# CVEs published 2026-02-20

376 CVEs were published on February 20, 2026: 50 critical, 208 high. Days are UTC.

- [CVE-2026-27170](https://cve.now/CVE-2026-27170.md): OpenSift: SSRF risk in URL ingestion endpoint (CVSS 7.1, OpenSift)
- [CVE-2026-27169](https://cve.now/CVE-2026-27169.md): OpenSift: Persistent XSS Chat Tool Rendering (CVSS 8.9, OpenSift)
- [CVE-2026-27168](https://cve.now/CVE-2026-27168.md): SAIL: Heap-based Buffer Overflow in Sail-codecs-xwd (CVSS 8.8, HappySeaFox sail)
- [CVE-2026-27203](https://cve.now/CVE-2026-27203.md): eBay API MCP Server Affected by Environment Variable Injection (CVSS 8.3, YosefHayim ebay-mcp · ebay-mcp)
- [CVE-2026-27202](https://cve.now/CVE-2026-27202.md): GetSimple CMS: Uploaded Files (feature) Arbitrary File Read Vulnerability (CVSS 8.8, GetSimpleCMS-CE)
- [CVE-2026-27161](https://cve.now/CVE-2026-27161.md): Unauthenticated Information Disclosure via .htaccess Reliance in Sensitive Directories (CVSS 8.7, GetSimpleCMS-CE)
- [CVE-2026-27147](https://cve.now/CVE-2026-27147.md): GetSimple CMS: Stored Cross-Site Scripting (XSS) via SVG File Upload (Authenticated) (CVSS 6.9, GetSimpleCMS-CE)
- [CVE-2026-27146](https://cve.now/CVE-2026-27146.md): GetSimple CMS: Cross-Site Request Forgery (CSRF) in File Upload Allows Arbitrary Uploads (CVSS 7.1, GetSimpleCMS-CE)
- [CVE-2026-27134](https://cve.now/CVE-2026-27134.md): Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication (CVSS 8.1, strimzi-kafka-operator)
- [CVE-2019-25454](https://cve.now/CVE-2019-25454.md): phpMoAdmin 1.1.5 Stored Cross-Site Scripting via collection Parameter (CVSS 5.3, phpMoAdmin)
- [CVE-2019-25453](https://cve.now/CVE-2019-25453.md): phpMoAdmin 1.1.5 Reflected Cross-Site Scripting via moadmin.php (CVSS 5.1, phpMoAdmin)
- [CVE-2019-25451](https://cve.now/CVE-2019-25451.md): phpMoAdmin 1.1.5 Cross-Site Request Forgery via moadmin.php (CVSS 5.3, phpMoAdmin)
- [CVE-2019-25449](https://cve.now/CVE-2019-25449.md): OrientDB 3.0.17 Reflected Cross-Site Scripting via document endpoint (CVSS 5.1, OrientDB)
- [CVE-2019-25448](https://cve.now/CVE-2019-25448.md): OrientDB 3.0.17 Stored Cross-Site Scripting via User Creation (CVSS 5.1, OrientDB)
- [CVE-2019-25447](https://cve.now/CVE-2019-25447.md): OrientDB 3.0.17 Cross-Site Request Forgery (CVSS 5.3, OrientDB)
- [CVE-2019-25441](https://cve.now/CVE-2019-25441.md): thesystem 1.0 Command Injection via run\_command endpoint (CVSS 9.3, kostasmitroglou thesystem)
- [CVE-2019-25438](https://cve.now/CVE-2019-25438.md): LabCollector 5.423 SQL Injection via login.php (CVSS 8.8, LabCollector)
- [CVE-2019-25437](https://cve.now/CVE-2019-25437.md): Foscam Video Management System 1.1.6.6 Buffer Overflow Denial of Service (CVSS 6.7, Foscam Video Management System)
- [CVE-2019-25436](https://cve.now/CVE-2019-25436.md): Sricam DeviceViewer 3.12.0.1 Password Change Security Bypass (CVSS 5.1, Sricam DeviceViewer)
- [CVE-2019-25435](https://cve.now/CVE-2019-25435.md): Sricam DeviceViewer 3.12.0.1 Local Buffer Overflow DEP Bypass (CVSS 8.4, Sricam DeviceViewer)
- [CVE-2019-25434](https://cve.now/CVE-2019-25434.md): SpotAuditor 5.3.1.0 Denial of Service via Registration Name Field (CVSS 6.7, Nsasoft Nsauditor SpotAuditor)
- [CVE-2019-25432](https://cve.now/CVE-2019-25432.md): Part-DB 0.4 Authentication Bypass via login.php (CVSS 8.8, Part-DB)
- [CVE-2019-25431](https://cve.now/CVE-2019-25431.md): delpino73 Blue-Smiley-Organizer 1.32 SQL Injection via datetime (CVSS 8.8, delpino73 Blue-Smiley-Organizer)
- [CVE-2018-25158](https://cve.now/CVE-2018-25158.md): Chamilo LMS 1.11.8 Arbitrary File Upload via elfinder (CVSS 8.7, Chamilo Chamillo LMS)
- [CVE-2026-27133](https://cve.now/CVE-2026-27133.md): Strimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clusters (CVSS 5.9, strimzi-kafka-operator)
- [CVE-2026-27125](https://cve.now/CVE-2026-27125.md): Svelte SSR attribute spreading includes inherited properties from prototype chain (CVSS 5.3, sveltejs svelte · svelte)
- [CVE-2026-27122](https://cve.now/CVE-2026-27122.md): Svelte SSR does not validate dynamic element tag names in \`\<svelte:element\>\` (CVSS 5.1, sveltejs svelte · svelte)
- [CVE-2026-27121](https://cve.now/CVE-2026-27121.md): Svelte affected by cross-site scripting via spread attributes in Svelte SSR (CVSS 5.1, sveltejs svelte · svelte)
- [CVE-2026-27119](https://cve.now/CVE-2026-27119.md): Svelte affected by XSS in SSR \`\<option\>\` element (CVSS 5.1, sveltejs svelte · svelte)
- [CVE-2026-2635](https://cve.now/CVE-2026-2635.md): MLflow Use of Default Password Authentication Bypass Vulnerability (CVSS 9.8, MLflow)
- [CVE-2026-2490](https://cve.now/CVE-2026-2490.md): RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability (CVSS 5.5, RustDesk Client for Windows)
- [CVE-2026-2048](https://cve.now/CVE-2026-2048.md): GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, GIMP)
- [CVE-2026-2047](https://cve.now/CVE-2026-2047.md): GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GIMP)
- [CVE-2026-2045](https://cve.now/CVE-2026-2045.md): GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, GIMP)
- [CVE-2026-2044](https://cve.now/CVE-2026-2044.md): GIMP PGM File Parsing Uninitialized Memory Remote Code Execution Vulnerability (CVSS 7.8, GIMP)
- [CVE-2026-2492](https://cve.now/CVE-2026-2492.md): TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (CVSS 7.0, TensorFlow)
- [CVE-2026-2041](https://cve.now/CVE-2026-2041.md): Nagios Host zabbixagent\_configwizard\_func Command Injection Remote Code Execution Vulnerability (CVSS 7.2, Nagios Host)
- [CVE-2026-2043](https://cve.now/CVE-2026-2043.md): Nagios Host esensors\_websensor\_configwizard\_func Command Injection Remote Code Execution Vulnerability (CVSS 7.2, Nagios Host)
- [CVE-2026-2042](https://cve.now/CVE-2026-2042.md): Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability (CVSS 7.2, Nagios Host)
- [CVE-2026-2040](https://cve.now/CVE-2026-2040.md): PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (CVSS 7.3, PDF-XChange Editor)
- [CVE-2026-2039](https://cve.now/CVE-2026-2039.md): GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability (CVSS 7.3, GFI Archiver)
- [CVE-2026-2036](https://cve.now/CVE-2026-2036.md): GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 8.8, GFI Archiver)
- [CVE-2026-2038](https://cve.now/CVE-2026-2038.md): GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability (CVSS 7.3, GFI Archiver)
- [CVE-2026-2037](https://cve.now/CVE-2026-2037.md): GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 8.8, GFI Archiver)
- [CVE-2026-2035](https://cve.now/CVE-2026-2035.md): Deciso OPNsense diag\_backup.php filename Command Injection Remote Code Execution Vulnerability (CVSS 6.8, Deciso OPNsense)
- [CVE-2026-2034](https://cve.now/CVE-2026-2034.md): Sante DICOM Viewer Pro DCM File Parsing Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Sante DICOM Viewer Pro)
- [CVE-2026-2033](https://cve.now/CVE-2026-2033.md): MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability (CVSS 8.1, MLflow)
- [CVE-2026-0777](https://cve.now/CVE-2026-0777.md): Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability (CVSS 7.8, Xmind)
- [CVE-2026-0797](https://cve.now/CVE-2026-0797.md): GIMP ICO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GIMP)
- [CVE-2026-27113](https://cve.now/CVE-2026-27113.md): Liquid Prompt arbitrary command injection via crafted Git branch names in gitstatusd backend (CVSS 6.3, liquidprompt)
- [CVE-2026-2858](https://cve.now/CVE-2026-2858.md): wren-lang wren Source File wren\_compiler.c peekChar out-of-bounds (CVSS 4.8, wren-lang wren)
- [CVE-2026-27120](https://cve.now/CVE-2026-27120.md): Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster (CVSS 6.1, vapor leaf-kit)
- [CVE-2026-27118](https://cve.now/CVE-2026-27118.md): Cache poisoning in @sveltejs/adapter-vercel (CVSS 5.3, sveltejs kit · @sveltejs/adapter-vercel)
