CVEs published March 5, 2026
487 CVEs were published on March 5, 2026: 68 critical, 314 high.
- Published
- 487
- Critical
- 68
- High
- 314
- Medium
- 100
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 146
Most affected products
- OpenClaw
- 38
- Acronis Cyber Protect
- 18
- Huawei HarmonyOS
- 15
- rustdesk-client RustDesk Client
- 10
- International Datacasting SFX2100 Satellite Receiver
- 8
- gogs · gogs.io/gogs
- 6
- OpenClaw · clawdbot
- 5
- epower.ie
- 4
- FreePBX security-reporting
- 4
- frappe
- 3
Critical 68
- CVE-2026-22552ePower epower.ie Missing Authentication for Critical Functionepower.ie
- CVE-2026-21536Microsoft Devices Pricing Program Remote Code Execution VulnerabilityMicrosoft Devices Pricing Program
- CVE-2026-28474OpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name SpoofingOpenClaw nextcloud-talk · @openclaw/nextcloud-talk
- CVE-2026-28472OpenClaw < 2026.2.2 - Device Identity Check Bypass in Gateway WebSocket Connect HandshakeOpenClaw
- CVE-2026-28470OpenClaw < 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double QuotesOpenClaw
- CVE-2026-28466OpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval BypassOpenClaw
- CVE-2026-28446OpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix MatchingOpenClaw
- CVE-2026-28391OpenClaw < 2026.2.2 - Command Injection via cmd.exe Parsing Bypass in Allowlist EnforcementOpenClaw
- CVE-2026-21622Password Reset Tokens Do Not Expirehexpm
- CVE-2025-55208Chamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded Fileschamilo-lms
- CVE-2026-29188File Browser: TUS Delete Endpoint Bypasses Delete Permission Checkfilebrowser · github.com/filebrowser/filebrowser +1
- CVE-2026-0848Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loadingnltk/nltk · nltk
- CVE-2026-28353Trivy Vulnerability Scanner: Unauthorized AI Agent Execution Code Included in OpenVSX Extension Releaseaquasecurity trivy-vscode-extension
- CVE-2026-25921Gogs: Cross-repository LFS object overwrite via missing content hash verificationgogs · gogs.io/gogs
- CVE-2025-13476Rakuten Viber uses broken or risky cryptographic AlgorithmRakuten Viber Cloak - Android · Rakuten Viber Cloak - Windo…
- CVE-2026-27944Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-24457An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQEclipse Foundation Eclipse OpenMQ · Eclipse Foundation Ecli…
- CVE-2026-30797RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Serverrustdesk-client RustDesk Client
- CVE-2026-30793RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmationrustdesk-client RustDesk Client
- CVE-2026-2599Database for Contact Form 7, WPforms, Elementor forms <= 1.4.7 - Unauthenticated PHP Object Injection via 'download_csv'crmperks Database for Contact Form 7, WPforms, Elementor fo…
- CVE-2026-21628Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomlaastroidframe.work Astroid Template Framework
- CVE-2026-28536Authentication bypass vulnerability in the device authentication module.Huawei HarmonyOS
- CVE-2026-2743SEPPmail User Web Interface Arbitrary File Write to RCESeppMail
- CVE-2026-1678dns: memory‑safety issue in the DNS name parserzephyrproject-rtos Zephyr
- CVE-2026-2418Login with Salesforce <= 1.0.2 - Unauthenticated Authentication BypassLogin with Salesforce
- CVE-2026-28115WordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - SQL Injection vulnerabilityloopus WP Attractive Donations System - Easy Stripe & Paypa…
- CVE-2026-28114WordPress WooCommerce License Manager plugin <= 7.0.6 - Arbitrary File Upload vulnerabilityfirassaidi WooCommerce License Manager
- CVE-2026-28105WordPress Good Energy theme <= 1.7.7 - PHP Object Injection vulnerabilityThemeREX Good Energy
- CVE-2026-28074WordPress Pizza House theme <= 1.4.0 - PHP Object Injection vulnerabilityThemeREX Pizza House
- CVE-2026-28043WordPress Healer - Doctor, Clinic & Medical WordPress Theme theme <= 1.0.0 - Local File Inclusion vulnerabilityThemeREX Healer - Doctor, Clinic & Medical WordPress Theme
- CVE-2026-27984WordPress Widget Options plugin <= 4.1.3 - Remote Code Execution (RCE) vulnerabilityMarketing Fire Widget Options
- CVE-2026-27983WordPress LMS Elementor Pro plugin <= 1.0.4 - Privilege Escalation vulnerabilitydesignthemes LMS Elementor Pro
- CVE-2026-27439WordPress Dentario theme <= 1.5 - PHP Object Injection vulnerabilityThemeREX Dentario
- CVE-2026-27438WordPress Kingler theme <= 1.7 - PHP Object Injection vulnerabilityThemeREX Kingler
- CVE-2026-27437WordPress Tennis Club theme <= 1.2.3 - PHP Object Injection vulnerabilityThemeREX Tennis Club
- CVE-2026-27417WordPress Sweet Date theme < 4.0.1 - PHP Object Injection vulnerabilitySeventhQueen Sweet Date
- CVE-2026-27389WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerabilitydesignthemes WeDesignTech Ultimate Booking Addon
- CVE-2026-27384WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerabilityBoldGrid W3 Total Cache
- CVE-2026-24960WordPress Charety theme < 2.0.2 - Arbitrary File Upload vulnerabilityzozothemes Charety
- CVE-2026-23802WordPress AI Engine plugin <= 3.3.2 - Arbitrary File Upload vulnerabilityJordy Meow AI Engine
- CVE-2026-22501WordPress Mounthood theme <= 1.3.2 - PHP Object Injection vulnerabilityaxiomthemes Mounthood
- CVE-2026-22497WordPress Jardi theme <= 1.7.2 - PHP Object Injection vulnerabilityAncoraThemes Jardi
- CVE-2026-22475WordPress Estate theme <= 1.3.4 - PHP Object Injection vulnerabilityaxiomthemes Estate
- CVE-2026-22474WordPress Equestrian Centre theme <= 1.5 - PHP Object Injection vulnerabilityThemeREX Equestrian Centre
- CVE-2026-22454WordPress Solaris theme <= 2.5 - PHP Object Injection vulnerabilityThemeREX Solaris
- CVE-2026-22453WordPress Pets Club theme <= 2.3 - PHP Object Injection vulnerabilityThemeREX Pets Club
- CVE-2026-22451WordPress Handyman theme <= 1.4.7 - PHP Object Injection vulnerabilityAncoraThemes Handyman
- CVE-2026-22417WordPress Grand Wedding theme < 3.1.11 - PHP Object Injection vulnerabilityThemeGoods Grand Wedding
- CVE-2026-22390WordPress Builderall Builder for WordPress plugin <= 3.0.1 - Remote Code Execution (RCE) vulnerabilityBuilderall Builder for WordPress
- CVE-2025-69338WordPress Riode Core plugin <= 1.6.26 - SQL Injection vulnerabilitydon-themes Riode Core
- CVE-2025-68555WordPress Nutrie theme < 2.0.1 - Arbitrary File Upload vulnerabilityzozothemes Nutrie
- CVE-2025-68554WordPress Keenarch theme < 2.0.1 - Arbitrary File Upload vulnerabilityzozothemes Keenarch
- CVE-2025-68553WordPress Lendiz theme < 2.0.1 - Arbitrary File Upload vulnerabilityzozothemes Lendiz
- CVE-2025-54001WordPress Classter theme <= 2.5 - PHP Object Injection vulnerabilityThemeREX Classter
- CVE-2026-23767ESC/POS, a printer control language designed by Seiko Epson Corporation, lacks mechanisms for user authentication and command authorization,Seiko Epson ESC/POS
- CVE-2026-29127Incorrect Permission Assignment(777) on `monitor` Users Home Directory Containing SUID Root Binaries in IDC SFX2100International Datacasting SFX2100 Satellite Receiver
- CVE-2024-57854Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generatorDOUGDUDE Net::NSCA::Client
- CVE-2025-40931Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session idCHORNY Apache::Session::Generate::MD5
- CVE-2026-3257UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite libraryTOKUHIROM UnQLite
- CVE-2026-3381Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlibPMQS Compress::Raw::Zlib
- CVE-2025-40926Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurelyKAZEBURO Plack::Middleware::Session::Simple
- CVE-2025-29165An issue in D-Link DIR-1253 MESH V1.6.1684 allows an attacker to escalate privileges via the etc/shadow.sample component
- CVE-2025-70229Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSchedule.
