CVEs published March 13, 2026
289 CVEs were published on March 13, 2026: 10 critical, 83 high.
- Published
- 289
- Critical
- 10
- High
- 83
- Medium
- 185
- Low
- 11
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 104
Most affected products
- gVectors wpDiscuz
- 11
- GStreamer
- 10
- FreeRDP
- 8
- Philips Hue Bridge
- 8
- PX4-Autopilot
- 7
- Mintplex-Labs anything-llm
- 6
- IBM Sterling Partner Engagement Manager
- 5
- Digilent DASYLab
- 4
- IBM Sterling B2B Integrator
- 4
- ABB AWIN GW100 rev.2 · ABB AWIN GW120
- 3
Critical 10
- CVE-2025-15060claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerabilityclaude-hovercraft
- CVE-2026-32621Apollo Federation has prototype pollution via incomplete key sanitization@apollo federation-internals · @apollo gateway +4
- CVE-2026-32626AnythingLLM has a Streaming Phase XSS to RCE via LLM Response InjectionMintplex-Labs anything-llm
- CVE-2026-31886Dagu has a Path Traversal via `dagRunId` in Inline DAG Executiondagu-org dagu · github.com/dagu-org/dagu
- CVE-2026-31806FreeRDP has a Heap Buffer Overflow in nsc_process_message() via Unchecked SURFACE_BITS_COMMAND Bitmap DimensionsFreeRDP
- CVE-2026-32746telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_GNU inetutils
- CVE-2026-26954SandboxJS has a Sandbox Escapenyariv SandboxJS · @nyariv/sandboxjs
- CVE-2026-32367WordPress Modal Dialog plugin <= 3.5.16 - Remote Code Execution (RCE) vulnerabilityYannick Lefebvre Modal Dialog
- CVE-2026-3891Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Uploadlinknacional Pix for WooCommerce
- CVE-2026-22193wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions()gVectors wpDiscuz
High 83
- CVE-2026-32729Runtipi has a TOTP two-factor authentication bypass via unrestricted brute-force on `/api/auth/verify-totp`runtipi
- CVE-2026-3227Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840NTP-Link Systems TL-WR802N · TP-Link Systems TL-WR841N +1
- CVE-2026-32720Improper Access Control in github.com/ctfer-io/monitoringctfer-io monitoring · github.com/ctfer-io/monitoring
- CVE-2026-32708Zenoh uORB Subscriber Allows Arbitrary Stack Allocation (PX4/PX4-Autopilot)PX4-Autopilot
- CVE-2026-32706PX4 autopilot has a global buffer overflow in crsf_rc via oversized variable-length known packetPX4-Autopilot
- CVE-2026-32616Pigeon has a Host Header Injection in email verification flowkasuganosoras Pigeon
- CVE-2026-26133M365 Copilot Information Disclosure VulnerabilityMicrosoft 365 Copilot for Android · Microsoft 365 Copil… +17
- CVE-2026-32640(SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.danthedeckie simpleeval · simpleeval
- CVE-2026-32635Angular has XSS in i18n attribute bindings@angular compiler · @angular core +2
- CVE-2026-32628AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name ParameterMintplex-Labs anything-llm
- CVE-2026-32627cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxyyhirose cpp-httplib
- CVE-2026-2493IceWarp collaboration Directory Traversal Information Disclosure VulnerabilityIceWarp
- CVE-2026-3084GStreamer H.266 Codec Parser Integer Underflow Remote Code Execution VulnerabilityGStreamer
- CVE-2026-2921GStreamer RIFF Palette Integer Overflow Remote Code Execution VulnerabilityGStreamer
- CVE-2026-3083GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution VulnerabilityGStreamer
- CVE-2026-3086GStreamer H.266 Codec Parser Out-Of-Bounds Write Remote Code Execution VulnerabilityGStreamer
- CVE-2026-3085GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution VulnerabilityGStreamer
- CVE-2026-3082GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution VulnerabilityGStreamer
- CVE-2026-3081GStreamer H.266 Codec Parser Stack-based Buffer Overflow Remote Code Execution VulnerabilityGStreamer
- CVE-2026-2923GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution VulnerabilityGStreamer
- CVE-2026-2922GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution VulnerabilityGStreamer
- CVE-2026-2920GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution VulnerabilityGStreamer
- CVE-2026-3839Unraid Authentication Request Path Traversal Authentication Bypass VulnerabilityUnraid
- CVE-2026-3838Unraid Update Request Path Traversal Remote Code Execution VulnerabilityUnraid
- CVE-2026-3561Philips Hue Bridge hk_hap characteristics Heap-based Buffer Overflow Remote Code Execution VulnerabilityPhilips Hue Bridge
