CVEs published April 8, 2026
484 CVEs were published on April 8, 2026: 23 critical, 148 high.
- Published
- 484
- Critical
- 23
- High
- 148
- Medium
- 305
- Low
- 7
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 192
Most affected products
- Google Chrome
- 59
- GitLab
- 11
- zammad
- 10
- aces Loris
- 8
- ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- 6
- Elastic Kibana
- 5
- InvenTree
- 5
- TP-Link Systems AX53
- 5
- harttle liquidjs · liquidjs
- 4
- honojs hono · hono
- 4
Critical 23
- CVE-2026-3199Nexus Repository 3 - Authenticated Remote Code Execution via Task Property InjectionSonatype Nexus Repository
- CVE-2026-40035Unfurl - Werkzeug Debugger Exposure via String Config Parsingobsidianforensics unfurl · dfir-unfurl
- CVE-2026-5902Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to corruGoogle Chrome
- CVE-2026-5874Use after free in PrivateAI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI Google Chrome
- CVE-2026-39860Nix sandbox escape: file write via symlink at FOD `.tmp` copy destinationNixOS nix
- CVE-2026-39890PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition LoadingMervinPraison PraisonAI · praisonai
- CVE-2026-39888PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)MervinPraison praisonaiagents · praisonaiagents
- CVE-2026-2942ProSolution WP Client <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcessProSolution WP Client
- CVE-2025-14816Information Disclosure, Tampering, and Denial-of-Service Vulnerabilities in GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works64Mitsubishi Electric GENESIS64 · Mitsubishi Electric Ico… +11
- CVE-2025-14815Information Disclosure, Tampering, and Denial-of-Service Vulnerabilities in GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works64Mitsubishi Electric GENESIS64 · Mitsubishi Electric Ico… +11
- CVE-2026-25776Movable Type provided by Six Apart Ltd.Six Apart Movable Type
- CVE-2026-39640WordPress Theme Editor plugin <= 3.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution vulnerabilitymndpsingh287 Theme Editor
- CVE-2026-39620WordPress Appointment theme <= 3.5.5 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerabilitypriyanshumittal Appointment
- CVE-2026-39619WordPress Busiprof theme <= 2.5.2 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerabilitypriyanshumittal Busiprof
- CVE-2026-39617WordPress Bluestreet theme <= 1.7.3 - Cross Site Request Forgery (CSRF) to Arbitrary Plugin Installation vulnerabilitypriyanshumittal Bluestreet
- CVE-2026-3535DSGVO Google Web Fonts GDPR <= 1.1 - Unauthenticated Arbitrary File Upload via 'fonturl' Parametermlfactory DSGVO Google Web Fonts GDPR
- CVE-2026-4003Users manager – PN <= 1.1.15 - Unauthenticated Privilege Escalation via Account Takeover via 'userspn_form_save' AJAX Actionfelixmartinez Users manager – PN
- CVE-2026-3296Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadatawpeverest Everest Forms – Contact Form, Payment Form, Quiz,…
- CVE-2026-27143Missing bound checks can lead to memory corruption in safe Go in cmd/compileGo toolchain cmd/compile · toolchain
- CVE-2026-1346Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessIBM Verify Identity Access Container · IBM Security Veri… +2
- CVE-2023-46945QD 20230821 is vulnerable to Server-side request forgery (SSRF) via a crafted request
- CVE-2026-31017A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1,
- CVE-2026-31040A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lead tstata-mcp
High 148
- CVE-2026-5815D-Link DIR-645 hedwig.cgi hedwigcgi_main stack-based overflowD-Link DIR-645
- CVE-2025-12664Improper Validation of Specified Quantity in Input in GitLabGitLab
- CVE-2026-1092Improper Validation of Specified Quantity in Input in GitLabGitLab
- CVE-2026-5173Exposed Dangerous Method or Function in GitLabGitLab
- CVE-2026-40037OpenClaw < 2026.4.8 - Unsafe Request Body Replay via fetchWithSsrFGuard Cross-Origin RedirectsOpenClaw
- CVE-2026-40036Unfurl < 2026.04 - Denial of Service via Unbounded zlib Decompressionobsidianforensics unfurl · dfir-unfurl
- CVE-2026-40032UAC < 3.3.0-rc1 Command Injection via Placeholder Substitutiontclahr UAC
- CVE-2026-40031MemProcFS < 5.17 DLL/Shared Library Hijackingufrisk MemProcFS
- CVE-2026-40030parseusbs < 1.9 Command Injection via Volume Path Argumentkhyrenz parseusbs
- CVE-2026-40029parseusbs < 1.9 Command Injection via Crafted LNK Filenamekhyrenz parseusbs
- CVE-2026-40027ALEAPP NQ Vault Artifact Parser Path Traversalabrignoni ALEAPP
- CVE-2026-40024Sleuth Kit tsk_recover Path Traversalsleuthkit
- CVE-2026-5915Insufficient validation of untrusted input in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bGoogle Chrome
- CVE-2026-5914Type Confusion in CSS in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to pGoogle Chrome
- CVE-2026-5913Out of bounds read in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a Google Chrome
- CVE-2026-5912Integer overflow in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory write via a Google Chrome
- CVE-2026-5910Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2026-5909Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2026-5908Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2026-5907Insufficient data validation in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory rGoogle Chrome
- CVE-2026-5890Race in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from processGoogle Chrome
- CVE-2026-5884Insufficient validation of untrusted input in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised thGoogle Chrome
- CVE-2026-5883Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a cGoogle Chrome
- CVE-2026-5879Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbiGoogle Chrome
- CVE-2026-5877Use after free in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox viGoogle Chrome
- CVE-2026-5873Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandGoogle Chrome
- CVE-2026-5872Use after free in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a cGoogle Chrome
- CVE-2026-5871Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafGoogle Chrome
- CVE-2026-5870Integer overflow in Skia in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-5868Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a saGoogle Chrome
- CVE-2026-5866Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a cGoogle Chrome
- CVE-2026-5865Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafGoogle Chrome
- CVE-2026-5863Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandGoogle Chrome
- CVE-2026-5862Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandGoogle Chrome
- CVE-2026-5861Use after free in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafGoogle Chrome
- CVE-2026-5860Use after free in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-5859Integer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2026-5858Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code via a crafted HTMLGoogle Chrome
- CVE-2026-39891PraisonAI has a Template Injection in Agent Tool DefinitionsMervinPraison PraisonAI · praisonai
- CVE-2026-39889PraisonAI has Unauthenticated SSE Event Stream Exposes All Agent Activity in A2U ServerMervinPraison PraisonAI · praisonai
- CVE-2026-39885FrontMCP Affected by SSRF via $ref Dereferencing in Untrusted OpenAPI Specificationsagentfront frontmcp · @frontmcp adapters +5
- CVE-2026-39883OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijackingopen-telemetry opentelemetry-go · go.opentelemetry.io/otel/…
- CVE-2026-5436MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keysinc2734 MW WP Form
- CVE-2026-39429kcp's cache server is accessible without authentication or authorization checkskcp-dev kcp · github.com/kcp-dev/kcp
- CVE-2026-39416Stored XSS in modal item preview for long item content in AIL Frameworkail-project ail-framework