- CVE-2025-70230Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetDDNS.
- CVE-2025-70231D-Link DIR-513 version 1.10 contains a critical-level vulnerability.
- CVE-2025-70232Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetMACFilter.
- CVE-2025-70233Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetEnableWizard.
- CVE-2025-70948A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and exe@perfood/couch-auth
High 314
- CVE-2026-28722Local privilege escalation due to improper soft link handling.Acronis Cyber Protect
- CVE-2026-28721Local privilege escalation due to improper soft link handling.Acronis Cyber Protect
- CVE-2026-28713Default credentials set for local privileged user in Virtual Appliance.Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- CVE-2026-28710Sensitive information disclosure and manipulation due to improper authentication.Acronis Cyber Protect
- CVE-2025-11792Local privilege escalation due to DLL hijacking vulnerability.Acronis Cyber Protect Cloud Agent
- CVE-2026-28727Local privilege escalation due to insecure Unix socket permissions.Acronis Cyber Protect · Acronis True Image
- CVE-2026-24912ePower epower.ie Insufficient Session Expirationepower.ie
- CVE-2026-27778ePower epower.ie Improper Restriction of Excessive Authentication Attemptsepower.ie
- CVE-2026-26125Payment Orchestrator Service Elevation of Privilege VulnerabilityMicrosoft Payment Orchestrator Service
- CVE-2026-29613OpenClaw < 2026.2.12 - Webhook Authentication Bypass via Loopback remoteAddress TrustOpenClaw
- CVE-2026-29611OpenClaw < 2026.2.14 - Local File Inclusion via mediaPath Parameter in BlueBubbles Media HandlingOpenClaw
- CVE-2026-29610OpenClaw < 2026.2.14 - Command Hijacking via Unsafe PATH HandlingOpenClaw
- CVE-2026-29609OpenClaw < 2026.2.14 - Denial of Service via Unbounded URL-backed Media FetchOpenClaw
- CVE-2026-28485OpenClaw 2026.1.5 < 2026.2.12 - Missing Authentication in Browser Control HTTP EndpointsOpenClaw
- CVE-2026-28482OpenClaw < 2026.2.12 - Path Traversal via Unsanitized sessionId and sessionFile ParametersOpenClaw
- CVE-2026-28479OpenClaw < 2026.2.15 - Cache Poisoning via Deprecated SHA-1 Hash in Sandbox ConfigurationOpenClaw
- CVE-2026-28478OpenClaw < 2026.2.13 - Denial of Service via Unbounded Webhook Request Body BufferingOpenClaw · clawdbot
- CVE-2026-28473OpenClaw < 2026.2.2 - Authorization Bypass via /approve Chat CommandOpenClaw
- CVE-2026-28469OpenClaw < 2026.2.14 - Cross-Account Policy Context Misrouting via Shared Webhook Path AmbiguityOpenClaw · clawdbot
- CVE-2026-28468OpenClaw 2026.1.29-beta.1 < 2026.2.14 - Authentication Bypass in Sandbox Browser Bridge ServerOpenClaw
- CVE-2026-28465OpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded HeadersOpenClaw voice-call · @openclaw/voice-call +1
- CVE-2026-28464OpenClaw < 2026.2.12 - Timing Attack in Hooks Token AuthenticationOpenClaw
- CVE-2026-28463OpenClaw < 2026.2.14 - Arbitrary File Read via Shell Expansion in Safe Bins AllowlistOpenClaw
- CVE-2026-28462OpenClaw < 2026.2.13 - Path Traversal in Trace and Download Output PathsOpenClaw
- CVE-2026-28459OpenClaw < 2026.2.12 - Arbitrary File Write via Untrusted sessionFile PathOpenClaw
- CVE-2026-28458OpenClaw 2026.1.20 < 2026.2.1 - Missing Authentication in Browser Relay /cdp WebSocket EndpointOpenClaw · moltbot
- CVE-2026-28456OpenClaw 2026.1.5 < 2026.2.14 - Arbitrary Code Execution via Unsafe Hook Module Path HandlingOpenClaw
- CVE-2026-28454OpenClaw < 2026.2.2 - Authorization Bypass via Unauthenticated Telegram WebhookOpenClaw
- CVE-2026-28453OpenClaw < 2026.2.14 - Zip Slip Path Traversal in TAR Archive ExtractionOpenClaw
- CVE-2026-28450OpenClaw < 2026.2.12 - Unauthenticated Profile Tampering via Nostr Plugin HTTP EndpointsOpenClaw
- CVE-2026-28447OpenClaw 2026.1.29-beta.1 < 2026.2.1 - Path Traversal in Plugin Installation via Package NameOpenClaw
- CVE-2026-28393OpenClaw 2.0.0-beta3 < 2026.2.14 - Arbitrary JavaScript Module Loading via Hook Transform Path TraversalOpenClaw
- CVE-2026-28392OpenClaw < 2026.2.14 - Privilege Escalation in Slack Slash Command Handler via Direct MessagesOpenClaw
- CVE-2026-28492File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directoryfilebrowser · github.com/filebrowser/filebrowser/v2 +1
- CVE-2026-28442ZimaOS: Arbitrary Deletion of Internal System Files via API Path ManipulationIceWhaleTech ZimaOS
- CVE-2026-29077Frappe: Broken Access Control in DocSharefrappe
- CVE-2026-28405MarkUs: Stored XSS in Submission HTML Preview Enables Instructor-Context ActionsMarkUsProject Markus
- CVE-2026-28790OliveTin: Unauthenticated Action Termination via KillAction When Guests Must LoginOliveTin · github.com/OliveTin/OliveTin
- CVE-2026-28789OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handlingOliveTin · github.com/OliveTin/OliveTin
- CVE-2026-28342OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API EndpointOliveTin · github.com/OliveTin/OliveTin
- CVE-2026-21621Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Accesshexpm
- CVE-2025-13350Use-after-free of orphaned AF_UNIX in Ubuntu builds of Linux kernelCanonical Ubuntu Linux
- CVE-2026-26276Gogs: DOM-based XSS via milestone selectiongogs · gogs.io/gogs
- CVE-2026-26194Gogs: Release tag option injection in release deletiongogs · gogs.io/gogs
- CVE-2026-26022Gogs: Stored XSS via data URI in issue commentsgogs · gogs.io/gogs
- CVE-2026-3047Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated loginRed Hat build of Keycloak · org.keycloak:keycloak-broker-sa…
- CVE-2026-3009Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)Red Hat build of Keycloak · Red Hat JBoss Enterprise App… +2
- CVE-2026-28287FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX EndpointsFreePBX security-reporting
- CVE-2026-3459Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.5 - Unauthenticated Arbitrary File Uploadglenwpcoder Drag and Drop Multiple File Upload for Contact…
- CVE-2026-28284FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles ModuleFreePBX security-reporting
- CVE-2026-28210FreePBX: Authenticated SQL Injection in CDR (Call Data Record) ReportsFreePBX security-reporting
- CVE-2026-28209FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integrationFreePBX security-reporting
- CVE-2026-29054Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)traefik · github.com/traefik/traefik/v2 +2
- CVE-2026-26999Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS)traefik · github.com/traefik/traefik +2
- CVE-2026-30785RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305)rustdesk-client RustDesk Client
- CVE-2026-30798RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payloadrustdesk-client RustDesk Client
- CVE-2026-25048xgrammar: Multi-layer nesting causes DoSmlc-ai xgrammar · xgrammar
- CVE-2026-30795RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failurerustdesk-client RustDesk Client
- CVE-2026-30792RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settingsrustdesk-client RustDesk Client