- [CVE-2026-27112](https://cve.now/CVE-2026-27112.md): Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints (CVSS 9.4, akuity kargo · github.com/akuity/kargo)
- [CVE-2026-27111](https://cve.now/CVE-2026-27111.md): Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints (CVSS 5.3, akuity kargo · github.com/akuity/kargo)
- [CVE-2026-27026](https://cve.now/CVE-2026-27026.md): pypdf possibly has long runtimes for malformed FlateDecode streams (CVSS 6.9, py-pdf pypdf · pypdf)
- [CVE-2026-27025](https://cve.now/CVE-2026-27025.md): pypdf has possible long runtimes/large memory usage for large /ToUnicode streams (CVSS 6.9, py-pdf pypdf · pypdf)
- [CVE-2026-27024](https://cve.now/CVE-2026-27024.md): pypdf has a possible infinite loop when processing TreeObject (CVSS 6.9, py-pdf pypdf · pypdf)
- [CVE-2026-27022](https://cve.now/CVE-2026-27022.md): RediSearch Query Injection in @langchain/langgraph-checkpoint-redis (CVSS 6.5, langchain-ai langgraphjs · @langchain/langgraph-checkpoint-…)
- [CVE-2026-27020](https://cve.now/CVE-2026-27020.md): Photobooth has a XSS vulnerability in user input (CVSS 5.3, lukas12000 photobooth)
- [CVE-2026-2857](https://cve.now/CVE-2026-2857.md): D-Link DWR-M960 Port Forwarding Configuration Endpoint formPortFw sub\_423E00 stack-based overflow (CVSS 8.7, D-Link DWR-M960)
- [CVE-2026-25896](https://cve.now/CVE-2026-25896.md): fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names (CVSS 9.3, NaturalIntelligence fast-xml-parser · fast-xml-parser)
- [CVE-2026-24892](https://cve.now/CVE-2026-24892.md): openITCOCKPIT has Unsafe Deserialization in openITCOCKPIT Changelog Handling (CVSS 7.5, openITCOCKPIT)
- [CVE-2026-27190](https://cve.now/CVE-2026-27190.md): Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child\_process (CVSS 8.1, denoland deno · deno)
- [CVE-2026-2856](https://cve.now/CVE-2026-2856.md): D-Link DWR-M960 Filter Configuration Endpoint formFilter sub\_424AFC stack-based overflow (CVSS 8.7, D-Link DWR-M960)
- [CVE-2026-2855](https://cve.now/CVE-2026-2855.md): D-Link DWR-M960 DDNS Settings formDdns sub\_4648F0 stack-based overflow (CVSS 8.7, D-Link DWR-M960)
- [CVE-2025-62326](https://cve.now/CVE-2025-62326.md): HCL Digital Experience is susceptible to stored cross-site scripting (XSS) (CVSS 6.1, HCLSoftware Digital Experience)
- [CVE-2026-2473](https://cve.now/CVE-2026-2473.md): Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft. (CVSS 7.7, Google Cloud Vertex AI Experiments · google-cloud-aiplatform)
- [CVE-2026-2472](https://cve.now/CVE-2026-2472.md): Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization (CVSS 8.6, Google Cloud Vertex AI SDK for Python · google-cloud-aiplat…)
- [CVE-2026-2854](https://cve.now/CVE-2026-2854.md): D-Link DWR-M960 NTP Configuration Endpoint formNtp sub\_4611CC stack-based overflow (CVSS 8.7, D-Link DWR-M960)
- [CVE-2026-2853](https://cve.now/CVE-2026-2853.md): D-Link DWR-M960 System Log Configuration Endpoint formSysLog sub\_462E14 stack-based overflow (CVSS 8.7, D-Link DWR-M960)
- [CVE-2026-2852](https://cve.now/CVE-2026-2852.md): yeqifu warehouse Sales Endpoint SalesController.java deleteSales access control (CVSS 5.3, yeqifu warehouse)
- [CVE-2019-25445](https://cve.now/CVE-2019-25445.md): Fiverr Clone Script 1.2.2 Cross-Site Scripting via search-results.php (CVSS 5.1, Phpscriptsmall Fiverr Clone Script)
- [CVE-2019-25444](https://cve.now/CVE-2019-25444.md): Fiverr Clone Script 1.2.2 SQL Injection via page Parameter (CVSS 8.8, Phpscriptsmall Fiverr Clone Script)
- [CVE-2026-24891](https://cve.now/CVE-2026-24891.md): openITCOCKPIT has Unsafe PHP Deserialization in Gearman Worker Allowing Conditional Object Injection (CVSS 7.5, openITCOCKPIT)
- [CVE-2026-2832](https://cve.now/CVE-2026-2832.md): Certain Samsung MultiXpress Multifunction Printers Firmware – Potential Information Disclosure (CVSS 5.3, HP Samsung MultiXpress SL-X7600LXR, SL-X7500LXR, SL-X740… +2)
- [CVE-2026-27115](https://cve.now/CVE-2026-27115.md): ADB Explorer is Vulnerable to Arbitrary Directory Deletion via Command-Line Argument (CVSS 7.1, Alex4SSB ADB-Explorer)
- [CVE-2026-2851](https://cve.now/CVE-2026-2851.md): yeqifu warehouse Inport Endpoint InportController.java deleteInport access control (CVSS 5.3, yeqifu warehouse)
- [CVE-2026-2850](https://cve.now/CVE-2026-2850.md): yeqifu warehouse Customer Endpoint CustomerController.java deleteCustomer access control (CVSS 5.3, yeqifu warehouse)
- [CVE-2026-26102](https://cve.now/CVE-2026-26102.md): Incorrect Permission Assignment for Critical Resource in Owl opds (CVSS 8.5, Owl opds)
- [CVE-2026-26101](https://cve.now/CVE-2026-26101.md): Incorrect Permission Assignment for Critical Resource in Owl opds (CVSS 8.5, Owl opds)
- [CVE-2026-26100](https://cve.now/CVE-2026-26100.md): Incorrect Permission Assignment for Critical Resource in Owl opds (CVSS 6.8, Owl opds)
- [CVE-2026-27506](https://cve.now/CVE-2026-27506.md): SVXportal \<= 2.5 Profile Update Stored XSS (CVSS 5.1, sa2blv SVXportal)
- [CVE-2026-26099](https://cve.now/CVE-2026-26099.md): Uncontrolled Search Path Element in Owl opds (CVSS 8.4, Owl opds)
- [CVE-2026-26098](https://cve.now/CVE-2026-26098.md): Uncontrolled Search Path Element in Owl opds (CVSS 8.4, Owl opds)
- [CVE-2026-26097](https://cve.now/CVE-2026-26097.md): Uncontrolled Search Path Element in Owl opds (CVSS 8.4, Owl opds)
- [CVE-2026-26096](https://cve.now/CVE-2026-26096.md): Incorrect Permission Assignment for Critical Resource in Owl opds (CVSS 8.5, Owl opds)
- [CVE-2026-26095](https://cve.now/CVE-2026-26095.md): Incorrect Permission Assignment for Critical Resource in Owl opds (CVSS 8.5, Owl opds)
- [CVE-2026-26093](https://cve.now/CVE-2026-26093.md): Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds (CVSS 8.7, Owl opds)
- [CVE-2026-27505](https://cve.now/CVE-2026-27505.md): SVXportal \<= 2.5 admin/user\_action.php Stored XSS (CVSS 5.1, sa2blv SVXportal)
- [CVE-2026-27504](https://cve.now/CVE-2026-27504.md): SVXportal \<= 2.5 radiomobile\_front.php stationid Reflected XSS (CVSS 5.1, sa2blv SVXportal)
- [CVE-2026-27503](https://cve.now/CVE-2026-27503.md): SVXportal \<= 2.5 admin/log.php Search Reflected XSS (CVSS 5.1, sa2blv SVXportal)
- [CVE-2026-2333](https://cve.now/CVE-2026-2333.md): Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds (CVSS 9.2, Owl opds)
- [CVE-2026-27502](https://cve.now/CVE-2026-27502.md): SVXportal \<= 2.5 log.php Search Reflected XSS (CVSS 5.1, sa2blv SVXportal)
- [CVE-2025-15583](https://cve.now/CVE-2025-15583.md): detronetdip E-commerce function.php get\_safe\_value cross site scripting (CVSS 5.1, detronetdip E-commerce)
- [CVE-2025-15582](https://cve.now/CVE-2025-15582.md): detronetdip E-commerce Product Management Update authorization (CVSS 5.3, detronetdip E-commerce)
- [CVE-2026-1842](https://cve.now/CVE-2026-1842.md): HyperCloud Improper Refresh Token Validation and Access Token Invalidation Allows Long-Term Unauthorized Access (CVSS 6.2, SoftIron HyperCloud)
- [CVE-2026-24790](https://cve.now/CVE-2026-24790.md): Welker OdorEyes EcoSystem Pulse Bypass System with XL4 Controller Missing Authentication for Critical Function (CVSS 8.2, Welker OdorEyes EcoSystem Pulse Bypass System with XL4 Cont…)
- [CVE-2026-26048](https://cve.now/CVE-2026-26048.md): Jinan USR IOT Technology Limited (PUSR) USR-W610 Missing Authentication for Critical Function (CVSS 7.5, Jinan USR IOT Technology Limited (PUSR) USR-W610)
- [CVE-2026-26049](https://cve.now/CVE-2026-26049.md): Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected Credentials (CVSS 5.7, Jinan USR IOT Technology Limited (PUSR) USR-W610)
- [CVE-2026-2818](https://cve.now/CVE-2026-2818.md): Zip Slip Path Traversal in Snapshot Archive Extraction (Windows-Specific) (CVSS 8.2, VMware Spring Data Geode · VMware Spring Data Gemfire)
- [CVE-2026-2849](https://cve.now/CVE-2026-2849.md): yeqifu warehouse Cache Sync CacheController.java syncCache access control (CVSS 5.3, yeqifu warehouse)