- CVE-2026-3560Philips Hue Bridge HomeKit hk_hap_pair_storage_put Heap-based Buffer Overflow Remote Code Execution VulnerabilityPhilips Hue Bridge
- CVE-2026-3559Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass VulnerabilityPhilips Hue Bridge
- CVE-2026-3558Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass VulnerabilityPhilips Hue Bridge
- CVE-2026-3557Philips Hue Bridge hap_pair_verify_handler Sub-TLV Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityPhilips Hue Bridge
- CVE-2026-3556Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution VulnerabilityPhilips Hue Bridge
- CVE-2026-3555Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution VulnerabilityPhilips Hue Bridge
- CVE-2026-32614Go ShangMi SM9 Infinity-Point Ciphertext Forgery Vulnerabilityemmansun gmsm · github.com/emmansun/gmsm
- CVE-2026-32617AnythingLLM Permissable CORS policyMintplex-Labs anything-llm
- CVE-2026-32600xml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryptionsimplesamlphp xml-security · simplesamlphp/xml-security
- CVE-2026-32314Yamux remote Panic via malformed Data frame with SYN set and len = 262145libp2p rust-yamux · yamux
- CVE-2026-32313xmlseclibs is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryptionrobrichards xmlseclibs · robrichards/xmlseclibs
- CVE-2026-31944LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect linkdanny-avila LibreChat
- CVE-2026-31899CairoSVG vulnerable to Exponential DoS via recursive <use> element amplificationKozea CairoSVG · cairosvg
- CVE-2026-31882Dagu SSE Authentication Bypass in Basic Auth Modedagu-org dagu · dagu
- CVE-2026-31814Yamux remote Panic via malformed WindowUpdate creditlibp2p rust-yamux · yamux
- CVE-2025-71263In UNIX Fourth Research Edition (v4), the su command is vulnerable to a buffer overflow due to the 'password' variable having a fixed size oAT&T Bell Labs UNIX
- CVE-2026-29079Type Confusion in Lexbor Fragment Parserlexbor
- CVE-2026-29078Integer Underflow in Lexbor ISO‑2022‑JP Encoderlexbor
- CVE-2026-1668Input Validation Vulnerability on Multiple Omada SwitchesTP-Link Systems SG2008P · TP-Link Systems SX3016F +37
- CVE-2026-23940Denial of Service via Oversized Package Uploadhexpm
- CVE-2026-4092Arbitrary File Write via Path Traversal in Google clasp leading to RCEGoogle Clasp · @google/clasp
- CVE-2026-0956Out-Of-Bounds Read in Digilent DASYLabDigilent DASYLab
- CVE-2026-0955Out-Of-Bounds Read When Opening a Corrupt File in Digilent DASYLabDigilent DASYLab
- CVE-2026-0957Out-Of-Bounds Write in Digilent DASYLabDigilent DASYLab
- CVE-2026-0954Out-Of-Bounds Write When Opening a Corrupt DSB File in Digilent DASYLabDigilent DASYLab
- CVE-2025-13779Configuration Data SpillABB AWIN GW100 rev.2 · ABB AWIN GW120
- CVE-2025-13777Authentication Bypass due to Improper Session ValidationABB AWIN GW100 rev.2 · ABB AWIN GW120
- CVE-2026-4111Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchiveRed Hat Enterprise Linux · Red Hat OpenShift Container P… +6
- CVE-2026-32459WordPress UpsellWP plugin <= 2.2.4 - SQL Injection vulnerabilityflycart UpsellWP
- CVE-2026-32458WordPress WOLF plugin <= 1.0.8.7 - SQL Injection vulnerabilityRealMag777 WOLF
- CVE-2026-32433WordPress CP Contact Form with Paypal plugin <= 1.3.61 - SQL Injection vulnerabilitycodepeople CP Contact Form with Paypal
- CVE-2026-32426WordPress Medilazar Core plugin < 1.4.7 - Local File Inclusion vulnerabilitythemelexus Medilazar Core
- CVE-2026-32422WordPress WP EasyCart plugin <= 5.8.13 - SQL Injection vulnerabilitylevelfourdevelopment WP EasyCart
- CVE-2026-32418WordPress Meow Gallery plugin <= 5.4.4 - SQL Injection vulnerabilityJordy Meow Meow Gallery
- CVE-2026-32414WordPress Advanced Woo Labels plugin <= 2.36 - Remote Code Execution (RCE) vulnerabilityILLID Advanced Woo Labels
- CVE-2026-32401WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.9 - Local File Inclusion vulnerabilityBoldGrid Client Invoicing by Sprout Invoices
- CVE-2026-32400WordPress Boldman theme <= 7.7 - Local File Inclusion vulnerabilityThemetechMount Boldman
- CVE-2026-32399WordPress Media LIbrary Assistant plugin <= 3.32 - SQL Injection vulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2026-32393WordPress Greenly Theme Addons plugin < 8.2 - Local File Inclusion vulnerabilityCreatives_Planet Greenly Theme Addons