- CVE-2026-30791RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validationrustdesk-client RustDesk Client
- CVE-2026-27748Avira Internet Security Arbitrary File Deletion via Improper Link ResolutionGen Digital Avira Internet Security
- CVE-2026-27749Avira Internet Security System Speedup Insecure DeserializationGen Digital Avira Internet Security
- CVE-2026-27750Avira Internet Security Optimizer TOCTOUGen Digital Avira Internet Security
- CVE-2026-3598RustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of Encryptionrustdesk-server-pro RustDesk Server Pro
- CVE-2026-1720WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation <= 1.4.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installationwpxpo WowOptin: Next-Gen Popup Maker – Create Stunning Popu…
- CVE-2026-1605In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:jetty-…
- CVE-2026-28542Permission bypass vulnerability in the system service framework.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-28548Vulnerability of improper verification in the email application.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-1321Membership Plugin – Restrict Content <= 3.2.20 - Unauthenticated Privilege Escalation via 'rcp_level'stellarwp Membership Plugin – Restrict Content
- CVE-2026-25702nftables disabled due to incorrect kernel backportSUSE Linux Enterprise Server
- CVE-2026-28137WordPress MediCenter - Health Medical Clinic WordPress Theme theme <= 14.9 - Reflected Cross Site Scripting (XSS) vulnerabilityQuanticaLabs MediCenter - Health Medical Clinic
- CVE-2026-28135WordPress Royal Elementor Addons plugin <= 1.7.1052 - Other vulnerability Type vulnerabilityWP Royal Royal Elementor Addons
- CVE-2026-28134WordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerabilityCrocoblock JetEngine
- CVE-2026-28133WordPress Filr plugin <= 1.2.14 - Arbitrary File Upload vulnerabilityWP Chill Filr
- CVE-2026-28130WordPress UDesign theme <= 4.14.0 - Reflected Cross Site Scripting (XSS) vulnerabilityAndonDesign UDesign
- CVE-2026-28129WordPress Little Birdies theme <= 1.3.16 - Local File Inclusion vulnerabilityaxiomthemes Little Birdies
- CVE-2026-28128WordPress Verse theme <= 1.7.0 - Local File Inclusion vulnerabilityThemeREX Verse
- CVE-2026-28127WordPress Lawyer Directory plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilitye-plugins Lawyer Directory
- CVE-2026-28126WordPress RH Frontend Publishing Pro plugin < 4.3.4 - Cross Site Scripting (XSS) vulnerabilitysizam RH Frontend Publishing Pro
- CVE-2026-28125WordPress Midi theme <= 1.14 - Local File Inclusion vulnerabilityAncoraThemes Midi
- CVE-2026-28124WordPress Notarius theme <= 1.9 - Local File Inclusion vulnerabilityAncoraThemes Notarius
- CVE-2026-28123WordPress Veil theme <= 1.9 - Local File Inclusion vulnerabilityAncoraThemes Veil
- CVE-2026-28122WordPress ListingPro plugin <= 2.9.8 - Reflected Cross Site Scripting (XSS) vulnerabilityCridioStudio ListingPro
- CVE-2026-28121WordPress Anderson theme <= 1.4.2 - Local File Inclusion vulnerabilityAncoraThemes Anderson
- CVE-2026-28120WordPress Dr.Patterson theme <= 1.3.2 - Local File Inclusion vulnerabilityThemeREX Dr.Patterson
- CVE-2026-28119WordPress Nirvana theme <= 2.6 - Local File Inclusion vulnerabilityaxiomthemes Nirvana
- CVE-2026-28118WordPress Welldone theme <= 2.4 - Local File Inclusion vulnerabilityaxiomthemes Welldone
- CVE-2026-28117WordPress smart SEO theme <= 2.9 - Local File Inclusion vulnerabilityaxiomthemes smart SEO
- CVE-2026-28113WordPress Ultimate Learning Pro plugin <= 3.9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityazzaroco Ultimate Learning Pro
- CVE-2026-28112WordPress AllInOne - Banner Rotator plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup AllInOne - Banner Rotator
- CVE-2026-28110WordPress LambertGroup - AllInOne - Banner with Playlist plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup - AllInOne - Banner with Playlist
- CVE-2026-28109WordPress LambertGroup - AllInOne - Content Slider plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup - AllInOne - Content Slider
- CVE-2026-28108WordPress LambertGroup - AllInOne - Banner with Thumbnails plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup - AllInOne - Banner with Thumbnails
- CVE-2026-28107WordPress Muzicon theme <= 1.9.0 - Local File Inclusion vulnerabilityThemeREX Muzicon
- CVE-2026-28103WordPress LBG Zoominoutslider plugin <= 5.4.5 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup LBG Zoominoutslider
- CVE-2026-28102WordPress UberSlider Classic plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup UberSlider Classic
- CVE-2026-28101WordPress UberSlider MouseInteraction plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup UberSlider MouseInteraction
- CVE-2026-28100WordPress UberSlider PerpetuumMobile plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup UberSlider PerpetuumMobile
- CVE-2026-28099WordPress UberSlider Ultra plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup UberSlider Ultra
- CVE-2026-28098WordPress Save Life theme <= 1.2.13 - Local File Inclusion vulnerabilityThemeREX Save Life
- CVE-2026-28097WordPress Artrium theme <= 1.0.14 - Local File Inclusion vulnerabilityThemeREX Artrium
- CVE-2026-28096WordPress WealthCo theme <= 2.18 - Local File Inclusion vulnerabilityThemeREX WealthCo
- CVE-2026-28095WordPress Marcell theme <= 1.2.14 - Local File Inclusion vulnerabilityThemeREX Marcell
- CVE-2026-28094WordPress RexCoin theme <= 1.2.6 - Local File Inclusion vulnerabilityThemeREX RexCoin
- CVE-2026-28093WordPress Ozisti theme <= 1.1.10 - Local File Inclusion vulnerabilityThemeREX Ozisti
- CVE-2026-28092WordPress Sounder theme <= 1.3.11 - Local File Inclusion vulnerabilityThemeREX Sounder
- CVE-2026-28091WordPress Coleo theme <= 1.1.7 - Local File Inclusion vulnerabilityThemeREX Coleo
- CVE-2026-28090WordPress Gamezone theme <= 1.1.11 - Local File Inclusion vulnerabilityThemeREX Gamezone
- CVE-2026-28089WordPress Daiquiri theme <= 1.2.4 - Local File Inclusion vulnerabilityThemeREX Daiquiri
- CVE-2026-28088WordPress Aqualots theme <= 1.1.6 - Local File Inclusion vulnerabilityThemeREX Aqualots
- CVE-2026-28087WordPress Filmax theme <= 1.1.11 - Local File Inclusion vulnerabilityThemeREX Filmax
- CVE-2026-28086WordPress Run Gran theme <= 2.0 - Local File Inclusion vulnerabilityThemeREX Run Gran
- CVE-2026-28085WordPress Mahogany theme <= 2.9 - Local File Inclusion vulnerabilityThemeREX Mahogany
- CVE-2026-28084WordPress Bazinga theme <= 1.1.9 - Local File Inclusion vulnerabilityThemeREX Bazinga
- CVE-2026-28081WordPress Windsor theme <= 2.5.0 - Local File Inclusion vulnerabilityThemeREX Windsor
- CVE-2026-28079WordPress Conquerors theme <= 1.2.13 - Local File Inclusion vulnerabilityaxiomthemes Conquerors
- CVE-2026-28077WordPress Vapester theme <= 1.1.10 - Local File Inclusion vulnerabilityThemeREX Vapester
- CVE-2026-28076WordPress Guff theme <= 1.0.1 - Broken Access Control vulnerabilityFrenify Guff