- CVE-2026-39414MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsingminio · github.com/minio/minio
- CVE-2026-39863Kamailio Core: TCP Data Processing Vulnerabilitykamailio
- CVE-2026-35525LiquidJS has a root restriction bypass for partial and layout loading through symlinked templatesharttle liquidjs · liquidjs
- CVE-2026-35476InvenTree Affected by Privilege Escalation via APIInvenTree
- CVE-2026-35478InvenTree has Arbitrary API Token CreationInvenTree
- CVE-2026-23869A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-serverMeta react-server-dom-turbopack · Meta react-server-dom-… +4
- CVE-2026-35455immich has Stored XSS via OCR Text in 360° Panorama Viewerimmich-app immich
- CVE-2026-35446LORIS has a path traversal in FilesDownloadHandleraces Loris
- CVE-2026-35169LORIS has potential cross-site scripting in help_editor moduleaces Loris
- CVE-2026-34724Zammad has a server-side template injection leading to RCE via AI Agentzammad
- CVE-2026-34723Zammad has incorrect access control in getting_started_controllerzammad
- CVE-2026-34719Zammad has a Server-side request forgery (SSRF) via webhookszammad
- CVE-2026-34392LORIS has a path traversal in static routeraces Loris
- CVE-2026-30818OS Command Injection Vulnerability in dnsmasq Module in TP-Link AX53TP-Link Systems AX53
- CVE-2026-30815OS Command Injection Vulnerability in OpenVPN Module in TP-Link AX53TP-Link Systems AX53
- CVE-2026-30814Buffer Overflow Vulnerability in TP-Link AX53TP-Link Systems AX53
- CVE-2026-33350LORIS has a SQL injection in MRI feedback popupaces Loris
- CVE-2026-27806Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbitfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-35401Saleor has a resource exhaustion vulnerability in GraphQL queriessaleor
- CVE-2026-33756Saleor Affected by Denial of Service via Unbounded GraphQL Query Batchingsaleor
- CVE-2026-32590Mirror-registry: remote code execution using pickle deserializationmirror registry for Red Hat OpenShift · Red Hat Quay
- CVE-2026-32589Mirror-registry: quay: insecure direct object reference in blobuploadmirror registry for Red Hat OpenShift · Red Hat Quay
- CVE-2026-33466Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File WriteElastic Logstash
- CVE-2026-33461Incorrect Authorization in Kibana Fleet Leading to Information DisclosureElastic Kibana
- CVE-2026-4498Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scopeElastic Kibana
- CVE-2026-33229XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting APIxwiki-platform · org.xwiki.platform xwiki-platform-legac… +3
- CVE-2026-39394CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controllerci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-39393Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4msci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-5795In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.Eclipse Foundation Eclipse Jetty · org.eclipse.jetty.ee1… +4
- CVE-2026-28261Dell Elastic Cloud Storage, version 3.8.1.7 and prior, and Dell ObjectScale, versions prior to 4.1.0.3 and version 4.2.0.0, contains an InseDell Elastic Cloud Storage · Dell ObjectScale
- CVE-2026-5301Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in coolercontrol-uicoolercontrol-ui
- CVE-2026-5208Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in coolercontroldcoolercontrold
- CVE-2026-3396WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injectionshamimmoeen WCAPF – Ajax Product Filter for WooCommerce
- CVE-2026-3243Advanced Members for ACF <= 1.2.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversaldanbilabs Advanced Members for ACF
- CVE-2026-33088Movable Type provided by Six Apart Ltd.Six Apart Movable Type
- CVE-2026-39684WordPress OrganicFood theme <= 3.6.4 - Local File Inclusion vulnerabilityUnTheme OrganicFood
- CVE-2026-39681WordPress Homeo theme <= 1.2.59 - Local File Inclusion vulnerabilityApusTheme Homeo
- CVE-2026-39679WordPress Freeio theme <= 1.3.21 - Local File Inclusion vulnerabilityApusTheme Freeio
- CVE-2026-39677WordPress Emphires theme <= 3.9 - Local File Inclusion vulnerabilityCreatives_Planet Emphires
- CVE-2026-39671WordPress Extra Fees Plugin for WooCommerce plugin <= 4.3.3 - Cross Site Request Forgery (CSRF) vulnerabilityDotstore Extra Fees Plugin for WooCommerce
- CVE-2026-39623WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerabilitykutethemes Biolife
- CVE-2026-39621WordPress SpicePress theme <= 2.3.2.5 - CSRF to Arbitrary Plugin Installation vulnerabilityspicethemes SpicePress
- CVE-2026-39613WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerabilitykutethemes Boutique
- CVE-2026-39611WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerabilitykutethemes KuteShop
- CVE-2026-39544WordPress LabtechCO theme <= 8.3 - Local File Inclusion vulnerabilitythemeStek LabtechCO
- CVE-2026-39538WordPress Mikado Core plugin <= 1.6 - Local File Inclusion vulnerabilityMikado-Themes Mikado Core
- CVE-2026-39497WordPress FOX plugin <= 1.4.5 - SQL Injection vulnerabilityRealMag777 FOX
- CVE-2026-39496WordPress YayMail plugin <= 4.3.3 - SQL Injection vulnerabilityYayCommerce YayMail
- CVE-2026-39495WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerabilityNSquared Simply Schedule Appointments
- CVE-2026-39487WordPress Amelia plugin <= 2.1.1 - SQL Injection vulnerabilityameliabooking Amelia
- CVE-2026-39486WordPress Download Monitor plugin <= 5.1.8 - SQL Injection vulnerabilityWP Chill Download Monitor
- CVE-2026-39479WordPress OttoKit plugin <= 1.1.20 - SQL Injection vulnerabilityBrainstorm Force OttoKit
- CVE-2026-39475WordPress User Feedback plugin <= 1.10.1 - SQL Injection vulnerabilitySyed Balkhi User Feedback
- CVE-2026-39466WordPress Broken Link Checker plugin <= 2.4.7 - SQL Injection vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Broken Link C…
- CVE-2026-4483An exposed IOCTL with an insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial xMoxa MxGeneralIo
- CVE-2026-4808Gerador de Certificados – DevApps <= 1.3.6 - Authenticated (Administrator+) Arbitrary File Uploadtidevapps Gerador de Certificados – DevApps
- CVE-2026-4338ActivityPub Routing < 8.0.2 - Unauthenticated Drafts/Scheduled/Pending Posts DisclosureActivityPub
- CVE-2026-24913SQL Injection vulnerability exists in MATCHA INVOICE 2.6.6 and earlier.ICZ MATCHA INVOICE
- CVE-2026-5726ASDA-Soft Stack-based Buffer Overflow VulnerabilityDeltaWW ASDA-Soft
- CVE-2026-3499Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce 13.4.6 - 13.5.2.1 - Cross-Site Request Forgery to Multiple Administrative Actionsjkohlbach Product Feed PRO for WooCommerce by AdTribes – Pr…
- CVE-2026-32280Unexpected work during chain building in crypto/x509Go standard library crypto/x509 · stdlib
- CVE-2026-32281Inefficient policy validation in crypto/x509Go standard library crypto/x509 · stdlib
- CVE-2026-27140Code execution vulnerability in SWIG code generation in cmd/goGo toolchain cmd/go · toolchain
- CVE-2026-32283Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tlsGo standard library crypto/tls · stdlib
- CVE-2026-27144Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compileGo toolchain cmd/compile · toolchain
- CVE-2026-33810Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509Go standard library crypto/x509 · stdlib
- CVE-2026-4788Multiple Vulnerabilities affect IBM Tivoli Netcool ImpactIBM Tivoli Netcool Impact
- CVE-2026-3357IBM Langflow Desktop FAISS Vector Store Remote Code Execution via malicious Pickle fileIBM Langflow Desktop
- CVE-2026-1343Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessIBM Verify Identity Access Container · IBM Security Veri… +2
- CVE-2025-45057D-Link DI-8300 v16.07.26A1 was discovered to contain a buffer overflow via the ip parameter in the ip_position_asp function.