- CVE-2026-32392WordPress Greenly theme <= 8.1 - Local File Inclusion vulnerabilityCreatives_Planet Greenly
- CVE-2026-32384WordPress WpBookingly plugin <= 1.2.9 - Local File Inclusion vulnerabilitymagepeopleteam WpBookingly
- CVE-2026-32369WordPress Medilink-Core plugin < 2.0.7 - Local File Inclusion vulnerabilityRadiusTheme Medilink-Core
- CVE-2026-32368WordPress Geo to Lat plugin <= 1.0.19 - SQL Injection vulnerabilitydelphiknight Geo to Lat
- CVE-2026-32366WordPress Collapsing Categories plugin <= 3.0.9 - SQL Injection vulnerabilityrobfelty Collapsing Categories
- CVE-2026-32365WordPress Collapsing Archives plugin <= 3.0.7 - SQL Injection vulnerabilityrobfelty Collapsing Archives
- CVE-2026-32364WordPress Turbo Manager plugin < 4.0.8 - Local File Inclusion vulnerabilityredqteam Turbo Manager
- CVE-2026-32358WordPress Booking Calendar plugin <= 10.14.15 - SQL Injection vulnerabilitywpdevelop Booking Calendar
- CVE-2026-32355WordPress JetEngine plugin < 3.8.4.1 - Deserialization of untrusted data vulnerabilityCrocoblock JetEngine
- CVE-2026-31922WordPress Fox LMS plugin <= 1.0.6.3 - SQL Injection vulnerabilityAys Pro Fox LMS
- CVE-2026-31917WordPress WP ERP plugin <= 1.16.10 - SQL Injection vulnerabilityweDevs WP ERP
- CVE-2026-23941Request smuggling via first-wins Content-Length parsing in inets httpdErlang OTP
- CVE-2026-3999Broken access control vulnerability affecting ID ServerPointsharp ID Server
- CVE-2026-3873Legacy built-in user accountsyslink software AG Avantra
- CVE-2026-2890Formidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reusestrategy11team Formidable Forms – Contact Form Plugin, Surv…
- CVE-2026-3045Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpointcroixhaug Appointment Booking Calendar — Simply Schedule Ap…
- CVE-2026-22199Voltronic Power SNMP Web Pro 1.1 Path Traversal via upload.cgiVoltronic Power SNMP Web Pro
- CVE-2026-22192Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorageVoltronic Power SNMP Web Pro
- CVE-2026-22182wpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationTypegVectors wpDiscuz
Medium, low and unrated 196
- CVE-2026-0385Microsoft Edge (Chromium-based) for Android Spoofing VulnerabilityMicrosoft Edge for Android
- CVE-2026-32732XSS in @leanprover/unicode-input-componentleanprover vscode-lean4 · @leanprover/unicode-input-compone…
- CVE-2026-32724PX4 autopilot has a heap Use-After-Free in MavlinkShell::available() via SERIAL_CONTROL Race ConditionPX4-Autopilot
- CVE-2026-32719AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin ImportMintplex-Labs anything-llm
- CVE-2026-32717AnythingLLM access control bypass: suspended users can continue using Browser Extension API keysMintplex-Labs anything-llm
- CVE-2026-32715AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System PreferencesMintplex-Labs anything-llm
- CVE-2026-32713PX4 Autopilot MAVLink FTP Session Validation Logic Error Allows Operations on Invalid File DescriptorsPX4-Autopilot
- CVE-2026-32709PX4 Autopilot MAVLink FTP Unauthenticated Path Traversal (Arbitrary File Read/Write/Delete)PX4-Autopilot
- CVE-2026-32707PX4 autopilot has a stack buffer overflow in tattu_can due to unbounded memcpy in frame assembly loopPX4-Autopilot
- CVE-2026-32705PX4 autopilot BST Device Name Length Can Overflow Driver BufferPX4-Autopilot
- CVE-2026-32704SiYuan renderSprig: missing admin check allows any user to read full workspace DBsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-32702Cleanuparr has Username Enumeration via Timing AttackCleanuparr
- CVE-2026-32772telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.GNU inetutils
- CVE-2026-32630file-type affected by ZIP Decompression Bomb DoS via [Content_Types].xml entrysindresorhus file-type · file-type
- CVE-2026-2491Socomec DIRIS A-40 HTTP API Authentication Bypass VulnerabilitySocomec DIRIS A-40
- CVE-2026-3562Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass VulnerabilityPhilips Hue Bridge
- CVE-2026-0977IBM CICS Transaction Gateway for Multiplatforms Information DisclosureIBM CICS Transaction Gateway for Multiplatforms
- CVE-2026-32594Parse Server GraphQL WebSocket endpoint bypasses security middlewareparse-community parse-server · parse-server
- CVE-2025-13212IBM Aspera Console Denial of ServiceIBM Aspera Console
