnerability discovered in OpenText WSM Management Server. (CVSS 5.9, OpenText™ Web Site Management Server)
- [CVE-2025-13672](https://cve.now/CVE-2025-13672.md): Reflected Cross-Site Scripting discovered in OpenText WSM Management Server. (CVSS 7.0, OpenText™ Web Site Management Server)
- [CVE-2026-26322](https://cve.now/CVE-2026-26322.md): OpenClaw Gateway tool allowed unrestricted gatewayUrl override (CVSS 7.6, openclaw)
- [CVE-2026-26321](https://cve.now/CVE-2026-26321.md): OpenClaw has a local file disclosure via sendMediaFeishu in Feishu extension (CVSS 7.5, openclaw)
- [CVE-2026-24122](https://cve.now/CVE-2026-24122.md): Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked (CVSS 3.7, sigstore cosign · github.com/sigstore/cosign +2)
- [CVE-2026-26320](https://cve.now/CVE-2026-26320.md): OpenClaw macOS deep link confirmation truncation can conceal executed agent message (CVSS 7.1, openclaw)
- [CVE-2025-8054](https://cve.now/CVE-2025-8054.md): Path Traversal vulnerability have been discovered in OpenText™ XM Fax. (CVSS 7.1, OpenText™ XM Fax)
- [CVE-2025-8055](https://cve.now/CVE-2025-8055.md): SSRF vulnerability have been discovered in OpenText™ XM Fax (CVSS 5.3, OpenText™ XM Fax)
- [CVE-2026-21535](https://cve.now/CVE-2026-21535.md): Microsoft Teams Information Disclosure Vulnerability (CVSS 8.2, Microsoft Teams)
- [CVE-2026-26319](https://cve.now/CVE-2026-26319.md): OpenClaw has Missing Webhook Authentication in Telnyx Provider Allowing Unauthenticated Requests (CVSS 7.5, openclaw)
- [CVE-2026-26317](https://cve.now/CVE-2026-26317.md): OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints (CVSS 7.1, openclaw · clawdbot)
- [CVE-2026-26316](https://cve.now/CVE-2026-26316.md): OpenClaw has BlueBubbles webhook auth bypass via loopback proxy trust (CVSS 7.5, openclaw · @openclaw/bluebubbles)
- [CVE-2026-26275](https://cve.now/CVE-2026-26275.md): httpsig-hyper has Improper Digest Verification that May Allow Message Integrity Bypass (CVSS 7.5, junkurihara httpsig-rs · httpsig-hyper)
- [CVE-2026-26315](https://cve.now/CVE-2026-26315.md): Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake (CVSS 6.9, go-ethereum · github.com/ethereum/go-ethereum)
- [CVE-2026-26314](https://cve.now/CVE-2026-26314.md): Go Ethereum affected by DoS via malicious p2p message (CVSS 8.7, go-ethereum · github.com/ethereum/go-ethereum)
- [CVE-2026-26313](https://cve.now/CVE-2026-26313.md): Go Ethereum affected by DoS via malicious p2p message (CVSS 6.9, go-ethereum · github.com/ethereum/go-ethereum)
- [CVE-2026-26312](https://cve.now/CVE-2026-26312.md): Stalwart Mail Server has Out-of-Memory Denial of Service via Malformed Nested MIME Messages (CVSS 6.5, stalwartlabs stalwart)
- [CVE-2026-26286](https://cve.now/CVE-2026-26286.md): SillyTavern has Server-Side Request Forgery (SSRF) via Asset Download Endpoint that Allows Reading Internal Services (CVSS 7.1, SillyTavern)
- [CVE-2026-27114](https://cve.now/CVE-2026-27114.md): NanaZip has ROMFS Archive Infinite Loop (CVSS 5.1, M2Team NanaZip)
- [CVE-2026-27014](https://cve.now/CVE-2026-27014.md): NanZip has ROMFS Archive Infinite Loop / Stack Overflow (CVSS 5.1, M2Team NanaZip)
- [CVE-2026-27476](https://cve.now/CVE-2026-27476.md): RustFly 2.0.0 Command Injection via UDP Remote Control (CVSS 9.3, Bixat RustFly)
- [CVE-2026-26282](https://cve.now/CVE-2026-26282.md): NanaZip has DotNet Single file OOB Heap Read (CVSS 5.2, M2Team NanaZip)
- [CVE-2026-27440](https://cve.now/CVE-2026-27440.md): WordPress myCred plugin \<= 2.9.7.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Saad Iqbal myCred)
- [CVE-2026-27387](https://cve.now/CVE-2026-27387.md): WordPress DirectoryPress plugin \<= 3.6.26 - Broken Access Control vulnerability (CVSS 5.4, Designinvento DirectoryPress)
- [CVE-2026-27368](https://cve.now/CVE-2026-27368.md): WordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin \<= 6.19.8 - Broken Access Control vulnerability (CVSS 5.3, Coming Soon Page, Under Construction & Maintenance Mode by…)
- [CVE-2026-27360](https://cve.now/CVE-2026-27360.md): WordPress Photo Gallery by 10Web plugin \<= 1.8.38 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Photo Gallery by 10Web)
- [CVE-2026-27343](https://cve.now/CVE-2026-27343.md): WordPress Airtifact theme \<= 1.2.91 - Local File Inclusion vulnerability (CVSS 7.5, VanKarWai Airtifact)
- [CVE-2026-27328](https://cve.now/CVE-2026-27328.md): WordPress EduBlink theme \<= 2.0.7 - Broken Access Control vulnerability (CVSS 5.3, DevsBlink EduBlink)
- [CVE-2026-27327](https://cve.now/CVE-2026-27327.md): WordPress YayMail – WooCommerce Email Customizer plugin \<= 4.3.2 - Broken Access Control vulnerability (CVSS 4.3, YayCommerce YayMail)
- [CVE-2026-2738](https://cve.now/CVE-2026-2738.md): Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peer (CVSS 5.6, OpenVPN ovpn-dco-win)
- [CVE-2026-26318](https://cve.now/CVE-2026-26318.md): systeminformation has Command Injection via Unsanitized \`locate\` Output in \`versions()\` (CVSS 8.8, sebhildebrandt systeminformation · systeminformation)
- [CVE-2026-26280](https://cve.now/CVE-2026-26280.md): Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path (CVSS 8.4, sebhildebrandt systeminformation · systeminformation)
- [CVE-2026-26278](https://cve.now/CVE-2026-26278.md): fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) (CVSS 7.5, NaturalIntelligence fast-xml-parser · fast-xml-parser)
- [CVE-2026-27013](https://cve.now/CVE-2026-27013.md): Fabric.js Affected by Stored XSS via SVG Export (CVSS 7.6, fabricjs fabric.js · fabric)
- [CVE-2026-26267](https://cve.now/CVE-2026-26267.md): rs-soroban-sdk #\[contractimpl\] macro calls inherent function instead of trait function when names collide (CVSS 7.5, stellar rs-soroban-sdk · soroban-sdk-macros)
- [CVE-2026-26205](https://cve.now/CVE-2026-26205.md): opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in \`input.parsed\_path\` (CVSS 7.1, open-policy-agent opa-envoy-plugin · github.com/open-policy…)
- [CVE-2026-26203](https://cve.now/CVE-2026-26203.md): PJSIP's pjmedia-video has use-after-free in H264 packetizer when packetizing fragmented NAL (CVSS 5.1, pjsip pjmedia-video)
- [CVE-2026-26202](https://cve.now/CVE-2026-26202.md): Penpot has Arbitrary File Read via create-font-variant RPC endpoint (CVSS 7.5, penpot)
- [CVE-2026-26201](https://cve.now/CVE-2026-26201.md): emp3r0r Affected by Concurrent Map Access DoS (panic/crash) (CVSS 7.0, jm33-m0 emp3r0r · github.com/jm33-m0/emp3r0r/core)
- [CVE-2026-26200](https://cve.now/CVE-2026-26200.md): HDF5 Affected by H5T\_\_conv\_struct\_opt Heap Buffer Overflow (CVSS 7.8, HDFGroup hdf5)
- [CVE-2026-26193](https://cve.now/CVE-2026-26193.md): Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages (CVSS 7.3, open-webui)
- [CVE-2026-26192](https://cve.now/CVE-2026-26192.md): Open WebUI vulnerable to Stored XSS via iFrame in citations model (CVSS 7.3, open-webui)
- [CVE-2026-26189](https://cve.now/CVE-2026-26189.md): Trivy Action has a script injection via sourced env file in composite action (CVSS 5.9, aquasecurity trivy-action)
- [CVE-2026-26063](https://cve.now/CVE-2026-26063.md): CediPay Affected by Improper Input Validation in Payment Processing (CVSS 8.8, xpertforextradeinc CediPay · cedipay-core)
- [CVE-2026-26059](https://cve.now/CVE-2026-26059.md): ChurchCRM has Stored Cross-Site Scripting (XSS) in GroupEditor.php (CVSS 2.1, ChurchCRM CRM)
- [CVE-2026-26057](https://cve.now/CVE-2026-26057.md): Skill Scanner Unsecured Network Binding Vulnerability (CVSS 6.5, cisco-ai-defense skill-scanner · cisco-ai-skill-scanner)
- [CVE-2026-27475](https://cve.now/CVE-2026-27475.md): SPIP \< 4.4.9 Insecure Deserialization (CVSS 9.2, SPIP)
- [CVE-2026-27474](https://cve.now/CVE-2026-27474.md): SPIP \< 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix) (CVSS 4.8, SPIP)
- [CVE-2026-27473](https://cve.now/CVE-2026-27473.md): SPIP \< 4.4.9 Stored Cross-Site Scripting via Syndicated Sites (CVSS 5.1, SPIP)