- CVE-2025-45058D-Link DI-8300 v16.07.26A1 was discovered to contain a buffer overflow via the fx parameter in the jingx_asp function.
- CVE-2025-45059D-Link DI-8300 v16.07.26A1 was discovered to contain a buffer overflow via the fn parameter in the tgfile_htm function.
- CVE-2025-50644A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper validation of user input in the qj.asp endpoint.
- CVE-2025-50645A vulnerability has been discovered in D-Link DI-8003 16.07.26A1, which can lead to a buffer overflow when the s parameter in the pppoe_list
- CVE-2025-50646A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to insufficient input validation on the name parameter in the /qos_t
- CVE-2025-50647A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1, specifically in the handling of the wans parameter in the qos.asp endpo
- CVE-2025-50648A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to inadequate input validation in the /tggl.asp endpoint.
- CVE-2025-50649A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper input validation in the vlan_name parameter in the /shut
- CVE-2025-50650A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to inadequate validation of input size in the routes_static paramete
- CVE-2025-50652An issue in D-Link DI-8003 16.07.26A1 related to improper handling of the id parameter in the /saveparm_usb.asp endpoint.
- CVE-2025-50653A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name and mem parameters in the /time_gro
- CVE-2025-50654A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper validation of the id parameter in the /thd_member.asp en
- CVE-2025-50655A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name parameter in the /thd_group.asp end
- CVE-2025-50657A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the pid parameter in the /trace.asp endpoint
- CVE-2025-50659A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the custom_error parameter in the /user.asp
- CVE-2025-50660A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name parameter in the /url_member.asp en
- CVE-2025-50661A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of multiple parameters in the /url_rule.asp end
- CVE-2025-50662A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name parameter in the /url_group.asp end
- CVE-2025-50663A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name parameter in the /usb_paswd.asp end
- CVE-2025-50664A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /user_group.asp endpoint.
- CVE-2025-50665A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of input parameters in the /web_keyword.asp end
- CVE-2025-50666A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of multiple parameters in the /web_post.asp end
- CVE-2025-50667A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the iface parameter in the /wan_line_detecti
- CVE-2025-50668A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the s parameter in the /web_list_opt.asp end
- CVE-2025-50669A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 and DI-8003G 19.12.10A1 due to improper handling of the wan_ping paramet
- CVE-2025-50670A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /xwgl_bwr.asp endpoint.
- CVE-2025-50671A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /xwgl_ref.asp endpoint.
- CVE-2025-50672A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /yyxz_dlink.asp endpoint.
- CVE-2025-50673A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the http_lanport parameter in the /webgl.asp
- CVE-2025-52221Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm function via the funcname, funcpara1, and funcpara2 parameter
- CVE-2025-52222D-Link DI-8003 v16.07.26A1, DI-8500 v16.07.26A1; DI-8003G v17.12.21A1, DI-8200G v17.12.20A1, DI-8200 v16.07.26A1, DI-8400 v16.07.26A1, DI-80
- CVE-2026-30075OpenAirInterface Version 2.2.0 has a Buffer Overflow vulnerability in processing UplinkNASTransport containing Authentication Response conta
- CVE-2026-30080OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection.
Medium, low and unrated 313
- CVE-2026-5824code-projects Simple Laundry System userchecklogin.php sql injectioncode-projects Simple Laundry System
- CVE-2026-5823itsourcecode Construction Management System borrowed_tool_report.php sql injectionitsourcecode Construction Management System
- CVE-2026-5814PHPGurukul Online Course Registration check_availability.php sql injectionPHPGurukul Online Course Registration
- CVE-2026-5813PHPGurukul Online Course Registration check_availability.php sql injectionPHPGurukul Online Course Registration
- CVE-2026-5812SourceCodester Pharmacy Product Management System POST Parameter add-sales.php logic errorSourceCodester Pharmacy Product Management System
- CVE-2025-9484Missing Authorization in GitLabGitLab
- CVE-2026-1101Improper Validation of Specified Quantity in Input in GitLabGitLab
- CVE-2026-1516Improper Control of Generation of Code ('Code Injection') in GitLabGitLab
- CVE-2026-1752Incorrect Authorization in GitLabGitLab
- CVE-2026-2104Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-2619Incorrect Authorization in GitLabGitLab
- CVE-2026-4332Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-4916Missing Authorization in GitLabGitLab
- CVE-2026-3438Nexus Repository 3 - Reflected Cross-Site Scripting (XSS) in ?describe PagesSonatype Nexus Repository
- CVE-2026-5811SourceCodester Online Food Ordering System POST Parameter Actions.php save_product logic errorSourceCodester Online Food Ordering System
- CVE-2026-5810SourceCodester Sales and Inventory System GET Parameter delete.php cross site scriptingSourceCodester Sales and Inventory System
- CVE-2026-40028Hayabusa < 3.8.0 XSS via JSON Log ImportYamato-Security hayabusa
- CVE-2026-40026Sleuth Kit ISO9660 SUSP Extension Reference Out-of-Bounds Readsleuthkit
- CVE-2026-40025Sleuth Kit APFS Keybag Parser Out-of-Bounds Readsleuthkit
- CVE-2026-5808openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scriptingopenstatusHQ openstatus
- CVE-2026-5711Post Blocks & Tools <= 1.3.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'sliderStyle' Block Attributepubudu-malalasekara Post Blocks & Tools
- CVE-2026-5919Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromisGoogle Chrome
- CVE-2026-5918Inappropriate implementation in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the rendereGoogle Chrome
- CVE-2026-5911Policy bypass in ServiceWorkers in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass content security policy via a crGoogle Chrome
- CVE-2026-5906Incorrect security UI in Omnibox in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the OGoogle Chrome
- CVE-2026-5905Incorrect security UI in Permissions in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to perform domain spoofingGoogle Chrome
- CVE-2026-5903Policy bypass in IFrameSandbox in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific Google Chrome
- CVE-2026-5901Insufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a maGoogle Chrome
- CVE-2026-5900Policy bypass in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass of multi-download protections via a cGoogle Chrome