- CVE-2025-13459IBM Aspera Console Denial of ServiceIBM Aspera Console
- CVE-2025-13460IBM Aspera Console Information DisclosureIBM Aspera Console
- CVE-2026-31949LibreChat Denial of Service (DoS) via Unhandled Exception in DELETE /api/convosdanny-avila LibreChat
- CVE-2025-36368IBM Sterling B2B Integrator and IBM Sterling File Gateway SQL InjectionIBM Sterling B2B Integrator
- CVE-2023-40693IBM Sterling B2B Integrator and IBM Sterling File Gateway Cross-Site ScriptingIBM Sterling B2B Integrator
- CVE-2026-31864JumpServer has a Server-Side Template Injection Leading to RCE via YAML Renderingjumpserver
- CVE-2026-31798JumpServer Improper Certificate Validation in Custom SMS API Clientjumpserver
- CVE-2025-14483IBM Sterling B2B Integrator and IBM Sterling File Gateway Information DisclosureIBM Sterling B2B Integrator
- CVE-2026-30961Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk UploadForceu Gokapi · github.com/forceu/gokapi
- CVE-2025-14504IBM Sterling B2B Integrator and IBM Sterling File Gateway Cross-Site ScriptingIBM Sterling B2B Integrator · IBM Sterling File Gateway
- CVE-2026-30955Gokapi vulnerable to DoS in E2E Metadata ParserForceu Gokapi · github.com/forceu/gokapi
- CVE-2026-30943Gokapi has Privilege Escalation in File ReplaceForceu Gokapi · github.com/forceu/gokapi
- CVE-2026-30915SFTPGo improperly sanitizes placeholders in group home directories/key prefixesdrakkan sftpgo · github.com/drakkan/sftpgo +1
- CVE-2026-30914SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancydrakkan sftpgo · github.com/drakkan/sftpgo/v2 +1
- CVE-2026-30853calibre has a Path Traversal Leading to Arbitrary File Writekovidgoyal calibre
- CVE-2026-0835IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, aIBM Sterling B2B Integrator
- CVE-2025-13702IBM Sterling Partner Engagement Manager Cross-Site ScriptingIBM Sterling Partner Engagement Manager
- CVE-2025-13718IBM Sterling Partner Engagement Manager Information DisclosureIBM Sterling Partner Engagement Manager
- CVE-2025-13723IBM Sterling Partner Engagement Manager Information DisclosureIBM Sterling Partner Engagement Manager
- CVE-2025-12453Improper neutralization of input during web page generation vulnerability has been discovered in OpenText™ Vertica.OpenText™ Vertica
- CVE-2025-12454Improper neutralization of input during web page generation vulnerability has been discovered in OpenText™ Vertica.OpenText™ Vertica
- CVE-2025-12455Username Enumeration Observable Response Discrepancy vulnerability has been discovered in OpenText™ Vertica.OpenText™ Vertica
- CVE-2025-13726IBM Sterling Partner Engagement Manager Information DisclosureIBM Sterling Partner Engagement Manager
- CVE-2025-14811IBM Sterling Partner Engagement Manager Information DisclosureIBM Sterling Partner Engagement Manager
- CVE-2026-31897FreeRDP has an out-of-bounds read in `freerdp_bitmap_decompress_planar`FreeRDP
- CVE-2026-31885FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checksFreeRDP
- CVE-2026-31884FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0FreeRDP
- CVE-2026-31883FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow writeFreeRDP
- CVE-2026-29776FreeRDP has an Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core LibraryFreeRDP
- CVE-2026-29775FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheIdFreeRDP
- CVE-2026-29774FreeRDP has a heap-buffer-overflow in avc420_yuv_to_rgb via OOB regionRectsFreeRDP
- CVE-2026-32745In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settingsJetBrains Datalore
- CVE-2025-60012Apache Livy: Restrict file accessApache Software Foundation Apache Livy · org.apache.livy:li…
- CVE-2025-66249Apache Livy: Unauthorized directory accessApache Software Foundation Apache Livy · org.apache.livy:li…
- CVE-2026-2673OpenSSL TLS 1.3 server may choose unexpected key agreement groupOpenSSL
- CVE-2025-13778Device Reboot ControlABB AWIN GW100 rev.2 · ABB AWIN GW120
- CVE-2026-32543WordPress Responsive Blocks plugin <= 2.2.0 - Broken Access Control vulnerabilityCyberChimps Responsive Blocks
- CVE-2026-32487WordPress Lawyer Landing Page theme <= 1.2.7 - Broken Access Control vulnerabilityraratheme Lawyer Landing Page
- CVE-2026-32486WordPress Travel Booking theme <= 1.3.9 - Broken Access Control vulnerabilitywptravelengine Travel Booking
