# CVEs published 2026-04-08

484 CVEs were published on April 8, 2026: 23 critical, 148 high. Days are UTC.

- [CVE-2026-5824](https://cve.now/CVE-2026-5824.md): code-projects Simple Laundry System userchecklogin.php sql injection (CVSS 6.9, code-projects Simple Laundry System)
- [CVE-2026-5823](https://cve.now/CVE-2026-5823.md): itsourcecode Construction Management System borrowed\_tool\_report.php sql injection (CVSS 5.3, itsourcecode Construction Management System)
- [CVE-2026-5815](https://cve.now/CVE-2026-5815.md): D-Link DIR-645 hedwig.cgi hedwigcgi\_main stack-based overflow (CVSS 8.7, D-Link DIR-645)
- [CVE-2026-5814](https://cve.now/CVE-2026-5814.md): PHPGurukul Online Course Registration check\_availability.php sql injection (CVSS 6.9, PHPGurukul Online Course Registration)
- [CVE-2026-5813](https://cve.now/CVE-2026-5813.md): PHPGurukul Online Course Registration check\_availability.php sql injection (CVSS 6.9, PHPGurukul Online Course Registration)
- [CVE-2026-5812](https://cve.now/CVE-2026-5812.md): SourceCodester Pharmacy Product Management System POST Parameter add-sales.php logic error (CVSS 5.3, SourceCodester Pharmacy Product Management System)
- [CVE-2025-9484](https://cve.now/CVE-2025-9484.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-12664](https://cve.now/CVE-2025-12664.md): Improper Validation of Specified Quantity in Input in GitLab (CVSS 7.5, GitLab)
- [CVE-2026-1092](https://cve.now/CVE-2026-1092.md): Improper Validation of Specified Quantity in Input in GitLab (CVSS 7.5, GitLab)
- [CVE-2026-1101](https://cve.now/CVE-2026-1101.md): Improper Validation of Specified Quantity in Input in GitLab (CVSS 6.5, GitLab)
- [CVE-2026-1516](https://cve.now/CVE-2026-1516.md): Improper Control of Generation of Code ('Code Injection') in GitLab (CVSS 5.7, GitLab)
- [CVE-2026-1752](https://cve.now/CVE-2026-1752.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-2104](https://cve.now/CVE-2026-2104.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-2619](https://cve.now/CVE-2026-2619.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-4332](https://cve.now/CVE-2026-4332.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 5.4, GitLab)
- [CVE-2026-4916](https://cve.now/CVE-2026-4916.md): Missing Authorization in GitLab (CVSS 2.7, GitLab)
- [CVE-2026-5173](https://cve.now/CVE-2026-5173.md): Exposed Dangerous Method or Function in GitLab (CVSS 8.5, GitLab)
- [CVE-2026-3199](https://cve.now/CVE-2026-3199.md): Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection (CVSS 9.4, Sonatype Nexus Repository)
- [CVE-2026-3438](https://cve.now/CVE-2026-3438.md): Nexus Repository 3 - Reflected Cross-Site Scripting (XSS) in ?describe Pages (CVSS 5.1, Sonatype Nexus Repository)
- [CVE-2026-5811](https://cve.now/CVE-2026-5811.md): SourceCodester Online Food Ordering System POST Parameter Actions.php save\_product logic error (CVSS 5.3, SourceCodester Online Food Ordering System)
- [CVE-2026-5810](https://cve.now/CVE-2026-5810.md): SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting (CVSS 5.1, SourceCodester Sales and Inventory System)
- [CVE-2026-40037](https://cve.now/CVE-2026-40037.md): OpenClaw \< 2026.4.8 - Unsafe Request Body Replay via fetchWithSsrFGuard Cross-Origin Redirects (CVSS 7.1, OpenClaw)
- [CVE-2026-40036](https://cve.now/CVE-2026-40036.md): Unfurl \< 2026.04 - Denial of Service via Unbounded zlib Decompression (CVSS 8.7, obsidianforensics unfurl · dfir-unfurl)
- [CVE-2026-40035](https://cve.now/CVE-2026-40035.md): Unfurl - Werkzeug Debugger Exposure via String Config Parsing (CVSS 9.3, obsidianforensics unfurl · dfir-unfurl)
- [CVE-2026-40032](https://cve.now/CVE-2026-40032.md): UAC \< 3.3.0-rc1 Command Injection via Placeholder Substitution (CVSS 8.5, tclahr UAC)
- [CVE-2026-40031](https://cve.now/CVE-2026-40031.md): MemProcFS \< 5.17 DLL/Shared Library Hijacking (CVSS 8.5, ufrisk MemProcFS)
- [CVE-2026-40030](https://cve.now/CVE-2026-40030.md): parseusbs \< 1.9 Command Injection via Volume Path Argument (CVSS 8.4, khyrenz parseusbs)
- [CVE-2026-40029](https://cve.now/CVE-2026-40029.md): parseusbs \< 1.9 Command Injection via Crafted LNK Filename (CVSS 8.5, khyrenz parseusbs)
- [CVE-2026-40028](https://cve.now/CVE-2026-40028.md): Hayabusa \< 3.8.0 XSS via JSON Log Import (CVSS 5.1, Yamato-Security hayabusa)
- [CVE-2026-40027](https://cve.now/CVE-2026-40027.md): ALEAPP NQ Vault Artifact Parser Path Traversal (CVSS 8.4, abrignoni ALEAPP)
- [CVE-2026-40026](https://cve.now/CVE-2026-40026.md): Sleuth Kit ISO9660 SUSP Extension Reference Out-of-Bounds Read (CVSS 4.8, sleuthkit)
- [CVE-2026-40025](https://cve.now/CVE-2026-40025.md): Sleuth Kit APFS Keybag Parser Out-of-Bounds Read (CVSS 4.8, sleuthkit)
- [CVE-2026-40024](https://cve.now/CVE-2026-40024.md): Sleuth Kit tsk\_recover Path Traversal (CVSS 8.4, sleuthkit)
- [CVE-2026-5808](https://cve.now/CVE-2026-5808.md): openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scripting (CVSS 5.3, openstatusHQ openstatus)
- [CVE-2026-5711](https://cve.now/CVE-2026-5711.md): Post Blocks & Tools \<= 1.3.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'sliderStyle' Block Attribute (CVSS 6.4, pubudu-malalasekara Post Blocks & Tools)
- [CVE-2026-5919](https://cve.now/CVE-2026-5919.md): Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromis (CVSS 6.5, Google Chrome)
- [CVE-2026-5918](https://cve.now/CVE-2026-5918.md): Inappropriate implementation in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the rendere (CVSS 4.3, Google Chrome)
- [CVE-2026-5915](https://cve.now/CVE-2026-5915.md): Insufficient validation of untrusted input in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of b (CVSS 8.1, Google Chrome)
- [CVE-2026-5914](https://cve.now/CVE-2026-5914.md): Type Confusion in CSS in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to p (CVSS 8.8, Google Chrome)
- [CVE-2026-5913](https://cve.now/CVE-2026-5913.md): Out of bounds read in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a (CVSS 8.1, Google Chrome)
- [CVE-2026-5912](https://cve.now/CVE-2026-5912.md): Integer overflow in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory write via a (CVSS 8.8, Google Chrome)
- [CVE-2026-5911](https://cve.now/CVE-2026-5911.md): Policy bypass in ServiceWorkers in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass content security policy via a cr (CVSS 4.3, Google Chrome)
- [CVE-2026-5910](https://cve.now/CVE-2026-5910.md): Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-5909](https://cve.now/CVE-2026-5909.md): Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-5908](https://cve.now/CVE-2026-5908.md): Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-5907](https://cve.now/CVE-2026-5907.md): Insufficient data validation in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory r (CVSS 8.1, Google Chrome)
- [CVE-2026-5906](https://cve.now/CVE-2026-5906.md): Incorrect security UI in Omnibox in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the O (CVSS 4.3, Google Chrome)
- [CVE-2026-5905](https://cve.now/CVE-2026-5905.md): Incorrect security UI in Permissions in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to perform domain spoofing (CVSS 6.5, Google Chrome)
- [CVE-2026-5903](https://cve.now/CVE-2026-5903.md): Policy bypass in IFrameSandbox in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific (CVSS 6.5, Google Chrome)
- [CVE-2026-5902](https://cve.now/CVE-2026-5902.md): Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to corru (CVSS 9.8, Google Chrome)
- [CVE-2026-5901](https://cve.now/CVE-2026-5901.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a ma (CVSS 6.5, Google Chrome)
- [CVE-2026-5900](https://cve.now/CVE-2026-5900.md): Policy bypass in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass of multi-download protections via a c (CVSS 4.3, Google Chrome)
- [CVE-2026-5899](https://cve.now/CVE-2026-5899.md): Insufficient policy enforcement in History Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user (CVSS 6.1, Google Chrome)
- [CVE-2026-5898](https://cve.now/CVE-2026-5898.md): Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a craft (CVSS 4.3, Google Chrome)
- [CVE-2026-5897](https://cve.now/CVE-2026-5897.md): Incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in speci (CVSS 4.3, Google Chrome)
- [CVE-2026-5896](https://cve.now/CVE-2026-5896.md): Policy bypass in Audio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestu (CVSS 6.1, Google Chrome)
- [CVE-2026-5895](https://cve.now/CVE-2026-5895.md): Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnib (CVSS 5.4, Google Chrome)
- [CVE-2026-5894](https://cve.now/CVE-2026-5894.md): Inappropriate implementation in PDF in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via (CVSS 4.3, Google Chrome)
- [CVE-2026-5893](https://cve.now/CVE-2026-5893.md): Race in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (CVSS 6.8, Google Chrome)
- [CVE-2026-5892](https://cve.now/CVE-2026-5892.md): Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer p (CVSS 6.6, Google Chrome)
- [CVE-2026-5891](https://cve.now/CVE-2026-5891.md): Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the rend (CVSS 4.3, Google Chrome)
- [CVE-2026-5890](https://cve.now/CVE-2026-5890.md): Race in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process (CVSS 7.5, Google Chrome)
- [CVE-2026-5889](https://cve.now/CVE-2026-5889.md): Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encr (CVSS 4.3, Google Chrome)
- [CVE-2026-5888](https://cve.now/CVE-2026-5888.md): Uninitialized Use in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information (CVSS 6.5, Google Chrome)
- [CVE-2026-5887](https://cve.now/CVE-2026-5887.md): Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to bypa (CVSS 4.3, Google Chrome)
- [CVE-2026-5886](https://cve.now/CVE-2026-5886.md): Out of bounds read in WebAudio in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive info (CVSS 5.3, Google Chrome)