- [CVE-2026-2848](https://cve.now/CVE-2026-2848.md): SourceCodester Simple Responsive Tourism Website Registration Master.php sql injection (CVSS 6.9, SourceCodester Simple Responsive Tourism Website)
- [CVE-2026-24455](https://cve.now/CVE-2026-24455.md): Jinan USR IOT Technology Limited (PUSR) USR-W610 Cleartext Transmission of Sensitive Information (CVSS 7.5, Jinan USR IOT Technology Limited (PUSR) USR-W610)
- [CVE-2026-25715](https://cve.now/CVE-2026-25715.md): Jinan USR IOT Technology Limited (PUSR) USR-W610 Weak Password Requirements (CVSS 9.8, Jinan USR IOT Technology Limited (PUSR) USR-W610)
- [CVE-2026-27072](https://cve.now/CVE-2026-27072.md): WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin \<= 11.2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PixelYourSite – Your smart PIXEL (TAG) Manager)
- [CVE-2026-24959](https://cve.now/CVE-2026-24959.md): WordPress JS Help Desk plugin \<= 3.0.1 - SQL Injection vulnerability (CVSS 8.5, JoomSky JS Help Desk)
- [CVE-2026-24956](https://cve.now/CVE-2026-24956.md): WordPress Download Manager Addons for Elementor plugin \<= 1.3.0 - SQL Injection vulnerability (CVSS 9.3, Shahjada Download Manager Addons for Elementor)
- [CVE-2026-24955](https://cve.now/CVE-2026-24955.md): WordPress Whizz Plugins plugin \<= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fox-themes Whizz Plugins)
- [CVE-2026-24953](https://cve.now/CVE-2026-24953.md): WordPress Simple File List plugin \<= 6.1.15 - Arbitrary File Download vulnerability (CVSS 6.5, Mitchell Bennis Simple File List)
- [CVE-2026-24950](https://cve.now/CVE-2026-24950.md): WordPress Authorsy plugin \<= 1.0.6 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5, themeplugs Authorsy)
- [CVE-2026-24949](https://cve.now/CVE-2026-24949.md): WordPress PhotoMe theme \<= 5.7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeGoods PhotoMe)
- [CVE-2026-24948](https://cve.now/CVE-2026-24948.md): WordPress Reflector plugin \<= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fox-themes Reflector)
- [CVE-2026-24946](https://cve.now/CVE-2026-24946.md): WordPress Print Invoice & Delivery Notes for WooCommerce plugin \<= 5.8.0 - Broken Access Control vulnerability (CVSS 6.5, tychesoftwares Print Invoice & Delivery Notes for WooCommer…)
- [CVE-2026-24944](https://cve.now/CVE-2026-24944.md): WordPress Subscribe2 plugin \<= 10.44 - Broken Access Control vulnerability (CVSS 6.5, weDevs Subscribe2)
- [CVE-2026-24943](https://cve.now/CVE-2026-24943.md): WordPress Grand Conference theme \<= 5.3.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeGoods Grand Conference)
- [CVE-2026-24941](https://cve.now/CVE-2026-24941.md): WordPress WP Job Portal plugin \<= 2.4.4 - Broken Access Control vulnerability (CVSS 7.5, wpjobportal WP Job Portal)
- [CVE-2026-22384](https://cve.now/CVE-2026-22384.md): WordPress Applay - Shortcodes plugin \<= 3.7 - PHP Object Injection vulnerability (CVSS 9.8, leafcolor Applay - Shortcodes)
- [CVE-2026-22383](https://cve.now/CVE-2026-22383.md): WordPress PawFriends - Pet Shop and Veterinary WordPress theme theme \<= 1.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5, Mikado-Themes PawFriends - Pet Shop and Veterinary WordPres…)
- [CVE-2026-22381](https://cve.now/CVE-2026-22381.md): WordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme \<= 1.3 - Local File Inclusion vulnerability (CVSS 8.1, Mikado-Themes PawFriends - Pet Shop and Veterinary WordPres…)
- [CVE-2026-22380](https://cve.now/CVE-2026-22380.md): WordPress UnlimHost theme \<= 1.2.3 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes UnlimHost)
- [CVE-2026-22379](https://cve.now/CVE-2026-22379.md): WordPress Netmix theme \<= 1.0.10 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Netmix)
- [CVE-2026-22378](https://cve.now/CVE-2026-22378.md): WordPress Blabber theme \<= 1.7.0 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Blabber)
- [CVE-2026-22377](https://cve.now/CVE-2026-22377.md): WordPress Saveo theme \<= 1.1.2 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Saveo)
- [CVE-2026-22376](https://cve.now/CVE-2026-22376.md): WordPress Parkivia theme \<= 1.1.9 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Parkivia)
- [CVE-2026-22375](https://cve.now/CVE-2026-22375.md): WordPress Impacto Patronus theme \<= 1.2.3 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Impacto Patronus)
- [CVE-2026-22374](https://cve.now/CVE-2026-22374.md): WordPress Zio Alberto theme \<= 1.2.2 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Zio Alberto)
- [CVE-2026-22373](https://cve.now/CVE-2026-22373.md): WordPress Fooddy theme \<= 1.3.10 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Fooddy)
- [CVE-2026-22372](https://cve.now/CVE-2026-22372.md): WordPress Isida theme \<= 1.4.2 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Isida)
- [CVE-2026-22371](https://cve.now/CVE-2026-22371.md): WordPress Gustavo theme \<= 1.2.2 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Gustavo)
- [CVE-2026-22370](https://cve.now/CVE-2026-22370.md): WordPress Marveland theme \<= 1.3.0 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Marveland)
- [CVE-2026-22369](https://cve.now/CVE-2026-22369.md): WordPress Ironfit theme \<= 1.5 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Ironfit)
- [CVE-2026-22368](https://cve.now/CVE-2026-22368.md): WordPress Redy theme \<= 1.0.2 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Redy)
- [CVE-2026-22367](https://cve.now/CVE-2026-22367.md): WordPress Coworking theme \<= 1.6.1 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Coworking)
- [CVE-2026-22366](https://cve.now/CVE-2026-22366.md): WordPress Jude theme \<= 1.3.0 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Jude)
- [CVE-2026-22365](https://cve.now/CVE-2026-22365.md): WordPress Soleng theme \<= 1.0.5 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Soleng)
- [CVE-2026-22364](https://cve.now/CVE-2026-22364.md): WordPress SevenTrees theme \<=1.0.2 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes SevenTrees)
- [CVE-2026-22363](https://cve.now/CVE-2026-22363.md): WordPress Rhodos theme \<= 1.3.3 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Rhodos)
- [CVE-2026-22362](https://cve.now/CVE-2026-22362.md): WordPress Photolia theme \<= 1.0.3 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Photolia)
- [CVE-2026-22361](https://cve.now/CVE-2026-22361.md): WordPress A-Mart theme \<= 1.0.2 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes A-Mart)
- [CVE-2026-22357](https://cve.now/CVE-2026-22357.md): WordPress Link Whisper Free plugin \<= 0.9.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Spencer Haws Link Whisper Free)
- [CVE-2026-22356](https://cve.now/CVE-2026-22356.md): WordPress Jetpack CRM plugin \<= 6.7.0 - Local File Inclusion vulnerability (CVSS 7.5, Automattic Jetpack CRM)
- [CVE-2026-22354](https://cve.now/CVE-2026-22354.md): WordPress Woocommerce Category Banner Management plugin \<= 2.5.1 - PHP Object Injection vulnerability (CVSS 8.8, Dotstore Woocommerce Category Banner Management)
- [CVE-2026-22352](https://cve.now/CVE-2026-22352.md): WordPress Persian Woocommerce SMS plugin \<= 7.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PersianScript Persian Woocommerce SMS)
- [CVE-2026-22351](https://cve.now/CVE-2026-22351.md): WordPress WP FullCalendar plugin \<= 1.6 - Broken Access Control vulnerability (CVSS 7.5, Marcus (aka @msykes) WP FullCalendar)
- [CVE-2026-22350](https://cve.now/CVE-2026-22350.md): WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin \<= 6.3.1 - Broken Access Control vulnerability (CVSS 6.5, add-ons.org PDF for Elementor Forms + Drag And Drop Templat…)
- [CVE-2026-22346](https://cve.now/CVE-2026-22346.md): WordPress Slider Responsive Slideshow – Image slider, Gallery slideshow plugin \<= 1.5.4 - PHP Object Injection vulnerability (CVSS 8.8, A WP Life Slider Responsive Slideshow – Image slider, Galle…)