- CVE-2026-32462WordPress Master Addons for Elementor plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilityLiton Arefin Master Addons for Elementor
- CVE-2026-32461WordPress Really Simple SSL plugin <= 9.5.7 - Broken Access Control vulnerabilityReally Simple Plugins Really Simple SSL
- CVE-2026-32460WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.36 - Cross Site Scripting (XSS) vulnerabilityThemefic Ultimate Addons for Contact Form
- CVE-2026-32457WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.18 - Broken Access Control vulnerabilityWombat Plugins Advanced Product Fields (Product Addons) for…
- CVE-2026-32456WordPress Admin Menu Editor plugin <= 1.14.1 - Cross Site Request Forgery (CSRF) vulnerabilityJanis Elsts Admin Menu Editor
- CVE-2026-32455WordPress MDTF plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityRealMag777 MDTF
- CVE-2026-32454WordPress Avada Core plugin < 5.15.0 - Cross Site Scripting (XSS) vulnerabilityThemeFusion Avada Core
- CVE-2026-32453WordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerabilityThemeFusion Avada Core
- CVE-2026-32452WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerabilityThemeFusion Fusion Builder
- CVE-2026-32451WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerabilityThemeFusion Fusion Builder
- CVE-2026-32450WordPress Active Products Tables for WooCommerce plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilityRealMag777 Active Products Tables for WooCommerce
- CVE-2026-32449WordPress Themify Event Post plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerabilitythemifyme Themify Event Post
- CVE-2026-32448WordPress Podlove Podcast Publisher plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerabilityEric Teubert Podlove Podcast Publisher
- CVE-2026-32447WordPress Atarim plugin <= 4.3.2 - Broken Access Control vulnerabilityVito Peleg Atarim
- CVE-2026-32446WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerabilitySyed Balkhi Contact Form by WPForms
- CVE-2026-32445WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerabilityElementor Website Builder
- CVE-2026-32443WordPress Product Feed PRO for WooCommerce plugin <= 13.5.2 - Cross Site Request Forgery (CSRF) vulnerabilityJosh Kohlbach Product Feed PRO for WooCommerce
- CVE-2026-32442WordPress e2pdf plugin <= 1.28.15 - Broken Access Control vulnerabilitye2pdf
- CVE-2026-32440WordPress WP Food plugin < 2.7.1 - Broken Access Control vulnerabilityEx-Themes WP Food
- CVE-2026-32439WordPress BigHearts theme <= 3.1.14 - Broken Access Control vulnerabilityWebGeniusLab BigHearts
- CVE-2026-32438WordPress VW School Education theme <= 1.4.6 - Broken Access Control vulnerabilityvowelweb VW School Education
- CVE-2026-32437WordPress VW Portfolio theme <= 1.3.3 - Broken Access Control vulnerabilityvowelweb VW Portfolio
- CVE-2026-32436WordPress VW Photography theme <= 1.3.8 - Broken Access Control vulnerabilityvowelweb VW Photography
- CVE-2026-32435WordPress VW Pet Shop theme <= 1.4.7 - Broken Access Control vulnerabilityvowelweb VW Pet Shop
- CVE-2026-32434WordPress VW Fitness theme <= 4.3.4 - Broken Access Control vulnerabilityvowelweb VW Fitness
- CVE-2026-32432WordPress WP Time Slots Booking Form plugin <= 1.2.42 - Broken Access Control vulnerabilitycodepeople WP Time Slots Booking Form
- CVE-2026-32431WordPress Astra Bulk Edit plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerabilityBrainstorm Force Astra Bulk Edit
- CVE-2026-32430WordPress PowerPack Addons for Elementor plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerabilityIdeaBox Creations PowerPack Addons for Elementor
- CVE-2026-32429WordPress Magical Addons For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityNoor Alam Magical Addons For Elementor
- CVE-2026-32428WordPress Popup Like box plugin <= 3.7.7 - Broken Access Control vulnerabilityAys Pro Popup Like box
- CVE-2026-32427WordPress VW Education Lite plugin <= 2.2.0 - Broken Access Control vulnerabilityvowelweb VW Education Lite
- CVE-2026-32425WordPress Payment Gateway Pix For GiveWP plugin <= 2.2.3 - Broken Access Control vulnerabilitylinknacional Payment Gateway Pix For GiveWP
- CVE-2026-32424WordPress Sprout Clients plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerabilityBoldGrid Sprout Clients
- CVE-2026-32423WordPress Admin and Site Enhancements (ASE) plugin <= 8.4.0 - Broken Access Control vulnerabilityBowo Admin and Site Enhancements