- CVE-2026-28075WordPress Porto theme <= 7.6.2 - Reflected Cross Site Scripting (XSS) vulnerabilityp-themes Porto
- CVE-2026-28072WordPress pixfort Core plugin <= 3.2.22 - Reflected Cross Site Scripting (XSS) vulnerabilitypixfort Core
- CVE-2026-28069WordPress Le Truffe theme <= 1.1.7 - Local File Inclusion vulnerabilityThemeREX Le Truffe
- CVE-2026-28068WordPress Rhythmo theme <= 1.3.4 - Local File Inclusion vulnerabilityThemeREX Rhythmo
- CVE-2026-28067WordPress Bassein theme <= 1.0.15 - Local File Inclusion vulnerabilityThemeREX Bassein
- CVE-2026-28066WordPress Legrand theme <= 2.17 - Local File Inclusion vulnerabilityThemeREX Legrand
- CVE-2026-28065WordPress Eject theme <= 2.17 - Local File Inclusion vulnerabilityThemeREX Eject
- CVE-2026-28064WordPress Edge Decor theme <= 2.2 - Local File Inclusion vulnerabilityThemeREX Edge Decor
- CVE-2026-28063WordPress Asia Garden theme <= 1.3.1 - Local File Inclusion vulnerabilityThemeREX Asia Garden
- CVE-2026-28062WordPress Happy Baby theme <= 1.2.12 - Local File Inclusion vulnerabilityThemeREX Happy Baby
- CVE-2026-28061WordPress Tiger Claw theme <= 1.1.14 - Local File Inclusion vulnerabilityThemeREX Tiger Claw
- CVE-2026-28060WordPress S.King theme <= 1.5.3 - Local File Inclusion vulnerabilityThemeREX S.King
- CVE-2026-28059WordPress Dermatology Clinic theme <= 1.4.3 - Local File Inclusion vulnerabilityThemeREX Dermatology Clinic
- CVE-2026-28058WordPress Dixon theme <= 1.4.2.1 - Local File Inclusion vulnerabilityThemeREX Dixon
- CVE-2026-28057WordPress Mandala theme <= 2.8 - Local File Inclusion vulnerabilityThemeREX Mandala
- CVE-2026-28056WordPress MCKinney's Politics theme <= 1.2.8 - Local File Inclusion vulnerabilityThemeREX MCKinney's Politics
- CVE-2026-28055WordPress M.Williamson theme <= 1.2.11 - Local File Inclusion vulnerabilityThemeREX M.Williamson
- CVE-2026-28054WordPress Legal Stone theme <= 1.2.11 - Local File Inclusion vulnerabilityThemeREX Legal Stone
- CVE-2026-28053WordPress Miller theme <= 1.3.3 - Local File Inclusion vulnerabilityThemeREX Miller
- CVE-2026-28052WordPress Peter Mason theme <= 1.4.5 - Local File Inclusion vulnerabilityThemeREX Peter Mason
- CVE-2026-28051WordPress Yacht Rental theme <= 2.6 - Local File Inclusion vulnerabilityThemeREX Yacht Rental
- CVE-2026-28050WordPress Beacon theme <= 2.24 - Local File Inclusion vulnerabilityThemeREX Beacon
- CVE-2026-28049WordPress Police Department theme <= 2.17 - Local File Inclusion vulnerabilityThemeREX Police Department
- CVE-2026-28048WordPress FlashMart theme <= 2.0.15 - Local File Inclusion vulnerabilitymagentech FlashMart
- CVE-2026-28047WordPress Victo theme <= 1.4.16 - Local File Inclusion vulnerabilitymagentech Victo
- CVE-2026-28046WordPress Law Office theme <= 3.3.0 - Local File Inclusion vulnerabilityThemeREX Law Office
- CVE-2026-28045WordPress N7 | Golf Club Sports & Events theme <= 2.16.0 - Local File Inclusion vulnerabilityThemeREX N7 | Golf Club Sports & Events
- CVE-2026-28042WordPress Listify plugin <= 3.2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityAstoundify Listify
- CVE-2026-28041WordPress Grit theme <= 1.0.1 - Local File Inclusion vulnerabilityAncoraThemes Grit
- CVE-2026-28039WordPress wpDataTables plugin <= 6.5.0.1 - Local File Inclusion vulnerabilityTMS wpDataTables
- CVE-2026-28037WordPress EventON plugin <= 4.9.12 - Reflected Cross Site Scripting (XSS) vulnerabilityashanjay EventON
- CVE-2026-28035WordPress Printy theme <= 1.8 - Local File Inclusion vulnerabilityThemeREX Printy
- CVE-2026-28034WordPress Progress theme <= 1.2 - Local File Inclusion vulnerabilityThemeREX Progress
- CVE-2026-28033WordPress Edifice theme <= 1.8 - Local File Inclusion vulnerabilityThemeREX Edifice
- CVE-2026-28032WordPress Tuning theme <= 1.3 - Local File Inclusion vulnerabilityThemeREX Tuning
- CVE-2026-28031WordPress Invetex theme <= 2.18 - Local File Inclusion vulnerabilityThemeREX Invetex
- CVE-2026-28030WordPress Bonbon theme <= 1.6 - Local File Inclusion vulnerabilityThemeREX Bonbon
- CVE-2026-28029WordPress EmojiNation theme <= 1.0.12 - Local File Inclusion vulnerabilityThemeREX EmojiNation
- CVE-2026-28028WordPress MoneyFlow theme <= 1.0 - Local File Inclusion vulnerabilityThemeREX MoneyFlow
- CVE-2026-28027WordPress Kayon theme <= 1.3 - Local File Inclusion vulnerabilityThemeREX Kayon
- CVE-2026-28026WordPress Motorix theme <= 1.6 - Local File Inclusion vulnerabilityThemeREX Motorix
- CVE-2026-28025WordPress Stargaze theme <= 1.5 - Local File Inclusion vulnerabilityThemeREX Stargaze
- CVE-2026-28024WordPress Helion theme <= 1.1.12 - Local File Inclusion vulnerabilityaxiomthemes Helion
- CVE-2026-28023WordPress Nuts theme <= 1.10 - Local File Inclusion vulnerabilityThemeREX Nuts
- CVE-2026-28022WordPress Foodie theme <= 1.14 - Local File Inclusion vulnerabilityThemeREX Foodie
- CVE-2026-28021WordPress Craftis theme <= 1.2.8 - Local File Inclusion vulnerabilityThemeREX Craftis
- CVE-2026-28020WordPress Chroma theme <= 1.11 - Local File Inclusion vulnerabilityThemeREX Chroma
- CVE-2026-28019WordPress Manoir theme <= 1.11 - Local File Inclusion vulnerabilityThemeREX Manoir
- CVE-2026-28018WordPress Global Logistics theme <= 3.20 - Local File Inclusion vulnerabilityThemeREX Global Logistics
- CVE-2026-28017WordPress Green Thumb theme <= 1.1.12 - Local File Inclusion vulnerabilityThemeREX Green Thumb
- CVE-2026-28016WordPress Luxury Wine theme <= 1.1.14 - Local File Inclusion vulnerabilityThemeREX Luxury Wine
- CVE-2026-28015WordPress ShiftCV theme <= 3.0.14 - Local File Inclusion vulnerabilityThemeREX ShiftCV
- CVE-2026-28014WordPress Translogic theme <= 1.2.11 - Local File Inclusion vulnerabilityThemeREX Translogic
- CVE-2026-28013WordPress Kratz theme <= 1.0.12 - Local File Inclusion vulnerabilityThemeREX Kratz
- CVE-2026-28012WordPress Gridiron theme <= 1.0.14 - Local File Inclusion vulnerabilityThemeREX Gridiron
- CVE-2026-28011WordPress Yottis theme <= 1.0.10 - Local File Inclusion vulnerabilityThemeREX Yottis
- CVE-2026-28010WordPress Scientia theme <= 1.2.4 - Local File Inclusion vulnerabilityThemeREX Scientia
- CVE-2026-28009WordPress DroneX theme <= 1.1.12 - Local File Inclusion vulnerabilityThemeREX DroneX
- CVE-2026-28007WordPress Coinpress theme <= 1.0.14 - Local File Inclusion vulnerabilityThemeREX Coinpress
- CVE-2026-28006WordPress Yungen theme <= 1.0.12 - Local File Inclusion vulnerabilityThemeREX Yungen
- CVE-2026-27998WordPress Vixus theme <= 1.0.16 - Local File Inclusion vulnerabilityThemeREX Vixus
- CVE-2026-27997WordPress Maxify theme <= 1.0.16 - Local File Inclusion vulnerabilityThemeREX Maxify
- CVE-2026-27996WordPress Lingvico theme <= 1.0.14 - Local File Inclusion vulnerabilityThemeREX Lingvico
- CVE-2026-27995WordPress Justitia theme <= 1.1.0 - Local File Inclusion vulnerabilityThemeREX Justitia
- CVE-2026-27994WordPress Tediss theme <= 1.2.4 - Local File Inclusion vulnerabilityThemeREX Tediss
- CVE-2026-27993WordPress Aldo theme <= 1.0.10 - Local File Inclusion vulnerabilityThemeREX Aldo