- CVE-2026-5899Insufficient policy enforcement in History Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a userGoogle Chrome
- CVE-2026-5898Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a craftGoogle Chrome
- CVE-2026-5897Incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in speciGoogle Chrome
- CVE-2026-5896Policy bypass in Audio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestuGoogle Chrome
- CVE-2026-5895Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the OmnibGoogle Chrome
- CVE-2026-5894Inappropriate implementation in PDF in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via Google Chrome
- CVE-2026-5893Race in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google Chrome
- CVE-2026-5892Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer pGoogle Chrome
- CVE-2026-5891Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2026-5889Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrGoogle Chrome
- CVE-2026-5888Uninitialized Use in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive informationGoogle Chrome
- CVE-2026-5887Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to bypaGoogle Chrome
- CVE-2026-5886Out of bounds read in WebAudio in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive infoGoogle Chrome
- CVE-2026-5885Insufficient validation of untrusted input in WebML in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to obtain pGoogle Chrome
- CVE-2026-5882Incorrect security UI in Fullscreen in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HGoogle Chrome
- CVE-2026-5881Policy bypass in LocalNetworkAccess in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via Google Chrome
- CVE-2026-5880Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2026-5878Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML pGoogle Chrome
- CVE-2026-5876Side-channel information leakage in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to leak cross-origin data vGoogle Chrome
- CVE-2026-5875Policy bypass in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page.Google Chrome
- CVE-2026-5869Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information Google Chrome
- CVE-2026-5867Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information Google Chrome
- CVE-2026-5864Heap buffer overflow in WebAudio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive informatiGoogle Chrome
- CVE-2026-5806code-projects Easy Blog Site update.php cross site scriptingcode-projects Easy Blog Site
- CVE-2026-39901monetr: Protected Transactions Deletable via PUTmonetr · github.com/monetr/monetr
- CVE-2026-39892cryptography has a buffer overflow if non-contiguous buffers were passed to APIspyca cryptography · cryptography
- CVE-2026-5805code-projects Easy Blog Site contact_us.php sql injectioncode-projects Easy Blog Site
- CVE-2026-5451Extensions for Leaflet Map <= 4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'elevation-track' Shortcodehupe13 Extensions for Leaflet Map
- CVE-2026-39882OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodiesopen-telemetry opentelemetry-go · go.opentelemetry.io/ot… +2
- CVE-2026-39881Vim Ex command injection in Vims NetBeans integrationvim
- CVE-2026-5803bigsk1 openai-realtime-ui API Proxy Endpoint server.js server-side request forgerybigsk1 openai-realtime-ui
- CVE-2026-39844NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitizationzauberzeug nicegui · nicegui
- CVE-2026-39415Frappe Learning Management System has Client-Side Manipulation of Quiz Scoresfrappe lms
- CVE-2026-39880Remnawave Backend has a race condition in HWID device limit allows bypassing max devicesremnawave backend
- CVE-2026-5802idachev mcp-javadc HTTP os command injectionidachev mcp-javadc
- CVE-2026-39864Kamailio Auth: Processing Vulnerability For Additional Authenticated User Identity Checkskamailio
- CVE-2026-39862Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat LinkShopify tophat
- CVE-2026-39859LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file readharttle liquidjs · liquidjs
- CVE-2026-39413LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG APIHKUDS LightRAG · lightrag-hku
- CVE-2026-39412LiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channelharttle liquidjs · liquidjs
- CVE-2026-39411LobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` headerlobehub · @lobehub/lobehub
- CVE-2026-39362InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLsInvenTree
- CVE-2026-35479InvenTree Plugin Installation - Insufficient PermissionsInvenTree
- CVE-2026-35477InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escapeInvenTree
- CVE-2026-35403LORIS has potential cross-site scripting in survey_accounts moduleaces Loris
- CVE-2026-35400LORIS incorrectly trusts user input in publication moduleaces Loris
- CVE-2026-35165LORIS has incorrect access checks in document_repositoryaces Loris
- CVE-2026-34985LORIS has incorrect access checks in media moduleaces Loris
- CVE-2026-20709Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celeron(R) Processor J SerieIntel(R) Pentium(R) Processor Silver Series, Intel(R) Celer…
- CVE-2026-34837Zammad is miissing authorization in AI assistance controller for context data used in text toolszammad
- CVE-2026-34782Zammad has improper access control in AI assistance controller for text toolszammad
- CVE-2026-34722Zammad is missing authorization in ticket create endpointzammad
- CVE-2026-34721Zammad has Cross-site request forgery (CSRF) in OAuth callback endpointszammad
- CVE-2026-34720Zammad has an origin validation error in SSO mechanismzammad
- CVE-2026-34718Zammad improperly neutralizes of script-related HTML tags in ticket articleszammad
- CVE-2026-34248Zammad has an information disclosure in ticket detail view of customers in shared organizationszammad
- CVE-2026-30817Arbitrary File Reading Vulnerability in dnsmasq Module in TP-Link AX53TP-Link Systems AX53
- CVE-2026-30816Arbitrary File Reading Vulnerability in OpenVPN Module in TP-Link AX53TP-Link Systems AX53
- CVE-2026-34166LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filterharttle liquidjs · liquidjs
- CVE-2026-39851Saleor has a user enumeration vulnerability due to different error messagessaleor
- CVE-2025-30650Junos OS: Privileged local user can gain access to a Linux-based FPC as rootJuniper Networks Junos OS
- CVE-2026-0811Advanced CF7 DB <= 2.0.9 - Cross-Site Request Forgery to Form Entry Deletionvsourz1td Advanced Contact form 7 DB
- CVE-2026-0814Advanced CF7 DB <= 2.0.9 - Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel Exportvsourz1td Advanced Contact form 7 DB
- CVE-2026-35407Saleor has Cross-Account Email Change via Unbound Confirmation Tokensaleor
- CVE-2026-32591Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configurationRed Hat Quay · mirror registry for Red Hat OpenShift
- CVE-2026-33458Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information DisclosureElastic Kibana
- CVE-2026-33459Uncontrolled Resource Consumption in Kibana Leading to Denial of ServiceElastic Kibana