- CVE-2026-32421WordPress Post Timeline plugin <= 2.4.1 - Broken Access Control vulnerabilityAgile Logix Post Timeline
- CVE-2026-32420WordPress GamiPress plugin <= 7.6.6 - Cross Site Request Forgery (CSRF) vulnerabilityRuben Garcia GamiPress
- CVE-2026-32419WordPress List category posts plugin <= 0.93.1 - Cross Site Scripting (XSS) vulnerabilityFernando Briano List category posts
- CVE-2026-32417WordPress Pochipp plugin < 1.18.9 - Broken Access Control vulnerabilitywppochipp Pochipp
- CVE-2026-32416WordPress PDF Poster plugin <= 2.4.0 - Broken Access Control vulnerabilitybPlugins PDF Poster
- CVE-2026-32415WordPress Squeeze plugin <= 1.7.7 - Directory Traversal vulnerabilityBogdan Bendziukov Squeeze
- CVE-2026-32413WordPress Permalink Manager Lite plugin < 2.5.3 - Broken Access Control vulnerabilityMaciej Bis Permalink Manager Lite
- CVE-2026-32412WordPress Gift Up Gift Cards for WordPress and WooCommerce plugin <= 3.1.7 - Server Side Request Forgery (SSRF) vulnerabilityGift Up! Gift Up Gift Cards for WordPress and WooCommerce
- CVE-2026-32411WordPress Embed Calendly plugin <= 4.4 - Cross Site Scripting (XSS) vulnerabilitySimpma Embed Calendly
- CVE-2026-32410WordPress WBW Currency Switcher for WooCommerce plugin <= 2.2.5 - Broken Access Control vulnerabilityWBW Plugins WBW Currency Switcher for WooCommerce
- CVE-2026-32409WordPress Forminator plugin <= 1.50.2 - Broken Access Control vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Forminator
- CVE-2026-32408WordPress Brizy plugin <= 2.7.23 - Broken Access Control vulnerabilitythemefusecom Brizy
- CVE-2026-32407WordPress WPC Smart Wishlist for WooCommerce plugin <= 5.0.8 - Broken Access Control vulnerabilityWPClever WPC Smart Wishlist for WooCommerce
- CVE-2026-32406WordPress WPC Product Bundles for WooCommerce plugin <= 8.4.5 - Broken Access Control vulnerabilityWPClever WPC Product Bundles for WooCommerce
- CVE-2026-32405WordPress WoodMart theme <= 8.3.9 - Sensitive Data Exposure vulnerabilityxtemos WoodMart
- CVE-2026-32404WordPress Studio99 WP Monitor plugin <= 1.0.3 - Broken Access Control vulnerabilityStudio99 WP Monitor
- CVE-2026-32403WordPress Toocheke Companion plugin <= 1.194 - Cross Site Scripting (XSS) vulnerabilityToocheke Companion
- CVE-2026-32402WordPress Image Slider by Ays plugin <= 2.7.1 - Broken Access Control vulnerabilityAys Pro Image Slider by Ays
- CVE-2026-32398WordPress TeraWallet – For WooCommerce plugin <= 1.5.15 - Race Condition vulnerabilitySubrata Mal TeraWallet – For WooCommerce
- CVE-2026-32397WordPress Filter & Grids plugin <= 3.5.1 - Broken Access Control vulnerabilityYMC Filter & Grids
- CVE-2026-32396WordPress Team plugin <= 5.0.13 - Broken Access Control vulnerabilityRadiusTheme Team
- CVE-2026-32395WordPress Xpro Addons For Beaver Builder – Lite plugin <= 1.5.6 - Broken Access Control vulnerabilityXpro Addons For Beaver Builder – Lite
- CVE-2026-32394WordPress PublishPress Capabilities plugin <= 2.31.0 - Broken Access Control vulnerabilityPublishPress Capabilities
- CVE-2026-32391WordPress SmartFix theme < 1.2.4 - Broken Access Control vulnerabilitylinethemes SmartFix
- CVE-2026-32390WordPress Nanosoft theme < 1.3.2 - Broken Access Control vulnerabilitylinethemes Nanosoft
- CVE-2026-32388WordPress GLB theme <= 1.2.2 - Broken Access Control vulnerabilitylinethemes GLB
- CVE-2026-32387WordPress Checkout for PayPal plugin <= 1.0.46 - Broken Access Control vulnerabilityNoor Alam Checkout for PayPal
- CVE-2026-32386WordPress Envo Extra plugin <= 1.9.13 - Broken Access Control vulnerabilityEnvoThemes Envo Extra
- CVE-2026-32385WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerabilityMetagauss RegistrationMagic
- CVE-2026-32383WordPress Ridhi theme <= 1.1.2 - Broken Access Control vulnerabilityraratheme Ridhi
- CVE-2026-32382WordPress Digital Download theme <= 1.1.4 - Broken Access Control vulnerabilityraratheme Digital Download
- CVE-2026-32381WordPress App Landing Page theme <= 1.2.2 - Broken Access Control vulnerabilityraratheme App Landing Page
- CVE-2026-32380WordPress Numinous theme <= 1.3.0 - Broken Access Control vulnerabilityraratheme Numinous
- CVE-2026-32379WordPress Rara Academic theme <= 1.2.2 - Broken Access Control vulnerabilityraratheme Rara Academic