- [CVE-2026-27472](https://cve.now/CVE-2026-27472.md): SPIP \< 4.4.9 Blind Server-Side Request Forgery via Syndicated Sites (CVSS 5.3, SPIP)
- [CVE-2026-23621](https://cve.now/CVE-2026-23621.md): GFI MailEssentials AI \< 22.4 ListServer.IsPathExist() Absolute Directory Traversal to File Enumeration (CVSS 5.3, GFI Software MailEssentials AI)
- [CVE-2026-23620](https://cve.now/CVE-2026-23620.md): GFI MailEssentials AI \< 22.4 ListServer.IsDBExist() Absolute Directory Traversal to File Enumeration (CVSS 5.3, GFI Software MailEssentials AI)
- [CVE-2026-23619](https://cve.now/CVE-2026-23619.md): GFI MailEssentials AI \< 22.4 General Settings Local Domains Domain Description Stored XSS (CVSS 5.1, GFI Software MailEssentials AI)
- [CVE-2026-23618](https://cve.now/CVE-2026-23618.md): GFI MailEssentials AI \< 22.4 Anti-Spam Spam Keyword Checking Subject Condition Stored XSS (CVSS 5.1, GFI Software MailEssentials AI)
- [CVE-2026-23617](https://cve.now/CVE-2026-23617.md): GFI MailEssentials AI \< 22.4 Anti-Spam Spam Keyword Checking Body Condition Stored XSS (CVSS 5.1, GFI Software MailEssentials AI)
- [CVE-2026-23616](https://cve.now/CVE-2026-23616.md): GFI MailEssentials AI \< 22.4 Anti-Spam Anti-Spoofing Description Stored XSS (CVSS 5.1, GFI Software MailEssentials AI)
- [CVE-2026-23615](https://cve.now/CVE-2026-23615.md): GFI MailEssentials AI \< 22.4 Anti-Spam Sender Policy Framework Email Exceptions Description Stored XSS (CVSS 5.1, GFI Software MailEssentials AI)
- [CVE-2026-23614](https://cve.now/CVE-2026-23614.md): GFI MailEssentials AI \< 22.4 Anti-Spam Sender Policy Framework IP Exceptions Description Stored XSS (CVSS 5.1, GFI Software MailEssentials AI)
- [CVE-2026-23613](https://cve.now/CVE-2026-23613.md): GFI MailEssentials AI \< 22.4 Anti-Spam URI DNS Blocklist Domain Stored XSS (CVSS 5.1, GFI Software MailEssentials AI)
- [CVE-2026-23612](https://cve.now/CVE-2026-23612.md): GFI MailEssentials AI \< 22.4 Anti-Spam IP DNS Blocklist Domain Stored XSS (CVSS 5.1, GFI Software MailEssentials AI)
- [CVE-2026-23611](https://cve.now/CVE-2026-23611.md): GFI MailEssentials AI \< 22.4 Anti-Spam IP Blocklist Description Stored XSS (CVSS 5.1, GFI Software MailEssentials AI)
- [CVE-2026-23610](https://cve.now/CVE-2026-23610.md): GFI MailEssentials AI \< 22.4 POP2Exchange POP3 Server Login Stored XSS (CVSS 5.1, GFI Software MailEssentials AI)
- [CVE-2026-23609](https://cve.now/CVE-2026-23609.md): GFI MailEssentials AI \< 22.4 General Settings Perimeter SMTP Servers Description Stored XSS (CVSS 5.1, GFI Software MailEssentials AI)
- [CVE-2026-23608](https://cve.now/CVE-2026-23608.md): GFI MailEssentials AI \< 22.4 Email Management Mail Monitoring Rule Stored XSS (CVSS 5.1, GFI Software MailEssentials AI)
- [CVE-2026-23607](https://cve.now/CVE-2026-23607.md): GFI MailEssentials AI \< 22.4 Anti-Spam Whitelist Description Stored XSS (CVSS 5.1, GFI Software MailEssentials AI)
- [CVE-2026-23606](https://cve.now/CVE-2026-23606.md): GFI MailEssentials AI \< 22.4 Advanced Content Filtering Rule Stored XSS (CVSS 5.1, GFI Software MailEssentials AI)
- [CVE-2026-2409](https://cve.now/CVE-2026-2409.md): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delinea Cloud Suite allows Argument In (CVSS 9.3, Delinea Cloud Suite)
- [CVE-2026-23605](https://cve.now/CVE-2026-23605.md): GFI MailEssentials AI \< 22.4 Attachment Filtering Rule Stored XSS (CVSS 5.1, GFI Software MailEssentials AI)
- [CVE-2026-23604](https://cve.now/CVE-2026-23604.md): GFI MailEssentials AI \< 22.4 Keyword Filtering Rule Stored XSS (CVSS 5.1, GFI Software MailEssentials AI)
- [CVE-2026-2243](https://cve.now/CVE-2026-2243.md): Qemu-kvm: heap buffer out-of-bounds read in vmdk compressed grain parsing (CVSS 5.1, qemu · Red Hat Enterprise Linux +1)
- [CVE-2026-2817](https://cve.now/CVE-2026-2817.md): Spring Data Geode Insecure Temporary Directory Usage (CVSS 4.4, VMware Spring Data Geode · VMware Spring Data Gemfire)
- [CVE-2026-26339](https://cve.now/CVE-2026-26339.md): Hyland Alfresco Transformation Service Argument Injection RCE (CVSS 9.3, Hyland Alfresco Transformation Service · Hyland Alfresco Co…)
- [CVE-2026-26338](https://cve.now/CVE-2026-26338.md): Hyland Alfresco Transformation Service SSRF (CVSS 6.9, Hyland Alfresco Transformation Service · Hyland Alfresco Co…)
- [CVE-2026-26337](https://cve.now/CVE-2026-26337.md): Hyland Alfresco Transformation Service Absolute Path Traversal Arbitrary File Read and SSRF (CVSS 8.8, Hyland Alfresco Transformation Service · Hyland Alfresco Co…)
- [CVE-2026-2232](https://cve.now/CVE-2026-2232.md): Product Table and List Builder for WooCommerce Lite \<= 4.6.2 - Unauthenticated Time-Based SQL Injection via 'search' Parameter (CVSS 7.5, wcproducttable Product Table and List Builder for WooCommer…)
- [CVE-2026-1581](https://cve.now/CVE-2026-1581.md): wpForo Forum \<= 2.4.14 - Unauthenticated Time-Based SQL Injection (CVSS 7.5, tomdever wpForo Forum)
- [CVE-2026-26030](https://cve.now/CVE-2026-26030.md): Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution (CVSS 10.0, microsoft semantic-kernel · semantic-kernel)
- [CVE-2026-24834](https://cve.now/CVE-2026-24834.md): Kata Container to Guest micro VM privilege escalation (CVSS 9.4, kata-containers · github.com/kata-containers/kata-container…)
- [CVE-2026-26336](https://cve.now/CVE-2026-26336.md): Hyland Alfresco Improper Authorization Arbitrary File Read (CVSS 8.7, Hyland Alfresco Enterprise · Hyland Alfresco Community)
- [CVE-2026-26016](https://cve.now/CVE-2026-26016.md): Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization (CVSS 9.2, pterodactyl panel · pterodactyl/panel)
- [CVE-2026-25998](https://cve.now/CVE-2026-25998.md): strongMan vulnerable to private credential recovery due to key and counter reuse (CVSS 8.7, strongswan strongMan)
- [CVE-2026-25766](https://cve.now/CVE-2026-25766.md): Echo has a Windows path traversal via backslash in middleware.Static default filesystem (CVSS 5.3, labstack echo · github.com/labstack/echo/v5)
- [CVE-2026-25739](https://cve.now/CVE-2026-25739.md): Indico affected by Cross-Site-Scripting via material uploads (CVSS 5.4, indico)
- [CVE-2026-25738](https://cve.now/CVE-2026-25738.md): Indico has Server-Side Request Forgery (SSRF) in multiple places (CVSS 6.9, indico)
- [CVE-2026-25940](https://cve.now/CVE-2026-25940.md): jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property) (CVSS 8.1, parallax jsPDF · jspdf)
- [CVE-2026-26223](https://cve.now/CVE-2026-26223.md): SPIP \< 4.4.8 Cross-Site Scripting via Iframe Tags in Private Area (CVSS 5.1, SPIP)
- [CVE-2026-26345](https://cve.now/CVE-2026-26345.md): SPIP \< 4.4.8 Cross-Site Scripting in Public Area (CVSS 8.6, SPIP)
- [CVE-2026-2274](https://cve.now/CVE-2026-2274.md): Arbitrary File Read and SSRF in Google AppSheet (CVSS 8.5, AppSheet Web)
- [CVE-2025-71244](https://cve.now/CVE-2025-71244.md): SPIP \< 4.4.5 Open Redirect via Login Form (CVSS 5.1, SPIP)
- [CVE-2025-71243](https://cve.now/CVE-2025-71243.md): SPIP Saisies Plugin \< 5.11.1 Remote Code Execution (CVSS 9.3, SPIP Saisies pour formulaire)
- [CVE-2025-71242](https://cve.now/CVE-2025-71242.md): SPIP \< 4.3.6 Authorization Bypass Leading to Content Disclosure (CVSS 5.3, SPIP)
- [CVE-2025-71241](https://cve.now/CVE-2025-71241.md): SPIP \< 4.3.6 Cross-Site Scripting in Private Area (CVSS 4.8, SPIP)
- [CVE-2025-71240](https://cve.now/CVE-2025-71240.md): SPIP \< 4.2.15 Cross-Site Scripting via Code Tags (CVSS 4.8, SPIP)
- [CVE-2026-25755](https://cve.now/CVE-2026-25755.md): jsPDF has PDF Object Injection via Unsanitized Input in addJS Method (CVSS 8.1, parallax jsPDF · jspdf)
- [CVE-2026-25535](https://cve.now/CVE-2026-25535.md): jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions (CVSS 8.7, parallax jsPDF · jspdf)