- CVE-2026-33460Incorrect Authorization in Kibana Fleet Leading to Information DisclosureElastic Kibana
- CVE-2025-14243Mirror-registry: openshift mirror registry: user enumeration via authentication error messagesmirror registry for Red Hat OpenShift
- CVE-2026-2377Mirror-registry: quay: quay: server-side request forgery via log export functionalityRed Hat Quay · mirror registry for Red Hat OpenShift
- CVE-2026-4837Eval Injection in Rapid7 Insight AgentRapid7 Insight Agent
- CVE-2026-33753Improper Certificate Validation in rfc3161-clienttrailofbits rfc3161-client · rfc3161-client
- CVE-2026-39410Hono has a non-breaking space prefix bypass in cookie name handling in getCookie()honojs hono · hono
- CVE-2026-39409Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresseshonojs hono · hono
- CVE-2026-39408Hono has a path traversal in toSSG() allows writing files outside the output directoryhonojs hono · hono
- CVE-2026-39407Hono has a middleware bypass via repeated slashes in serveStatichonojs hono · hono
- CVE-2026-39406@hono/node-server has a middleware bypass via repeated slashes in serveStatichonojs node-server · @hono/node-server
- CVE-2026-39392CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitizationci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-39391CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User Listci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-39390CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe settingci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-39389CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Filesci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-39865Axios HTTP/2 Session Cleanup State Corruption Vulnerabilityaxios
- CVE-2025-58713Rhpam: privilege escalation via excessive /etc/passwd permissionsRed Hat Process Automation
- CVE-2025-57853Web-terminal: privilege escalation via excessive /etc/passwd permissionsRed Hat Web Terminal
- CVE-2025-57854Osus-operator: privilege escalation via excessive /etc/passwd permissionsRed Hat OpenShift Update Service
- CVE-2025-57851Mce: privilege escalation via excessive /etc/passwd permissionsRed Hat Multicluster Engine for Kubernetes
- CVE-2025-57847Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissionsRed Hat Ansible Automation Platform
- CVE-2026-2509Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributessoftaculous Page Builder: Pagelayer – Drag and Drop website…
- CVE-2026-31411net: atm: fix crash due to unvalidated vcc pointer in sigd_send()Linux
- CVE-2026-35023Wimi Teamwork On-Premises < 8.2.0 IDOR via preview.phpCloud Solutions SAS Wimi Teamwork
- CVE-2026-24511Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.0, contains a generation of error message contDell PowerScale OneFS
- CVE-2026-5600A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-pretix
- CVE-2026-27102Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.1, contains an incorrect privilege assignment Dell PowerScale OneFS
- CVE-2026-5302Permissive Cross-domain Policy with Untrusted Domains in coolercontroldcoolercontrold
- CVE-2026-5300Missing Authentication for Critical Function in coolercontroldcoolercontrold
- CVE-2026-28264Dell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerabilityDell PowerProtect Agent
- CVE-2026-1672BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Product Data Modificationrealmag777 BEAR – Bulk Editor and Products Manager Professi…
- CVE-2026-2481Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]'beaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2026-1673BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Taxonomy Term Deletionrealmag777 BEAR – Bulk Editor and Products Manager Professi…
- CVE-2026-1865User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[]wpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2026-4300Robo Gallery <= 5.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Loading Label' Settingrobosoft Robo Gallery – Photo & Image Slider
- CVE-2026-4025PrivateContent Free <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attributelcweb-projects PrivateContent Free
- CVE-2026-4303WP Visitor Statistics (Real Time Traffic) <= 8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height' Shortcode Attributeosamaesh WP Visitor Statistics
- CVE-2026-4073pdfl.io <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attributedougblackjr pdfl.io
- CVE-2026-39716WordPress Flipmart theme <= 2.8 - Broken Access Control vulnerabilityCKThemes Flipmart
- CVE-2026-39715WordPress AnyTrack Affiliate Link Manager plugin <= 1.5.5 - Broken Access Control vulnerabilityAnyTrack Affiliate Link Manager
- CVE-2026-39714WordPress G5Plus April theme <= 6.8 - Broken Access Control vulnerabilityG5Theme G5Plus April
- CVE-2026-39713WordPress Mailercloud – Integrate webforms and synchronize website contacts plugin <= 1.0.7 - Broken Access Control vulnerabilityMailercloud – Integrate webforms and synchronize website co…
- CVE-2026-39712WordPress tagDiv Composer plugin <= 5.4.3 - Arbitrary Shortcode Execution vulnerabilitytagDiv Composer
- CVE-2026-39711WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Sensitive Data Exposure vulnerabilitystmcan RT-Theme 18 | Extensions
- CVE-2026-39710WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Cross Site Request Forgery (CSRF) vulnerabilitystmcan RT-Theme 18 | Extensions
- CVE-2026-39709WordPress The Tribal plugin <= 1.3.4 - Sensitive Data Exposure vulnerabilitythetechtribe The Tribal
- CVE-2026-39708WordPress UiCore Elements plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerabilityUiCore Elements
- CVE-2026-39707WordPress Accept PayPal Payments using Contact Form 7 plugin <= 4.0.4 - Broken Access Control vulnerabilityZealousWeb Accept PayPal Payments using Contact Form
- CVE-2026-39706WordPress Make My Trivia plugin <= 1.1.0 - Broken Access Control vulnerabilityNetro Systems Make My Trivia
- CVE-2026-39705WordPress MIPL WC Multisite Sync plugin <= 1.4.4 - Broken Access Control vulnerabilityMulika Team MIPL WC Multisite Sync
- CVE-2026-39704WordPress Precious Metals Automated Product Pricing – Pro plugin <= 4.0.5 - Broken Access Control vulnerabilitynfusionsolutions Precious Metals Automated Product Pricing…
- CVE-2026-39703WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerabilityWPBITS Addons For Elementor Page Builder
- CVE-2026-39702WordPress Animation Addons for Elementor plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerabilityWealcoder Animation Addons for Elementor
- CVE-2026-39701WordPress ShopWP plugin <= 5.2.4 - Broken Access Control vulnerabilityAndrew ShopWP
- CVE-2026-39700WordPress WowOptin plugin <= 1.4.32 - Broken Access Control vulnerabilityWPXPO WowOptin
- CVE-2026-39699WordPress AI Workflow Automation plugin <= 1.4.2 - Broken Access Control vulnerabilitymassiveshift AI Workflow Automation
- CVE-2026-39698WordPress The Publisher Desk ads.txt plugin <= 1.5.0 - Broken Access Control vulnerabilityPublisherDesk The Publisher Desk ads.txt