- CVE-2026-32378WordPress Book Landing Page theme <= 1.2.7 - Broken Access Control vulnerabilityraratheme Book Landing Page
- CVE-2026-32377WordPress Pranayama Yoga theme <= 1.2.2 - Broken Access Control vulnerabilityraratheme Pranayama Yoga
- CVE-2026-32376WordPress Kalon theme <= 1.2.9 - Broken Access Control vulnerabilityraratheme Kalon
- CVE-2026-32375WordPress Travel Diaries theme <= 1.2.4 - Broken Access Control vulnerabilityraratheme Travel Diaries
- CVE-2026-32374WordPress The Minimal theme <= 1.2.9 - Broken Access Control vulnerabilityraratheme The Minimal
- CVE-2026-32373WordPress SMS Alert Order Notifications plugin <= 3.9.0 - Broken Access Control vulnerabilityCozy Vision SMS Alert Order Notifications
- CVE-2026-32372WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.2.4 - Sensitive Data Exposure vulnerabilityRadiusTheme ShopBuilder – Elementor WooCommerce Builder Add…
- CVE-2026-32371WordPress Elegant Pink theme <= 1.3.3 - Broken Access Control vulnerabilityraratheme Elegant Pink
- CVE-2026-32370WordPress Influencer theme <= 1.1.7 - Broken Access Control vulnerabilityraratheme Influencer
- CVE-2026-32363WordPress WPLifeCycle plugin <= 3.3.1 - Broken Access Control vulnerabilityFunlus Oy WPLifeCycle
- CVE-2026-32362WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.3 - Broken Access Control vulnerabilityactivity-log.com WP Sessions Time Monitoring Full Automatic
- CVE-2026-32361WordPress Editorial Calendar plugin <= 3.9.0 - Cross Site Scripting (XSS) vulnerabilityMarketing Fire Editorial Calendar
- CVE-2026-32360WordPress Rich Showcase for Google Reviews plugin <= 6.9.4.3 - Cross Site Scripting (XSS) vulnerabilityrichplugins Rich Showcase for Google Reviews
- CVE-2026-32359WordPress Icon List Block plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerabilitybPlugins Icon List Block
- CVE-2026-32357WordPress Simple Blog Card plugin <= 2.37 - Server Side Request Forgery (SSRF) vulnerabilityKatsushi Kawamori Simple Blog Card
- CVE-2026-32356WordPress Robo Gallery plugin <= 5.1.2 - Cross Site Scripting (XSS) vulnerabilityrobosoft Robo Gallery
- CVE-2026-32354WordPress WpEvently plugin < 5.1.9 - Sensitive Data Exposure vulnerabilitymagepeopleteam WpEvently
- CVE-2026-32353WordPress MailerPress plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerabilityMailerPress Team MailerPress
- CVE-2026-32352WordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerabilityElementor Website Builder
- CVE-2026-32351WordPress PowerPress Podcasting plugin <= 11.15.13 - Cross Site Scripting (XSS) vulnerabilityblubrry PowerPress Podcasting
- CVE-2026-32350WordPress Chocolate House theme <= 1.1.5 - Broken Access Control vulnerabilitywpradiant Chocolate House
- CVE-2026-32349WordPress Embed PDF Viewer plugin <= 2.4.7 - Server Side Request Forgery (SSRF) vulnerabilityAndy Fragen Embed PDF Viewer
- CVE-2026-32348WordPress MAS Videos plugin <= 1.3.2 - Broken Access Control vulnerabilityMadrasThemes MAS Videos
- CVE-2026-32347WordPress Restaurant and Cafe theme <= 1.2.5 - Broken Access Control vulnerabilityraratheme Restaurant and Cafe
- CVE-2026-32346WordPress Travel Agency theme <= 1.5.5 - Broken Access Control vulnerabilityraratheme Travel Agency
- CVE-2026-32345WordPress Perfect Portfolio theme <= 1.2.4 - Broken Access Control vulnerabilityraratheme Perfect Portfolio
- CVE-2026-32344WordPress Corpiva theme <= 1.0.96 - Cross Site Request Forgery (CSRF) vulnerabilitydesertthemes Corpiva
- CVE-2026-32343WordPress Easy Table of Contents plugin <= 2.0.80 - Cross Site Request Forgery (CSRF) vulnerabilityMagazine3 Easy Table of Contents
- CVE-2026-32342WordPress Quiz Maker plugin <= 6.7.1.2 - Cross Site Request Forgery (CSRF) vulnerabilityAys Pro Quiz Maker
- CVE-2026-32341WordPress Benevolent theme <= 1.3.9 - Broken Access Control vulnerabilityraratheme Benevolent
- CVE-2026-32340WordPress Business One Page theme <= 1.3.2 - Broken Access Control vulnerabilityraratheme Business One Page
- CVE-2026-32339WordPress Bakes And Cakes theme <= 1.2.9 - Broken Access Control vulnerabilityraratheme Bakes And Cakes
- CVE-2026-32338WordPress Construction Landing Page theme <= 1.4.1 - Broken Access Control vulnerabilityraratheme Construction Landing Page
- CVE-2026-32337WordPress Preschool and Kindergarten theme <= 1.2.5 - Broken Access Control vulnerabilityraratheme Preschool and Kindergarten