- [CVE-2026-22345](https://cve.now/CVE-2026-22345.md): WordPress Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery plugin \<= 1.6.0 - PHP Object Injection vulnerability (CVSS 8.8, A WP Life Image Gallery – Lightbox Gallery, Responsive Phot…)
- [CVE-2026-22344](https://cve.now/CVE-2026-22344.md): WordPress FiveStar theme \<= 1.7 - Local File Inclusion vulnerability (CVSS 8.1, Mikado-Themes FiveStar)
- [CVE-2026-22341](https://cve.now/CVE-2026-22341.md): WordPress Booked plugin \<= 3.0.0 - Account Takeover vulnerability (CVSS 6.7, Case-Themes Booked)
- [CVE-2025-69410](https://cve.now/CVE-2025-69410.md): WordPress Belletrist theme \<= 1.2 - Local File Inclusion vulnerability (CVSS 8.1, Edge-Themes Belletrist)
- [CVE-2025-69409](https://cve.now/CVE-2025-69409.md): WordPress PJ | Life & Business Coaching theme \<= 3.0.0 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes PJ | Life & Business Coaching)
- [CVE-2025-69408](https://cve.now/CVE-2025-69408.md): WordPress HealthFirst theme \<= 1.0.1 - Local File Inclusion vulnerability (CVSS 8.1, Mikado-Themes HealthFirst)
- [CVE-2025-69407](https://cve.now/CVE-2025-69407.md): WordPress Struktur theme \<= 2.5.1 - Local File Inclusion vulnerability (CVSS 8.1, Select-Themes Struktur)
- [CVE-2025-69406](https://cve.now/CVE-2025-69406.md): WordPress FreightCo theme \<= 1.1.7 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX FreightCo)
- [CVE-2025-69405](https://cve.now/CVE-2025-69405.md): WordPress Lorem Ipsum | Books & Media Store theme \<= 1.2.11 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Lorem Ipsum | Books & Media Store)
- [CVE-2025-69404](https://cve.now/CVE-2025-69404.md): WordPress Extreme Store theme \<= 1.5.10 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Extreme Store)
- [CVE-2025-69403](https://cve.now/CVE-2025-69403.md): WordPress Bravis Addons plugin \<= 1.3.0 - Arbitrary File Upload vulnerability (CVSS 9.9, Bravis-Themes Bravis Addons)
- [CVE-2025-69402](https://cve.now/CVE-2025-69402.md): WordPress R&F theme \<= 1.5 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX R&F)
- [CVE-2025-69401](https://cve.now/CVE-2025-69401.md): WordPress WooODT Lite plugin \<= 2.5.2 - Payment Bypass Vulnerability vulnerability (CVSS 7.5, mdalabar WooODT Lite)
- [CVE-2025-69400](https://cve.now/CVE-2025-69400.md): WordPress Yokoo theme \<= 1.1.11 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Yokoo)
- [CVE-2025-69399](https://cve.now/CVE-2025-69399.md): WordPress Cobble theme \<= 1.7 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Cobble)
- [CVE-2025-69398](https://cve.now/CVE-2025-69398.md): WordPress Plank theme \<= 1.7 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Plank)
- [CVE-2025-69397](https://cve.now/CVE-2025-69397.md): WordPress Tint theme \<= 1.7 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Tint)
- [CVE-2025-69396](https://cve.now/CVE-2025-69396.md): WordPress Splendour theme \<= 1.23 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Splendour)
- [CVE-2025-69395](https://cve.now/CVE-2025-69395.md): WordPress Gable theme \<= 1.5 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Gable)
- [CVE-2025-69394](https://cve.now/CVE-2025-69394.md): WordPress Cnvrse plugin \< 026.02.10.20 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5, Cnvrse)
- [CVE-2025-69393](https://cve.now/CVE-2025-69393.md): WordPress Exzo theme \<= 1.2.4 - Broken Access Control vulnerability (CVSS 7.5, Jthemes Exzo)
- [CVE-2025-69392](https://cve.now/CVE-2025-69392.md): WordPress iMoney plugin \<= 0.36 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, itex iMoney)
- [CVE-2025-69391](https://cve.now/CVE-2025-69391.md): WordPress Diamond theme \<= 2.4.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, GT3themes Diamond)
- [CVE-2025-69390](https://cve.now/CVE-2025-69390.md): WordPress Business Template Blocks for WPBakery (Visual Composer) Page Builder plugin \<= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, themebon Business Template Blocks for WPBakery (Visual Comp…)
- [CVE-2025-69389](https://cve.now/CVE-2025-69389.md): WordPress Visitor Maps Extended Referer Field plugin \<= 1.2.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Hugh Mungus Visitor Maps Extended Referer Field)
- [CVE-2025-69388](https://cve.now/CVE-2025-69388.md): WordPress Cliengo – Chatbot plugin \<= 3.0.4 - Broken Access Control vulnerability (CVSS 6.5, Cliengo – Chatbot)
- [CVE-2025-69387](https://cve.now/CVE-2025-69387.md): WordPress Simple Retail Menus plugin \<= 4.2.1 - Local File Inclusion vulnerability (CVSS 7.5, whatwouldjessedo Simple Retail Menus)
- [CVE-2025-69386](https://cve.now/CVE-2025-69386.md): WordPress RVCFDI para Woocommerce plugin \<= 8.1.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, realvirtualmx RVCFDI para Woocommerce)
- [CVE-2025-69385](https://cve.now/CVE-2025-69385.md): WordPress Cartify - WooCommerce Gutenberg WordPress Theme theme \<= 1.3 - Arbitrary Content Deletion vulnerability (CVSS 6.5, AgniHD Cartify - WooCommerce Gutenberg WordPress Theme)
- [CVE-2025-69384](https://cve.now/CVE-2025-69384.md): WordPress Timeline Event History plugin \<= 3.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpdiscover Timeline Event History)
- [CVE-2025-69383](https://cve.now/CVE-2025-69383.md): WordPress WP shop plugin \<= 2.6.1 - Local File Inclusion vulnerability (CVSS 7.5, Agence web Eoxia - Montpellier WP shop)
- [CVE-2025-69382](https://cve.now/CVE-2025-69382.md): WordPress Themesflat Elementor plugin \<= 1.0.1 - PHP Object Injection vulnerability (CVSS 9.8, Themesflat Elementor)
- [CVE-2025-69381](https://cve.now/CVE-2025-69381.md): WordPress WooCommerce Bulk Product Editor plugin \<= 3.0 - Broken Access Control vulnerability (CVSS 7.1, vanquish WooCommerce Bulk Product Editor)
- [CVE-2025-69380](https://cve.now/CVE-2025-69380.md): WordPress Upload Files Anywhere plugin \<= 2.8 - Arbitrary File Download vulnerability (CVSS 7.5, vanquish Upload Files Anywhere)
- [CVE-2025-69379](https://cve.now/CVE-2025-69379.md): WordPress Upload Files Anywhere plugin \<= 2.8 - Arbitrary File Deletion vulnerability (CVSS 8.6, vanquish Upload Files Anywhere)
- [CVE-2025-69378](https://cve.now/CVE-2025-69378.md): WordPress Product Filter for WooCommerce plugin \<= 9.1.2 - Privilege Escalation vulnerability (CVSS 7.2, XforWooCommerce Product Filter for WooCommerce)
- [CVE-2025-69377](https://cve.now/CVE-2025-69377.md): WordPress User Extra Fields plugin \<= 17.0 - Arbitrary File Deletion vulnerability (CVSS 7.7, vanquish User Extra Fields)
- [CVE-2025-69376](https://cve.now/CVE-2025-69376.md): WordPress User Extra Fields plugin \<= 17.0 - Arbitrary File Deletion vulnerability (CVSS 8.6, vanquish User Extra Fields)
- [CVE-2025-69375](https://cve.now/CVE-2025-69375.md): WordPress Portfolio Builder plugin \<= 1.2.5 - Local File Inclusion vulnerability (CVSS 8.1, SolverWp Portfolio Builder)
- [CVE-2025-69374](https://cve.now/CVE-2025-69374.md): WordPress Eleblog – Elementor Blog And Magazine Addons plugin \<= 2.0.3 - Local File Inclusion vulnerability (CVSS 8.1, SolverWp Eleblog – Elementor Blog And Magazine Addons)
- [CVE-2025-69373](https://cve.now/CVE-2025-69373.md): WordPress VidoRev theme \<= 2.9.9.9.9.9.7 - Local File Inclusion vulnerability (CVSS 7.5, beeteam368 VidoRev)
- [CVE-2025-69372](https://cve.now/CVE-2025-69372.md): WordPress SevenHills theme \<= 1.6.2 - PHP Object Injection vulnerability (CVSS 9.8, AncoraThemes SevenHills)
- [CVE-2025-69371](https://cve.now/CVE-2025-69371.md): WordPress KindlyCare theme \<= 1.6.1 - PHP Object Injection vulnerability (CVSS 9.8, AncoraThemes KindlyCare)
- [CVE-2025-69370](https://cve.now/CVE-2025-69370.md): WordPress Capella theme \<= 2.5.5 - PHP Object Injection vulnerability (CVSS 9.8, ThemeGoods Capella)
- [CVE-2025-69368](https://cve.now/CVE-2025-69368.md): WordPress SOHO - Photography WordPress Theme theme \<= 3.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, GT3themes SOHO - Photography WordPress Theme)