- CVE-2026-39697WordPress MAIO – The new AI GEO / SEO tool plugin <= 6.2.8 - Broken Access Control vulnerabilityHBSS Technologies MAIO – The new AI GEO / SEO tool
- CVE-2026-39696WordPress Elfsight WhatsApp Chat CC plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityElfsight WhatsApp Chat CC
- CVE-2026-39695WordPress Podigee plugin <= 1.4.0 - Server Side Request Forgery (SSRF) vulnerabilityPodigee
- CVE-2026-39694WordPress Simply Schedule Appointments plugin <= 1.6.10.2 - Broken Access Control vulnerabilityNSquared Simply Schedule Appointments
- CVE-2026-39693WordPress FSM Custom Featured Image Caption plugin <= 1.25.1 - Cross Site Scripting (XSS) vulnerabilityfesomia FSM Custom Featured Image Caption
- CVE-2026-39692WordPress tagDiv Composer plugin <= 5.4.3 - Cross Site Scripting (XSS) vulnerabilitytagDiv Composer
- CVE-2026-39691WordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin <= 2.2.13 - Broken Access Control vulnerabilityAdAstraCrypto Cryptocurrency Donation Box – Bitcoin & Crypt…
- CVE-2026-39690WordPress Author Avatars List/Block plugin <= 2.1.25 - Broken Access Control vulnerabilityPaul Bearne Author Avatars List/Block
- CVE-2026-39689WordPress eShipper Commerce plugin <= 2.16.12 - Broken Access Control vulnerabilityeShipper Commerce
- CVE-2026-39688WordPress WP Frontend Profile plugin <= 1.3.9 - Broken Access Control vulnerabilityGlowlogix WP Frontend Profile
- CVE-2026-39687WordPress Rapid Car Check Vehicle Data plugin <= 2.0 - Broken Access Control vulnerabilityRapid Car Check Vehicle Data
- CVE-2026-39686WordPress BSK PDF Manager plugin <= 3.7.2 - Sensitive Data Exposure vulnerabilitybannersky BSK PDF Manager
- CVE-2026-39685WordPress The Moneytizer plugin <= 10.0.10 - Broken Access Control vulnerabilitylvaudore The Moneytizer
- CVE-2026-39683WordPress Garden Gnome Package plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilityChief Gnome Garden Gnome Package
- CVE-2026-39682WordPress linkPizza-Manager plugin <= 5.5.5 - Broken Access Control vulnerabilityArjan Pronk linkPizza-Manager
- CVE-2026-39680WordPress Diet Calorie Calculator plugin <= 1.1.1 - Broken Access Control vulnerabilityMWP Development Diet Calorie Calculator
- CVE-2026-39678WordPress Pinpoint Booking System plugin <= 2.9.9.7.2 - Broken Access Control vulnerabilityPinpoint Booking System
- CVE-2026-39676WordPress Download Manager plugin <= 3.3.52 - Broken Access Control vulnerabilityShahjada Download Manager
- CVE-2026-39675WordPress Court Reservation plugin <= 1.10.11 - Broken Access Control vulnerabilitywebmuehle Court Reservation
- CVE-2026-39674WordPress MK Google Directions plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerabilityManoj Kumar MK Google Directions
- CVE-2026-39673WordPress iZooto plugin <= 3.7.20 - Broken Access Control vulnerabilityshrikantkale iZooto
- CVE-2026-39672WordPress ShipTime: Discounted Shipping Rates plugin <= 1.1.1 - Broken Access Control vulnerabilityShipTime: Discounted Shipping Rates
- CVE-2026-39670WordPress Visual Link Preview plugin <= 2.3.0 - Server Side Request Forgery (SSRF) vulnerabilityBrecht Visual Link Preview
- CVE-2026-39669WordPress NitroPack plugin <= 1.19.3 - Broken Access Control vulnerabilityNitroPack
- CVE-2026-39668WordPress Book Previewer for Woocommerce plugin <= 1.0.6 - Broken Access Control vulnerabilityg5theme Book Previewer for Woocommerce
- CVE-2026-39667WordPress Korea SNS plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerabilityJongmyoung Kim Korea SNS
- CVE-2026-39666WordPress Hello Bar Popup Builder plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilitytelepathy Hello Bar Popup Builder
- CVE-2026-39665WordPress SEO Friendly Images plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerabilityVladimir Prelovac SEO Friendly Images
- CVE-2026-39664WordPress Leadrebel plugin <= 1.0.2 - Broken Access Control vulnerabilityLeadrebel
- CVE-2026-39663WordPress TrueBooker plugin <= 1.1.5 - Broken Access Control vulnerabilitythemetechmount TrueBooker
- CVE-2026-39662WordPress Product Price by Formula for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerabilityProWCPlugins Product Price by Formula for WooCommerce
- CVE-2026-39658WordPress Panda Pods Repeater Field plugin <= 1.5.12 - Broken Access Control vulnerabilityCoding Panda Panda Pods Repeater Field
- CVE-2026-39657WordPress leadlovers forms plugin <= 1.0.2 - Broken Access Control vulnerabilityleadlovers forms
- CVE-2026-39656WordPress Razorpay for WooCommerce plugin <= 4.8.2 - Broken Access Control vulnerabilityRazorpay for WooCommerce
- CVE-2026-39654WordPress WP Simple HTML Sitemap plugin <= 3.8 - Cross Site Scripting (XSS) vulnerabilityAshish Ajani WP Simple HTML Sitemap
- CVE-2026-39653WordPress Video Conferencing with Zoom plugin <= 4.6.6 - Broken Access Control vulnerabilityDeepen Bajracharya Video Conferencing with Zoom
- CVE-2026-39652WordPress iGMS Direct Booking plugin <= 1.3 - Broken Access Control vulnerabilityiGMS Direct Booking
- CVE-2026-39651WordPress Total Poll Lite plugin <= 4.12.0 - Broken Access Control vulnerabilityTotalSuite Total Poll Lite
- CVE-2026-39650WordPress UnitechPay plugin <= 1.0.2 - Broken Access Control vulnerabilityUnitech Web UnitechPay
- CVE-2026-39649WordPress Royale News theme <= 2.2.4 - Broken Access Control vulnerabilitythemebeez Royale News
- CVE-2026-39648WordPress Cream Blog theme <= 2.1.7 - Broken Access Control vulnerabilitythemebeez Cream Blog
- CVE-2026-39647WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.11 - Server Side Request Forgery (SSRF) vulnerabilityMP3 Audio Player for Music, Radio & Podcast by Sonaar
- CVE-2026-39646WordPress Leaflet Map plugin <= 3.4.4 - Cross Site Scripting (XSS) vulnerabilitybozdoz Leaflet Map
- CVE-2026-39645WordPress GlobalPayments WooCommerce plugin <= 1.18.0 - Server Side Request Forgery (SSRF) vulnerabilityGlobal Payments GlobalPayments WooCommerce
- CVE-2026-39644WordPress Wp Ultimate Review plugin <= 2.3.8 - Broken Access Control vulnerabilityRoxnor Wp Ultimate Review
- CVE-2026-39643WordPress Payment Plugins for PayPal WooCommerce plugin <= 2.0.13 - Broken Access Control vulnerabilityPayment Plugins for PayPal WooCommerce
- CVE-2026-39641WordPress Blackfyre theme <= 2.5.4 - Cross Site Request Forgery (CSRF) vulnerabilitySkywarrior Blackfyre
- CVE-2026-39639WordPress RPS Include Content plugin <= 1.2.2 - Broken Access Control vulnerabilityredpixelstudios RPS Include Content
- CVE-2026-39638WordPress Qubely plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerabilityThemeum Qubely
- CVE-2026-39637WordPress Mogi theme <= 1.2.3 - Arbitrary Shortcode Execution vulnerabilitySpabRice Mogi
- CVE-2026-39636WordPress Livemesh Addons for Elementor plugin <= 9.0 - Cross Site Scripting (XSS) vulnerabilityLivemesh Addons for Elementor
- CVE-2026-39635WordPress Grand Magazine theme <= 3.5.5 - Cross Site Request Forgery (CSRF) vulnerabilityThemeGoods Grand Magazine
- CVE-2026-39634WordPress Grand Portfolio theme <= 3.3 - Cross Site Request Forgery (CSRF) vulnerabilityThemeGoods Grand Portfolio
- CVE-2026-39633WordPress Grand Car Rental theme <= 3.6.9 - Cross Site Request Forgery (CSRF) vulnerabilityThemeGoods Grand Car Rental