- [CVE-2026-25527](https://cve.now/CVE-2026-25527.md): changedetection.io vulnerable to unauthenticated static path traversal (CVSS 5.3, dgtlmoon changedetection.io · changedetection-io)
- [CVE-2019-25430](https://cve.now/CVE-2019-25430.md): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via vpn\_users (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25429](https://cve.now/CVE-2019-25429.md): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via openvpn\_advanced (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25428](https://cve.now/CVE-2019-25428.md): Comodo Dome Firewall 2.7.0 Cross-Site Scripting via openvpn\_users (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25427](https://cve.now/CVE-2019-25427.md): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via antispyware (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25426](https://cve.now/CVE-2019-25426.md): Comodo Dome Firewall 2.7.0 Cross-Site Scripting via dnsmasq (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25425](https://cve.now/CVE-2019-25425.md): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via smtpconfig (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25424](https://cve.now/CVE-2019-25424.md): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via https\_exceptions (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25423](https://cve.now/CVE-2019-25423.md): Comodo Dome Firewall 2.7.0 Cross-Site Scripting via proxyconfig (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25422](https://cve.now/CVE-2019-25422.md): Comodo Dome Firewall 2.7.0 Cross-Site Scripting via vpnfw (CVSS 5.3, Comodo Dome Firewall)
- [CVE-2019-25421](https://cve.now/CVE-2019-25421.md): Comodo Dome Firewall 2.7.0 Cross-Site Scripting via policyfw (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25420](https://cve.now/CVE-2019-25420.md): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via snat (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25419](https://cve.now/CVE-2019-25419.md): Comodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via schedule (CVSS 5.3, Comodo Dome Firewall)
- [CVE-2019-25418](https://cve.now/CVE-2019-25418.md): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via fwgroups (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25417](https://cve.now/CVE-2019-25417.md): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via QoS Rules (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25416](https://cve.now/CVE-2019-25416.md): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via device Parameter (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25415](https://cve.now/CVE-2019-25415.md): Comodo Dome Firewall 2.7.0 Cross-Site Scripting via hotspot\_permanent\_users (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25414](https://cve.now/CVE-2019-25414.md): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via ID Parameter Appid (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25413](https://cve.now/CVE-2019-25413.md): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via ID Parameter (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25412](https://cve.now/CVE-2019-25412.md): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via NTP\_SERVER\_LIST (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25411](https://cve.now/CVE-2019-25411.md): Comodo Dome Firewall 2.7.0 Cross-Site Scripting via DHCP (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25410](https://cve.now/CVE-2019-25410.md): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via policy\_routing (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25409](https://cve.now/CVE-2019-25409.md): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via routing (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25408](https://cve.now/CVE-2019-25408.md): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via netwizard2 (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25407](https://cve.now/CVE-2019-25407.md): Comodo Dome Firewall 2.7.0 Cross-Site Scripting via backupschedule (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25406](https://cve.now/CVE-2019-25406.md): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via organization Parameter (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25405](https://cve.now/CVE-2019-25405.md): Comodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via license\_activation (CVSS 5.3, Comodo Dome Firewall)
- [CVE-2019-25404](https://cve.now/CVE-2019-25404.md): Comodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via admins (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25403](https://cve.now/CVE-2019-25403.md): Comodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via admin\_profiles (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2019-25402](https://cve.now/CVE-2019-25402.md): Comodo Dome Firewall 2.7.0 Cross-Site Scripting via login (CVSS 5.1, Comodo Dome Firewall)
- [CVE-2025-9953](https://cve.now/CVE-2025-9953.md): SQLi in Database Software's Databank Accreditation Software (CVSS 9.8, DATABASE Software Training Consulting Databank Accreditatio…)
- [CVE-2025-8350](https://cve.now/CVE-2025-8350.md): Authentication Bypass with Redirect in BiEticaret Software's BiEticaret CMS (CVSS 9.8, Inrove Software and Internet Services BiEticaret CMS)
- [CVE-2025-15563](https://cve.now/CVE-2025-15563.md): Broken Access Control results in Denial of Service in NesterSoft WorkTime (CVSS 5.3, NesterSoft WorkTime)
- [CVE-2025-9062](https://cve.now/CVE-2025-9062.md): IDOR in MeCODE Informatics' Envanty (CVSS 7.3, MeCODE Informatics and Engineering Services Envanty)
- [CVE-2025-15562](https://cve.now/CVE-2025-15562.md): Reflected Cross-Site Scripting in NesterSoft WorkTime (CVSS 6.1, NesterSoft WorkTime)
- [CVE-2025-15561](https://cve.now/CVE-2025-15561.md): Local Privilege Escalation in NesterSoft WorkTime (CVSS 7.8, NesterSoft WorkTime)
- [CVE-2025-15560](https://cve.now/CVE-2025-15560.md): SQL Injection in NesterSoft WorkTime (CVSS 8.8, NesterSoft WorkTime)
- [CVE-2025-15559](https://cve.now/CVE-2025-15559.md): Unauthenticated OS Command Injection in NesterSoft WorkTime (CVSS 9.8, NesterSoft WorkTime)
- [CVE-2025-13590](https://cve.now/CVE-2025-13590.md): Authenticated arbitrary file upload via a System REST API requiring administrator permission. (CVSS 9.1, WSO2 API Manager · WSO2 API Control Plane +4)
- [CVE-2025-12107](https://cve.now/CVE-2025-12107.md): Server-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code Execution (CVSS 8.4, WSO2 Identity Server)
- [CVE-2026-1219](https://cve.now/CVE-2026-1219.md): MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure (CVSS 5.3, MP3 Audio Player – Music Player, Podcast Player & Radio by…)
- [CVE-2026-2718](https://cve.now/CVE-2026-2718.md): Dealia \<= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block Attributes (CVSS 6.4, Dealia – Request a quote)
- [CVE-2026-2716](https://cve.now/CVE-2026-2716.md): Client Testimonial Slider \<= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Testimonial Heading' Setting (CVSS 4.4, amu02aftab Client Testimonial Slider)
- [CVE-2026-1461](https://cve.now/CVE-2026-1461.md): Simple Membership \<= 4.7.0 - Unauthenticated Improper Handling of Missing Values (CVSS 6.5, wpinsider-1 Simple Membership)
- [CVE-2026-22267](https://cve.now/CVE-2026-22267.md): Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. (CVSS 8.1, Dell PowerProtect Data Manager)
- [CVE-2026-22268](https://cve.now/CVE-2026-22268.md): Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. (CVSS 6.3, Dell PowerProtect Data Manager)
- [CVE-2026-22266](https://cve.now/CVE-2026-22266.md): Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel vulnerab (CVSS 4.7, Dell PowerProtect Data Manager)
- [CVE-2026-22269](https://cve.now/CVE-2026-22269.md): Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel vulnerab (CVSS 4.7, Dell PowerProtect Data Manager)