- CVE-2026-27992WordPress Meals & Wheels theme <= 1.1.12 - Local File Inclusion vulnerabilityThemeREX Meals & Wheels
- CVE-2026-27991WordPress Avventure theme <= 1.1.12 - Local File Inclusion vulnerabilityThemeREX Avventure
- CVE-2026-27990WordPress ConFix theme <= 1.013 - Local File Inclusion vulnerabilityThemeREX ConFix
- CVE-2026-27989WordPress Quanzo theme <= 1.0.10 - Local File Inclusion vulnerabilityThemeREX Quanzo
- CVE-2026-27988WordPress Equadio theme <= 1.1.3 - Local File Inclusion vulnerabilityThemeREX Equadio
- CVE-2026-27987WordPress The Qlean theme <= 2.12 - Local File Inclusion vulnerabilityThemeREX The Qlean
- CVE-2026-27986WordPress OsTende theme <= 1.4.3 - Local File Inclusion vulnerabilityThemeREX OsTende
- CVE-2026-27985WordPress Humanum theme <= 1.1.4 - Local File Inclusion vulnerabilityThemeREX Humanum
- CVE-2026-27541WordPress Wholesale Suite plugin <= 2.2.6 - Privilege Escalation vulnerabilityJosh Kohlbach Wholesale Suite
- CVE-2026-27428WordPress Eagle Booking plugin <= 1.3.4.3 - SQL Injection vulnerabilityEagle-Themes Eagle Booking
- CVE-2026-27406WordPress My Tickets plugin <= 2.1.0 - Sensitive Data Exposure vulnerabilityJoe Dolson My Tickets
- CVE-2026-27396WordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerabilitye-plugins Directory Pro
- CVE-2026-27390WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerabilitydesignthemes WeDesignTech Ultimate Booking Addon
- CVE-2026-27388WordPress DesignThemes Booking Manager plugin <= 2.0 - Broken Access Control vulnerabilityDesignThemes Booking Manager
- CVE-2026-27386WordPress DesignThemes Directory Addon plugin <= 1.8 - Broken Access Control vulnerabilityDesignThemes Directory Addon
- CVE-2026-27385WordPress DesignThemes Portfolio plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityDesignThemes Portfolio
- CVE-2026-27383WordPress Metro theme <= 2.13 - Local File Inclusion vulnerabilityRadiusTheme Metro
- CVE-2026-27382WordPress Metro theme <= 2.13 - Reflected Cross Site Scripting (XSS) vulnerabilityRadiusTheme Metro
- CVE-2026-27381WordPress Aora theme <= 1.3.15 - Local File Inclusion vulnerabilitythembay Aora
- CVE-2026-27379WordPress NextScripts plugin <= 4.4.7 - PHP Object Injection vulnerabilityNextScripts
- CVE-2026-27376WordPress Claue - Clean, Minimal Elementor WooCommerce Theme theme <= 2.2.7 - Reflected Cross Site Scripting (XSS) vulnerabilityJanStudio Claue - Clean, Minimal Elementor WooCommerce Theme
- CVE-2026-27375WordPress Gecko theme <= 1.9.8 - Reflected Cross Site Scripting (XSS) vulnerabilityJanStudio Gecko
- CVE-2026-27374WordPress WooCommerce Order Details plugin <= 3.1 - Broken Access Control vulnerabilityvanquish WooCommerce Order Details
- CVE-2026-27373WordPress Tablesome plugin <= 1.2.3 - SQL Injection vulnerabilityEssekia Tablesome
- CVE-2026-27370WordPress Chaty plugin <= 3.5.1 - Sensitive Data Exposure vulnerabilityPremio Chaty
- CVE-2026-27369WordPress Celeste theme <= 1.3.6 - PHP Object Injection vulnerabilityBoldThemes Celeste
- CVE-2026-27367WordPress Musico theme < 3.4.5 - Cross Site Scripting (XSS) vulnerabilityThemeGoods Musico
- CVE-2026-27363WordPress WP Bakery Autoresponder Addon plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilitykamleshyadav WP Bakery Autoresponder Addon
- CVE-2026-27361WordPress Responsive Posts Carousel Pro plugin <= 15.1 - Broken Access Control vulnerabilityWebCodingPlace Responsive Posts Carousel Pro
- CVE-2026-27359WordPress Awa Plugins plugin <= 1.4.4 - Reflected Cross Site Scripting (XSS) vulnerabilityfox-themes Awa Plugins
- CVE-2026-27358WordPress Architecturer theme < 3.9.5 - Cross Site Scripting (XSS) vulnerabilityThemeGoods Architecturer
- CVE-2026-27353WordPress Grand News | Magazine Newspaper WordPress theme <= 3.4.3 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeGoods Grand News
- CVE-2026-27352WordPress Starto theme < 2.2.5 - Cross Site Scripting (XSS) vulnerabilityThemeGoods Starto
- CVE-2026-27348WordPress Photography theme < 7.7.6 - Cross Site Scripting (XSS) vulnerabilityThemeGoods Photography
- CVE-2026-27342WordPress TopFit - Fitness and Gym WordPress Theme theme <= 1.9 - Local File Inclusion vulnerabilityMikado-Themes TopFit - Fitness and Gym WordPress Theme
- CVE-2026-27341WordPress TopScorer - Sports WordPress Theme theme <= 1.2 - Local File Inclusion vulnerabilityMikado-Themes TopScorer - Sports WordPress Theme
- CVE-2026-27340WordPress Apollo | Night Club, DJ Event WordPress Theme theme <= 1.3.1 - Local File Inclusion vulnerabilityAncoraThemes Apollo | Night Club, DJ Event WordPress Theme
- CVE-2026-27339WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - Local File Inclusion vulnerabilityAncoraThemes Buzz Stone | Magazine & Viral Blog WordPress T…
- CVE-2026-27338WordPress Car Zone theme <= 3.7 - Deserialization of untrusted data vulnerabilityAivahThemes Car Zone
- CVE-2026-27337WordPress Chronicle - Lifestyle Magazine & Blog WordPress Theme theme <= 1.0 - Local File Inclusion vulnerabilityAncoraThemes Chronicle - Lifestyle Magazine & Blog WordPres…
- CVE-2026-27336WordPress Consultor | Consulting, Accounting & Legal Counsel WordPress Theme theme <= 1.2.4 - Local File Inclusion vulnerabilityAncoraThemes Consultor | Consulting, Accounting & Legal Cou…
- CVE-2026-27335WordPress Ekoterra - NonProfit, Green Energy & Ecology Theme theme <= 1.0.0 - Local File Inclusion vulnerabilityAncoraThemes Ekoterra - NonProfit, Green Energy & Ecology T…
- CVE-2026-27334WordPress Alchemists theme <= 4.6.0 - Local File Inclusion vulnerabilitydan_fisher Alchemists
- CVE-2026-27332WordPress Agrofood theme < 1.4.0 - Cross Site Scripting (XSS) vulnerabilityskygroup Agrofood
- CVE-2026-27326WordPress AC Services | HVAC, Air Conditioning & Heating Company WordPress Theme theme <= 1.2.5 - Local File Inclusion vulnerabilityaxiomthemes AC Services | HVAC, Air Conditioning & Heating…
- CVE-2026-27098WordPress Au Pair Agency - Babysitting & Nanny Theme theme <= 1.2.2 - Deserialization of untrusted data vulnerabilityaxiomthemes Au Pair Agency - Babysitting & Nanny Theme
- CVE-2026-27097WordPress CasaMia | Property Rental Real Estate WordPress Theme theme <= 1.1.2 - Local File Inclusion vulnerabilityAncoraThemes CasaMia | Property Rental Real Estate WordPres…
- CVE-2026-24963WordPress Amelia plugin <= 1.2.38 - Privilege Escalation vulnerabilityameliabooking Amelia
- CVE-2026-24385WordPress Podlove Web Player plugin <= 5.9.1 - PHP Object Injection vulnerabilitygerritvanaaken Podlove Web Player
- CVE-2026-23801WordPress The Issue theme <= 1.6.11 - Local File Inclusion vulnerabilityfuelthemes The Issue
- CVE-2026-23798WordPress PowerPress Podcasting plugin <= 11.15.10 - PHP Object Injection vulnerabilityblubrry PowerPress Podcasting
- CVE-2026-22479WordPress Easy Post Submission plugin <= 2.4.0 - Broken Access Control vulnerabilityThemeRuby Easy Post Submission
- CVE-2026-22478WordPress FindAll theme <= 1.4 - Local File Inclusion vulnerabilityElated-Themes FindAll
- CVE-2026-22477WordPress Felizia theme <= 1.3.4 - Local File Inclusion vulnerabilityAncoraThemes Felizia