- CVE-2026-39632WordPress Grand Blog theme <= 3.1 - Cross Site Request Forgery (CSRF) vulnerabilityThemeGoods Grand Blog
- CVE-2026-39631WordPress WPSchoolPress plugin <= 2.2.35 - Broken Access Control vulnerabilityRonik@UnlimitedWP WPSchoolPress
- CVE-2026-39630WordPress Getty Images plugin <= 4.1.0 - Server Side Request Forgery (SSRF) vulnerabilityGetty Images
- CVE-2026-39629WordPress Uminex theme <= 1.0.9 - Arbitrary Shortcode Execution vulnerabilitykutethemes Uminex
- CVE-2026-39628WordPress DukaMarket theme <= 1.3.0 - Arbitrary Shortcode Execution vulnerabilitykutethemes DukaMarket
- CVE-2026-39627WordPress Ashe theme <= 2.266 - Broken Access Control vulnerabilitywproyal Ashe
- CVE-2026-39626WordPress Armania theme <= 1.4.8 - Arbitrary Shortcode Execution vulnerabilitykutethemes Armania
- CVE-2026-39625WordPress TechOne theme <= 3.0.3 - Arbitrary Shortcode Execution vulnerabilitykutethemes TechOne
- CVE-2026-39624WordPress Biolife theme <= 3.2.3 - Arbitrary Shortcode Execution vulnerabilitykutethemes Biolife
- CVE-2026-39622WordPress Education Base theme <= 3.0.8 - Broken Access Control vulnerabilityacmethemes Education Base
- CVE-2026-39618WordPress NewsExo theme <= 7.1 - Cross Site Request Forgery (CSRF) vulnerabilitythemearile NewsExo
- CVE-2026-39616WordPress Download Attachments plugin <= 1.4.0 - Insecure Direct Object References (IDOR) vulnerabilitydFactory Download Attachments
- CVE-2026-39615WordPress Download Manager plugin <= 3.3.53 - Cross Site Scripting (XSS) vulnerabilityShahjada Download Manager
- CVE-2026-39614WordPress JW Player for WordPress plugin <= 2.3.6 - Broken Access Control vulnerabilityilGhera JW Player for WordPress
- CVE-2026-39612WordPress KuteShop theme <= 4.2.9 - Arbitrary Shortcode Execution vulnerabilitykutethemes KuteShop
- CVE-2026-39610WordPress WpXmas-Snow plugin <= 1.1 - Broken Access Control vulnerabilityPankaj Kumar WpXmas-Snow
- CVE-2026-39609WordPress Wava Payment plugin <= 0.3.7 - Broken Access Control vulnerabilityWava.co Wava Payment
- CVE-2026-39608WordPress iPOSpays Gateways WC plugin <= 1.3.7 - Broken Access Control vulnerabilityiPOSpays Gateways WC
- CVE-2026-39607WordPress Filter Plus plugin <= 1.1.17 - Broken Access Control vulnerabilityWpbens Filter Plus
- CVE-2026-39606WordPress BizReview plugin <= 1.5.13 - Broken Access Control vulnerabilityFoysal Imran BizReview
- CVE-2026-39605WordPress Super Custom Login plugin <= 1.1 - Broken Access Control vulnerabilityObadiah Super Custom Login
- CVE-2026-39604WordPress MyBookTable Bookstore plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerabilityzookatron MyBookTable Bookstore
- CVE-2026-39603WordPress Grand Photography theme <= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerabilityThemeGoods Grand Photography
- CVE-2026-39602WordPress Order Tracking plugin <= 3.4.3 - Broken Access Control vulnerabilityRustaurius Order Tracking
- CVE-2026-39592WordPress DEPART plugin <= 1.0.7 - Broken Access Control vulnerabilityAndy Ha DEPART
- CVE-2026-39588WordPress NM Gift Registry and Wishlist Lite plugin <= 5.13 - Broken Access Control vulnerabilitynmerii NM Gift Registry and Wishlist Lite
- CVE-2026-39586WordPress RepairBuddy plugin <= 4.1132 - Sensitive Data Exposure vulnerabilityAteeq Rafeeq RepairBuddy
- CVE-2026-39585WordPress Booktics plugin <= 1.0.16 - Broken Access Control vulnerabilityArraytics Booktics
- CVE-2026-39575WordPress Custom Query Blocks plugin <= 5.5.0 - Cross Site Scripting (XSS) vulnerabilityRonald Huereca Custom Query Blocks
- CVE-2026-39572WordPress Bus Ticket Booking with Seat Reservation plugin < 5.6.5 - Sensitive Data Exposure vulnerabilitymagepeopleteam Bus Ticket Booking with Seat Reservation
- CVE-2026-39571WordPress Instantio plugin <= 3.3.30 - Sensitive Data Exposure vulnerabilityThemefic Instantio
- CVE-2026-39570WordPress 12 Step Meeting List plugin <= 3.19.9 - Sensitive Data Exposure vulnerabilityAA Web Servant 12 Step Meeting List
- CVE-2026-39569WordPress 12 Step Meeting List plugin <= 3.19.9 - Broken Access Control vulnerabilityAA Web Servant 12 Step Meeting List
- CVE-2026-39566WordPress DirectoryPress plugin <= 3.6.26 - Sensitive Data Exposure vulnerabilityDesigninvento DirectoryPress
- CVE-2026-39565WordPress WpTravelly plugin <= 2.1.7 - Broken Access Control vulnerabilitymagepeopleteam WpTravelly
- CVE-2026-39564WordPress Sunshine Photo Cart plugin < 3.6.2 - Sensitive Data Exposure vulnerabilitysunshinephotocart Sunshine Photo Cart
- CVE-2026-39563WordPress Share This Image plugin <= 2.12 - Broken Access Control vulnerabilityILLID Share This Image
- CVE-2026-39562WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.10 - Broken Access Control vulnerabilityBoldGrid Client Invoicing by Sprout Invoices
- CVE-2026-39561WordPress Revive.so plugin <= 2.0.7 - Broken Access Control vulnerabilityWP Chill Revive.so
- CVE-2026-39543WordPress Tourfic plugin <= 2.21.4 - Broken Access Control vulnerabilityThemefic Tourfic
- CVE-2026-39542WordPress Doofinder for WooCommerce plugin <= 2.10.13 - Sensitive Data Exposure vulnerabilityDoofinder for WooCommerce
- CVE-2026-39541WordPress Hydra Booking plugin <= 1.1.38 - Cross Site Scripting (XSS) vulnerabilityThemefic Hydra Booking
- CVE-2026-39536WordPress RSVP and Event Management plugin <= 2.7.16 - Sensitive Data Exposure vulnerabilityWP Chill RSVP and Event Management
- CVE-2026-39535WordPress Display Eventbrite Events plugin <= 6.5.6 - Broken Access Control vulnerabilityfullworks Display Eventbrite Events
- CVE-2026-39528WordPress WP Delicious plugin <= 1.9.5 - Broken Access Control vulnerabilityWP Delicious
- CVE-2026-39526WordPress WpStream plugin < 4.11.2 - Insecure Direct Object References (IDOR) vulnerabilityWpStream
- CVE-2026-39521WordPress Nelio Content plugin <= 4.3.1 - Server Side Request Forgery (SSRF) vulnerabilityNelio Software Nelio Content
- CVE-2026-39520WordPress weDocs plugin <= 2.1.18 - Broken Access Control vulnerabilityweDevs weDocs
- CVE-2026-39517WordPress Blog Filter plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerabilityA WP Life Blog Filter
- CVE-2026-39516WordPress Nexter Blocks plugin <= 4.7.0 - Sensitive Data Exposure vulnerabilityPOSIMYTH Nexter Blocks
- CVE-2026-39510WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Insecure Direct Object References (IDOR) vulnerabilityWP Chill Image Photo Gallery Final Tiles Grid
- CVE-2026-39509WordPress Directorist plugin <= 8.5.10 - Broken Access Control vulnerabilitywpWax Directorist
- CVE-2026-39508WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.7.1.1 - Cross Site Scripting (XSS) vulnerabilityJosh Kohlbach Advanced Coupons for WooCommerce Coupons
- CVE-2026-39506WordPress AI Engine (Pro) plugin < 3.4.2 - Broken Access Control vulnerabilityJordy Meow AI Engine
- CVE-2026-39505WordPress Seriously Simple Podcasting plugin <= 3.14.2 - Broken Access Control vulnerabilityCraig Hewitt Seriously Simple Podcasting
- CVE-2026-39504WordPress InstaWP Connect plugin <= 0.1.2.5 - Broken Access Control vulnerabilityInstaWP Connect