- [CVE-2026-5885](https://cve.now/CVE-2026-5885.md): Insufficient validation of untrusted input in WebML in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to obtain p (CVSS 6.5, Google Chrome)
- [CVE-2026-5884](https://cve.now/CVE-2026-5884.md): Insufficient validation of untrusted input in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised th (CVSS 8.8, Google Chrome)
- [CVE-2026-5883](https://cve.now/CVE-2026-5883.md): Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-5882](https://cve.now/CVE-2026-5882.md): Incorrect security UI in Fullscreen in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted H (CVSS 4.3, Google Chrome)
- [CVE-2026-5881](https://cve.now/CVE-2026-5881.md): Policy bypass in LocalNetworkAccess in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via (CVSS 6.5, Google Chrome)
- [CVE-2026-5880](https://cve.now/CVE-2026-5880.md): Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the rend (CVSS 4.3, Google Chrome)
- [CVE-2026-5879](https://cve.now/CVE-2026-5879.md): Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbi (CVSS 8.8, Google Chrome)
- [CVE-2026-5878](https://cve.now/CVE-2026-5878.md): Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML p (CVSS 4.3, Google Chrome)
- [CVE-2026-5877](https://cve.now/CVE-2026-5877.md): Use after free in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox vi (CVSS 8.8, Google Chrome)
- [CVE-2026-5876](https://cve.now/CVE-2026-5876.md): Side-channel information leakage in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to leak cross-origin data v (CVSS 6.5, Google Chrome)
- [CVE-2026-5875](https://cve.now/CVE-2026-5875.md): Policy bypass in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (CVSS 4.3, Google Chrome)
- [CVE-2026-5874](https://cve.now/CVE-2026-5874.md): Use after free in PrivateAI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI (CVSS 9.6, Google Chrome)
- [CVE-2026-5873](https://cve.now/CVE-2026-5873.md): Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sand (CVSS 8.8, Google Chrome)
- [CVE-2026-5872](https://cve.now/CVE-2026-5872.md): Use after free in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-5871](https://cve.now/CVE-2026-5871.md): Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-5870](https://cve.now/CVE-2026-5870.md): Integer overflow in Skia in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-5869](https://cve.now/CVE-2026-5869.md): Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information (CVSS 4.3, Google Chrome)
- [CVE-2026-5868](https://cve.now/CVE-2026-5868.md): Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sa (CVSS 8.8, Google Chrome)
- [CVE-2026-5867](https://cve.now/CVE-2026-5867.md): Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information (CVSS 4.3, Google Chrome)
- [CVE-2026-5866](https://cve.now/CVE-2026-5866.md): Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-5865](https://cve.now/CVE-2026-5865.md): Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-5864](https://cve.now/CVE-2026-5864.md): Heap buffer overflow in WebAudio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive informati (CVSS 4.3, Google Chrome)
- [CVE-2026-5863](https://cve.now/CVE-2026-5863.md): Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sand (CVSS 8.8, Google Chrome)
- [CVE-2026-5862](https://cve.now/CVE-2026-5862.md): Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sand (CVSS 8.8, Google Chrome)
- [CVE-2026-5861](https://cve.now/CVE-2026-5861.md): Use after free in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-5860](https://cve.now/CVE-2026-5860.md): Use after free in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-5859](https://cve.now/CVE-2026-5859.md): Integer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-5858](https://cve.now/CVE-2026-5858.md): Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code via a crafted HTML (CVSS 8.8, Google Chrome)
- [CVE-2026-5806](https://cve.now/CVE-2026-5806.md): code-projects Easy Blog Site update.php cross site scripting (CVSS 5.1, code-projects Easy Blog Site)
- [CVE-2026-39901](https://cve.now/CVE-2026-39901.md): monetr: Protected Transactions Deletable via PUT (CVSS 5.7, monetr · github.com/monetr/monetr)
- [CVE-2026-39860](https://cve.now/CVE-2026-39860.md): Nix sandbox escape: file write via symlink at FOD \`.tmp\` copy destination (CVSS 9.0, NixOS nix)
- [CVE-2026-39892](https://cve.now/CVE-2026-39892.md): cryptography has a buffer overflow if non-contiguous buffers were passed to APIs (CVSS 6.9, pyca cryptography · cryptography)
- [CVE-2026-39891](https://cve.now/CVE-2026-39891.md): PraisonAI has a Template Injection in Agent Tool Definitions (CVSS 8.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-39890](https://cve.now/CVE-2026-39890.md): PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading (CVSS 9.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-39889](https://cve.now/CVE-2026-39889.md): PraisonAI has Unauthenticated SSE Event Stream Exposes All Agent Activity in A2U Server (CVSS 7.5, MervinPraison PraisonAI · praisonai)
- [CVE-2026-39888](https://cve.now/CVE-2026-39888.md): PraisonAIAgents has a sandbox escape via exception frame traversal in \`execute\_code\` (subprocess mode) (CVSS 10.0, MervinPraison praisonaiagents · praisonaiagents)
- [CVE-2026-39885](https://cve.now/CVE-2026-39885.md): FrontMCP Affected by SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications (CVSS 7.5, agentfront frontmcp · @frontmcp adapters +5)
- [CVE-2026-5805](https://cve.now/CVE-2026-5805.md): code-projects Easy Blog Site contact\_us.php sql injection (CVSS 6.9, code-projects Easy Blog Site)
- [CVE-2026-39883](https://cve.now/CVE-2026-39883.md): OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking (CVSS 7.3, open-telemetry opentelemetry-go · go.opentelemetry.io/otel/…)
- [CVE-2026-5436](https://cve.now/CVE-2026-5436.md): MW WP Form \<= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate\_upload\_file\_keys (CVSS 8.1, inc2734 MW WP Form)
- [CVE-2026-5451](https://cve.now/CVE-2026-5451.md): Extensions for Leaflet Map \<= 4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'elevation-track' Shortcode (CVSS 6.4, hupe13 Extensions for Leaflet Map)
- [CVE-2026-39882](https://cve.now/CVE-2026-39882.md): OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies (CVSS 5.3, open-telemetry opentelemetry-go · go.opentelemetry.io/ot… +2)
- [CVE-2026-39881](https://cve.now/CVE-2026-39881.md): Vim Ex command injection in Vims NetBeans integration (CVSS 5.0, vim)
- [CVE-2026-39429](https://cve.now/CVE-2026-39429.md): kcp's cache server is accessible without authentication or authorization checks (CVSS 8.2, kcp-dev kcp · github.com/kcp-dev/kcp)
- [CVE-2026-5803](https://cve.now/CVE-2026-5803.md): bigsk1 openai-realtime-ui API Proxy Endpoint server.js server-side request forgery (CVSS 5.3, bigsk1 openai-realtime-ui)
- [CVE-2026-39844](https://cve.now/CVE-2026-39844.md): NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization (CVSS 5.9, zauberzeug nicegui · nicegui)
- [CVE-2026-39416](https://cve.now/CVE-2026-39416.md): Stored XSS in modal item preview for long item content in AIL Framework (CVSS 8.5, ail-project ail-framework)
- [CVE-2026-39415](https://cve.now/CVE-2026-39415.md): Frappe Learning Management System has Client-Side Manipulation of Quiz Scores (CVSS 5.3, frappe lms)
- [CVE-2026-39414](https://cve.now/CVE-2026-39414.md): MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing (CVSS 7.1, minio · github.com/minio/minio)
- [CVE-2026-39880](https://cve.now/CVE-2026-39880.md): Remnawave Backend has a race condition in HWID device limit allows bypassing max devices (CVSS 5.0, remnawave backend)
- [CVE-2026-5802](https://cve.now/CVE-2026-5802.md): idachev mcp-javadc HTTP os command injection (CVSS 6.9, idachev mcp-javadc)
- [CVE-2026-39864](https://cve.now/CVE-2026-39864.md): Kamailio Auth: Processing Vulnerability For Additional Authenticated User Identity Checks (CVSS 4.4, kamailio)
- [CVE-2026-39863](https://cve.now/CVE-2026-39863.md): Kamailio Core: TCP Data Processing Vulnerability (CVSS 7.5, kamailio)
- [CVE-2026-39862](https://cve.now/CVE-2026-39862.md): Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link (CVSS 6.3, Shopify tophat)
- [CVE-2026-39859](https://cve.now/CVE-2026-39859.md): LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read (CVSS 6.3, harttle liquidjs · liquidjs)
- [CVE-2026-39413](https://cve.now/CVE-2026-39413.md): LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API (CVSS 4.2, HKUDS LightRAG · lightrag-hku)
- [CVE-2026-39412](https://cve.now/CVE-2026-39412.md): LiquidJS has an ownPropertyOnly bypass via sort\_natural filter — prototype property information disclosure through sorting side-channel (CVSS 5.3, harttle liquidjs · liquidjs)
- [CVE-2026-39411](https://cve.now/CVE-2026-39411.md): LobeHub has an unauthenticated authentication bypass on \`webapi\` routes via forgeable \`X-lobe-chat-auth\` header (CVSS 5.0, lobehub · @lobehub/lobehub)
- [CVE-2026-39362](https://cve.now/CVE-2026-39362.md): InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote\_image URLs (CVSS 5.3, InvenTree)
- [CVE-2026-35525](https://cve.now/CVE-2026-35525.md): LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates (CVSS 8.2, harttle liquidjs · liquidjs)
- [CVE-2026-35479](https://cve.now/CVE-2026-35479.md): InvenTree Plugin Installation - Insufficient Permissions (CVSS 6.6, InvenTree)
- [CVE-2026-35476](https://cve.now/CVE-2026-35476.md): InvenTree Affected by Privilege Escalation via API (CVSS 7.2, InvenTree)
- [CVE-2026-35478](https://cve.now/CVE-2026-35478.md): InvenTree has Arbitrary API Token Creation (CVSS 8.3, InvenTree)
- [CVE-2026-35477](https://cve.now/CVE-2026-35477.md): InvenTree has SSTI in PART\_NAME\_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape (CVSS 5.5, InvenTree)