- [CVE-2025-69367](https://cve.now/CVE-2025-69367.md): WordPress Oyster - Photography WordPress Theme theme \<= 4.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, GT3themes Oyster - Photography WordPress Theme)
- [CVE-2025-69366](https://cve.now/CVE-2025-69366.md): WordPress Emerce Core plugin \<= 1.8 - SQL Injection vulnerability (CVSS 9.3, TeconceTheme Emerce Core)
- [CVE-2025-69365](https://cve.now/CVE-2025-69365.md): WordPress Uroan Core plugin \<= 1.4.4 - SQL Injection vulnerability (CVSS 9.3, TeconceTheme Uroan Core)
- [CVE-2025-69337](https://cve.now/CVE-2025-69337.md): WordPress Wolmart Core plugin \<= 1.9.6 - SQL Injection vulnerability (CVSS 9.3, don-themes Wolmart Core)
- [CVE-2025-69330](https://cve.now/CVE-2025-69330.md): WordPress Prestige theme \< 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jthemes Prestige)
- [CVE-2025-69329](https://cve.now/CVE-2025-69329.md): WordPress Prestige theme \< 1.4.1 - PHP Object Injection vulnerability (CVSS 9.8, Jthemes Prestige)
- [CVE-2025-69328](https://cve.now/CVE-2025-69328.md): WordPress Booking and Rental Manager plugin \<= 2.5.9 - PHP Object Injection vulnerability (CVSS 8.8, magepeopleteam Booking and Rental Manager)
- [CVE-2025-69326](https://cve.now/CVE-2025-69326.md): WordPress NEX-Forms plugin \<= 9.1.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Basix NEX-Forms)
- [CVE-2025-69325](https://cve.now/CVE-2025-69325.md): WordPress Primer MyData for Woocommerce plugin \<= 4.2.8 - Path Traversal vulnerability (CVSS 5.3, primersoftware Primer MyData for Woocommerce)
- [CVE-2025-69324](https://cve.now/CVE-2025-69324.md): WordPress NEX-Forms plugin \<= 9.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Basix NEX-Forms)
- [CVE-2025-69323](https://cve.now/CVE-2025-69323.md): WordPress Slimstat Analytics plugin \<= 5.3.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, VeronaLabs Slimstat Analytics)
- [CVE-2025-69322](https://cve.now/CVE-2025-69322.md): WordPress PeakShops theme \< 1.5.9 - Local File Inclusion vulnerability (CVSS 8.1, fuelthemes PeakShops)
- [CVE-2025-69310](https://cve.now/CVE-2025-69310.md): WordPress Woodly Core plugin \<= 1.4 - SQL Injection vulnerability (CVSS 9.3, TeconceTheme Woodly Core)
- [CVE-2025-69309](https://cve.now/CVE-2025-69309.md): WordPress Saasplate Core plugin \<= 1.2.8 - SQL Injection vulnerability (CVSS 9.3, TeconceTheme Saasplate Core)
- [CVE-2025-69308](https://cve.now/CVE-2025-69308.md): WordPress Nestbyte Core plugin \<= 1.2 - SQL Injection vulnerability (CVSS 9.3, TeconceTheme Nestbyte Core)
- [CVE-2025-69307](https://cve.now/CVE-2025-69307.md): WordPress Medinik Core plugin \<= 1.3.6 - SQL Injection vulnerability (CVSS 9.3, TeconceTheme Medinik Core)
- [CVE-2025-69306](https://cve.now/CVE-2025-69306.md): WordPress Electio Core plugin \<= 1.4 - SQL Injection vulnerability (CVSS 9.3, TeconceTheme Electio Core)
- [CVE-2025-69305](https://cve.now/CVE-2025-69305.md): WordPress Crete Core plugin \<= 1.4.3 - SQL Injection vulnerability (CVSS 9.3, TeconceTheme Crete Core)
- [CVE-2025-69304](https://cve.now/CVE-2025-69304.md): WordPress Allmart plugin \<= 1.1 - SQL Injection vulnerability (CVSS 9.3, TeconceTheme Allmart)
- [CVE-2025-69303](https://cve.now/CVE-2025-69303.md): WordPress ModelTheme Framework plugin \< 2.0.0 - Broken Access Control vulnerability (CVSS 7.5, ModelTheme Framework)
- [CVE-2025-69302](https://cve.now/CVE-2025-69302.md): WordPress DesignThemes Core Features plugin \<= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, DesignThemes Core Features)
- [CVE-2025-69301](https://cve.now/CVE-2025-69301.md): WordPress PhotoMe theme \<= 5.6.11 - PHP Object Injection vulnerability (CVSS 9.8, ThemeGoods PhotoMe)
- [CVE-2025-69299](https://cve.now/CVE-2025-69299.md): WordPress Oxygen theme \<= 6.0.8 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.2, Laborator Oxygen)
- [CVE-2025-69298](https://cve.now/CVE-2025-69298.md): WordPress Gauge theme \<= 6.56.4 - Broken Access Control vulnerability (CVSS 7.5, GhostPool Gauge)
- [CVE-2025-69297](https://cve.now/CVE-2025-69297.md): WordPress Aardvark Plugin plugin \<= 2.19 - Broken Access Control vulnerability (CVSS 7.5, GhostPool Aardvark Plugin)
- [CVE-2025-69296](https://cve.now/CVE-2025-69296.md): WordPress Aardvark theme \<= 4.6.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, GhostPool Aardvark)
- [CVE-2025-69295](https://cve.now/CVE-2025-69295.md): WordPress Coven Core plugin \<= 1.3 - SQL Injection vulnerability (CVSS 9.3, TeconceTheme Coven Core)
- [CVE-2025-69294](https://cve.now/CVE-2025-69294.md): WordPress PeakShops theme \<= 1.5.9 - PHP Object Injection vulnerability (CVSS 8.8, fuelthemes PeakShops)
- [CVE-2025-69063](https://cve.now/CVE-2025-69063.md): WordPress New User Approve plugin \<= 3.2.0 - Broken Access Control vulnerability (CVSS 8.6, Saad Iqbal New User Approve)
- [CVE-2025-69011](https://cve.now/CVE-2025-69011.md): WordPress Cool Tag Cloud plugin \<= 2.29 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPKube Cool Tag Cloud)
- [CVE-2025-68895](https://cve.now/CVE-2025-68895.md): WordPress AhaChat Messenger Marketing plugin \<= 1.1 - Broken Authentication vulnerability (CVSS 6.5, AhaChat Messenger Marketing)
- [CVE-2025-68880](https://cve.now/CVE-2025-68880.md): WordPress Simple Archive Generator plugin \<= 5.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, peterwsterling Simple Archive Generator)
- [CVE-2025-68863](https://cve.now/CVE-2025-68863.md): WordPress iContact for Gravity Forms plugin \<= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Zack Katz iContact for Gravity Forms)
- [CVE-2025-68862](https://cve.now/CVE-2025-68862.md): WordPress Woo File Dropzone plugin \<= 1.1.7 - Arbitrary File Deletion vulnerability (CVSS 7.7, Murtaza Bhurgri Woo File Dropzone)
- [CVE-2025-68856](https://cve.now/CVE-2025-68856.md): WordPress Mopinion Feedback Form plugin \<= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, keeswolters Mopinion Feedback Form)
- [CVE-2025-68855](https://cve.now/CVE-2025-68855.md): WordPress JobBoard Job listing plugin \<= 1.2.8 - Sensitive Data Exposure vulnerability (CVSS 5.9, themeglow JobBoard Job listing)
- [CVE-2025-68854](https://cve.now/CVE-2025-68854.md): WordPress ID Arrays plugin \<= 2.1.2 - POST-Based Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, harman79 ID Arrays)
- [CVE-2025-68853](https://cve.now/CVE-2025-68853.md): WordPress Contact Manager plugin \<= 9.1.1 - PHP Object Injection vulnerability (CVSS 8.8, Kleor Contact Manager)
- [CVE-2025-68852](https://cve.now/CVE-2025-68852.md): WordPress Court Reservation plugin \<= 1.10.13 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, webmuehle Court Reservation)
- [CVE-2025-68848](https://cve.now/CVE-2025-68848.md): WordPress amr cron manager plugin \<= 2.3 - Reflecte dCross Site Scripting (XSS) vulnerability (CVSS 7.1, anmari amr cron manager)
- [CVE-2025-68847](https://cve.now/CVE-2025-68847.md): WordPress iSape plugin \<= 0.72 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, itex iSape)
- [CVE-2025-68846](https://cve.now/CVE-2025-68846.md): WordPress Asynchronous Javascript plugin \<= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Paris Holley Asynchronous Javascript)
- [CVE-2025-68845](https://cve.now/CVE-2025-68845.md): WordPress eDS Responsive Menu plugin \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, aThemeArt Translations eDS Responsive Menu)
- [CVE-2025-68844](https://cve.now/CVE-2025-68844.md): WordPress Membee Login plugin \<= 2.3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, DaleAB Membee Login)
- [CVE-2025-68843](https://cve.now/CVE-2025-68843.md): WordPress FeedWordPress Advanced Filters plugin \<= 0.6.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bas Schuiling FeedWordPress Advanced Filters)
- [CVE-2025-68842](https://cve.now/CVE-2025-68842.md): WordPress Widget Logic Visual plugin \<= 1.52 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, totalbounty Widget Logic Visual)