- [CVE-2025-41023](https://cve.now/CVE-2025-41023.md): Authentication bypass in AutoGPT de Thesamur (CVSS 6.9, Thesamur AutoGPT)
- [CVE-2026-26358](https://cve.now/CVE-2026-26358.md): Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability. (CVSS 8.8, Dell Unisphere for PowerMax · Dell PowerMax)
- [CVE-2025-40697](https://cve.now/CVE-2025-40697.md): Reflected Cross-Site Scripting (XSS) in Lewe WebMeasure (CVSS 5.1, Lewe WebMeasure)
- [CVE-2026-26360](https://cve.now/CVE-2026-26360.md): Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. (CVSS 8.1, Dell Unisphere for PowerMax · Dell PowerMax)
- [CVE-2026-2736](https://cve.now/CVE-2026-2736.md): Reflected Cross-Site Scripting (XSS) vulnerability in Alkacon's OpenCms (CVSS 5.1, Alkacon OpenCms)
- [CVE-2026-2735](https://cve.now/CVE-2026-2735.md): Stored Cross-Site Scripting (XSS) vulnerability in Alkacon's OpenCms (CVSS 5.1, Alkacon OpenCms)
- [CVE-2026-26359](https://cve.now/CVE-2026-26359.md): Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. (CVSS 8.8, Dell Unisphere for PowerMax · Dell PowerMax)
- [CVE-2026-27094](https://cve.now/CVE-2026-27094.md): WordPress CoBlocks plugin \<= 3.1.16 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GoDaddy CoBlocks)
- [CVE-2026-27092](https://cve.now/CVE-2026-27092.md): WordPress WPAdverts plugin \<= 2.3.0 - Broken Access Control vulnerability (CVSS 6.5, Greg Winiarski WPAdverts)
- [CVE-2026-27090](https://cve.now/CVE-2026-27090.md): WordPress Kenta Companion plugin \<= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, WP Moose Kenta Companion)
- [CVE-2026-27074](https://cve.now/CVE-2026-27074.md): WordPress Shortcoder plugin \<= 6.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, vaakash Shortcoder)
- [CVE-2026-27069](https://cve.now/CVE-2026-27069.md): WordPress Soledad theme \<= 8.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PenciDesign Soledad)
- [CVE-2026-27059](https://cve.now/CVE-2026-27059.md): WordPress Penci Recipe plugin \<= 4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PenciDesign Penci Recipe)
- [CVE-2026-27058](https://cve.now/CVE-2026-27058.md): WordPress Penci Podcast plugin \<= 1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PenciDesign Penci Podcast)
- [CVE-2026-27057](https://cve.now/CVE-2026-27057.md): WordPress Penci Filter Everything plugin \<= 1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PenciDesign Penci Filter Everything)
- [CVE-2026-27055](https://cve.now/CVE-2026-27055.md): WordPress Penci AI SmartContent Creator plugin \<= 2.0 - Broken Access Control vulnerability (CVSS 4.3, PenciDesign Penci AI SmartContent Creator)
- [CVE-2026-27052](https://cve.now/CVE-2026-27052.md): WordPress Sales Countdown Timer for WooCommerce and WordPress plugin \< 1.1.9 - Local File Inclusion vulnerability (CVSS 7.5, villatheme Sales Countdown Timer for WooCommerce and WordPr…)
- [CVE-2026-27050](https://cve.now/CVE-2026-27050.md): WordPress RealPress plugin \<= 1.1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, ThimPress RealPress)
- [CVE-2026-27042](https://cve.now/CVE-2026-27042.md): WordPress NotificationX plugin \<= 3.2.1 - Broken Access Control vulnerability (CVSS 5.3, WPDeveloper NotificationX)
- [CVE-2026-25473](https://cve.now/CVE-2026-25473.md): WordPress WZone plugin \<= 14.0.31 - Broken Access Control vulnerability (CVSS 5.4, AA-Team WZone)
- [CVE-2026-25472](https://cve.now/CVE-2026-25472.md): WordPress Fusion Builder plugin \<= 3.14.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ThemeFusion Fusion Builder)
- [CVE-2026-25463](https://cve.now/CVE-2026-25463.md): WordPress Wpresidence Core plugin \<= 5.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WpEstate Wpresidence Core)
- [CVE-2026-25459](https://cve.now/CVE-2026-25459.md): WordPress Sober theme \<= 3.5.12 - Broken Access Control vulnerability (CVSS 4.3, uixthemes Sober)
- [CVE-2026-25453](https://cve.now/CVE-2026-25453.md): WordPress Advanced iFrame plugin \<= 2025.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, mdempfle Advanced iFrame)
- [CVE-2026-25451](https://cve.now/CVE-2026-25451.md): WordPress Bold Page Builder plugin \<= 5.6.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, boldthemes Bold Page Builder)
- [CVE-2026-25441](https://cve.now/CVE-2026-25441.md): WordPress LeadConnector plugin \<= 3.0.21 - Broken Access Control vulnerability (CVSS 5.3, varunvairavanlc LeadConnector)
- [CVE-2026-25432](https://cve.now/CVE-2026-25432.md): WordPress Omnipress plugin \<= 1.6.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, omnipressteam Omnipress)
- [CVE-2026-25428](https://cve.now/CVE-2026-25428.md): WordPress TS Poll plugin \<= 2.5.5 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, totalsoft TS Poll)
- [CVE-2026-25423](https://cve.now/CVE-2026-25423.md): WordPress Real 3D FlipBook plugin \<= 4.19.1 - Broken Access Control vulnerability (CVSS 3.8, creativeinteractivemedia Real 3D FlipBook)
- [CVE-2026-25422](https://cve.now/CVE-2026-25422.md): WordPress Popularis Extra plugin \<= 1.2.10 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Themes4WP Popularis Extra)
- [CVE-2026-25420](https://cve.now/CVE-2026-25420.md): WordPress MailerLite plugin \<= 1.7.18 - Broken Access Control vulnerability (CVSS 4.3, MailerLite)
- [CVE-2026-25419](https://cve.now/CVE-2026-25419.md): WordPress UpsellWP plugin \<= 2.2.5 - Broken Access Control vulnerability (CVSS 4.3, flycart UpsellWP)
- [CVE-2026-25418](https://cve.now/CVE-2026-25418.md): WordPress Bit Form plugin \<= 2.21.10 - SQL Injection vulnerability (CVSS 7.6, Bit Apps Bit Form)
- [CVE-2026-25416](https://cve.now/CVE-2026-25416.md): WordPress News Kit Elementor Addons plugin \<= 1.4.2 - Broken Access Control vulnerability (CVSS 4.3, blazethemes News Kit Elementor Addons)
- [CVE-2026-25415](https://cve.now/CVE-2026-25415.md): WordPress WPBookit Pro plugin \<= 1.6.18 - Broken Access Control vulnerability (CVSS 5.3, iqonicdesign WPBookit Pro)
- [CVE-2026-25411](https://cve.now/CVE-2026-25411.md): WordPress Revision Manager TMC plugin \<= 2.8.22 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, themastercut Revision Manager TMC)
- [CVE-2026-25410](https://cve.now/CVE-2026-25410.md): WordPress WP-CORS plugin \<= 0.2.2 - Broken Access Control vulnerability (CVSS 4.3, tstephenson WP-CORS)
- [CVE-2026-25409](https://cve.now/CVE-2026-25409.md): WordPress JAMstack Deployments plugin \<= 1.1.1 - Broken Access Control vulnerability (CVSS 4.3, crgeary JAMstack Deployments)
- [CVE-2026-25408](https://cve.now/CVE-2026-25408.md): WordPress Broken Link Notifier plugin \<= 1.3.5 - Broken Access Control vulnerability (CVSS 5.3, PluginRx Broken Link Notifier)
- [CVE-2026-25407](https://cve.now/CVE-2026-25407.md): WordPress Cookiebot plugin \<= 4.6.4 - Broken Access Control vulnerability (CVSS 4.3, Cookiebot)
- [CVE-2026-25404](https://cve.now/CVE-2026-25404.md): WordPress WP Job Manager plugin \<= 2.4.0 - Broken Access Control vulnerability (CVSS 5.3, Automattic WP Job Manager)
- [CVE-2026-25402](https://cve.now/CVE-2026-25402.md): WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin \<= 16.011.0 - Broken Access Control vulnerability (CVSS 4.3, echoplugins Knowledge Base for Documentation, FAQs with AI…)
- [CVE-2026-25399](https://cve.now/CVE-2026-25399.md): WordPress Serious Slider plugin \<= 1.2.7 - Broken Access Control vulnerability (CVSS 4.3, CryoutCreations Serious Slider)
- [CVE-2026-25395](https://cve.now/CVE-2026-25395.md): WordPress Business Roy theme \<= 1.1.4 - Broken Access Control vulnerability (CVSS 4.3, ikreatethemes Business Roy)
- [CVE-2026-25394](https://cve.now/CVE-2026-25394.md): WordPress Fitness FSE theme \<= 1.0.6 - Broken Access Control vulnerability (CVSS 4.3, sparklewpthemes Fitness FSE)
- [CVE-2026-25393](https://cve.now/CVE-2026-25393.md): WordPress Hello FSE theme \<= 1.0.6 - Broken Access Control vulnerability (CVSS 4.3, sparklewpthemes Hello FSE)