- [CVE-2026-23869](https://cve.now/CVE-2026-23869.md): A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server (CVSS 7.5, Meta react-server-dom-turbopack · Meta react-server-dom-… +4)
- [CVE-2026-35455](https://cve.now/CVE-2026-35455.md): immich has Stored XSS via OCR Text in 360° Panorama Viewer (CVSS 7.3, immich-app immich)
- [CVE-2026-35446](https://cve.now/CVE-2026-35446.md): LORIS has a path traversal in FilesDownloadHandler (CVSS 7.7, aces Loris)
- [CVE-2026-35403](https://cve.now/CVE-2026-35403.md): LORIS has potential cross-site scripting in survey\_accounts module (CVSS 6.5, aces Loris)
- [CVE-2026-35400](https://cve.now/CVE-2026-35400.md): LORIS incorrectly trusts user input in publication module (CVSS 3.5, aces Loris)
- [CVE-2026-35169](https://cve.now/CVE-2026-35169.md): LORIS has potential cross-site scripting in help\_editor module (CVSS 8.7, aces Loris)
- [CVE-2026-35165](https://cve.now/CVE-2026-35165.md): LORIS has incorrect access checks in document\_repository (CVSS 6.3, aces Loris)
- [CVE-2026-34985](https://cve.now/CVE-2026-34985.md): LORIS has incorrect access checks in media module (CVSS 6.3, aces Loris)
- [CVE-2026-20709](https://cve.now/CVE-2026-20709.md): Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celeron(R) Processor J Serie (CVSS 5.8, Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celer…)
- [CVE-2026-34837](https://cve.now/CVE-2026-34837.md): Zammad is miissing authorization in AI assistance controller for context data used in text tools (CVSS 5.3, zammad)
- [CVE-2026-34782](https://cve.now/CVE-2026-34782.md): Zammad has improper access control in AI assistance controller for text tools (CVSS 5.3, zammad)
- [CVE-2026-34724](https://cve.now/CVE-2026-34724.md): Zammad has a server-side template injection leading to RCE via AI Agent (CVSS 8.7, zammad)
- [CVE-2026-34723](https://cve.now/CVE-2026-34723.md): Zammad has incorrect access control in getting\_started\_controller (CVSS 8.7, zammad)
- [CVE-2026-34722](https://cve.now/CVE-2026-34722.md): Zammad is missing authorization in ticket create endpoint (CVSS 6.9, zammad)
- [CVE-2026-34721](https://cve.now/CVE-2026-34721.md): Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints (CVSS 5.9, zammad)
- [CVE-2026-34720](https://cve.now/CVE-2026-34720.md): Zammad has an origin validation error in SSO mechanism (CVSS 2.3, zammad)
- [CVE-2026-34719](https://cve.now/CVE-2026-34719.md): Zammad has a Server-side request forgery (SSRF) via webhooks (CVSS 8.3, zammad)
- [CVE-2026-34718](https://cve.now/CVE-2026-34718.md): Zammad improperly neutralizes of script-related HTML tags in ticket articles (CVSS 5.3, zammad)
- [CVE-2026-34248](https://cve.now/CVE-2026-34248.md): Zammad has an information disclosure in ticket detail view of customers in shared organizations (CVSS 2.1, zammad)
- [CVE-2026-34392](https://cve.now/CVE-2026-34392.md): LORIS has a path traversal in static router (CVSS 7.5, aces Loris)
- [CVE-2026-30818](https://cve.now/CVE-2026-30818.md): OS Command Injection Vulnerability in dnsmasq Module in TP-Link AX53 (CVSS 8.5, TP-Link Systems AX53)
- [CVE-2026-30817](https://cve.now/CVE-2026-30817.md): Arbitrary File Reading Vulnerability in dnsmasq Module in TP-Link AX53 (CVSS 6.8, TP-Link Systems AX53)
- [CVE-2026-30816](https://cve.now/CVE-2026-30816.md): Arbitrary File Reading Vulnerability in OpenVPN Module in TP-Link AX53 (CVSS 6.8, TP-Link Systems AX53)
- [CVE-2026-30815](https://cve.now/CVE-2026-30815.md): OS Command Injection Vulnerability in OpenVPN Module in TP-Link AX53 (CVSS 8.5, TP-Link Systems AX53)
- [CVE-2026-34166](https://cve.now/CVE-2026-34166.md): LiquidJS has a Memory Limit Bypass via Quadratic Amplification in \`replace\` Filter (CVSS 3.7, harttle liquidjs · liquidjs)
- [CVE-2026-30814](https://cve.now/CVE-2026-30814.md): Buffer Overflow Vulnerability in TP-Link AX53 (CVSS 7.3, TP-Link Systems AX53)
- [CVE-2026-33350](https://cve.now/CVE-2026-33350.md): LORIS has a SQL injection in MRI feedback popup (CVSS 7.5, aces Loris)
- [CVE-2026-27806](https://cve.now/CVE-2026-27806.md): Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit (CVSS 7.8, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-39851](https://cve.now/CVE-2026-39851.md): Saleor has a user enumeration vulnerability due to different error messages (CVSS 5.3, saleor)
- [CVE-2025-30650](https://cve.now/CVE-2025-30650.md): Junos OS: Privileged local user can gain access to a Linux-based FPC as root (CVSS 6.7, Juniper Networks Junos OS)
- [CVE-2026-0811](https://cve.now/CVE-2026-0811.md): Advanced CF7 DB \<= 2.0.9 - Cross-Site Request Forgery to Form Entry Deletion (CVSS 5.4, vsourz1td Advanced Contact form 7 DB)
- [CVE-2026-0814](https://cve.now/CVE-2026-0814.md): Advanced CF7 DB \<= 2.0.9 - Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel Export (CVSS 4.3, vsourz1td Advanced Contact form 7 DB)
- [CVE-2026-2942](https://cve.now/CVE-2026-2942.md): ProSolution WP Client \<= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol\_fileUploadProcess (CVSS 9.8, ProSolution WP Client)
- [CVE-2026-35407](https://cve.now/CVE-2026-35407.md): Saleor has Cross-Account Email Change via Unbound Confirmation Token (CVSS 5.9, saleor)
- [CVE-2026-35401](https://cve.now/CVE-2026-35401.md): Saleor has a resource exhaustion vulnerability in GraphQL queries (CVSS 7.5, saleor)
- [CVE-2026-33756](https://cve.now/CVE-2026-33756.md): Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching (CVSS 7.5, saleor)
- [CVE-2026-32591](https://cve.now/CVE-2026-32591.md): Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration (CVSS 5.2, Red Hat Quay · mirror registry for Red Hat OpenShift)
- [CVE-2026-32590](https://cve.now/CVE-2026-32590.md): Mirror-registry: remote code execution using pickle deserialization (CVSS 7.1, mirror registry for Red Hat OpenShift · Red Hat Quay)
- [CVE-2026-32589](https://cve.now/CVE-2026-32589.md): Mirror-registry: quay: insecure direct object reference in blobupload (CVSS 7.4, mirror registry for Red Hat OpenShift · Red Hat Quay)
- [CVE-2026-33466](https://cve.now/CVE-2026-33466.md): Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write (CVSS 8.1, Elastic Logstash)
- [CVE-2026-33458](https://cve.now/CVE-2026-33458.md): Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure (CVSS 6.8, Elastic Kibana)
- [CVE-2026-33459](https://cve.now/CVE-2026-33459.md): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (CVSS 6.5, Elastic Kibana)
- [CVE-2026-33460](https://cve.now/CVE-2026-33460.md): Incorrect Authorization in Kibana Fleet Leading to Information Disclosure (CVSS 4.3, Elastic Kibana)
- [CVE-2025-14243](https://cve.now/CVE-2025-14243.md): Mirror-registry: openshift mirror registry: user enumeration via authentication error messages (CVSS 5.3, mirror registry for Red Hat OpenShift)
- [CVE-2026-33461](https://cve.now/CVE-2026-33461.md): Incorrect Authorization in Kibana Fleet Leading to Information Disclosure (CVSS 7.7, Elastic Kibana)
- [CVE-2026-4498](https://cve.now/CVE-2026-4498.md): Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope (CVSS 7.7, Elastic Kibana)
- [CVE-2026-2377](https://cve.now/CVE-2026-2377.md): Mirror-registry: quay: quay: server-side request forgery via log export functionality (CVSS 6.5, Red Hat Quay · mirror registry for Red Hat OpenShift)
- [CVE-2026-4837](https://cve.now/CVE-2026-4837.md): Eval Injection in Rapid7 Insight Agent (CVSS 6.6, Rapid7 Insight Agent)
- [CVE-2026-33753](https://cve.now/CVE-2026-33753.md): Improper Certificate Validation in rfc3161-client (CVSS 6.2, trailofbits rfc3161-client · rfc3161-client)
- [CVE-2026-33229](https://cve.now/CVE-2026-33229.md): XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API (CVSS 8.6, xwiki-platform · org.xwiki.platform xwiki-platform-legac… +3)
- [CVE-2026-39410](https://cve.now/CVE-2026-39410.md): Hono has a non-breaking space prefix bypass in cookie name handling in getCookie() (CVSS 4.8, honojs hono · hono)
- [CVE-2026-39409](https://cve.now/CVE-2026-39409.md): Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses (CVSS 6.3, honojs hono · hono)
- [CVE-2026-39408](https://cve.now/CVE-2026-39408.md): Hono has a path traversal in toSSG() allows writing files outside the output directory (CVSS 5.9, honojs hono · hono)
- [CVE-2026-39407](https://cve.now/CVE-2026-39407.md): Hono has a middleware bypass via repeated slashes in serveStatic (CVSS 5.3, honojs hono · hono)
- [CVE-2026-39406](https://cve.now/CVE-2026-39406.md): @hono/node-server has a middleware bypass via repeated slashes in serveStatic (CVSS 5.3, honojs node-server · @hono/node-server)
- [CVE-2026-39394](https://cve.now/CVE-2026-39394.md): CI4MS has an .env CRLF Injection via Unvalidated \`host\` Parameter in Install Controller (CVSS 8.1, ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms)
- [CVE-2026-39393](https://cve.now/CVE-2026-39393.md): Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms (CVSS 8.1, ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms)
- [CVE-2026-39392](https://cve.now/CVE-2026-39392.md): CI4MS has Stored XSS in Pages Content Due to Missing html\_purify Sanitization (CVSS 5.5, ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms)
- [CVE-2026-39391](https://cve.now/CVE-2026-39391.md): CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List (CVSS 4.8, ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms)
- [CVE-2026-39390](https://cve.now/CVE-2026-39390.md): CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting (CVSS 5.5, ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms)
- [CVE-2026-39389](https://cve.now/CVE-2026-39389.md): CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files (CVSS 6.7, ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms)
- [CVE-2026-39865](https://cve.now/CVE-2026-39865.md): Axios HTTP/2 Session Cleanup State Corruption Vulnerability (CVSS 5.9, axios)
- [CVE-2025-58713](https://cve.now/CVE-2025-58713.md): Rhpam: privilege escalation via excessive /etc/passwd permissions (CVSS 6.4, Red Hat Process Automation)