- [CVE-2025-68841](https://cve.now/CVE-2025-68841.md): WordPress TopperPack – Complete Elementor Addons, theme & CPT Builder plugin \<= 1.2.1 - Local File Inclusion vulnerability (CVSS 7.5, Themepul TopperPack – Complete Elementor Addons, Theme & CP…)
- [CVE-2025-68837](https://cve.now/CVE-2025-68837.md): WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin \<= 3.3.5 - Broken Access Control vulnerability (CVSS 6.5, ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing S…)
- [CVE-2025-68834](https://cve.now/CVE-2025-68834.md): WordPress Sync Master Sheet – Product Sync with Google Sheet for WooCommerce plugin \<= 1.1.3 - Broken Access Control vulnerability (CVSS 7.5, Saiful Islam Sync Master Sheet – Product Sync with Google S…)
- [CVE-2025-68564](https://cve.now/CVE-2025-68564.md): WordPress Sendy plugin \<= 3.4.2 - Broken Access Control vulnerability (CVSS 6.5, Sendy)
- [CVE-2025-68552](https://cve.now/CVE-2025-68552.md): WordPress WooCommerce Coming Soon Product with Countdown plugin \<= 5.0 - Local File Inclusion vulnerability (CVSS 7.5, WebCodingPlace WooCommerce Coming Soon Product with Countdo…)
- [CVE-2025-68549](https://cve.now/CVE-2025-68549.md): WordPress Wiguard theme \< 2.0.1 - Arbitrary File Upload vulnerability (CVSS 9.9, zozothemes Wiguard)
- [CVE-2025-68545](https://cve.now/CVE-2025-68545.md): WordPress Nika theme \<= 1.2.14 - Local File Inclusion vulnerability (CVSS 8.1, thembay Nika)
- [CVE-2025-68543](https://cve.now/CVE-2025-68543.md): WordPress Diza theme \<= 1.3.15 - Local File Inclusion vulnerability (CVSS 8.1, thembay Diza)
- [CVE-2025-68542](https://cve.now/CVE-2025-68542.md): WordPress Checkout Gateway for IRIS plugin \<= 1.3 - Broken Access Control vulnerability (CVSS 6.5, vgdevsolutions Checkout Gateway for IRIS)
- [CVE-2025-68541](https://cve.now/CVE-2025-68541.md): WordPress Ippsum theme \<= 1.2.0 - PHP Object Injection vulnerability (CVSS 9.8, BoldThemes Ippsum)
- [CVE-2025-68539](https://cve.now/CVE-2025-68539.md): WordPress Fana theme \<= 1.1.35 - Local File Inclusion vulnerability (CVSS 8.1, thembay Fana)
- [CVE-2025-68536](https://cve.now/CVE-2025-68536.md): WordPress Zota theme \<= 1.3.14 - Local File Inclusion vulnerability (CVSS 8.1, thembay Zota)
- [CVE-2025-68534](https://cve.now/CVE-2025-68534.md): WordPress PDF for WPForms plugin \<= 6.3.0 - Broken Access Control vulnerability (CVSS 6.5, add-ons.org PDF for WPForms)
- [CVE-2025-68531](https://cve.now/CVE-2025-68531.md): WordPress ModelTheme Addons for WPBakery and Elementor plugin \< 1.5.6 - PHP Object Injection vulnerability (CVSS 8.8, ModelTheme Addons for WPBakery and Elementor)
- [CVE-2025-68526](https://cve.now/CVE-2025-68526.md): WordPress Modal Popup Box plugin \<= 1.6.1 - PHP Object Injection vulnerability (CVSS 8.8, A WP Life Modal Popup Box)
- [CVE-2025-68514](https://cve.now/CVE-2025-68514.md): WordPress Paid Member Subscriptions plugin \<= 2.16.8 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5, Cozmoslabs Paid Member Subscriptions)
- [CVE-2025-68501](https://cve.now/CVE-2025-68501.md): WordPress Mollie Payments for WooCommerce plugin \<= 8.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mollie Payments for WooCommerce)
- [CVE-2025-68495](https://cve.now/CVE-2025-68495.md): WordPress JetEngine plugin \<= 3.8.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Crocoblock JetEngine)
- [CVE-2025-68069](https://cve.now/CVE-2025-68069.md): WordPress Directorist plugin \<= 8.6.6 - Broken Access Control vulnerability (CVSS 7.1, wpWax Directorist)
- [CVE-2025-68051](https://cve.now/CVE-2025-68051.md): WordPress Shiprocket plugin \<= 2.0.8 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5, Shiprocket)
- [CVE-2025-68050](https://cve.now/CVE-2025-68050.md): WordPress Leadpages plugin \<= 1.1.3 - Broken Access Control vulnerability (CVSS 6.5, Leadpages)
- [CVE-2025-68048](https://cve.now/CVE-2025-68048.md): WordPress NextMove Lite plugin \<= 2.23.0 - Broken Access Control vulnerability (CVSS 7.5, XLPlugins NextMove Lite)
- [CVE-2025-68043](https://cve.now/CVE-2025-68043.md): WordPress LottieFiles plugin \<= 3.0.0 - Broken Access Control vulnerability (CVSS 7.3, LottieFiles)
- [CVE-2025-68042](https://cve.now/CVE-2025-68042.md): WordPress Travelpayouts plugin \<= 1.2.2 - Broken Access Control vulnerability (CVSS 6.5, Travelpayouts)
- [CVE-2025-68037](https://cve.now/CVE-2025-68037.md): WordPress Export Media URLs plugin \<= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Atlas Gondal Export Media URLs)
- [CVE-2025-68032](https://cve.now/CVE-2025-68032.md): WordPress Advanced WC Analytics plugin \<= 3.19.0 - Settings Change vulnerability (CVSS 6.5, Passionate Brains Advanced WC Analytics)
- [CVE-2025-68031](https://cve.now/CVE-2025-68031.md): WordPress افزونه پیامک حرفه ای فراز اس ام اس plugin \<= 2.7.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, faraz sms افزونه پیامک حرفه ای فراز اس ام اس)
- [CVE-2025-68028](https://cve.now/CVE-2025-68028.md): WordPress GA4WP: Google Analytics for WordPress plugin \<= 2.10.0 - Broken Access Control vulnerability (CVSS 6.5, Passionate Brains GA4WP: Google Analytics for WordPress)
- [CVE-2025-68026](https://cve.now/CVE-2025-68026.md): WordPress LC Wizard plugin \<= 2.1.1 - Settings Change vulnerability (CVSS 6.5, Niaj Morshed LC Wizard)
- [CVE-2025-68025](https://cve.now/CVE-2025-68025.md): WordPress Addonify Floating Cart For WooCommerce plugin \<= 1.2.17 - Broken Access Control vulnerability (CVSS 6.5, Addonify Floating Cart For WooCommerce)
- [CVE-2025-68024](https://cve.now/CVE-2025-68024.md): WordPress Addonify – WooCommerce Wishlist plugin \<= 2.0.15 - Settings Change vulnerability (CVSS 6.5, Addonify – WooCommerce Wishlist)
- [CVE-2025-68023](https://cve.now/CVE-2025-68023.md): WordPress Addonify – Compare Products For WooCommerce plugin \<= 1.1.17 - Settings Change vulnerability (CVSS 6.5, Addonify – Compare Products For WooCommerce)
- [CVE-2025-68022](https://cve.now/CVE-2025-68022.md): WordPress Plugin BlueX for WooCommerce plugin \<= 3.1.6 - Broken Access Control vulnerability (CVSS 7.3, soporteblue Plugin BlueX for WooCommerce)
- [CVE-2025-68021](https://cve.now/CVE-2025-68021.md): WordPress ConveyThis plugin \<= 269.9 - Broken Access Control vulnerability (CVSS 6.5, ConveyThis)
- [CVE-2025-68005](https://cve.now/CVE-2025-68005.md): WordPress Easy Hotel Booking plugin \<= 1.9.2 - Broken Access Control vulnerability (CVSS 6.5, themewant Easy Hotel Booking)
- [CVE-2025-68002](https://cve.now/CVE-2025-68002.md): WordPress Open User Map plugin \<= 1.4.16 - Arbitrary File Download vulnerability (CVSS 6.5, 100plugins Open User Map)
- [CVE-2025-68000](https://cve.now/CVE-2025-68000.md): WordPress Testimonial Slider plugin \<= 2.0.15 - Broken Access Control vulnerability (CVSS 6.5, PickPlugins Testimonial Slider)
- [CVE-2025-67998](https://cve.now/CVE-2025-67998.md): WordPress Miraculous Elementor plugin \<= 2.0.7 - Broken Authentication vulnerability (CVSS 8.8, kamleshyadav Miraculous Elementor)
- [CVE-2025-67997](https://cve.now/CVE-2025-67997.md): WordPress Travelicious theme \< 1.6.7 - PHP Object Injection vulnerability (CVSS 9.8, BoldThemes Travelicious)
- [CVE-2025-67996](https://cve.now/CVE-2025-67996.md): WordPress Nestin theme \< 1.2.6 - PHP Object Injection vulnerability (CVSS 9.8, BoldThemes Nestin)
- [CVE-2025-67995](https://cve.now/CVE-2025-67995.md): WordPress PatioTime theme \< 2.1 - PHP Object Injection vulnerability (CVSS 9.8, LoftOcean PatioTime)
- [CVE-2025-67994](https://cve.now/CVE-2025-67994.md): WordPress YayCurrency plugin \<= 3.3 - Arbitrary Content Deletion vulnerability (CVSS 7.5, YayCommerce YayCurrency)
- [CVE-2025-67993](https://cve.now/CVE-2025-67993.md): WordPress Atarim plugin \<= 4.2.1 - Broken Access Control vulnerability (CVSS 6.5, Vito Peleg Atarim)
- [CVE-2025-67992](https://cve.now/CVE-2025-67992.md): WordPress PatioTime theme \< 2.1 - Local File Inclusion vulnerability (CVSS 8.1, LoftOcean PatioTime)