- CVE-2026-22476WordPress Etchy theme <= 1.0 - Local File Inclusion vulnerabilityElated-Themes Etchy
- CVE-2026-22473WordPress Dental Clinic theme <= 3.7 - PHP Object Injection vulnerabilitydesignthemes Dental Clinic
- CVE-2026-22471WordPress Secudeal Payments for Ecommerce plugin <= 1.1 - PHP Object Injection vulnerabilitymaximsecudeal Secudeal Payments for Ecommerce
- CVE-2026-22467WordPress DeepDigital theme <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilitymwtemplates DeepDigital
- CVE-2026-22465WordPress BuddyApp theme <= 1.9.2 - Reflected Cross Site Scripting (XSS) vulnerabilitySeventhQueen BuddyApp
- CVE-2026-22460WordPress FormGent plugin <= 1.7.0 - Arbitrary File Deletion vulnerabilitywpWax FormGent
- CVE-2026-22457WordPress Wanderland theme <= 1.5 - Local File Inclusion vulnerabilityMikado-Themes Wanderland
- CVE-2026-22456WordPress Askka theme <= 1.0 - Local File Inclusion vulnerabilityElated-Themes Askka
- CVE-2026-22455WordPress Thebe theme <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityforeverpinetree Thebe
- CVE-2026-22452WordPress Hoverex theme <= 1.5.10 - Local File Inclusion vulnerabilityThemeREX Hoverex
- CVE-2026-22449WordPress Don Peppe theme <= 1.3 - Local File Inclusion vulnerabilitySelect-Themes Don Peppe
- CVE-2026-22446WordPress Prowess theme <= 1.8.1 - Local File Inclusion vulnerabilitySelect-Themes Prowess
- CVE-2026-22443WordPress Alliance theme <= 3.1.1 - Local File Inclusion vulnerabilityThemeREX Alliance
- CVE-2026-22442WordPress Tribe theme <= 1.7.3 - Local File Inclusion vulnerabilityLaunchandSell Tribe
- CVE-2026-22441WordPress Zentrum theme <= 1.0 - Local File Inclusion vulnerabilityElated-Themes Zentrum
- CVE-2026-22440WordPress Thecs theme <= 1.4.7 - Reflected Cross Site Scripting (XSS) vulnerabilityforeverpinetree Thecs
- CVE-2026-22439WordPress Green Planet theme <= 1.1.14 - Local File Inclusion vulnerabilityAncoraThemes Green Planet
- CVE-2026-22438WordPress TheBi theme <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityforeverpinetree TheBi
- CVE-2026-22437WordPress Playa theme <= 1.3.9 - Local File Inclusion vulnerabilityAncoraThemes Playa
- CVE-2026-22436WordPress Helvig theme <= 1.0 - Local File Inclusion vulnerabilityElated-Themes Helvig
- CVE-2026-22435WordPress ElectroServ theme <= 1.3.2 - Local File Inclusion vulnerabilityAncoraThemes ElectroServ
- CVE-2026-22434WordPress Crown Art theme <= 1.2.11 - Local File Inclusion vulnerabilityAncoraThemes Crown Art
- CVE-2026-22433WordPress CloudMe theme <= 1.2.2 - Local File Inclusion vulnerabilityAncoraThemes CloudMe
- CVE-2026-22432WordPress Woopy theme <= 1.2 - Local File Inclusion vulnerabilityAncoraThemes Woopy
- CVE-2026-22431WordPress Wabi-Sabi theme <= 1.2 - Local File Inclusion vulnerabilityAncoraThemes Wabi-Sabi
- CVE-2026-22429WordPress Verdure theme <= 1.6 - Local File Inclusion vulnerabilityMikado-Themes Verdure
- CVE-2026-22428WordPress Tooth Fairy theme <= 1.16 - Local File Inclusion vulnerabilityAncoraThemes Tooth Fairy
- CVE-2026-22427WordPress GoTravel theme <= 2.1 - Local File Inclusion vulnerabilityMikado-Themes GoTravel
- CVE-2026-22425WordPress Sweet Jane theme <= 1.2 - Local File Inclusion vulnerabilityElated-Themes Sweet Jane
- CVE-2026-22424WordPress Shaha theme <= 1.1.2 - Local File Inclusion vulnerabilityAncoraThemes Shaha
- CVE-2026-22423WordPress SetSail theme <= 1.8 - Local File Inclusion vulnerabilitySelect-Themes SetSail
- CVE-2026-22421WordPress Quantum theme <= 1.0 - Local File Inclusion vulnerabilityAncoraThemes Quantum
- CVE-2026-22420WordPress Horizon theme <= 1.1 - Local File Inclusion vulnerabilityAncoraThemes Horizon
- CVE-2026-22419WordPress Honor theme <= 2.3 - Local File Inclusion vulnerabilityAncoraThemes Honor
- CVE-2026-22418WordPress Great Lotus theme <= 1.3.1 - Local File Inclusion vulnerabilityAncoraThemes Great Lotus
- CVE-2026-22416WordPress FixTeam theme <= 1.5.0 - Local File Inclusion vulnerabilityAncoraThemes FixTeam
- CVE-2026-22415WordPress The Mounty theme <= 1.1 - Local File Inclusion vulnerabilityAncoraThemes The Mounty
- CVE-2026-22414WordPress Marra theme <= 1.2 - Local File Inclusion vulnerabilityMikado-Themes Marra
- CVE-2026-22413WordPress Malgré theme <= 1.0.3 - Local File Inclusion vulnerabilityMikado-Themes Malgré
- CVE-2026-22412WordPress Eona theme <= 1.3 - Local File Inclusion vulnerabilityMikado-Themes Eona
- CVE-2026-22410WordPress Dolcino theme <= 1.6 - Local File Inclusion vulnerabilityMikado-Themes Dolcino
- CVE-2026-22408WordPress Justicia theme <= 1.2 - Local File Inclusion vulnerabilityMikado-Themes Justicia
- CVE-2026-22405WordPress Overton theme <= 1.3 - Local File Inclusion vulnerabilityMikado-Themes Overton
- CVE-2026-22403WordPress Innovio theme <= 1.9 - Local File Inclusion vulnerabilityMikado-Themes Innovio
- CVE-2026-22399WordPress Holmes theme <= 1.7 - Local File Inclusion vulnerabilityMikado-Themes Holmes
- CVE-2026-22397WordPress Fleur theme <= 2.2.1 - Local File Inclusion vulnerabilityMikado-Themes Fleur
- CVE-2026-22395WordPress Fiorello theme <= 1.0 - Local File Inclusion vulnerabilityMikado-Themes Fiorello
- CVE-2026-22394WordPress Evently theme <= 1.7 - Local File Inclusion vulnerabilityMikado-Themes Evently
- CVE-2026-22392WordPress Cortex theme <= 1.9 - Local File Inclusion vulnerabilityMikado-Themes Cortex
- CVE-2026-22389WordPress Cocco theme <= 2.0 - Local File Inclusion vulnerabilityMikado-Themes Cocco
- CVE-2026-22387WordPress Aviana theme <= 2.1 - Local File Inclusion vulnerabilityMikado-Themes Aviana
- CVE-2026-22385WordPress Wolmart theme <= 1.9.6 - Local File Inclusion vulnerabilitydon-themes Wolmart
- CVE-2025-69411WordPress ionCube tester plus plugin <= 1.3 - Arbitrary File Download vulnerabilityRobert Seyfriedsberger ionCube tester plus
- CVE-2025-69340WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.3 - Broken Access Control vulnerabilityBuddhaThemes WeDesignTech Ultimate Booking Addon
- CVE-2025-69339WordPress Molla theme <= 1.5.16 - Local File Inclusion vulnerabilitydon-themes Molla
- CVE-2025-69090WordPress Remons theme <= 1.3.4 - Local File Inclusion vulnerabilityovatheme Remons
- CVE-2025-53335WordPress Berger theme <= 1.1.1 - Local File Inclusion vulnerabilityThemeREX Berger
- CVE-2026-29053Ghost Vulnerable to Remote Code Execution via Malicious ThemesTryGhost Ghost · ghost
- CVE-2026-29128IDC SFX2100 Satellite Receiver bgpd/ospfd/ripd/zebra Config Credential Disclosure via World-Readable FilesInternational Datacasting SFX2100 Satellite Receiver
- CVE-2026-2365Fluent Forms Pro <= 6.1.17 - Unauthenticated Stored Cross-Site Scripting via Draft Form Submissiontechjewel Fluent Forms Pro Add On Pack
- CVE-2026-26034UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Incorrect Default Permissions (CWE-276) vulnerability that alloDell UPS Multi-UPS Management Console
- CVE-2026-29126World-Writable, Root Owned/Run `/etc/udhcpc/default.script` in IDC SFX2100 Satellite Receiver Leads To Potential LPEInternational Datacasting SFX2100 Satellite Receiver