- [CVE-2025-57853](https://cve.now/CVE-2025-57853.md): Web-terminal: privilege escalation via excessive /etc/passwd permissions (CVSS 6.4, Red Hat Web Terminal)
- [CVE-2025-57854](https://cve.now/CVE-2025-57854.md): Osus-operator: privilege escalation via excessive /etc/passwd permissions (CVSS 6.4, Red Hat OpenShift Update Service)
- [CVE-2025-57851](https://cve.now/CVE-2025-57851.md): Mce: privilege escalation via excessive /etc/passwd permissions (CVSS 6.4, Red Hat Multicluster Engine for Kubernetes)
- [CVE-2025-57847](https://cve.now/CVE-2025-57847.md): Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions (CVSS 6.4, Red Hat Ansible Automation Platform)
- [CVE-2026-5795](https://cve.now/CVE-2026-5795.md): In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. (CVSS 7.4, Eclipse Foundation Eclipse Jetty · org.eclipse.jetty.ee1… +4)
- [CVE-2026-2509](https://cve.now/CVE-2026-2509.md): Page Builder: Pagelayer \<= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes (CVSS 6.4, softaculous Page Builder: Pagelayer – Drag and Drop website…)
- [CVE-2025-14816](https://cve.now/CVE-2025-14816.md): Information Disclosure, Tampering, and Denial-of-Service Vulnerabilities in GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works64 (CVSS 9.3, Mitsubishi Electric GENESIS64 · Mitsubishi Electric Ico… +11)
- [CVE-2025-14815](https://cve.now/CVE-2025-14815.md): Information Disclosure, Tampering, and Denial-of-Service Vulnerabilities in GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works64 (CVSS 9.3, Mitsubishi Electric GENESIS64 · Mitsubishi Electric Ico… +11)
- [CVE-2026-31411](https://cve.now/CVE-2026-31411.md): net: atm: fix crash due to unvalidated vcc pointer in sigd\_send() (no CVSS, Linux)
- [CVE-2026-35023](https://cve.now/CVE-2026-35023.md): Wimi Teamwork On-Premises \< 8.2.0 IDOR via preview.php (CVSS 5.3, Cloud Solutions SAS Wimi Teamwork)
- [CVE-2026-28261](https://cve.now/CVE-2026-28261.md): Dell Elastic Cloud Storage, version 3.8.1.7 and prior, and Dell ObjectScale, versions prior to 4.1.0.3 and version 4.2.0.0, contains an Inse (CVSS 7.8, Dell Elastic Cloud Storage · Dell ObjectScale)
- [CVE-2026-24511](https://cve.now/CVE-2026-24511.md): Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.0, contains a generation of error message cont (CVSS 4.4, Dell PowerScale OneFS)
- [CVE-2026-5600](https://cve.now/CVE-2026-5600.md): A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check- (CVSS 5.5, pretix)
- [CVE-2026-27102](https://cve.now/CVE-2026-27102.md): Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.1, contains an incorrect privilege assignment (CVSS 6.6, Dell PowerScale OneFS)
- [CVE-2026-5302](https://cve.now/CVE-2026-5302.md): Permissive Cross-domain Policy with Untrusted Domains in coolercontrold (CVSS 6.3, coolercontrold)
- [CVE-2026-5300](https://cve.now/CVE-2026-5300.md): Missing Authentication for Critical Function in coolercontrold (CVSS 5.9, coolercontrold)
- [CVE-2026-5301](https://cve.now/CVE-2026-5301.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in coolercontrol-ui (CVSS 7.6, coolercontrol-ui)
- [CVE-2026-5208](https://cve.now/CVE-2026-5208.md): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in coolercontrold (CVSS 8.2, coolercontrold)
- [CVE-2026-28264](https://cve.now/CVE-2026-28264.md): Dell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability (CVSS 3.3, Dell PowerProtect Agent)
- [CVE-2026-3396](https://cve.now/CVE-2026-3396.md): WCAPF – WooCommerce Ajax Product Filter \<= 4.2.3 - Unauthenticated Time-Based SQL Injection (CVSS 7.5, shamimmoeen WCAPF – Ajax Product Filter for WooCommerce)
- [CVE-2026-1672](https://cve.now/CVE-2026-1672.md): BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net \<= 1.1.5 - Cross-Site Request Forgery to Product Data Modification (CVSS 6.5, realmag777 BEAR – Bulk Editor and Products Manager Professi…)
- [CVE-2026-2481](https://cve.now/CVE-2026-2481.md): Beaver Builder Page Builder – Drag and Drop Website Builder \<= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings\[js\]' (CVSS 6.4, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2026-3243](https://cve.now/CVE-2026-3243.md): Advanced Members for ACF \<= 1.2.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal (CVSS 8.8, danbilabs Advanced Members for ACF)
- [CVE-2026-1673](https://cve.now/CVE-2026-1673.md): BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net \<= 1.1.5 - Cross-Site Request Forgery to Taxonomy Term Deletion (CVSS 4.3, realmag777 BEAR – Bulk Editor and Products Manager Professi…)
- [CVE-2026-1865](https://cve.now/CVE-2026-1865.md): User Registration & Membership \<= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership\_ids\[\] (CVSS 6.5, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2026-4300](https://cve.now/CVE-2026-4300.md): Robo Gallery \<= 5.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Loading Label' Setting (CVSS 6.4, robosoft Robo Gallery – Photo & Image Slider)
- [CVE-2026-4025](https://cve.now/CVE-2026-4025.md): PrivateContent Free \<= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute (CVSS 6.4, lcweb-projects PrivateContent Free)
- [CVE-2026-4303](https://cve.now/CVE-2026-4303.md): WP Visitor Statistics (Real Time Traffic) \<= 8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height' Shortcode Attribute (CVSS 6.4, osamaesh WP Visitor Statistics)
- [CVE-2026-4073](https://cve.now/CVE-2026-4073.md): pdfl.io \<= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute (CVSS 6.4, dougblackjr pdfl.io)
- [CVE-2026-25776](https://cve.now/CVE-2026-25776.md): Movable Type provided by Six Apart Ltd. (CVSS 9.8, Six Apart Movable Type)
- [CVE-2026-33088](https://cve.now/CVE-2026-33088.md): Movable Type provided by Six Apart Ltd. (CVSS 7.3, Six Apart Movable Type)
- [CVE-2026-39716](https://cve.now/CVE-2026-39716.md): WordPress Flipmart theme \<= 2.8 - Broken Access Control vulnerability (CVSS 5.3, CKThemes Flipmart)
- [CVE-2026-39715](https://cve.now/CVE-2026-39715.md): WordPress AnyTrack Affiliate Link Manager plugin \<= 1.5.5 - Broken Access Control vulnerability (CVSS 5.3, AnyTrack Affiliate Link Manager)
- [CVE-2026-39714](https://cve.now/CVE-2026-39714.md): WordPress G5Plus April theme \<= 6.8 - Broken Access Control vulnerability (CVSS 5.3, G5Theme G5Plus April)
- [CVE-2026-39713](https://cve.now/CVE-2026-39713.md): WordPress Mailercloud – Integrate webforms and synchronize website contacts plugin \<= 1.0.7 - Broken Access Control vulnerability (CVSS 5.3, Mailercloud – Integrate webforms and synchronize website co…)
- [CVE-2026-39712](https://cve.now/CVE-2026-39712.md): WordPress tagDiv Composer plugin \<= 5.4.3 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3, tagDiv Composer)
- [CVE-2026-39711](https://cve.now/CVE-2026-39711.md): WordPress RT-Theme 18 | Extensions plugin \<= 2.5 - Sensitive Data Exposure vulnerability (CVSS 5.3, stmcan RT-Theme 18 | Extensions)
- [CVE-2026-39710](https://cve.now/CVE-2026-39710.md): WordPress RT-Theme 18 | Extensions plugin \<= 2.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, stmcan RT-Theme 18 | Extensions)
- [CVE-2026-39709](https://cve.now/CVE-2026-39709.md): WordPress The Tribal plugin \<= 1.3.4 - Sensitive Data Exposure vulnerability (CVSS 5.3, thetechtribe The Tribal)
- [CVE-2026-39708](https://cve.now/CVE-2026-39708.md): WordPress UiCore Elements plugin \<= 1.3.17 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, UiCore Elements)
- [CVE-2026-39707](https://cve.now/CVE-2026-39707.md): WordPress Accept PayPal Payments using Contact Form 7 plugin \<= 4.0.4 - Broken Access Control vulnerability (CVSS 5.3, ZealousWeb Accept PayPal Payments using Contact Form)
- [CVE-2026-39706](https://cve.now/CVE-2026-39706.md): WordPress Make My Trivia plugin \<= 1.1.0 - Broken Access Control vulnerability (CVSS 5.3, Netro Systems Make My Trivia)
- [CVE-2026-39705](https://cve.now/CVE-2026-39705.md): WordPress MIPL WC Multisite Sync plugin \<= 1.4.4 - Broken Access Control vulnerability (CVSS 5.3, Mulika Team MIPL WC Multisite Sync)
- [CVE-2026-39704](https://cve.now/CVE-2026-39704.md): WordPress Precious Metals Automated Product Pricing – Pro plugin \<= 4.0.5 - Broken Access Control vulnerability (CVSS 5.3, nfusionsolutions Precious Metals Automated Product Pricing…)
- [CVE-2026-39703](https://cve.now/CVE-2026-39703.md): WordPress WPBITS Addons For Elementor Page Builder plugin \<= 1.8.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPBITS Addons For Elementor Page Builder)
- [CVE-2026-39702](https://cve.now/CVE-2026-39702.md): WordPress Animation Addons for Elementor plugin \<= 2.6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Wealcoder Animation Addons for Elementor)
- [CVE-2026-39701](https://cve.now/CVE-2026-39701.md): WordPress ShopWP plugin \<= 5.2.4 - Broken Access Control vulnerability (CVSS 5.3, Andrew ShopWP)
- [CVE-2026-39700](https://cve.now/CVE-2026-39700.md): WordPress WowOptin plugin \<= 1.4.32 - Broken Access Control vulnerability (CVSS 5.3, WPXPO WowOptin)
- [CVE-2026-39699](https://cve.now/CVE-2026-39699.md): WordPress AI Workflow Automation plugin \<= 1.4.2 - Broken Access Control vulnerability (CVSS 5.3, massiveshift AI Workflow Automation)
- [CVE-2026-39698](https://cve.now/CVE-2026-39698.md): WordPress The Publisher Desk ads.txt plugin \<= 1.5.0 - Broken Access Control vulnerability (CVSS 5.3, PublisherDesk The Publisher Desk ads.txt)
- [CVE-2026-39697](https://cve.now/CVE-2026-39697.md): WordPress MAIO – The new AI GEO / SEO tool plugin \<= 6.2.8 - Broken Access Control vulnerability (CVSS 5.3, HBSS Technologies MAIO – The new AI GEO / SEO tool)
- [CVE-2026-39696](https://cve.now/CVE-2026-39696.md): WordPress Elfsight WhatsApp Chat CC plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Elfsight WhatsApp Chat CC)
- [CVE-2026-39695](https://cve.now/CVE-2026-39695.md): WordPress Podigee plugin \<= 1.4.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, Podigee)