- [CVE-2026-25392](https://cve.now/CVE-2026-25392.md): WordPress Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress plugin \<= 1.4.0 - Open Redirection vulnerability (CVSS 4.7, KaizenCoders Update URLs – Quick and Easy way to search old…)
- [CVE-2026-25391](https://cve.now/CVE-2026-25391.md): WordPress WP Wand plugin \<= 1.3.07 - Broken Access Control vulnerability (CVSS 5.4, WP Grids WP Wand)
- [CVE-2026-25389](https://cve.now/CVE-2026-25389.md): WordPress EventPrime plugin \<= 4.2.8.3 - Sensitive Data Exposure vulnerability (CVSS 5.3, Metagauss EventPrime)
- [CVE-2026-25388](https://cve.now/CVE-2026-25388.md): WordPress Ads Pro plugin \<= 5.0 - Broken Access Control vulnerability (CVSS 5.4, scripteo Ads Pro)
- [CVE-2026-25387](https://cve.now/CVE-2026-25387.md): WordPress Image Optimizer by Elementor plugin \<= 1.7.1 - Broken Access Control vulnerability (CVSS 4.3, Image Optimizer by Elementor)
- [CVE-2026-25386](https://cve.now/CVE-2026-25386.md): WordPress Ally plugin \<= 4.0.2 - Broken Access Control vulnerability (CVSS 5.3, Elementor Ally)
- [CVE-2026-25385](https://cve.now/CVE-2026-25385.md): WordPress URL Shortify plugin \<= 1.12.3 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.5, KaizenCoders URL Shortify)
- [CVE-2026-25384](https://cve.now/CVE-2026-25384.md): WordPress WP-Lister Lite for eBay plugin \<= 3.8.5 - Broken Access Control vulnerability (CVSS 5.3, WP Lab WP-Lister Lite for eBay)
- [CVE-2026-25378](https://cve.now/CVE-2026-25378.md): WordPress Nelio AB Testing plugin \<= 8.2.4 - SQL Injection vulnerability (CVSS 7.6, Nelio Software Nelio AB Testing)
- [CVE-2026-25375](https://cve.now/CVE-2026-25375.md): WordPress Image Photo Gallery Final Tiles Grid plugin \<= 3.6.10 - Broken Access Control vulnerability (CVSS 4.3, WP Chill Image Photo Gallery Final Tiles Grid)
- [CVE-2026-25374](https://cve.now/CVE-2026-25374.md): WordPress Spa and Salon theme \<= 1.3.2 - Broken Access Control vulnerability (CVSS 5.3, raratheme Spa and Salon)
- [CVE-2026-25372](https://cve.now/CVE-2026-25372.md): WordPress Academy LMS plugin \<= 3.5.3 - Broken Access Control vulnerability (CVSS 6.5, Kodezen Academy LMS)
- [CVE-2026-25370](https://cve.now/CVE-2026-25370.md): WordPress WP Compress plugin \<= 6.60.28 - Broken Access Control vulnerability (CVSS 5.3, AresIT WP Compress)
- [CVE-2026-25368](https://cve.now/CVE-2026-25368.md): WordPress Calculated Fields Form plugin \<= 5.4.4.1 - Broken Access Control vulnerability (CVSS 6.5, codepeople Calculated Fields Form)
- [CVE-2026-25367](https://cve.now/CVE-2026-25367.md): WordPress CitiLights theme \< 3.7.2 - Broken Access Control vulnerability (CVSS 5.3, NooTheme CitiLights)
- [CVE-2026-25364](https://cve.now/CVE-2026-25364.md): WordPress Client Invoicing by Sprout Invoices plugin \<= 20.8.8 - Broken Access Control vulnerability (CVSS 5.3, BoldGrid Client Invoicing by Sprout Invoices)
- [CVE-2026-25363](https://cve.now/CVE-2026-25363.md): WordPress FooGallery plugin \<= 3.1.11 - Broken Access Control vulnerability (CVSS 4.3, FooPlugins FooGallery)
- [CVE-2026-25362](https://cve.now/CVE-2026-25362.md): WordPress FooGallery plugin \<= 3.1.11 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, FooPlugins FooGallery)
- [CVE-2026-25348](https://cve.now/CVE-2026-25348.md): WordPress Download Alt Text AI plugin \<= 1.10.15 - Broken Access Control vulnerability (CVSS 5.3, alttextai Download Alt Text AI)
- [CVE-2026-25343](https://cve.now/CVE-2026-25343.md): WordPress WP SMS plugin \<= 7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, VeronaLabs WP SMS)
- [CVE-2026-25338](https://cve.now/CVE-2026-25338.md): WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin \<= 2.7.4 - Broken Access Control vulnerability (CVSS 5.3, Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS)
- [CVE-2026-25337](https://cve.now/CVE-2026-25337.md): WordPress Coachify theme \<= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, wpcoachify Coachify)
- [CVE-2026-25336](https://cve.now/CVE-2026-25336.md): WordPress Coachify theme \<= 1.1.5 - Broken Access Control vulnerability (CVSS 5.3, wpcoachify Coachify)
- [CVE-2026-25335](https://cve.now/CVE-2026-25335.md): WordPress Secure Copy Content Protection and Content Locking plugin \<= 5.0.0 - Broken Access Control vulnerability (CVSS 4.3, Ays Pro Secure Copy Content Protection and Content Locking)
- [CVE-2026-25333](https://cve.now/CVE-2026-25333.md): WordPress Shopwell theme \<= 1.0.11 - Broken Access Control vulnerability (CVSS 5.3, peregrinethemes Shopwell)
- [CVE-2026-25332](https://cve.now/CVE-2026-25332.md): WordPress Endless Posts Navigation plugin \<= 2.2.9 - Broken Access Control vulnerability (CVSS 5.3, Fahad Mahmood Endless Posts Navigation)
- [CVE-2026-25331](https://cve.now/CVE-2026-25331.md): WordPress WP Activity Log plugin \<= 5.5.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Melapress WP Activity Log)
- [CVE-2026-25330](https://cve.now/CVE-2026-25330.md): WordPress PublishPress Authors plugin \<= 4.10.1 - Broken Access Control vulnerability (CVSS 4.3, PublishPress Authors)
- [CVE-2026-25329](https://cve.now/CVE-2026-25329.md): WordPress Quiz And Survey Master plugin \<= 10.3.4 - Broken Access Control vulnerability (CVSS 4.3, ExpressTech Systems Quiz And Survey Master)
- [CVE-2026-25326](https://cve.now/CVE-2026-25326.md): WordPress CMSMasters Content Composer plugin \<= 1.4.5 - Local File Inclusion vulnerability (CVSS 7.5, CMSMasters Content Composer)
- [CVE-2026-25325](https://cve.now/CVE-2026-25325.md): WordPress rtMedia for WordPress, BuddyPress and bbPress plugin \<= 4.7.8 - Sensitive Data Exposure vulnerability (CVSS 5.3, rtCamp rtMedia for WordPress, BuddyPress and bbPress)
- [CVE-2026-25324](https://cve.now/CVE-2026-25324.md): WordPress Quiz And Survey Master plugin \<= 10.3.4 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, ExpressTech Systems Quiz And Survey Master)
- [CVE-2026-25323](https://cve.now/CVE-2026-25323.md): WordPress OSM plugin \<= 6.1.12 - Broken Access Control vulnerability (CVSS 4.3, MiKa OSM)
- [CVE-2026-25322](https://cve.now/CVE-2026-25322.md): WordPress PublishPress Revisions plugin \<= 3.7.22 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, PublishPress Revisions)
- [CVE-2026-25321](https://cve.now/CVE-2026-25321.md): WordPress SupportCandy plugin \<= 3.4.4 - Broken Access Control vulnerability (CVSS 5.3, PSM Plugins SupportCandy)
- [CVE-2026-25320](https://cve.now/CVE-2026-25320.md): WordPress Elementor Contact Form DB plugin \<= 2.1.3 - Broken Access Control vulnerability (CVSS 5.3, Cool Plugins Elementor Contact Form DB)
- [CVE-2026-25319](https://cve.now/CVE-2026-25319.md): WordPress Zita Elementor Site Library plugin \<= 1.6.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, wpzita Zita Elementor Site Library)
- [CVE-2026-25318](https://cve.now/CVE-2026-25318.md): WordPress WiserReview Product Reviews for WooCommerce plugin \<= 2.9 - Broken Access Control vulnerability (CVSS 4.3, Wisernotify team WiserReview Product Reviews for WooCommerce)
- [CVE-2026-25316](https://cve.now/CVE-2026-25316.md): WordPress CartFlows plugin \<= 2.1.19 - PHP Object Injection vulnerability (CVSS 7.2, Brainstorm Force CartFlows)
- [CVE-2026-25315](https://cve.now/CVE-2026-25315.md): WordPress hCaptcha for WP plugin \<= 4.21.1 - Broken Access Control vulnerability (CVSS 5.3, hCaptcha for WP)
- [CVE-2026-25314](https://cve.now/CVE-2026-25314.md): WordPress TOP Table Of Contents plugin \<= 1.3.31 - Broken Access Control vulnerability (CVSS 4.3, WP Messiah TOP Table Of Contents)
- [CVE-2026-25313](https://cve.now/CVE-2026-25313.md): WordPress FluentForm plugin \<= 6.1.14 - Broken Access Control vulnerability (CVSS 4.3, Shahjahan Jewel FluentForm)
- [CVE-2026-25311](https://cve.now/CVE-2026-25311.md): WordPress Autoshare for Twitter plugin \<= 2.3.1 - Broken Access Control vulnerability (CVSS 5.4, 10up Autoshare for Twitter)