- CVE-2026-29125IDC SFX2100 Satellite Receiver allows unprivileged modification of DNS configuration due to world-writable `/etc/resolv.conf`International Datacasting SFX2100 Satellite Receiver
- CVE-2026-29124Multiple SUID Root Binaries in `monitor` User Home Directory Leading to Potential Local Privilege EscalationInternational Datacasting SFX2100 Satellite Receiver
- CVE-2026-29123Multiple SUID Root Binaries in `xd` User Home Directory Leading to Potential Local Privilege EscalationInternational Datacasting SFX2100 Satellite Receiver
- CVE-2026-29122`/bin/date` Binary given SETUID Permissions on IDC SFX2100 Leading to Potential LPEInternational Datacasting SFX2100 Satellite Receiver
- CVE-2026-29121`/sbin/ip` Binary given SETUID Permissions on IDC SFX2100 Leading to Potential LPEInternational Datacasting SFX2100 Satellite Receiver
- CVE-2025-45691An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients RAGAS v0.2.3 to v0.2.14.ragas
- CVE-2025-69534Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandlmarkdown
- CVE-2025-70614OpenCode Systems OC Messaging / USSD Gateway OC Release 6.32.2 contains a broken access control vulnerability in the web-based control panel
- CVE-2025-70616A stack buffer overflow vulnerability exists in the Wincor Nixdorf wnBios64.sys kernel driver (version 1.2.0.0) in the IOCTL handler for cod
- CVE-2025-70949An observable timing discrepancy in @perfood/couch-auth v0.26.0 allows attackers to access sensitive information via a timing side-channel.@perfood/couch-auth
- CVE-2025-70995An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execution due to improper v
- CVE-2026-26416An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privilege
- CVE-2026-26417A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authe
- CVE-2026-26418Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to acc
Medium, low and unrated 105
- CVE-2026-28726Sensitive information disclosure due to improper access control.Acronis Cyber Protect
- CVE-2026-28725Sensitive information disclosure due to improper configuration of a headless browser.Acronis Cyber Protect
- CVE-2025-30413Credentials are not deleted from Acronis Agent after plan revocation.Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- CVE-2026-28724Unauthorized data access due to insufficient access control validation.Acronis Cyber Protect
- CVE-2026-28723Unauthorized report deletion due to insufficient access control.Acronis Cyber Protect
- CVE-2026-28720Unauthorized modification of settings due to insufficient authorization checks.Acronis Cyber Protect
- CVE-2026-28719Unauthorized resource manipulation due to improper authorization checks.Acronis Cyber Protect
- CVE-2026-28718Denial of service due to insufficient input validation in authentication logging.Acronis Cyber Protect
- CVE-2026-28717Local privilege escalation due to improper directory permissions.Acronis Cyber Protect
- CVE-2026-28716Information disclosure and manipulation due to improper authorization checks.Acronis Cyber Protect
- CVE-2026-28715Sensitive information disclosure due to improper authorization checks.Acronis Cyber Protect
- CVE-2026-28714Unnecessary transmission of sensitive cryptographic material.Acronis Cyber Protect
- CVE-2026-28712Local privilege escalation due to DLL hijacking vulnerability.Acronis Cyber Protect
- CVE-2026-28711Local privilege escalation due to DLL hijacking vulnerability.Acronis Cyber Protect
- CVE-2026-28709Unauthorized resource manipulation due to improper authorization checks.Acronis Cyber Protect
- CVE-2025-11790Credentials are not deleted from Acronis Agent after plan revocation.Acronis Cyber Protect Cloud Agent
- CVE-2025-11791Sensitive information disclosure and manipulation due to insufficient authorization checks.Acronis Cyber Protect
- CVE-2026-27770ePower epower.ie Insufficiently Protected Credentialsepower.ie
- CVE-2026-2589Greenshift – animation and page builder blocks <= 12.8.3 - Unauthenticated Sensitive Information Exposure via Settings Backupwpsoul Greenshift – animation and page builder blocks
- CVE-2026-26122Microsoft ACI Confidential Containers Information Disclosure VulnerabilityMicrosoft ACI Confidential Containers
- CVE-2026-26124Microsoft ACI Confidential Containers Elevation of Privilege VulnerabilityMicrosoft ACI Confidential Containers
- CVE-2026-23651Microsoft ACI Confidential Containers Elevation of Privilege VulnerabilityMicrosoft ACI Confidential Containers
- CVE-2026-3606Ettercap etterfilter ef_output.c add_data_segment out-of-boundsEttercap
- CVE-2026-29612OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File DecodingOpenClaw · clawdbot
- CVE-2026-29606OpenClaw < 2026.2.14 - Webhook Signature Verification Bypass via ngrok Loopback CompatibilityOpenClaw
- CVE-2026-28486OpenClaw 2026.1.16-2 < 2026.2.14 - Path Traversal (Zip Slip) in Archive Extraction via Installation CommandsOpenClaw
- CVE-2026-28481OpenClaw < 2026.2.1 - Bearer Token Leakage via MS Teams Attachment Downloader Suffix MatchingOpenClaw
- CVE-2026-28480OpenClaw < 2026.2.14 - Identity Spoofing via Mutable Username in Telegram Allowlist AuthorizationOpenClaw · clawdbot
- CVE-2026-28477OpenClaw < 2026.2.14 - OAuth State Validation Bypass in Manual Chutes Login FlowOpenClaw
- CVE-2026-28476OpenClaw < 2026.2.14 - Server-Side Request Forgery in Tlon Extension AuthenticationOpenClaw
- CVE-2026-28475OpenClaw < 2026.2.13 - Timing Attack via Hook Token ComparisonOpenClaw
- CVE-2026-28471OpenClaw 2026.1.14-1 < 2026.2.2 - Allowlist Bypass via displayName and Cross-Homeserver localpart Matching in Matrix PluginOpenClaw
- CVE-2026-28467OpenClaw < 2026.2.2 - SSRF via Attachment Media URL HydrationOpenClaw
- CVE-2026-28457OpenClaw < 2026.2.14 - Path Traversal in Sandbox Skill Mirroring via Name ParameterOpenClaw
- CVE-2026-28452OpenClaw < 2026.2.14 - Denial of Service via Unguarded Archive Extraction in extractArchiveOpenClaw · clawdbot
- CVE-2026-28451OpenClaw < 2026.2.14 - SSRF via Feishu Extension Media FetchingOpenClaw
- CVE-2026-28448OpenClaw 2026.1.29 < 2026.2.1 - Authorization Bypass in Twitch Plugin allowFrom Access ControlOpenClaw
- CVE-2026-28395OpenClaw 2026.1.14-1 < 2026.2.12 - Unintended Public Binding of Chrome Extension Relay via Wildcard cdpUrlOpenClaw
- CVE-2026-28394OpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch ToolOpenClaw
- CVE-2026-2593Greenshift – animation and page builder blocks <= 12.8.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpsoul Greenshift – animation and page builder blocks
- CVE-2026-28443OpenReplay: SQL injection in cards/search via unvalidated sort field parameteropenreplay
- CVE-2026-22723UAA User Token Revocation logic errorCloudfoundry Foundation UAA · org.cloudfoundry.identity:clo…
- CVE-2026-29081Frappe: Possibility of SQL Injection due to improper fieldname sanitizationfrappe
- CVE-2026-28436Frappe: Stored XSS in avatar_macro.htmlfrappe