- [CVE-2026-39694](https://cve.now/CVE-2026-39694.md): WordPress Simply Schedule Appointments plugin \<= 1.6.10.2 - Broken Access Control vulnerability (CVSS 5.3, NSquared Simply Schedule Appointments)
- [CVE-2026-39693](https://cve.now/CVE-2026-39693.md): WordPress FSM Custom Featured Image Caption plugin \<= 1.25.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, fesomia FSM Custom Featured Image Caption)
- [CVE-2026-39692](https://cve.now/CVE-2026-39692.md): WordPress tagDiv Composer plugin \<= 5.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, tagDiv Composer)
- [CVE-2026-39691](https://cve.now/CVE-2026-39691.md): WordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin \<= 2.2.13 - Broken Access Control vulnerability (CVSS 5.3, AdAstraCrypto Cryptocurrency Donation Box – Bitcoin & Crypt…)
- [CVE-2026-39690](https://cve.now/CVE-2026-39690.md): WordPress Author Avatars List/Block plugin \<= 2.1.25 - Broken Access Control vulnerability (CVSS 5.3, Paul Bearne Author Avatars List/Block)
- [CVE-2026-39689](https://cve.now/CVE-2026-39689.md): WordPress eShipper Commerce plugin \<= 2.16.12 - Broken Access Control vulnerability (CVSS 5.3, eShipper Commerce)
- [CVE-2026-39688](https://cve.now/CVE-2026-39688.md): WordPress WP Frontend Profile plugin \<= 1.3.9 - Broken Access Control vulnerability (CVSS 5.3, Glowlogix WP Frontend Profile)
- [CVE-2026-39687](https://cve.now/CVE-2026-39687.md): WordPress Rapid Car Check Vehicle Data plugin \<= 2.0 - Broken Access Control vulnerability (CVSS 5.3, Rapid Car Check Vehicle Data)
- [CVE-2026-39686](https://cve.now/CVE-2026-39686.md): WordPress BSK PDF Manager plugin \<= 3.7.2 - Sensitive Data Exposure vulnerability (CVSS 5.3, bannersky BSK PDF Manager)
- [CVE-2026-39685](https://cve.now/CVE-2026-39685.md): WordPress The Moneytizer plugin \<= 10.0.10 - Broken Access Control vulnerability (CVSS 5.3, lvaudore The Moneytizer)
- [CVE-2026-39684](https://cve.now/CVE-2026-39684.md): WordPress OrganicFood theme \<= 3.6.4 - Local File Inclusion vulnerability (CVSS 7.5, UnTheme OrganicFood)
- [CVE-2026-39683](https://cve.now/CVE-2026-39683.md): WordPress Garden Gnome Package plugin \<= 2.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Chief Gnome Garden Gnome Package)
- [CVE-2026-39682](https://cve.now/CVE-2026-39682.md): WordPress linkPizza-Manager plugin \<= 5.5.5 - Broken Access Control vulnerability (CVSS 5.3, Arjan Pronk linkPizza-Manager)
- [CVE-2026-39681](https://cve.now/CVE-2026-39681.md): WordPress Homeo theme \<= 1.2.59 - Local File Inclusion vulnerability (CVSS 7.5, ApusTheme Homeo)
- [CVE-2026-39680](https://cve.now/CVE-2026-39680.md): WordPress Diet Calorie Calculator plugin \<= 1.1.1 - Broken Access Control vulnerability (CVSS 5.3, MWP Development Diet Calorie Calculator)
- [CVE-2026-39679](https://cve.now/CVE-2026-39679.md): WordPress Freeio theme \<= 1.3.21 - Local File Inclusion vulnerability (CVSS 7.5, ApusTheme Freeio)
- [CVE-2026-39678](https://cve.now/CVE-2026-39678.md): WordPress Pinpoint Booking System plugin \<= 2.9.9.7.2 - Broken Access Control vulnerability (CVSS 5.3, Pinpoint Booking System)
- [CVE-2026-39677](https://cve.now/CVE-2026-39677.md): WordPress Emphires theme \<= 3.9 - Local File Inclusion vulnerability (CVSS 7.5, Creatives\_Planet Emphires)
- [CVE-2026-39676](https://cve.now/CVE-2026-39676.md): WordPress Download Manager plugin \<= 3.3.52 - Broken Access Control vulnerability (CVSS 5.3, Shahjada Download Manager)
- [CVE-2026-39675](https://cve.now/CVE-2026-39675.md): WordPress Court Reservation plugin \<= 1.10.11 - Broken Access Control vulnerability (CVSS 5.3, webmuehle Court Reservation)
- [CVE-2026-39674](https://cve.now/CVE-2026-39674.md): WordPress MK Google Directions plugin \<= 3.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Manoj Kumar MK Google Directions)
- [CVE-2026-39673](https://cve.now/CVE-2026-39673.md): WordPress iZooto plugin \<= 3.7.20 - Broken Access Control vulnerability (CVSS 5.3, shrikantkale iZooto)
- [CVE-2026-39672](https://cve.now/CVE-2026-39672.md): WordPress ShipTime: Discounted Shipping Rates plugin \<= 1.1.1 - Broken Access Control vulnerability (CVSS 5.3, ShipTime: Discounted Shipping Rates)
- [CVE-2026-39671](https://cve.now/CVE-2026-39671.md): WordPress Extra Fees Plugin for WooCommerce plugin \<= 4.3.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Dotstore Extra Fees Plugin for WooCommerce)
- [CVE-2026-39670](https://cve.now/CVE-2026-39670.md): WordPress Visual Link Preview plugin \<= 2.3.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.0, Brecht Visual Link Preview)
- [CVE-2026-39669](https://cve.now/CVE-2026-39669.md): WordPress NitroPack plugin \<= 1.19.3 - Broken Access Control vulnerability (CVSS 5.3, NitroPack)
- [CVE-2026-39668](https://cve.now/CVE-2026-39668.md): WordPress Book Previewer for Woocommerce plugin \<= 1.0.6 - Broken Access Control vulnerability (CVSS 5.3, g5theme Book Previewer for Woocommerce)
- [CVE-2026-39667](https://cve.now/CVE-2026-39667.md): WordPress Korea SNS plugin \<= 1.7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Jongmyoung Kim Korea SNS)
- [CVE-2026-39666](https://cve.now/CVE-2026-39666.md): WordPress Hello Bar Popup Builder plugin \<= 1.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, telepathy Hello Bar Popup Builder)
- [CVE-2026-39665](https://cve.now/CVE-2026-39665.md): WordPress SEO Friendly Images plugin \<= 3.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Vladimir Prelovac SEO Friendly Images)
- [CVE-2026-39664](https://cve.now/CVE-2026-39664.md): WordPress Leadrebel plugin \<= 1.0.2 - Broken Access Control vulnerability (CVSS 5.3, Leadrebel)
- [CVE-2026-39663](https://cve.now/CVE-2026-39663.md): WordPress TrueBooker plugin \<= 1.1.5 - Broken Access Control vulnerability (CVSS 5.3, themetechmount TrueBooker)
- [CVE-2026-39662](https://cve.now/CVE-2026-39662.md): WordPress Product Price by Formula for WooCommerce plugin \<= 2.5.6 - Broken Access Control vulnerability (CVSS 5.3, ProWCPlugins Product Price by Formula for WooCommerce)
- [CVE-2026-39658](https://cve.now/CVE-2026-39658.md): WordPress Panda Pods Repeater Field plugin \<= 1.5.12 - Broken Access Control vulnerability (CVSS 5.3, Coding Panda Panda Pods Repeater Field)
- [CVE-2026-39657](https://cve.now/CVE-2026-39657.md): WordPress leadlovers forms plugin \<= 1.0.2 - Broken Access Control vulnerability (CVSS 5.3, leadlovers forms)
- [CVE-2026-39656](https://cve.now/CVE-2026-39656.md): WordPress Razorpay for WooCommerce plugin \<= 4.8.2 - Broken Access Control vulnerability (CVSS 5.3, Razorpay for WooCommerce)
- [CVE-2026-39654](https://cve.now/CVE-2026-39654.md): WordPress WP Simple HTML Sitemap plugin \<= 3.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Ashish Ajani WP Simple HTML Sitemap)
- [CVE-2026-39653](https://cve.now/CVE-2026-39653.md): WordPress Video Conferencing with Zoom plugin \<= 4.6.6 - Broken Access Control vulnerability (CVSS 4.3, Deepen Bajracharya Video Conferencing with Zoom)
- [CVE-2026-39652](https://cve.now/CVE-2026-39652.md): WordPress iGMS Direct Booking plugin \<= 1.3 - Broken Access Control vulnerability (CVSS 5.3, iGMS Direct Booking)
- [CVE-2026-39651](https://cve.now/CVE-2026-39651.md): WordPress Total Poll Lite plugin \<= 4.12.0 - Broken Access Control vulnerability (CVSS 6.5, TotalSuite Total Poll Lite)
- [CVE-2026-39650](https://cve.now/CVE-2026-39650.md): WordPress UnitechPay plugin \<= 1.0.2 - Broken Access Control vulnerability (CVSS 5.3, Unitech Web UnitechPay)
- [CVE-2026-39649](https://cve.now/CVE-2026-39649.md): WordPress Royale News theme \<= 2.2.4 - Broken Access Control vulnerability (CVSS 5.3, themebeez Royale News)
- [CVE-2026-39648](https://cve.now/CVE-2026-39648.md): WordPress Cream Blog theme \<= 2.1.7 - Broken Access Control vulnerability (CVSS 5.3, themebeez Cream Blog)
- [CVE-2026-39647](https://cve.now/CVE-2026-39647.md): WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin \<= 5.11 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, MP3 Audio Player for Music, Radio & Podcast by Sonaar)
- [CVE-2026-39646](https://cve.now/CVE-2026-39646.md): WordPress Leaflet Map plugin \<= 3.4.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bozdoz Leaflet Map)
- [CVE-2026-39645](https://cve.now/CVE-2026-39645.md): WordPress GlobalPayments WooCommerce plugin \<= 1.18.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, Global Payments GlobalPayments WooCommerce)
- [CVE-2026-39644](https://cve.now/CVE-2026-39644.md): WordPress Wp Ultimate Review plugin \<= 2.3.8 - Broken Access Control vulnerability (CVSS 5.3, Roxnor Wp Ultimate Review)
- [CVE-2026-39643](https://cve.now/CVE-2026-39643.md): WordPress Payment Plugins for PayPal WooCommerce plugin \<= 2.0.13 - Broken Access Control vulnerability (CVSS 5.3, Payment Plugins for PayPal WooCommerce)
- [CVE-2026-39641](https://cve.now/CVE-2026-39641.md): WordPress Blackfyre theme \<= 2.5.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5, Skywarrior Blackfyre)
- [CVE-2026-39640](https://cve.now/CVE-2026-39640.md): WordPress Theme Editor plugin \<= 3.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution vulnerability (CVSS 9.6, mndpsingh287 Theme Editor)
- [CVE-2026-39639](https://cve.now/CVE-2026-39639.md): WordPress RPS Include Content plugin \<= 1.2.2 - Broken Access Control vulnerability (CVSS 6.5, redpixelstudios RPS Include Content)
- [CVE-2026-39638](https://cve.now/CVE-2026-39638.md): WordPress Qubely plugin \<= 1.8.14 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Themeum Qubely)
- [CVE-2026-39637](https://cve.now/CVE-2026-39637.md): WordPress Mogi theme \<= 1.2.3 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3, SpabRice Mogi)
- [CVE-2026-39636](https://cve.now/CVE-2026-39636.md): WordPress Livemesh Addons for Elementor plugin \<= 9.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Livemesh Addons for Elementor)