- [CVE-2026-25310](https://cve.now/CVE-2026-25310.md): WordPress Extend Link plugin \<= 2.0.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, Alobaidi Extend Link)
- [CVE-2026-25308](https://cve.now/CVE-2026-25308.md): WordPress Simple Membership plugin \<= 4.6.9 - Broken Access Control vulnerability (CVSS 4.3, wp.insider Simple Membership)
- [CVE-2026-25307](https://cve.now/CVE-2026-25307.md): WordPress XStore Core plugin \< 5.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, 8theme XStore Core)
- [CVE-2026-25305](https://cve.now/CVE-2026-25305.md): WordPress XStore theme \<= 9.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, 8theme XStore)
- [CVE-2026-25008](https://cve.now/CVE-2026-25008.md): WordPress Ninja Tables plugin \<= 5.2.5 - Sensitive Data Exposure vulnerability (CVSS 4.3, Shahjahan Jewel Ninja Tables)
- [CVE-2026-25006](https://cve.now/CVE-2026-25006.md): WordPress XStore theme \<= 9.6.4 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3, 8theme XStore)
- [CVE-2026-25005](https://cve.now/CVE-2026-25005.md): WordPress Frontend File Manager plugin \<= 23.5 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, N-Media Frontend File Manager)
- [CVE-2026-25004](https://cve.now/CVE-2026-25004.md): WordPress CM Business Directory plugin \<= 1.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, CreativeMindsSolutions CM Business Directory)
- [CVE-2026-25003](https://cve.now/CVE-2026-25003.md): WordPress Client Portal plugin \<= 1.2.1 - Broken Access Control vulnerability (CVSS 4.3, madalin.ungureanu Client Portal)
- [CVE-2026-25000](https://cve.now/CVE-2026-25000.md): WordPress Wheel of Life plugin \<= 1.2.0 - Broken Access Control vulnerability (CVSS 5.3, Kraft Plugins Wheel of Life)
- [CVE-2026-24999](https://cve.now/CVE-2026-24999.md): WordPress Alma plugin \<= 5.16.1 - Broken Access Control vulnerability (CVSS 5.3, Alma)
- [CVE-2026-24392](https://cve.now/CVE-2026-24392.md): WordPress HurryTimer plugin \<= 2.14.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Nabil Lemsieh HurryTimer)
- [CVE-2026-24375](https://cve.now/CVE-2026-24375.md): WordPress Ultimate Gift Cards For WooCommerce plugin \<= 3.2.4 - Broken Access Control vulnerability (CVSS 5.3, WP Swings Ultimate Gift Cards For WooCommerce)
- [CVE-2026-23805](https://cve.now/CVE-2026-23805.md): WordPress Media Search Enhanced plugin \<= 0.9.1 - SQL Injection vulnerability (CVSS 7.6, Yoren Chang Media Search Enhanced)
- [CVE-2026-23804](https://cve.now/CVE-2026-23804.md): WordPress Better Business Reviews plugin \<= 0.1.1 - Broken Access Control vulnerability (CVSS 5.4, BBR Plugins Better Business Reviews)
- [CVE-2026-23803](https://cve.now/CVE-2026-23803.md): WordPress Smart Auto Upload Images plugin \<= 1.2.2 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.2, Burhan Nasir Smart Auto Upload Images)
- [CVE-2026-23549](https://cve.now/CVE-2026-23549.md): WordPress WpEvently plugin \<= 5.1.1 - PHP Object Injection vulnerability (CVSS 9.8, magepeopleteam WpEvently)
- [CVE-2026-23548](https://cve.now/CVE-2026-23548.md): WordPress DirectoryPress plugin \<= 3.6.25 - Broken Access Control vulnerability (CVSS 5.3, Designinvento DirectoryPress)
- [CVE-2026-23547](https://cve.now/CVE-2026-23547.md): WordPress CMSMasters Content Composer plugin \<= 2.5.8 - Broken Access Control vulnerability (CVSS 7.1, CMSMasters Content Composer)
- [CVE-2026-23545](https://cve.now/CVE-2026-23545.md): WordPress Aruba HiSpeed Cache plugin \<= 3.0.4 - Broken Access Control vulnerability (CVSS 6.5, Aruba.it Dev Aruba HiSpeed Cache)
- [CVE-2026-23544](https://cve.now/CVE-2026-23544.md): WordPress Valenti theme \<= 5.6.3.5 - PHP Object Injection vulnerability (CVSS 8.8, codetipi Valenti)
- [CVE-2026-23543](https://cve.now/CVE-2026-23543.md): WordPress Essential Addons for Elementor plugin \<= 6.5.5 - Broken Access Control vulnerability (CVSS 5.3, WPDeveloper Essential Addons for Elementor)
- [CVE-2026-23542](https://cve.now/CVE-2026-23542.md): WordPress Grand Restaurant theme \<= 7.0.10 - PHP Object Injection vulnerability (CVSS 9.8, ThemeGoods Grand Restaurant)
- [CVE-2026-23541](https://cve.now/CVE-2026-23541.md): WordPress Mail Mint plugin \<= 1.19.4 - Broken Access Control vulnerability (CVSS 7.5, WPFunnels Mail Mint)
- [CVE-2026-22422](https://cve.now/CVE-2026-22422.md): WordPress Everest Forms plugin \<= 3.4.1 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3, wpeverest Everest Forms)
- [CVE-2026-22333](https://cve.now/CVE-2026-22333.md): WordPress YITH WooCommerce Compare plugin \<= 3.6.0 - Deserialization of untrusted data vulnerability (CVSS 7.2, YITHEMES YITH WooCommerce Compare)
- [CVE-2026-26362](https://cve.now/CVE-2026-26362.md): Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability. (CVSS 8.1, Dell Unisphere for PowerMax · Dell PowerMax)
- [CVE-2026-27056](https://cve.now/CVE-2026-27056.md): WordPress iThemes Sync plugin \<= 3.2.8 - Broken Access Control vulnerability (CVSS 4.3, StellarWP iThemes Sync)
- [CVE-2026-26361](https://cve.now/CVE-2026-26361.md): Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. (CVSS 6.5, Dell Unisphere for PowerMax · Dell PowerMax)
- [CVE-2026-2733](https://cve.now/CVE-2026-2733.md): Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol (CVSS 3.8, Red Hat build of Keycloak · Red Hat JBoss Enterprise App… +2)
- [CVE-2026-2711](https://cve.now/CVE-2026-2711.md): zhutoutoutousan worldquant-miner URL ssrf\_proxy.py server-side request forgery (CVSS 6.3, zhutoutoutousan worldquant-miner)
- [CVE-2026-2681](https://cve.now/CVE-2026-2681.md): Github.com/supranational/blst: blst cryptographic library: denial of service via out-of-bounds stack write in key generation (CVSS 5.3, blst)
- [CVE-2026-1994](https://cve.now/CVE-2026-1994.md): s2Member \<= 260127 - Unauthenticated Privilege Escalation via Account Takeover (CVSS 9.8, clavaque s2Member – Excellent for All Kinds of Memberships,…)
- [CVE-2026-2731](https://cve.now/CVE-2026-2731.md): Unauthenticated RCE in Dynamicweb 9 and Dynamicweb 8 (CVSS 10.0, DynamicWeb)
- [CVE-2026-2709](https://cve.now/CVE-2026-2709.md): busy Callback app.js redirect (CVSS 5.1, busy)
- [CVE-2026-2706](https://cve.now/CVE-2026-2706.md): code-projects Patient Record Management System fecalysis\_not.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2026-2705](https://cve.now/CVE-2026-2705.md): Open Babel MOL2 File atom.h SetFormalCharge out-of-bounds (CVSS 5.3, Open Babel · openbabel)
- [CVE-2026-1055](https://cve.now/CVE-2026-1055.md): TalkJS \<= 0.1.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'welcomeMessage' Parameter (CVSS 4.4, TalkJS)
- [CVE-2026-0722](https://cve.now/CVE-2026-0722.md): Shield Security \<= 21.0.8 - Cross-Site Request Forgery to SQL Injection (CVSS 6.5, paultgoodchild Shield: Blocks Bots, Protects Users, and Pre…)
- [CVE-2025-13851](https://cve.now/CVE-2025-13851.md): Buyent Theme (with Buyent Classified Plugin) \<= 1.0.7 - Unauthenticated Privilege Escalation via User Registration (CVSS 9.8, scriptsbundle Buyent)
- [CVE-2026-1373](https://cve.now/CVE-2026-1373.md): Easy Author Image \<= 1.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Picture URL (CVSS 6.4, lawsonry Easy Author Image)
- [CVE-2026-2284](https://cve.now/CVE-2026-2284.md): News Element Elementor Blog Magazine \<= 1.0.8 - Missing Authorization to Authenticated (Subscriber+) Data Loss (CVSS 5.4, webangon News Element Elementor Blog Magazine)
- [CVE-2026-1455](https://cve.now/CVE-2026-1455.md): Whatsiplus Scheduled Notification for Woocommerce \<= 1.0.1 - Cross-Site Request Forgery to 'wsnfw\_save\_users\_settings' AJAX Action (CVSS 4.3, Whatsiplus Scheduled Notification for Woocommerce)
- [CVE-2025-14445](https://cve.now/CVE-2025-14445.md): Image Hotspot by DevVN \<= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Meta (CVSS 6.4, levantoan Image Hotspot by DevVN)