- CVE-2026-32336WordPress Rara Business theme <= 1.3.0 - Broken Access Control vulnerabilityraratheme Rara Business
- CVE-2026-32335WordPress The Conference theme <= 1.2.5 - Broken Access Control vulnerabilityraratheme The Conference
- CVE-2026-32334WordPress JobScout theme <= 1.1.7 - Broken Access Control vulnerabilityraratheme JobScout
- CVE-2026-32332WordPress Easy Form plugin <= 2.7.9 - Broken Access Control vulnerabilityAys Pro Easy Form
- CVE-2026-32331WordPress Textmetrics plugin <= 3.6.4 - Broken Access Control vulnerabilityIsrapil Textmetrics
- CVE-2026-32330WordPress Photo Gallery by 10Web plugin <= 1.8.37 - Cross Site Request Forgery (CSRF) vulnerabilityPhoto Gallery by 10Web
- CVE-2026-32329WordPress Advanced Related Posts plugin <= 1.9.1 - Broken Access Control vulnerabilityAys Pro Advanced Related Posts
- CVE-2026-32328WordPress Lemmony theme < 1.7.1 - Cross Site Request Forgery (CSRF) vulnerabilityshufflehound Lemmony
- CVE-2026-31919WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.7.1 - Broken Access Control vulnerabilityJosh Kohlbach Advanced Coupons for WooCommerce Coupons
- CVE-2026-31918WordPress immonex Kickstart plugin <= 1.13.0 - Cross Site Scripting (XSS) vulnerabilityimmonex Kickstart
- CVE-2026-31916WordPress Latest Post Shortcode plugin <= 14.2.1 - Broken Access Control vulnerabilityIulia Cazan Latest Post Shortcode
- CVE-2026-31915WordPress Flatsome theme <= 3.19.6 - Broken Access Control vulnerabilityUX-themes Flatsome
- CVE-2026-2859Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent EndpointCheckmk
- CVE-2026-24097Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing EndpointCheckmk
- CVE-2026-4063Social Icons Widget & Block <= 4.5.8 - Missing Authorization to Authenticated (Subscriber+) Sharing Configuration Creationwpzoom Social Icons Widget & Block – Social Media Icons & S…
- CVE-2026-23943Pre-auth SSH DoS via unbounded zlib inflateErlang OTP
- CVE-2026-23942SFTP root escape via component-agnostic prefix check in ssh_sftpdErlang OTP
- CVE-2026-4105Systemd: systemd: privilege escalation via improper access control in registermachine d-bus methodRed Hat Hardened Images · Red Hat Enterprise Linux +1
- CVE-2026-3986Calculated Fields Form <= 5.4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settingscodepeople Calculated Fields Form
- CVE-2026-2888Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameterstrategy11team Formidable Forms – Contact Form Plugin, Surv…
- CVE-2026-2879GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletionroxnor GetGenie – AI Content Writer with Keyword Research &…
- CVE-2026-2257GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST APIroxnor GetGenie – AI Content Writer with Keyword Research &…
- CVE-2026-1704Appointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposurecroixhaug Appointment Booking Calendar — Simply Schedule Ap…
- CVE-2025-15515The authentication mechanism for a specific feature in the EasyShare module contains a vulnerability.vivo Easyshare
- CVE-2025-57849Fuse: privilege escalation via excessive /etc/passwd permissionsRed Hat Fuse
- CVE-2025-8766Noobaa-core: excessive permissions of /etc could lead to escalation of privilege in the noobaa-core containerRed Hat Openshift Data Foundation
- CVE-2026-22216wpDiscuz before 7.6.47 - No Rate Limiting on Subscription Endpoints with LIKE Wildcard BypassgVectors wpDiscuz
- CVE-2026-22215wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPagegVectors wpDiscuz
- CVE-2026-22210wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLsgVectors wpDiscuz
- CVE-2026-22209wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Custom CSS in Style TaggVectors wpDiscuz
- CVE-2026-22204wpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp_mail() RecipientgVectors wpDiscuz
- CVE-2026-22203wpDiscuz before 7.6.47 - Options Export Leaks OAuth Secrets in PlaintextgVectors wpDiscuz
- CVE-2026-22202wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by EmailgVectors wpDiscuz
- CVE-2026-22201wpDiscuz before 7.6.47 - IP Address Spoofing in getIP()gVectors wpDiscuz
- CVE-2026-22191Beghelli Sicuro24 SicuroWeb AngularJS Template InjectionBeghelli SicuroWeb
- CVE-2026-22183wpDiscuz before 7.6.47 - Stored Cross-Site Scripting in Inline Comment PreviewgVectors wpDiscuz