- [CVE-2026-39635](https://cve.now/CVE-2026-39635.md): WordPress Grand Magazine theme \<= 3.5.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, ThemeGoods Grand Magazine)
- [CVE-2026-39634](https://cve.now/CVE-2026-39634.md): WordPress Grand Portfolio theme \<= 3.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, ThemeGoods Grand Portfolio)
- [CVE-2026-39633](https://cve.now/CVE-2026-39633.md): WordPress Grand Car Rental theme \<= 3.6.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5, ThemeGoods Grand Car Rental)
- [CVE-2026-39632](https://cve.now/CVE-2026-39632.md): WordPress Grand Blog theme \<= 3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5, ThemeGoods Grand Blog)
- [CVE-2026-39631](https://cve.now/CVE-2026-39631.md): WordPress WPSchoolPress plugin \<= 2.2.35 - Broken Access Control vulnerability (CVSS 4.9, Ronik@UnlimitedWP WPSchoolPress)
- [CVE-2026-39630](https://cve.now/CVE-2026-39630.md): WordPress Getty Images plugin \<= 4.1.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4, Getty Images)
- [CVE-2026-39629](https://cve.now/CVE-2026-39629.md): WordPress Uminex theme \<= 1.0.9 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3, kutethemes Uminex)
- [CVE-2026-39628](https://cve.now/CVE-2026-39628.md): WordPress DukaMarket theme \<= 1.3.0 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3, kutethemes DukaMarket)
- [CVE-2026-39627](https://cve.now/CVE-2026-39627.md): WordPress Ashe theme \<= 2.266 - Broken Access Control vulnerability (CVSS 4.3, wproyal Ashe)
- [CVE-2026-39626](https://cve.now/CVE-2026-39626.md): WordPress Armania theme \<= 1.4.8 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3, kutethemes Armania)
- [CVE-2026-39625](https://cve.now/CVE-2026-39625.md): WordPress TechOne theme \<= 3.0.3 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3, kutethemes TechOne)
- [CVE-2026-39624](https://cve.now/CVE-2026-39624.md): WordPress Biolife theme \<= 3.2.3 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3, kutethemes Biolife)
- [CVE-2026-39623](https://cve.now/CVE-2026-39623.md): WordPress Biolife theme \<= 3.2.3 - Local File Inclusion vulnerability (CVSS 7.5, kutethemes Biolife)
- [CVE-2026-39622](https://cve.now/CVE-2026-39622.md): WordPress Education Base theme \<= 3.0.8 - Broken Access Control vulnerability (CVSS 5.3, acmethemes Education Base)
- [CVE-2026-39621](https://cve.now/CVE-2026-39621.md): WordPress SpicePress theme \<= 2.3.2.5 - CSRF to Arbitrary Plugin Installation vulnerability (CVSS 8.8, spicethemes SpicePress)
- [CVE-2026-39620](https://cve.now/CVE-2026-39620.md): WordPress Appointment theme \<= 3.5.5 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability (CVSS 9.6, priyanshumittal Appointment)
- [CVE-2026-39619](https://cve.now/CVE-2026-39619.md): WordPress Busiprof theme \<= 2.5.2 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability (CVSS 9.6, priyanshumittal Busiprof)
- [CVE-2026-39618](https://cve.now/CVE-2026-39618.md): WordPress NewsExo theme \<= 7.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, themearile NewsExo)
- [CVE-2026-39617](https://cve.now/CVE-2026-39617.md): WordPress Bluestreet theme \<= 1.7.3 - Cross Site Request Forgery (CSRF) to Arbitrary Plugin Installation vulnerability (CVSS 9.6, priyanshumittal Bluestreet)
- [CVE-2026-39616](https://cve.now/CVE-2026-39616.md): WordPress Download Attachments plugin \<= 1.4.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, dFactory Download Attachments)
- [CVE-2026-39615](https://cve.now/CVE-2026-39615.md): WordPress Download Manager plugin \<= 3.3.53 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Shahjada Download Manager)
- [CVE-2026-39614](https://cve.now/CVE-2026-39614.md): WordPress JW Player for WordPress plugin \<= 2.3.6 - Broken Access Control vulnerability (CVSS 5.4, ilGhera JW Player for WordPress)
- [CVE-2026-39613](https://cve.now/CVE-2026-39613.md): WordPress Boutique theme \<= 2.3.3 - Local File Inclusion vulnerability (CVSS 7.5, kutethemes Boutique)
- [CVE-2026-39612](https://cve.now/CVE-2026-39612.md): WordPress KuteShop theme \<= 4.2.9 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3, kutethemes KuteShop)
- [CVE-2026-39611](https://cve.now/CVE-2026-39611.md): WordPress KuteShop theme \<= 4.2.9 - Local File Inclusion vulnerability (CVSS 7.5, kutethemes KuteShop)
- [CVE-2026-39610](https://cve.now/CVE-2026-39610.md): WordPress WpXmas-Snow plugin \<= 1.1 - Broken Access Control vulnerability (CVSS 5.3, Pankaj Kumar WpXmas-Snow)
- [CVE-2026-39609](https://cve.now/CVE-2026-39609.md): WordPress Wava Payment plugin \<= 0.3.7 - Broken Access Control vulnerability (CVSS 5.3, Wava.co Wava Payment)
- [CVE-2026-39608](https://cve.now/CVE-2026-39608.md): WordPress iPOSpays Gateways WC plugin \<= 1.3.7 - Broken Access Control vulnerability (CVSS 5.3, iPOSpays Gateways WC)
- [CVE-2026-39607](https://cve.now/CVE-2026-39607.md): WordPress Filter Plus plugin \<= 1.1.17 - Broken Access Control vulnerability (CVSS 5.4, Wpbens Filter Plus)
- [CVE-2026-39606](https://cve.now/CVE-2026-39606.md): WordPress BizReview plugin \<= 1.5.13 - Broken Access Control vulnerability (CVSS 5.3, Foysal Imran BizReview)
- [CVE-2026-39605](https://cve.now/CVE-2026-39605.md): WordPress Super Custom Login plugin \<= 1.1 - Broken Access Control vulnerability (CVSS 5.3, Obadiah Super Custom Login)
- [CVE-2026-39604](https://cve.now/CVE-2026-39604.md): WordPress MyBookTable Bookstore plugin \<= 3.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, zookatron MyBookTable Bookstore)
- [CVE-2026-39603](https://cve.now/CVE-2026-39603.md): WordPress Grand Photography theme \<= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, ThemeGoods Grand Photography)
- [CVE-2026-39602](https://cve.now/CVE-2026-39602.md): WordPress Order Tracking plugin \<= 3.4.3 - Broken Access Control vulnerability (CVSS 5.3, Rustaurius Order Tracking)
- [CVE-2026-39592](https://cve.now/CVE-2026-39592.md): WordPress DEPART plugin \<= 1.0.7 - Broken Access Control vulnerability (CVSS 4.3, Andy Ha DEPART)
- [CVE-2026-39588](https://cve.now/CVE-2026-39588.md): WordPress NM Gift Registry and Wishlist Lite plugin \<= 5.13 - Broken Access Control vulnerability (CVSS 5.3, nmerii NM Gift Registry and Wishlist Lite)
- [CVE-2026-39586](https://cve.now/CVE-2026-39586.md): WordPress RepairBuddy plugin \<= 4.1132 - Sensitive Data Exposure vulnerability (CVSS 5.3, Ateeq Rafeeq RepairBuddy)
- [CVE-2026-39585](https://cve.now/CVE-2026-39585.md): WordPress Booktics plugin \<= 1.0.16 - Broken Access Control vulnerability (CVSS 5.3, Arraytics Booktics)
- [CVE-2026-39575](https://cve.now/CVE-2026-39575.md): WordPress Custom Query Blocks plugin \<= 5.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ronald Huereca Custom Query Blocks)
- [CVE-2026-39572](https://cve.now/CVE-2026-39572.md): WordPress Bus Ticket Booking with Seat Reservation plugin \< 5.6.5 - Sensitive Data Exposure vulnerability (CVSS 4.3, magepeopleteam Bus Ticket Booking with Seat Reservation)
- [CVE-2026-39571](https://cve.now/CVE-2026-39571.md): WordPress Instantio plugin \<= 3.3.30 - Sensitive Data Exposure vulnerability (CVSS 5.3, Themefic Instantio)
- [CVE-2026-39570](https://cve.now/CVE-2026-39570.md): WordPress 12 Step Meeting List plugin \<= 3.19.9 - Sensitive Data Exposure vulnerability (CVSS 5.3, AA Web Servant 12 Step Meeting List)
- [CVE-2026-39569](https://cve.now/CVE-2026-39569.md): WordPress 12 Step Meeting List plugin \<= 3.19.9 - Broken Access Control vulnerability (CVSS 6.5, AA Web Servant 12 Step Meeting List)
- [CVE-2026-39566](https://cve.now/CVE-2026-39566.md): WordPress DirectoryPress plugin \<= 3.6.26 - Sensitive Data Exposure vulnerability (CVSS 4.3, Designinvento DirectoryPress)
- [CVE-2026-39565](https://cve.now/CVE-2026-39565.md): WordPress WpTravelly plugin \<= 2.1.7 - Broken Access Control vulnerability (CVSS 4.3, magepeopleteam WpTravelly)
- [CVE-2026-39564](https://cve.now/CVE-2026-39564.md): WordPress Sunshine Photo Cart plugin \< 3.6.2 - Sensitive Data Exposure vulnerability (CVSS 5.3, sunshinephotocart Sunshine Photo Cart)
- [CVE-2026-39563](https://cve.now/CVE-2026-39563.md): WordPress Share This Image plugin \<= 2.12 - Broken Access Control vulnerability (CVSS 5.3, ILLID Share This Image)
- [CVE-2026-39562](https://cve.now/CVE-2026-39562.md): WordPress Client Invoicing by Sprout Invoices plugin \<= 20.8.10 - Broken Access Control vulnerability (CVSS 5.3, BoldGrid Client Invoicing by Sprout Invoices)
- [CVE-2026-39561](https://cve.now/CVE-2026-39561.md): WordPress Revive.so plugin \<= 2.0.7 - Broken Access Control vulnerability (CVSS 5.3, WP Chill Revive.so)
- [CVE-2026-39544](https://cve.now/CVE-2026-39544.md): WordPress LabtechCO theme \<= 8.3 - Local File Inclusion vulnerability (CVSS 7.5, themeStek LabtechCO)
- [CVE-2026-39543](https://cve.now/CVE-2026-39543.md): WordPress Tourfic plugin \<= 2.21.4 - Broken Access Control vulnerability (CVSS 5.3, Themefic Tourfic)
- [CVE-2026-39542](https://cve.now/CVE-2026-39542.md): WordPress Doofinder for WooCommerce plugin \<= 2.10.13 - Sensitive Data Exposure vulnerability (CVSS 5.3, Doofinder for WooCommerce)
- [CVE-2026-39541](https://cve.now/CVE-2026-39541.md): WordPress Hydra Booking plugin \<= 1.1.38 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Themefic Hydra Booking)
- [CVE-2026-39538](https://cve.now/CVE-2026-39538.md): WordPress Mikado Core plugin \<= 1.6 - Local File Inclusion vulnerability (CVSS 7.5, Mikado-Themes Mikado Core)
- [CVE-2026-39536](https://cve.now/CVE-2026-39536.md): WordPress RSVP and Event Management plugin \<= 2.7.16 - Sensitive Data Exposure vulnerability (CVSS 5.3, WP Chill RSVP and Event Management)
- [CVE-2026-39535](https://cve.now/CVE-2026-39535.md): WordPress Display Eventbrite Events plugin \<= 6.5.6 - Broken Access Control vulnerability (CVSS 5.3, fullworks Display Eventbrite Events)