- [CVE-2026-0926](https://cve.now/CVE-2026-0926.md): Prodigy Commerce \<= 3.3.0 - Unauthenticated Local File Inclusion via parameters\[template\_name\] (CVSS 9.8, prodigycommerce Prodigy Commerce)
- [CVE-2025-14357](https://cve.now/CVE-2025-14357.md): Mega Store Woocommerce \<= 5.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation and Settings Change (CVSS 5.3, misbahwp Mega Store Woocommerce)
- [CVE-2026-0561](https://cve.now/CVE-2026-0561.md): Shield Security \<= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter (CVSS 6.1, paultgoodchild Shield: Blocks Bots, Protects Users, and Pre…)
- [CVE-2026-2504](https://cve.now/CVE-2026-2504.md): Dealia – Request a quote \<= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Plugin Configuration Reset (CVSS 4.3, Dealia – Request a quote)
- [CVE-2025-14452](https://cve.now/CVE-2025-14452.md): WP Customer Reviews \<= 3.7.5 - Reflected Cross-Site Scripting via 'wpcr3\_fname' Parameter (CVSS 7.2, bompus WP Customer Reviews)
- [CVE-2025-14983](https://cve.now/CVE-2025-14983.md): Advanced Custom Fields: Font Awesome \<= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, mattkeys Advanced Custom Fields: Font Awesome Field)
- [CVE-2025-14167](https://cve.now/CVE-2025-14167.md): Remove Post Type Slug \<= 1.0.2 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, akshayshah5189 Remove Post Type Slug)
- [CVE-2026-0974](https://cve.now/CVE-2026-0974.md): Orderable \<= 1.20.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation (CVSS 8.8, Orderable – Restaurant & Food Ordering System)
- [CVE-2025-14270](https://cve.now/CVE-2025-14270.md): OneClick Chat to Order \<= 1.0.9 - Missing Authorization to Authenticated (Editor+) Plugin Settings Update (CVSS 2.7, walterpinem OneClick Chat to Order)
- [CVE-2025-13563](https://cve.now/CVE-2025-13563.md): Lizza LMS Pro \<= 1.0.3 - Unauthenticated Privilege Escalation (CVSS 9.8, BuddhaThemes Lizza LMS Pro)
- [CVE-2025-14851](https://cve.now/CVE-2025-14851.md): YaMaps for WordPress \<= 0.6.40 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Parameters (CVSS 6.4, yhunter YaMaps for WordPress Plugin)
- [CVE-2026-1044](https://cve.now/CVE-2026-1044.md): Tennis Court Bookings \<= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings and Calendar Parameters (CVSS 4.4, renoiriii Tennis Court Bookings)
- [CVE-2025-14427](https://cve.now/CVE-2025-14427.md): Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches \<= 21.0.9 - Missing Authorization to Authenticated (Subscriber+) Email MFA Update (CVSS 4.3, paultgoodchild Shield: Blocks Bots, Protects Users, and Pre…)
- [CVE-2025-14864](https://cve.now/CVE-2025-14864.md): Virusdie \<= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) API Key Disclosure (CVSS 4.3, Virusdie – One-click website security)
- [CVE-2025-13091](https://cve.now/CVE-2025-13091.md): Shopire \<= 1.0.57 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install (CVSS 4.3, wpfable Shopire)
- [CVE-2025-13603](https://cve.now/CVE-2025-13603.md): WP AUDIO GALLERY \<= 2.0 - Authenticated (Subscriber+) Arbitrary File Read via .htaccess Manipulation (CVSS 8.8, husainali52 WP AUDIO GALLERY)
- [CVE-2026-1043](https://cve.now/CVE-2026-1043.md): PostmarkApp Email Integrator \<= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (CVSS 4.4, gagan0123 PostmarkApp Email Integrator)
- [CVE-2025-14076](https://cve.now/CVE-2025-14076.md): iXML – Google XML sitemap generator \<= 0.6 - Reflected Cross-Site Scripting via 'iXML\_email' Parameter (CVSS 6.1, icount iXML – Google XML sitemap generator)
- [CVE-2025-14342](https://cve.now/CVE-2025-14342.md): SEO Plugin by Squirrly SEO \<= 12.4.14 - Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection (CVSS 4.3, cifi SEO Plugin by Squirrly SEO)
- [CVE-2026-0549](https://cve.now/CVE-2026-0549.md): Groups \<= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups\_group\_info' Shortcode (CVSS 6.4, itthinx Groups)
- [CVE-2025-13738](https://cve.now/CVE-2025-13738.md): Easy Table of Contents \<= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, magazine3 Easy Table of Contents)
- [CVE-2025-13438](https://cve.now/CVE-2025-13438.md): Page Title, Description & Open Graph Updater \<= 1.02 - Cross-Site Request Forgery to Arbitrary Page Title Modification (CVSS 4.3, dienodigital Page Title, Description & Open Graph Updater)
- [CVE-2026-0556](https://cve.now/CVE-2026-0556.md): XO Event Calendar \<= 3.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xo\_event\_field' shortcode (CVSS 6.4, ishitaka XO Event Calendar)
- [CVE-2026-1047](https://cve.now/CVE-2026-1047.md): salavat counter Plugin \<= 0.9.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'image\_url' Parameter (CVSS 4.4, goback2 salavat counter Plugin)
- [CVE-2025-13842](https://cve.now/CVE-2025-13842.md): Breadcrumb NavXT \<= 7.5.0 - Missing Authorization to Sensitive Information Exposure (CVSS 5.3, mtekk Breadcrumb NavXT)
- [CVE-2025-13864](https://cve.now/CVE-2025-13864.md): Breeze – WordPress Cache Plugin \<= 2.2.21 - Missing Authorization to Cache Deletion (CVSS 5.3, cloudways Breeze Cache)
- [CVE-2025-13617](https://cve.now/CVE-2025-13617.md): Apollo13 Framework Extension \<= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via \`a13\_alt\_link\` Parameter (CVSS 6.4, apollo13themes Apollo13 Framework Extensions)
- [CVE-2025-4521](https://cve.now/CVE-2025-4521.md): IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate\_donor\_profile Function (CVSS 8.8, themeatelier IDonate – Blood Donation, Request And Donor Ma…)
- [CVE-2026-2282](https://cve.now/CVE-2026-2282.md): Slidorion \<= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Slidorion Settings (CVSS 4.4, hollandben Slidorion)
- [CVE-2025-12975](https://cve.now/CVE-2025-12975.md): CTX Feed – WooCommerce Product Feed Manager \<= 6.6.11 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation (CVSS 7.2, wahid0003 Product Feed Manager for WooCommerce – CTX Feed –…)
- [CVE-2026-0912](https://cve.now/CVE-2026-0912.md): Toret Manager \<= 1.2.7 - Authenticated (Subscriber+) Arbitrary Options Update via AJAX actions (CVSS 8.8, Toret Manager)
- [CVE-2025-13612](https://cve.now/CVE-2025-13612.md): Album and Image Gallery Plus Lightbox \<= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode (CVSS 6.4, essentialplugin Album and Image Gallery Plus Lightbox)
- [CVE-2026-1405](https://cve.now/CVE-2026-1405.md): Slider Future \<= 1.0.5 - Unauthenticated Arbitrary File Upload (CVSS 9.8, franchidesign Slider Future)
- [CVE-2025-13930](https://cve.now/CVE-2025-13930.md): Checkout Field Manager (Checkout Manager) for WooCommerce \<= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion (CVSS 5.3, quadlayers Checkout Field Manager (Checkout Manager) for Wo…)
- [CVE-2026-1646](https://cve.now/CVE-2026-1646.md): Advance Block Extend \<= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleColor Block Attribute (CVSS 6.4, iamjaydip Advance Block Extend)
- [CVE-2025-15041](https://cve.now/CVE-2025-15041.md): BackWPup \<= 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update (CVSS 7.2, wp\_media BackWPup – WordPress Backup & Restore Plugin)
- [CVE-2025-14294](https://cve.now/CVE-2025-14294.md): Razorpay for WooCommerce \<= 4.7.8 - Missing Authentication to Unauthenticated Order Modification (CVSS 5.3, Razorpay for WooCommerce)
- [CVE-2025-13413](https://cve.now/CVE-2025-13413.md): Country Blocker for AdSense \<= 1.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, soyrodriguez Country Blocker for AdSense)
- [CVE-2025-13732](https://cve.now/CVE-2025-13732.md): s2Member \<= 251005 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, clavaque s2Member – Excellent for All Kinds of Memberships,…)
- [CVE-2025-13587](https://cve.now/CVE-2025-13587.md): Two Factor (2FA) Authentication via Email \<= 1.9.8 - Two-Factor Authentication Bypass via token (CVSS 6.5, ss88\_uk Two Factor (2FA) Authentication via Email)