- CVE-2026-28413Products.isurlinportal: Possible open redirect when using more than 2 forward slashesplone Products.isurlinportal · products-isurlinportal
- CVE-2026-28410The Graph: Revocable vesting contracts allows early access to locked tokensgraphprotocol contracts
- CVE-2026-28350lxml_html_clean: <base> tag injection through default Cleaner configurationfedora-python lxml_html_clean · lxml-html-clean
- CVE-2026-28348lxml_html_clean: CSS @import Filter Bypass via Unicode Escapesfedora-python lxml_html_clean · lxml-html-clean
- CVE-2026-28343CKEditor: Cross-site scripting (XSS) in the HTML Support packageckeditor5 · @ckeditor/ckeditor5-html-support
- CVE-2026-28277LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loadinglangchain-ai langgraph · langgraph
- CVE-2026-28222Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributeswagtail
- CVE-2026-28223Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interfacewagtail
- CVE-2026-26196Gogs: Access tokens get exposed through URL params in API requestsgogs · gogs.io/gogs
- CVE-2026-26195Gogs: Stored XSS in branch and wiki views through author and committer namesgogs · gogs.io/gogs
- CVE-2025-7375Unauthenticated Denial-of-Service Vulnerability in Omada EAP610TP-Link Systems EAP610
- CVE-2026-27723OpenProject: Insufficient access control leads to create Wiki objects belongs unpermitted projectsopf openproject
- CVE-2026-27023Twenty: SSRF protection bypass via HTTP redirect following in secure HTTP clienttwentyhq twenty
- CVE-2026-26998Traefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS)traefik · github.com/traefik/traefik/v2 +2
- CVE-2026-30783RustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL Policiesrustdesk-client RustDesk Client
- CVE-2026-30789RustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-Forcerustdesk-client RustDesk Client
- CVE-2025-64166Mercurius: Incorrect Content-Type parsing can lead to CSRF attackmercurius-js mercurius · mercurius
- CVE-2026-30796RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Syncrustdesk-client RustDesk Client
- CVE-2026-3236In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key haOctopus Deploy Octopus Server
- CVE-2025-11143The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs.Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:jetty-…
- CVE-2026-28551Race condition vulnerability in the device security management module.Huawei HarmonyOS
- CVE-2026-28549Race condition vulnerability in the permission management service.Huawei HarmonyOS
- CVE-2026-28547Vulnerability of uninitialized pointer access in the scanning module.Huawei HarmonyOS
- CVE-2026-28546Buffer overflow vulnerability in the scanning module.Huawei HarmonyOS
- CVE-2026-28543Race condition vulnerability in the maintenance and diagnostics module.Huawei HarmonyOS
- CVE-2026-28541Permission control vulnerability in the cellular_data module.Huawei HarmonyOS
- CVE-2026-28540Out-of-bounds character read vulnerability in Bluetooth.Huawei HarmonyOS
- CVE-2026-28539Data processing vulnerability in the certificate management module.Huawei HarmonyOS
- CVE-2026-28538Path traversal vulnerability in the certificate management module.Huawei HarmonyOS
- CVE-2025-66319Permission control vulnerability in the resource scheduling module.Huawei HarmonyOS
- CVE-2026-28552Out-of-bounds write vulnerability in the IMS module.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-28550Race condition vulnerability in the security control module.Huawei HarmonyOS
- CVE-2026-28545Race condition vulnerability in the printing module.Huawei HarmonyOS
- CVE-2026-28544Race condition vulnerability in the printing module.Huawei HarmonyOS
- CVE-2026-2893Page and Post Clone <= 6.3 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parametercarlosfazenda Fast Page & Post Duplicator
- CVE-2026-21786HCL Sametime for iOS is affected by sensitive information disclosureHCLSoftware Sametime for iOS
- CVE-2026-28537Double free vulnerability in the window module.Huawei HarmonyOS
- CVE-2026-28104WordPress Site Suggest plugin <= 1.3.9 - Broken Access Control vulnerabilityAryan Shirani Bid Abadi Site Suggest
- CVE-2026-28078WordPress uListing plugin <= 2.2.0 - Arbitrary File Download vulnerabilityStylemix uListing
- CVE-2026-28071WordPress pixfort Core plugin <= 3.2.22 - Broken Access Control vulnerabilitypixfort Core
- CVE-2026-28038WordPress Ultimate Addons for WPBakery Page Builder plugin <= 3.21.1 - Broken Access Control vulnerabilityBrainstorm_Force Ultimate Addons for WPBakery Page Builder
- CVE-2026-28036WordPress Ratatouille theme <= 1.2.6 - Server Side Request Forgery (SSRF) vulnerabilitySkatDesign Ratatouille
- CVE-2026-27411WordPress SiteGuard WP plugin plugin <= 1.7.9 - Captcha Bypass vulnerabilityjp-secure SiteGuard WP Plugin
- CVE-2026-27362WordPress WP Bakery Autoresponder Addon plugin <= 1.0.6 - Broken Access Control vulnerabilitykamleshyadav WP Bakery Autoresponder Addon
- CVE-2026-27354WordPress WooCommerce Coming Soon Product with Countdown plugin <= 5.0 - Cross Site Scripting (XSS) vulnerabilityWebCodingPlace WooCommerce Coming Soon Product with Countdo…
- CVE-2026-27344WordPress inseri core plugin <= 1.0.5 - Broken Access Control vulnerabilityinseriswiss inseri core
- CVE-2026-23799WordPress Tutor LMS plugin <= 3.9.5 - Broken Access Control vulnerabilityThemeum Tutor LMS
- CVE-2026-23546WordPress Classified Listing plugin <= 5.3.4 - Sensitive Data Exposure vulnerabilityRadiusTheme Classified Listing
- CVE-2026-22459WordPress WordPress CTA plugin <= 2.1.2 - Broken Access Control vulnerabilityBlend Media WordPress CTA
- CVE-2025-69343WordPress Theater for WordPress plugin <= 0.19 - Cross Site Scripting (XSS) vulnerabilityJeroen Schmit Theater for WordPress
- CVE-2025-68515WordPress WP Booking System plugin <= 2.0.19.12 - Sensitive Data Exposure vulnerabilityRoland Murg WP Booking System
- CVE-2026-29052HumHub Calendar Module: Stored XSS in Event Typeshumhub calendar
- CVE-2026-30777EC-CUBE provided by EC-CUBE CO.,LTD.EC-CUBE CO. EC-CUBE 4.1 series · EC-CUBE CO. EC-CUBE 4.2… +1
- CVE-2026-27982An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by django-allauth
- CVE-2026-3072Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modificationdglingren Media Library Assistant
- CVE-2026-3523Apocalypse Meow <= 22.1.0 - Authenticated (Administrator+) SQL Injection via 'type' Parameterblobfolio Apocalypse Meow
- CVE-2026-2899Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletiontechjewel Fluent Forms Pro Add On Pack
- CVE-2026-3034OoohBoi Steroids for Elementor <= 2.1.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple URL Controlssagarpatel124 OoohBoi Steroids for Elementor
- CVE-2026-26033UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Unquoted Search Path or Element (CWE-428) vulnerability, which Dell UPS Multi-UPS Management Console
- CVE-2024-43035Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint.Fonoster · @fonoster/voice
- CVE-2026-26377Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via the News function.