- [CVE-2026-39528](https://cve.now/CVE-2026-39528.md): WordPress WP Delicious plugin \<= 1.9.5 - Broken Access Control vulnerability (CVSS 5.3, WP Delicious)
- [CVE-2026-39526](https://cve.now/CVE-2026-39526.md): WordPress WpStream plugin \< 4.11.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, WpStream)
- [CVE-2026-39521](https://cve.now/CVE-2026-39521.md): WordPress Nelio Content plugin \<= 4.3.1 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, Nelio Software Nelio Content)
- [CVE-2026-39520](https://cve.now/CVE-2026-39520.md): WordPress weDocs plugin \<= 2.1.18 - Broken Access Control vulnerability (CVSS 5.3, weDevs weDocs)
- [CVE-2026-39517](https://cve.now/CVE-2026-39517.md): WordPress Blog Filter plugin \<= 1.7.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, A WP Life Blog Filter)
- [CVE-2026-39516](https://cve.now/CVE-2026-39516.md): WordPress Nexter Blocks plugin \<= 4.7.0 - Sensitive Data Exposure vulnerability (CVSS 5.3, POSIMYTH Nexter Blocks)
- [CVE-2026-39510](https://cve.now/CVE-2026-39510.md): WordPress Image Photo Gallery Final Tiles Grid plugin \<= 3.6.11 - Insecure Direct Object References (IDOR) vulnerability (CVSS 2.7, WP Chill Image Photo Gallery Final Tiles Grid)
- [CVE-2026-39509](https://cve.now/CVE-2026-39509.md): WordPress Directorist plugin \<= 8.5.10 - Broken Access Control vulnerability (CVSS 5.3, wpWax Directorist)
- [CVE-2026-39508](https://cve.now/CVE-2026-39508.md): WordPress Advanced Coupons for WooCommerce Coupons plugin \<= 4.7.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Josh Kohlbach Advanced Coupons for WooCommerce Coupons)
- [CVE-2026-39506](https://cve.now/CVE-2026-39506.md): WordPress AI Engine (Pro) plugin \< 3.4.2 - Broken Access Control vulnerability (CVSS 4.3, Jordy Meow AI Engine)
- [CVE-2026-39505](https://cve.now/CVE-2026-39505.md): WordPress Seriously Simple Podcasting plugin \<= 3.14.2 - Broken Access Control vulnerability (CVSS 5.3, Craig Hewitt Seriously Simple Podcasting)
- [CVE-2026-39504](https://cve.now/CVE-2026-39504.md): WordPress InstaWP Connect plugin \<= 0.1.2.5 - Broken Access Control vulnerability (CVSS 5.4, InstaWP Connect)
- [CVE-2026-39501](https://cve.now/CVE-2026-39501.md): WordPress FOX plugin \<= 1.4.5 - Broken Access Control vulnerability (CVSS 5.3, RealMag777 FOX)
- [CVE-2026-39500](https://cve.now/CVE-2026-39500.md): WordPress themesflat-addons-for-elementor plugin \<= 2.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, themesflat-addons-for-elementor)
- [CVE-2026-39497](https://cve.now/CVE-2026-39497.md): WordPress FOX plugin \<= 1.4.5 - SQL Injection vulnerability (CVSS 7.6, RealMag777 FOX)
- [CVE-2026-39496](https://cve.now/CVE-2026-39496.md): WordPress YayMail plugin \<= 4.3.3 - SQL Injection vulnerability (CVSS 7.6, YayCommerce YayMail)
- [CVE-2026-39495](https://cve.now/CVE-2026-39495.md): WordPress Simply Schedule Appointments plugin \<= 1.6.9.27 - SQL Injection vulnerability (CVSS 8.5, NSquared Simply Schedule Appointments)
- [CVE-2026-39488](https://cve.now/CVE-2026-39488.md): WordPress SureCart plugin \<= 4.0.2 - Broken Access Control vulnerability (CVSS 6.5, SureCart)
- [CVE-2026-39487](https://cve.now/CVE-2026-39487.md): WordPress Amelia plugin \<= 2.1.1 - SQL Injection vulnerability (CVSS 7.6, ameliabooking Amelia)
- [CVE-2026-39486](https://cve.now/CVE-2026-39486.md): WordPress Download Monitor plugin \<= 5.1.8 - SQL Injection vulnerability (CVSS 8.5, WP Chill Download Monitor)
- [CVE-2026-39485](https://cve.now/CVE-2026-39485.md): WordPress Youtube Embed Plus plugin \<= 14.2.4 - Broken Access Control vulnerability (CVSS 4.3, embedplus Youtube Embed Plus)
- [CVE-2026-39484](https://cve.now/CVE-2026-39484.md): WordPress Hide My WP Ghost plugin \< 7.0.00 - Open Redirection vulnerability (CVSS 4.7, John Darrel Hide My WP Ghost)
- [CVE-2026-39483](https://cve.now/CVE-2026-39483.md): WordPress VK All in One Expansion Unit plugin \<= 9.113.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Hidekazu Ishikawa VK All in One Expansion Unit)
- [CVE-2026-39482](https://cve.now/CVE-2026-39482.md): WordPress Post Expirator plugin \<= 4.9.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PublishPress Post Expirator)
- [CVE-2026-39479](https://cve.now/CVE-2026-39479.md): WordPress OttoKit plugin \<= 1.1.20 - SQL Injection vulnerability (CVSS 7.6, Brainstorm Force OttoKit)
- [CVE-2026-39477](https://cve.now/CVE-2026-39477.md): WordPress CartFlows plugin \<= 2.2.3 - Broken Access Control vulnerability (CVSS 4.3, Brainstorm Force CartFlows)
- [CVE-2026-39476](https://cve.now/CVE-2026-39476.md): WordPress User Feedback plugin \<= 1.10.1 - Broken Access Control vulnerability (CVSS 4.3, Syed Balkhi User Feedback)
- [CVE-2026-39475](https://cve.now/CVE-2026-39475.md): WordPress User Feedback plugin \<= 1.10.1 - SQL Injection vulnerability (CVSS 7.6, Syed Balkhi User Feedback)
- [CVE-2026-39473](https://cve.now/CVE-2026-39473.md): WordPress Simple History plugin \<= 5.24.0 - Sensitive Data Exposure vulnerability (CVSS 5.3, Pär Thernström Simple History)
- [CVE-2026-39469](https://cve.now/CVE-2026-39469.md): WordPress PageLayer plugin \<= 2.0.8 - Sensitive Data Exposure vulnerability (CVSS 4.3, Softaculous PageLayer)
- [CVE-2026-39466](https://cve.now/CVE-2026-39466.md): WordPress Broken Link Checker plugin \<= 2.4.7 - SQL Injection vulnerability (CVSS 7.6, WPMU DEV - Your All-in-One WordPress Platform Broken Link C…)
- [CVE-2026-39464](https://cve.now/CVE-2026-39464.md): WordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin \<= 6.19.8 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.5, Coming Soon Page, Under Construction & Maintenance Mode by…)
- [CVE-2026-1396](https://cve.now/CVE-2026-1396.md): Magic Conversation For Gravity Forms \<= 3.0.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, magicplugins Magic Conversation For Gravity Forms)
- [CVE-2026-4330](https://cve.now/CVE-2026-4330.md): Blog2Social: Social Media Auto Post & Scheduler \<= 8.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Schedule Modification via 'b2s\_id' Parameter (CVSS 4.3, pr-gateway Blog2Social: Social Media Auto Post & Scheduler)
- [CVE-2026-4654](https://cve.now/CVE-2026-4654.md): Awesome Support \<= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket\_id' Parameter (CVSS 5.3, awesomesupport Awesome Support – WordPress HelpDesk & Suppo…)
- [CVE-2026-4655](https://cve.now/CVE-2026-4655.md): Element Pack Addons for Elementor \<= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget (CVSS 6.4, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2026-4483](https://cve.now/CVE-2026-4483.md): An exposed IOCTL with an insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial x (CVSS 7.0, Moxa MxGeneralIo)
- [CVE-2025-1794](https://cve.now/CVE-2025-1794.md): AM LottiePlayer \<= 3.6.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG (CVSS 5.4, johanaarstein AM LottiePlayer)
- [CVE-2026-3781](https://cve.now/CVE-2026-3781.md): Attendance Manager \<= 0.6.2 - Authenticated (Subscriber+) SQL Injection via 'attmgr\_off' Parameter (CVSS 5.4, tnomi Attendance Manager)
- [CVE-2026-4141](https://cve.now/CVE-2026-4141.md): Quran Translations \<= 1.7 - Cross-Site Request Forgery to Playlist Settings Form (CVSS 4.3, edckwt Quran Translations)
- [CVE-2026-2838](https://cve.now/CVE-2026-2838.md): Whole Enquiry Cart for WooCommerce \<= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'woowhole\_success\_msg' Parameter (CVSS 4.4, idealwebdesignlk Whole Enquiry Cart for WooCommerce)
- [CVE-2026-5506](https://cve.now/CVE-2026-5506.md): Wavr \<= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, lucascaro Wavr)
- [CVE-2026-3618](https://cve.now/CVE-2026-3618.md): Columns by BestWebSoft \<= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'columns' Shortcode 'id' Attribute (CVSS 6.4, bestweblayout Columns by BestWebSoft – Additional Columns P…)
- [CVE-2026-5167](https://cve.now/CVE-2026-5167.md): Masteriyo LMS \<= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint (CVSS 5.3, Masteriyo LMS – Online Course Builder for eLearning, LMS &…)
- [CVE-2026-3477](https://cve.now/CVE-2026-3477.md): PZ Frontend Manager \<= 1.0.6 - Missing Authorization to Arbitrary User Deletion via 'dataType' Parameter (CVSS 5.3, projectzealous01 PZ Frontend Manager)
- [CVE-2026-5508](https://cve.now/CVE-2026-5508.md): WowPress \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, theyeti WowPress)
- [CVE-2026-4808](https://cve.now/CVE-2026-4808.md): Gerador de Certificados – DevApps \<= 1.3.6 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2, tidevapps Gerador de Certificados – DevApps)
- [CVE-2026-3142](https://cve.now/CVE-2026-3142.md): Pinterest Site Verification plugin using Meta Tag \<= 1.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post\_var' (CVSS 6.4, uniquecodergmailcom Pinterest Site Verification plugin usin…)
- [CVE-2026-5169](https://cve.now/CVE-2026-5169.md): Inquiry form to posts or pages \<= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Header Field (CVSS 4.4, udamadu Inquiry form to posts or pages)
- [CVE-2026-3535](https://cve.now/CVE-2026-3535.md): DSGVO Google Web Fonts GDPR \<= 1.1 - Unauthenticated Arbitrary File Upload via 'fonturl' Parameter (CVSS 9.8, mlfactory DSGVO Google Web Fonts GDPR)
- [CVE-2026-3480](https://cve.now/CVE-2026-3480.md): WP Blockade \<= 0.9.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'shortcode' Parameter (CVSS 6.5, burlingtonbytes WP Blockade – Visual Page Builder)
- [CVE-2026-4871](https://cve.now/CVE-2026-4871.md): Sports Club Management \<= 1.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' Attribute (CVSS 6.4, pstruik Sports Club Management)
- [CVE-2026-3594](https://cve.now/CVE-2026-3594.md): Riaxe Product Customizer \<= 2.4 - Unauthenticated Sensitive Information Disclosure via '/orders' REST API Endpoint (CVSS 5.3, imprintnext Riaxe Product Customizer)