- [CVE-2025-67991](https://cve.now/CVE-2025-67991.md): WordPress User Extra Fields plugin \<= 16.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, vanquish User Extra Fields)
- [CVE-2025-67990](https://cve.now/CVE-2025-67990.md): WordPress GMap Targeting plugin \<= 1.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, RealMag777 GMap Targeting)
- [CVE-2025-67988](https://cve.now/CVE-2025-67988.md): WordPress CozyStay theme \< 1.9.1 - Local File Inclusion vulnerability (CVSS 8.1, LoftOcean CozyStay)
- [CVE-2025-67987](https://cve.now/CVE-2025-67987.md): WordPress Quiz And Survey Master plugin \<= 10.3.1 - SQL Injection vulnerability (CVSS 8.5, ExpressTech Systems Quiz And Survey Master)
- [CVE-2025-67984](https://cve.now/CVE-2025-67984.md): WordPress NPS computy plugin \<= 2.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, calliko NPS computy)
- [CVE-2025-67982](https://cve.now/CVE-2025-67982.md): WordPress Urna theme \<= 2.5.12 - Local File Inclusion vulnerability (CVSS 8.1, thembay Urna)
- [CVE-2025-67981](https://cve.now/CVE-2025-67981.md): WordPress Besa theme \<= 2.3.15 - Local File Inclusion vulnerability (CVSS 8.1, thembay Besa)
- [CVE-2025-67980](https://cve.now/CVE-2025-67980.md): WordPress Hara theme \<= 1.2.17 - Local File Inclusion vulnerability (CVSS 8.1, thembay Hara)
- [CVE-2025-67979](https://cve.now/CVE-2025-67979.md): WordPress WPForms Google Sheet Connector plugin \<= 4.0.1 - Remote Code Execution (RCE) vulnerability (CVSS 9.9, WesternDeal WPForms Google Sheet Connector)
- [CVE-2025-67978](https://cve.now/CVE-2025-67978.md): WordPress Educare plugin \<= 1.6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, FixBD Educare)
- [CVE-2025-67977](https://cve.now/CVE-2025-67977.md): WordPress HAPPY plugin \<= 1.0.8 - Broken Access Control vulnerability (CVSS 8.2, VillaTheme HAPPY)
- [CVE-2025-67975](https://cve.now/CVE-2025-67975.md): WordPress aDirectory plugin \<= 3.0.3 - Broken Access Control vulnerability (CVSS 6.5, aDirectory)
- [CVE-2025-67974](https://cve.now/CVE-2025-67974.md): WordPress WPLegalPages plugin \<= 3.5.4 - Broken Access Control vulnerability (CVSS 7.5, WP Legal Pages WPLegalPages)
- [CVE-2025-67973](https://cve.now/CVE-2025-67973.md): WordPress Sunshine Photo Cart plugin \<= 3.5.6.2 - Broken Access Control vulnerability (CVSS 6.5, sunshinephotocart Sunshine Photo Cart)
- [CVE-2025-67972](https://cve.now/CVE-2025-67972.md): WordPress Zoho ZeptoMail plugin \<= 3.2.9 - Broken Access Control vulnerability (CVSS 4.3, Zoho Mail Zoho ZeptoMail)
- [CVE-2025-67971](https://cve.now/CVE-2025-67971.md): WordPress FluentCart plugin \< 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPManageNinja FluentCart)
- [CVE-2025-67970](https://cve.now/CVE-2025-67970.md): WordPress Schedula plugin \<= 1.0 - Broken Access Control vulnerability (CVSS 5.9, vertim Schedula)
- [CVE-2025-67969](https://cve.now/CVE-2025-67969.md): WordPress UPI QR Code Payment Gateway for WooCommerce plugin \<= 1.5.1 - Broken Access Control vulnerability (CVSS 6.5, knitpay UPI QR Code Payment Gateway for WooCommerce)
- [CVE-2025-67624](https://cve.now/CVE-2025-67624.md): WordPress Optimize More! – Images plugin \<= 1.1.3 - Broken Access Control vulnerability (CVSS 6.5, Arya Dhiratara Optimize More! – Images)
- [CVE-2025-67547](https://cve.now/CVE-2025-67547.md): WordPress Konte theme \<= 2.4.6 - Broken Access Control vulnerability (CVSS 6.5, uixthemes Konte)
- [CVE-2025-60183](https://cve.now/CVE-2025-60183.md): WordPress Silencesoft RSS Reader Plugin \<= 0.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Silencesoft RSS Reader)
- [CVE-2025-60087](https://cve.now/CVE-2025-60087.md): WordPress Extensive VC Addons for WPBakery page builder plugin \<= 1.9.1 - Local File Inclusion vulnerability (CVSS 8.1, Nenad Obradovic Extensive VC Addons for WPBakery page build…)
- [CVE-2025-53237](https://cve.now/CVE-2025-53237.md): WordPress WP Wizard Cloak Plugin \<= 1.0.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Soflyy WP Wizard Cloak)
- [CVE-2025-53233](https://cve.now/CVE-2025-53233.md): WordPress Storyform plugin \<= 0.6.14 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, RylanH Storyform)
- [CVE-2025-53231](https://cve.now/CVE-2025-53231.md): WordPress Easy Taxonomy Images plugin \<= 1.0.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, wpdevstudio Easy Taxonomy Images)
- [CVE-2025-53228](https://cve.now/CVE-2025-53228.md): WordPress bbpress Simple Advert Units Plugin \<= 0.41 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, jezza101 bbpress Simple Advert Units)
- [CVE-2025-53217](https://cve.now/CVE-2025-53217.md): WordPress AIO WP Builder Plugin \<= 2.0.2 - Broken Access Control Vulnerability (CVSS 7.6, staviravn AIO WP Builder)
- [CVE-2025-52744](https://cve.now/CVE-2025-52744.md): WordPress Inpersttion For Theme plugin \<= 1.0 - Arbitrary Code Execution vulnerability (CVSS 7.7, Inpersttion For Theme)
- [CVE-2024-56208](https://cve.now/CVE-2024-56208.md): WordPress NewsMash theme \<= 1.0.71 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, desertthemes NewsMash)
- [CVE-2024-54222](https://cve.now/CVE-2024-54222.md): WordPress Seraphinite Accelerator plugin \<= 2.22.15 - Authenticated Sensitive Data Exposure vulnerability (CVSS 4.3, Seraphinite Solutions Seraphinite Accelerator)
- [CVE-2024-52387](https://cve.now/CVE-2024-52387.md): WordPress Master Addons plugin \<= 2.0.9.9.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Liton Arefin Master Addons for Elementor)
- [CVE-2024-51915](https://cve.now/CVE-2024-51915.md): WordPress LiteSpeed Cache plugin \<= 6.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, LiteSpeed Technologies LiteSpeed Cache)
- [CVE-2024-50555](https://cve.now/CVE-2024-50555.md): WordPress Elementor Website Builder plugin \<= 3.29.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Elementor Website Builder)
- [CVE-2024-50452](https://cve.now/CVE-2024-50452.md): WordPress Nexter Blocks plugin \<= 3.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, POSIMYTH Nexter Blocks)
- [CVE-2024-43228](https://cve.now/CVE-2024-43228.md): WordPress SecuPress Free plugin \<= 2.2.5.3 - Broken Access Control vulnerability (CVSS 5.3, SecuPress Free)
- [CVE-2024-34438](https://cve.now/CVE-2024-34438.md): WordPress Shared Files plugin \<= 1.7.19 - Broken Access Control vulnerability (CVSS 5.3, Anssi Laitila Shared Files)
- [CVE-2026-22885](https://cve.now/CVE-2026-22885.md): EnOcean SmartServer IoT Out-of-bounds Read (CVSS 3.7, EnOcean Edge SmartServer IoT)
- [CVE-2026-20761](https://cve.now/CVE-2026-20761.md): EnOcean SmartServer IoT Command Injection (CVSS 8.1, EnOcean Edge SmartServer IoT)
- [CVE-2026-2847](https://cve.now/CVE-2026-2847.md): UTT HiPER 520 Web Management formReleaseConnect sub\_44EFB4 os command injection (CVSS 8.6, UTT HiPER)
- [CVE-2026-2846](https://cve.now/CVE-2026-2846.md): UTT HiPER 520 Web Management formPdbUpConfig sub\_44D264 os command injection (CVSS 8.6, UTT HiPER)
- [CVE-2025-52603](https://cve.now/CVE-2025-52603.md): HCL Connections is vulnerable to information disclosure (CVSS 3.5, HCLSoftware Connections)
- [CVE-2025-14055](https://cve.now/CVE-2025-14055.md): Integer underflow in Secure NCP host (CVSS 2.4, silabs.com Simplicity SDK, Gecko SDK)
- [CVE-2026-21627](https://cve.now/CVE-2026-21627.md): Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla (CVSS 9.5, tassos.gr Novarain/Tassos Framework · tassos.gr Convert… +4)
- [CVE-2025-14547](https://cve.now/CVE-2025-14547.md): ECJ-PAKE Integer Underflow Vulnerability in Silicon Labs PSA Crypto and SE Manager APIs (CVSS 2.3, silabs.com Simplicity SDK · silabs.com Gecko SDK)
- [CVE-2025-10970](https://cve.now/CVE-2025-10970.md): SQLi in Kolay Software's Talentics (CVSS 9.8, Kolay Software Talentics)
- [CVE-2026-2486](https://cve.now/CVE-2026-2486.md): Master Addons For Elementor \<= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma\_el\_bh\_table\_btn\_text' (CVSS 6.4, litonice13 Master Addons For Elementor – Widgets, Extension…)