- CVE-2026-39501WordPress FOX plugin <= 1.4.5 - Broken Access Control vulnerabilityRealMag777 FOX
- CVE-2026-39500WordPress themesflat-addons-for-elementor plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerabilitythemesflat-addons-for-elementor
- CVE-2026-39488WordPress SureCart plugin <= 4.0.2 - Broken Access Control vulnerabilitySureCart
- CVE-2026-39485WordPress Youtube Embed Plus plugin <= 14.2.4 - Broken Access Control vulnerabilityembedplus Youtube Embed Plus
- CVE-2026-39484WordPress Hide My WP Ghost plugin < 7.0.00 - Open Redirection vulnerabilityJohn Darrel Hide My WP Ghost
- CVE-2026-39483WordPress VK All in One Expansion Unit plugin <= 9.113.3 - Cross Site Scripting (XSS) vulnerabilityHidekazu Ishikawa VK All in One Expansion Unit
- CVE-2026-39482WordPress Post Expirator plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerabilityPublishPress Post Expirator
- CVE-2026-39477WordPress CartFlows plugin <= 2.2.3 - Broken Access Control vulnerabilityBrainstorm Force CartFlows
- CVE-2026-39476WordPress User Feedback plugin <= 1.10.1 - Broken Access Control vulnerabilitySyed Balkhi User Feedback
- CVE-2026-39473WordPress Simple History plugin <= 5.24.0 - Sensitive Data Exposure vulnerabilityPär Thernström Simple History
- CVE-2026-39469WordPress PageLayer plugin <= 2.0.8 - Sensitive Data Exposure vulnerabilitySoftaculous PageLayer
- CVE-2026-39464WordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin <= 6.19.8 - Server Side Request Forgery (SSRF) vulnerabilityComing Soon Page, Under Construction & Maintenance Mode by…
- CVE-2026-1396Magic Conversation For Gravity Forms <= 3.0.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesmagicplugins Magic Conversation For Gravity Forms
- CVE-2026-4330Blog2Social: Social Media Auto Post & Scheduler <= 8.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Schedule Modification via 'b2s_id' Parameterpr-gateway Blog2Social: Social Media Auto Post & Scheduler
- CVE-2026-4654Awesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameterawesomesupport Awesome Support – WordPress HelpDesk & Suppo…
- CVE-2026-4655Element Pack Addons for Elementor <= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widgetbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2025-1794AM LottiePlayer <= 3.6.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVGjohanaarstein AM LottiePlayer
- CVE-2026-3781Attendance Manager <= 0.6.2 - Authenticated (Subscriber+) SQL Injection via 'attmgr_off' Parametertnomi Attendance Manager
- CVE-2026-4141Quran Translations <= 1.7 - Cross-Site Request Forgery to Playlist Settings Formedckwt Quran Translations
- CVE-2026-2838Whole Enquiry Cart for WooCommerce <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'woowhole_success_msg' Parameteridealwebdesignlk Whole Enquiry Cart for WooCommerce
- CVE-2026-5506Wavr <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributeslucascaro Wavr
- CVE-2026-3618Columns by BestWebSoft <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'columns' Shortcode 'id' Attributebestweblayout Columns by BestWebSoft – Additional Columns P…
- CVE-2026-5167Masteriyo LMS <= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook EndpointMasteriyo LMS – Online Course Builder for eLearning, LMS &…
- CVE-2026-3477PZ Frontend Manager <= 1.0.6 - Missing Authorization to Arbitrary User Deletion via 'dataType' Parameterprojectzealous01 PZ Frontend Manager
- CVE-2026-5508WowPress <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributestheyeti WowPress
- CVE-2026-3142Pinterest Site Verification plugin using Meta Tag <= 1.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_var'uniquecodergmailcom Pinterest Site Verification plugin usin…
- CVE-2026-5169Inquiry form to posts or pages <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Header Fieldudamadu Inquiry form to posts or pages
- CVE-2026-3480WP Blockade <= 0.9.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'shortcode' Parameterburlingtonbytes WP Blockade – Visual Page Builder
- CVE-2026-4871Sports Club Management <= 1.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' Attributepstruik Sports Club Management
- CVE-2026-3594Riaxe Product Customizer <= 2.4 - Unauthenticated Sensitive Information Disclosure via '/orders' REST API Endpointimprintnext Riaxe Product Customizer
- CVE-2026-5083Ado::Sessions versions through 0.935 for Perl generates insecure session idsBEROV Ado::Sessions
- CVE-2026-5082Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session idTOKUHIROM Amon2::Plugin::Web::CSRFDefender
- CVE-2026-3311The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Barposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2026-27787Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier.ICZ MATCHA SNS
- CVE-2026-33273Unrestricted upload of file with dangerous type issue exists in MATCHA INVOICE 2.6.6 and earlier.ICZ MATCHA INVOICE
- CVE-2026-3239Strong Testimonials <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial_view Shortcodewpchill Strong Testimonials
- CVE-2026-3600Investi <= 1.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'maximum-num-years' Shortcode AttributeInvesti
- CVE-2026-3646LTL Freight Quotes – R+L Carriers Edition <= 3.3.13 - Missing Authorization to Unauthenticated Settings Updateenituretechnology LTL Freight Quotes – R+L Carriers Edition
- CVE-2026-4299MainWP Child Reports <= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure via Heartbeat APIMainWP Child Reports
- CVE-2026-4785LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeLatePoint – Calendar Booking Plugin for Appointments and Ev…
- CVE-2026-4341Prime Slider <= 4.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'follow_us_text' Parameterbdthemes Prime Slider – Addons for Elementor
- CVE-2026-3513TableOn – WordPress Posts Table Filterable <= 1.0.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attributerealmag777 TableOn – WordPress Posts Table Filterable
- CVE-2026-4333LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attributethimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2026-2988Blubrry PowerPress <= 11.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via powerpress and podcast ShortcodesPowerPress Podcasting plugin by Blubrry
- CVE-2026-4379LightPress Lightbox <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group' Shortcode Attributefirelightwp LightPress Lightbox
- CVE-2026-1163Insufficient Session Expiration in parisneo/lollmsparisneo/lollms · lollms
- CVE-2025-14732Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST APIelemntor Elementor Website Builder – more than just a page…
- CVE-2026-32288Unbounded allocation for old GNU sparse in archive/tarGo standard library archive/tar · stdlib
- CVE-2026-32289JsBraceDepth Context Tracking Bugs (XSS) in html/templateGo standard library html/template · stdlib
- CVE-2026-32282TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unixGo standard library internal/syscall/unix · stdlib
- CVE-2025-57175Siklu EtherHaul 8010 siklu-uimage-nxp-enc-10_6_2-18707-ea552dc00b devices have a static root password.Siklu EtherHaul