- [CVE-2026-2502](https://cve.now/CVE-2026-2502.md): xmlrpc attacks blocker \<= 1.0 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For' (CVSS 6.1, yehudah xmlrpc attacks blocker)
- [CVE-2026-2704](https://cve.now/CVE-2026-2704.md): Open Babel CIF File transform3d.cpp DescribeAsString out-of-bounds (CVSS 5.3, Open Babel · openbabel)
- [CVE-2026-2703](https://cve.now/CVE-2026-2703.md): xlnt-community xlnt Encrypted XLSX File base64.cpp decode\_base64 off-by-one (CVSS 4.8, xlnt-community xlnt)
- [CVE-2025-15586](https://cve.now/CVE-2025-15586.md): OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw which if exploited can r (CVSS 10.0, OpenGamePanel OGP-Website)
- [CVE-2026-2702](https://cve.now/CVE-2026-2702.md): Beetel 777VR1 WPA2 PSK hard-coded credentials (CVSS 2.3, Beetel 777VR1)
- [CVE-2025-12500](https://cve.now/CVE-2025-12500.md): Checkout Field Manager (Checkout Manager) for WooCommerce \<= 7.8.1 - Unauthenticated Limited File Upload (CVSS 5.3, quadlayers Checkout Field Manager (Checkout Manager) for Wo…)
- [CVE-2025-12081](https://cve.now/CVE-2025-12081.md): ACF Photo Gallery Field \<= 3.0 - Missing Authorization to Authenticated (Subscriber+) Attachment Metadata Modification (CVSS 4.3, navzme ACF Photo Gallery Field)
- [CVE-2025-13048](https://cve.now/CVE-2025-13048.md): Official StatCounter Plugin \<= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Nickname (CVSS 6.4, StatCounter – Free Real Time Visitor Stats)
- [CVE-2025-12117](https://cve.now/CVE-2025-12117.md): Renden \<= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title (CVSS 6.4, thinkupthemes Renden)
- [CVE-2025-13113](https://cve.now/CVE-2025-13113.md): Web Accessibility by accessiBe \<= 2.11 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, accessibewp Web Accessibility by accessiBe)
- [CVE-2025-12845](https://cve.now/CVE-2025-12845.md): Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation (CVSS 8.8, essekia Tablesome Table – Contact Form DB – WPForms, CF7, G…)
- [CVE-2025-12884](https://cve.now/CVE-2025-12884.md): Advanced Ads – Ad Manager & AdSense \<= 2.0.14 - Missing Authorization to Authenticated (Subscriber+) Ad Placements Update (CVSS 4.3, monetizemore Advanced Ads – Ad Manager & AdSense)
- [CVE-2025-12821](https://cve.now/CVE-2025-12821.md): NewsBlogger \<= 0.2.5.6 - 0.2.5.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation (CVSS 8.8, spicethemes NewsBlogger)
- [CVE-2025-12116](https://cve.now/CVE-2025-12116.md): Drift \<= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title (CVSS 6.4, thinkupthemes Drift)
- [CVE-2025-12882](https://cve.now/CVE-2025-12882.md): Clasifico Listing \<= 2.0 - Unauthenticated Privilege Escalation (CVSS 9.8, SmartDataSoft Clasifico Listing)
- [CVE-2025-12707](https://cve.now/CVE-2025-12707.md): Library Management System \<= 3.2.1 - Unauthenticated SQL Injection (CVSS 7.5, owthub Library Management System)
- [CVE-2025-13079](https://cve.now/CVE-2025-13079.md): Popup Builder - Create highly converting, mobile friendly marketing popups. \<= 4.4.2 - Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens (CVSS 5.3, popupbuilder Popup Builder – Create highly converting, mobi…)
- [CVE-2025-12375](https://cve.now/CVE-2025-12375.md): Printful Integration for WooCommerce \<= 2.2.11 - Authenticated (Contributor+) Server-Side Request Forgery (CVSS 6.4, Printful Integration for WooCommerce)
- [CVE-2025-12451](https://cve.now/CVE-2025-12451.md): Easy SVG Support \<= 4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 4.4, benjamin\_zekavica Easy SVG Support)
- [CVE-2025-11754](https://cve.now/CVE-2025-11754.md): Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent \<= 4.1.2 - Missing Authorization to Sensitive Information Exposure (CVSS 7.5, wplegalpages Cookie Banner for GDPR / CCPA – WPLP Cookie Co…)
- [CVE-2025-12172](https://cve.now/CVE-2025-12172.md): Mailchimp List Subscribe Form \<= 2.0.0 - Cross-Site Request Forgery to Mailchimp List Change (CVSS 4.3, Mailchimp List Subscribe Form)
- [CVE-2025-11706](https://cve.now/CVE-2025-11706.md): Aruba HiSpeed Cache \<= 3.0.2 - Reflected Cross-Site Scripting (CVSS 6.1, arubadev Aruba HiSpeed Cache)
- [CVE-2025-12448](https://cve.now/CVE-2025-12448.md): Smartsupp – live chat, AI shopping assistant and chatbots \<= 3.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, Smartsupp – live chat, AI shopping assistant and chatbots)
- [CVE-2025-11725](https://cve.now/CVE-2025-11725.md): Aruba HiSpeed Cache \<= 3.0.2 - Missing Authorization to Unauthenticated Plugin's Settings Modification (CVSS 6.5, arubadev Aruba HiSpeed Cache)
- [CVE-2025-12027](https://cve.now/CVE-2025-12027.md): Mesmerize Companion \<= 1.6.158 - Missing Authorization Authenticated (Subscriber+) Settings Update (CVSS 4.3, horearadu Mesmerize Companion)
- [CVE-2026-25474](https://cve.now/CVE-2026-25474.md): OpenClaw has a Telegram webhook request forgery (missing \`channels.telegram.webhookSecret\`) → auth bypass (CVSS 7.5, openclaw)
- [CVE-2026-25229](https://cve.now/CVE-2026-25229.md): Gogs Authorization Bypass Allows Cross-Repository Label Modification (CVSS 5.3, gogs · gogs.io/gogs)
- [CVE-2026-2693](https://cve.now/CVE-2026-2693.md): CoCoTeaNet CyreneAdmin System Info Endpoint getCount improper authorization (CVSS 5.3, CoCoTeaNet CyreneAdmin)
- [CVE-2026-25242](https://cve.now/CVE-2026-25242.md): Gogs allows unauthenticated file uploads (CVSS 6.9, gogs · gogs.io/gogs)
- [CVE-2026-25232](https://cve.now/CVE-2026-25232.md): Gogs has a Protected Branch Deletion Bypass in Web Interface (CVSS 7.1, gogs · gogs.io/gogs)
- [CVE-2026-2692](https://cve.now/CVE-2026-2692.md): CoCoTeaNet CyreneAdmin Image getAvatar path traversal (CVSS 5.3, CoCoTeaNet CyreneAdmin)
- [CVE-2026-25120](https://cve.now/CVE-2026-25120.md): Gogs Allows Cross-Repository Comment Deletion via DeleteComment (CVSS 5.1, gogs · gogs.io/gogs)
- [CVE-2025-4960](https://cve.now/CVE-2025-4960.md): macOS Local Privilege Escalation via Improper Authorization Handling in EPSON Printer Controller Installer (CVSS 7.8, EPSON Printer Controller Installer)
- [CVE-2026-2691](https://cve.now/CVE-2026-2691.md): itsourcecode Event Management System manage\_register.php sql injection (CVSS 6.9, itsourcecode Event Management System)
- [CVE-2026-24764](https://cve.now/CVE-2026-24764.md): OpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions (CVSS 3.7, clawdbot · openclaw)
- [CVE-2026-2690](https://cve.now/CVE-2026-2690.md): itsourcecode Event Management System Admin Login ajax.php sql injection (CVSS 6.9, itsourcecode Event Management System)
- [CVE-2026-2689](https://cve.now/CVE-2026-2689.md): itsourcecode Event Management System manage\_booking.php sql injection (CVSS 6.9, itsourcecode Event Management System)
- [CVE-2026-2686](https://cve.now/CVE-2026-2686.md): SECCN Dingcheng G10 session\_login.cgi qq os command injection (CVSS 9.3, SECCN Dingcheng G10)
- [CVE-2025-55853](https://cve.now/CVE-2025-55853.md): SoftVision webPDF before 10.0.2 is vulnerable to Server-Side Request Forgery (SSRF). (CVSS 9.1)
- [CVE-2025-67304](https://cve.now/CVE-2025-67304.md): In Ruckus Network Director (RND) \< 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user. (CVSS 9.8)
- [CVE-2025-67305](https://cve.now/CVE-2025-67305.md): In RUCKUS Network Director (RND) \< 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user. (CVSS 9.8)
- [CVE-2025-69674](https://cve.now/CVE-2025-69674.md): Buffer Overflow vulnerability in CDATA FD614GS3-R850 V3.2.7\_P161006 (Build.0333.250211) allows an attacker to execute arbitrary code via the (CVSS 6.4)
- [CVE-2025-69725](https://cve.now/CVE-2025-69725.md): An Open Redirect vulnerability in the go-chi/chi \>=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malici (CVSS 4.7, github.com/go-chi/chi/v5 · github.com/go-chi/chi +3)
- [CVE-2026-26744](https://cve.now/CVE-2026-26744.md): A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endp (CVSS 5.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.