- [CVE-2026-21620](https://cve.now/CVE-2026-21620.md): TFTP Path Traversal (CVSS 2.3, Erlang OTP)
- [CVE-2026-26050](https://cve.now/CVE-2026-26050.md): The installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール versions prior to Ver.1.3.7 contains an issue with the DLL search path, which may lead to (CVSS 7.8, Ricoh Company ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール)
- [CVE-2025-59819](https://cve.now/CVE-2025-59819.md): Authenticated Arbitrary File Read via filepath parameter (CVSS 6.5, zenitel alphacom\_xe\_audio\_server)
- [CVE-2026-26370](https://cve.now/CVE-2026-26370.md): WordPress Plugin "Survey Maker" versions 5.1.7.7 and prior contain a cross-site scripting vulnerability. (CVSS 6.1, Ays Pro Survey Maker)
- [CVE-2026-2825](https://cve.now/CVE-2026-2825.md): rachelos WeRSS we-mp-rss Article fix.py fix\_html cross site scripting (CVSS 5.1, rachelos WeRSS we-mp-rss)
- [CVE-2026-2824](https://cve.now/CVE-2026-2824.md): Comfast CF-E7 webmggnt mbox-config sub\_441CF4 command injection (CVSS 5.3, Comfast CF-E7)
- [CVE-2026-2823](https://cve.now/CVE-2026-2823.md): Comfast CF-E7 webmggnt mbox-config sub\_41ACCC command injection (CVSS 5.3, Comfast CF-E7)
- [CVE-2026-2739](https://cve.now/CVE-2026-2739.md): This affects versions of the package bn.js before 5.2.3. (CVSS 6.9, bn.js)
- [CVE-2026-2822](https://cve.now/CVE-2026-2822.md): JeecgBoot Backend airag\_app,1,create\_by sql injection (CVSS 5.3, JeecgBoot)
- [CVE-2026-26996](https://cve.now/CVE-2026-26996.md): minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern (CVSS 8.7, isaacs minimatch · minimatch)
- [CVE-2026-26994](https://cve.now/CVE-2026-26994.md): uTLS ServerHellos are accepted without checking TLS 1.3 downgrade canaries (CVSS 6.5, refraction-networking utls · github.com/refraction-networki…)
- [CVE-2026-27017](https://cve.now/CVE-2026-27017.md): uTLS has a Chrome Parrot Fingerprint Vulnerability due to GREASE ECH Cipher Suite Mismatch (CVSS 2.3, refraction-networking utls · github.com/refraction-networki…)
- [CVE-2026-26993](https://cve.now/CVE-2026-26993.md): Flare has XSS vulnerability in Raw File Preview (CVSS 4.6, FlintSH Flare)
- [CVE-2026-2821](https://cve.now/CVE-2026-2821.md): Fujian Smart Integrated Management Platform System XCamera.ashx sql injection (CVSS 6.9, Fujian Smart Integrated Management Platform System)
- [CVE-2026-26992](https://cve.now/CVE-2026-26992.md): LibreNMS has Stored Cross-Site Scripting via unsanitized /port-groups name (CVSS 5.1, librenms · librenms/librenms)
- [CVE-2026-2384](https://cve.now/CVE-2026-2384.md): Quiz Maker \<= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, ays-pro Quiz Maker)
- [CVE-2026-26991](https://cve.now/CVE-2026-26991.md): LibreNMS vulnerable to Stored Cross-site Scripting through unsanitized /device-groups name (CVSS 5.1, librenms · librenms/librenms)
- [CVE-2026-2820](https://cve.now/CVE-2026-2820.md): Fujian Smart Integrated Management Platform System XAccessPermissionPlus.ashx sql injection (CVSS 6.9, Fujian Smart Integrated Management Platform System)
- [CVE-2026-26065](https://cve.now/CVE-2026-26065.md): calibre: Path Traversal can Lead to Arbitrary File Write and Potential Code Execution (CVSS 9.3, kovidgoyal calibre)
- [CVE-2026-26064](https://cve.now/CVE-2026-26064.md): calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution (CVSS 9.3, kovidgoyal calibre)
- [CVE-2026-27016](https://cve.now/CVE-2026-27016.md): LibreNMS has Stored XSS in Custom OID - unit parameter missing strip\_tags() (CVSS 5.4, librenms · librenms/librenms)
- [CVE-2026-2819](https://cve.now/CVE-2026-2819.md): Dromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorization (CVSS 5.3, Dromara RuoYi-Vue-Plus)
- [CVE-2026-26990](https://cve.now/CVE-2026-26990.md): LibreNMS has Time-Based Blind SQL Injection in address-search.inc.php (CVSS 8.8, librenms · librenms/librenms)
- [CVE-2026-26989](https://cve.now/CVE-2026-26989.md): LibreNMS has Stored XSS in Alert Rule (CVSS 4.3, librenms · librenms/librenms)
- [CVE-2026-26988](https://cve.now/CVE-2026-26988.md): LibreNMS: SQL Injection in ajax\_table.php spreads through a covert data stream (CVSS 9.3, librenms · librenms/librenms)
- [CVE-2026-26987](https://cve.now/CVE-2026-26987.md): LibreNMS affected by reflected XSS via email field (CVSS 5.3, librenms · librenms/librenms)
- [CVE-2026-26960](https://cve.now/CVE-2026-26960.md): node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction (CVSS 7.1, isaacs node-tar · tar)
- [CVE-2026-26980](https://cve.now/CVE-2026-26980.md): Ghost has a SQL Injection in its Content API (CVSS 9.4, TryGhost Ghost · ghost)
- [CVE-2026-26977](https://cve.now/CVE-2026-26977.md): Frappe Learning Management System exposes details of unpublished courses to unauthorized users (CVSS 6.9, frappe lms)
- [CVE-2026-26975](https://cve.now/CVE-2026-26975.md): Music Assistant Server Path Traversal in Playlist Update API Allows Remote Code Execution (CVSS 8.8, music-assistant server)
- [CVE-2026-26974](https://cve.now/CVE-2026-26974.md): Sylde has Improper Control of Generation of Code (CVSS 7.6, Tygo-van-den-Hurk Slyde · @tygo-van-den-hurk/slyde)
- [CVE-2025-30416](https://cve.now/CVE-2025-30416.md): Sensitive data disclosure and manipulation due to missing authorization. (CVSS 10.0, Acronis Cyber Protect)
- [CVE-2025-30410](https://cve.now/CVE-2025-30410.md): Sensitive data disclosure and manipulation due to missing authentication. (CVSS 9.8, Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect)
- [CVE-2025-30412](https://cve.now/CVE-2025-30412.md): Sensitive data disclosure and manipulation due to improper authentication. (CVSS 10.0, Acronis Cyber Protect)
- [CVE-2025-30411](https://cve.now/CVE-2025-30411.md): Sensitive data disclosure and manipulation due to improper authentication. (CVSS 10.0, Acronis Cyber Protect)
- [CVE-2026-26967](https://cve.now/CVE-2026-26967.md): PJSIP has a Heap-based Buffer Overflow vulnerability in its H.264 unpacketizer (CVSS 8.1, pjsip pjproject)
- [CVE-2021-35402](https://cve.now/CVE-2021-35402.md): PROLiNK PRC2402M 20190909 before 2021-06-13 allows live\_api.cgi?page=satellite\_list OS command injection via shell metacharacters in the ip (CVSS 10.0, PROLiNK PRC2402M)
- [CVE-2025-67438](https://cve.now/CVE-2025-67438.md): A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaS (CVSS 6.1, @sync-in/server)
- [CVE-2025-70831](https://cve.now/CVE-2025-70831.md): A Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php interface. (CVSS 9.8)
- [CVE-2025-70833](https://cve.now/CVE-2025-70833.md): An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the a (CVSS 9.4)
- [CVE-2026-26721](https://cve.now/CVE-2026-26721.md): An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to obtain sensitive information via t (CVSS 7.1)
- [CVE-2026-26722](https://cve.now/CVE-2026-26722.md): An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to escalate privileges via PIN compon (CVSS 9.4)
- [CVE-2026-26723](https://cve.now/CVE-2026-26723.md): Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. (CVSS 8.2)
- [CVE-2026-26724](https://cve.now/CVE-2026-26724.md): Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. (CVSS 7.6)
- [CVE-2026-26725](https://cve.now/CVE-2026-26725.md): An issue in edu Business Solutions Print Shop Pro WebDesk v.18.34 (fixed in 19.76) allows a remote attacker to escalate privileges via the A (CVSS 9.8)
- [CVE-2026-26745](https://cve.now/CVE-2026-26745.md): OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency\_symbol configuration field. (CVSS 5.3)
- [CVE-2026-26746](https://cve.now/CVE-2026-26746.md): OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. (CVSS 8.8)
- [CVE-2026-26747](https://cve.now/CVE-2026-26747.md): A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServicePro (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.