- [CVE-2026-4338](https://cve.now/CVE-2026-4338.md): ActivityPub Routing \< 8.0.2 - Unauthenticated Drafts/Scheduled/Pending Posts Disclosure (CVSS 7.5, ActivityPub)
- [CVE-2026-5083](https://cve.now/CVE-2026-5083.md): Ado::Sessions versions through 0.935 for Perl generates insecure session ids (CVSS 5.3, BEROV Ado::Sessions)
- [CVE-2026-5082](https://cve.now/CVE-2026-5082.md): Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id (CVSS 5.3, TOKUHIROM Amon2::Plugin::Web::CSRFDefender)
- [CVE-2026-3311](https://cve.now/CVE-2026-3311.md): The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce \<= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2026-27787](https://cve.now/CVE-2026-27787.md): Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier. (CVSS 5.4, ICZ MATCHA SNS)
- [CVE-2026-33273](https://cve.now/CVE-2026-33273.md): Unrestricted upload of file with dangerous type issue exists in MATCHA INVOICE 2.6.6 and earlier. (CVSS 4.7, ICZ MATCHA INVOICE)
- [CVE-2026-24913](https://cve.now/CVE-2026-24913.md): SQL Injection vulnerability exists in MATCHA INVOICE 2.6.6 and earlier. (CVSS 8.8, ICZ MATCHA INVOICE)
- [CVE-2026-3239](https://cve.now/CVE-2026-3239.md): Strong Testimonials \<= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial\_view Shortcode (CVSS 6.4, wpchill Strong Testimonials)
- [CVE-2026-3600](https://cve.now/CVE-2026-3600.md): Investi \<= 1.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'maximum-num-years' Shortcode Attribute (CVSS 6.4, Investi)
- [CVE-2026-3646](https://cve.now/CVE-2026-3646.md): LTL Freight Quotes – R+L Carriers Edition \<= 3.3.13 - Missing Authorization to Unauthenticated Settings Update (CVSS 5.3, enituretechnology LTL Freight Quotes – R+L Carriers Edition)
- [CVE-2026-4299](https://cve.now/CVE-2026-4299.md): MainWP Child Reports \<= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure via Heartbeat API (CVSS 5.3, MainWP Child Reports)
- [CVE-2026-4785](https://cve.now/CVE-2026-4785.md): LatePoint \<= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, LatePoint – Calendar Booking Plugin for Appointments and Ev…)
- [CVE-2026-4341](https://cve.now/CVE-2026-4341.md): Prime Slider \<= 4.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'follow\_us\_text' Parameter (CVSS 6.4, bdthemes Prime Slider – Addons for Elementor)
- [CVE-2026-3513](https://cve.now/CVE-2026-3513.md): TableOn – WordPress Posts Table Filterable \<= 1.0.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute (CVSS 6.4, realmag777 TableOn – WordPress Posts Table Filterable)
- [CVE-2026-4003](https://cve.now/CVE-2026-4003.md): Users manager – PN \<= 1.1.15 - Unauthenticated Privilege Escalation via Account Takeover via 'userspn\_form\_save' AJAX Action (CVSS 9.8, felixmartinez Users manager – PN)
- [CVE-2026-4333](https://cve.now/CVE-2026-4333.md): LearnPress \<= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute (CVSS 6.4, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2026-2988](https://cve.now/CVE-2026-2988.md): Blubrry PowerPress \<= 11.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via powerpress and podcast Shortcodes (CVSS 6.4, PowerPress Podcasting plugin by Blubrry)
- [CVE-2026-4379](https://cve.now/CVE-2026-4379.md): LightPress Lightbox \<= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group' Shortcode Attribute (CVSS 6.4, firelightwp LightPress Lightbox)
- [CVE-2026-1163](https://cve.now/CVE-2026-1163.md): Insufficient Session Expiration in parisneo/lollms (CVSS 4.1, parisneo/lollms · lollms)
- [CVE-2026-5726](https://cve.now/CVE-2026-5726.md): ASDA-Soft Stack-based Buffer Overflow Vulnerability (CVSS 7.8, DeltaWW ASDA-Soft)
- [CVE-2026-3499](https://cve.now/CVE-2026-3499.md): Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce 13.4.6 - 13.5.2.1 - Cross-Site Request Forgery to Multiple Administrative Actions (CVSS 8.8, jkohlbach Product Feed PRO for WooCommerce by AdTribes – Pr…)
- [CVE-2026-3296](https://cve.now/CVE-2026-3296.md): Everest Forms \<= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata (CVSS 9.8, wpeverest Everest Forms – Contact Form, Payment Form, Quiz,…)
- [CVE-2025-14732](https://cve.now/CVE-2025-14732.md): Elementor Website Builder \<= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API (CVSS 6.4, elemntor Elementor Website Builder – more than just a page…)
- [CVE-2026-32280](https://cve.now/CVE-2026-32280.md): Unexpected work during chain building in crypto/x509 (CVSS 7.5, Go standard library crypto/x509 · stdlib)
- [CVE-2026-32281](https://cve.now/CVE-2026-32281.md): Inefficient policy validation in crypto/x509 (CVSS 7.5, Go standard library crypto/x509 · stdlib)
- [CVE-2026-27140](https://cve.now/CVE-2026-27140.md): Code execution vulnerability in SWIG code generation in cmd/go (CVSS 8.8, Go toolchain cmd/go · toolchain)
- [CVE-2026-32283](https://cve.now/CVE-2026-32283.md): Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls (CVSS 7.5, Go standard library crypto/tls · stdlib)
- [CVE-2026-32288](https://cve.now/CVE-2026-32288.md): Unbounded allocation for old GNU sparse in archive/tar (CVSS 5.5, Go standard library archive/tar · stdlib)
- [CVE-2026-27143](https://cve.now/CVE-2026-27143.md): Missing bound checks can lead to memory corruption in safe Go in cmd/compile (CVSS 9.8, Go toolchain cmd/compile · toolchain)
- [CVE-2026-27144](https://cve.now/CVE-2026-27144.md): Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile (CVSS 7.1, Go toolchain cmd/compile · toolchain)
- [CVE-2026-33810](https://cve.now/CVE-2026-33810.md): Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509 (CVSS 7.5, Go standard library crypto/x509 · stdlib)
- [CVE-2026-32289](https://cve.now/CVE-2026-32289.md): JsBraceDepth Context Tracking Bugs (XSS) in html/template (CVSS 6.1, Go standard library html/template · stdlib)
- [CVE-2026-32282](https://cve.now/CVE-2026-32282.md): TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix (CVSS 6.4, Go standard library internal/syscall/unix · stdlib)
- [CVE-2026-4788](https://cve.now/CVE-2026-4788.md): Multiple Vulnerabilities affect IBM Tivoli Netcool Impact (CVSS 8.4, IBM Tivoli Netcool Impact)
- [CVE-2026-3357](https://cve.now/CVE-2026-3357.md): IBM Langflow Desktop FAISS Vector Store Remote Code Execution via malicious Pickle file (CVSS 8.8, IBM Langflow Desktop)
- [CVE-2026-1346](https://cve.now/CVE-2026-1346.md): Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (CVSS 9.3, IBM Verify Identity Access Container · IBM Security Veri… +2)
- [CVE-2026-1343](https://cve.now/CVE-2026-1343.md): Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (CVSS 7.2, IBM Verify Identity Access Container · IBM Security Veri… +2)
- [CVE-2023-46945](https://cve.now/CVE-2023-46945.md): QD 20230821 is vulnerable to Server-side request forgery (SSRF) via a crafted request (CVSS 9.1)
- [CVE-2025-45057](https://cve.now/CVE-2025-45057.md): D-Link DI-8300 v16.07.26A1 was discovered to contain a buffer overflow via the ip parameter in the ip\_position\_asp function. (CVSS 7.5)
- [CVE-2025-45058](https://cve.now/CVE-2025-45058.md): D-Link DI-8300 v16.07.26A1 was discovered to contain a buffer overflow via the fx parameter in the jingx\_asp function. (CVSS 7.5)
- [CVE-2025-45059](https://cve.now/CVE-2025-45059.md): D-Link DI-8300 v16.07.26A1 was discovered to contain a buffer overflow via the fn parameter in the tgfile\_htm function. (CVSS 7.5)
- [CVE-2025-50644](https://cve.now/CVE-2025-50644.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper validation of user input in the qj.asp endpoint. (CVSS 7.5)
- [CVE-2025-50645](https://cve.now/CVE-2025-50645.md): A vulnerability has been discovered in D-Link DI-8003 16.07.26A1, which can lead to a buffer overflow when the s parameter in the pppoe\_list (CVSS 7.5)
- [CVE-2025-50646](https://cve.now/CVE-2025-50646.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to insufficient input validation on the name parameter in the /qos\_t (CVSS 7.5)
- [CVE-2025-50647](https://cve.now/CVE-2025-50647.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1, specifically in the handling of the wans parameter in the qos.asp endpo (CVSS 7.5)
- [CVE-2025-50648](https://cve.now/CVE-2025-50648.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to inadequate input validation in the /tggl.asp endpoint. (CVSS 7.5)
- [CVE-2025-50649](https://cve.now/CVE-2025-50649.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper input validation in the vlan\_name parameter in the /shut (CVSS 7.5)
- [CVE-2025-50650](https://cve.now/CVE-2025-50650.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to inadequate validation of input size in the routes\_static paramete (CVSS 7.5)
- [CVE-2025-50652](https://cve.now/CVE-2025-50652.md): An issue in D-Link DI-8003 16.07.26A1 related to improper handling of the id parameter in the /saveparm\_usb.asp endpoint. (CVSS 7.5)
- [CVE-2025-50653](https://cve.now/CVE-2025-50653.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name and mem parameters in the /time\_gro (CVSS 7.5)
- [CVE-2025-50654](https://cve.now/CVE-2025-50654.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper validation of the id parameter in the /thd\_member.asp en (CVSS 7.5)
- [CVE-2025-50655](https://cve.now/CVE-2025-50655.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name parameter in the /thd\_group.asp end (CVSS 7.5)
- [CVE-2025-50657](https://cve.now/CVE-2025-50657.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the pid parameter in the /trace.asp endpoint (CVSS 7.5)
- [CVE-2025-50659](https://cve.now/CVE-2025-50659.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the custom\_error parameter in the /user.asp (CVSS 7.5)
- [CVE-2025-50660](https://cve.now/CVE-2025-50660.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name parameter in the /url\_member.asp en (CVSS 7.5)
- [CVE-2025-50661](https://cve.now/CVE-2025-50661.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of multiple parameters in the /url\_rule.asp end (CVSS 7.5)
- [CVE-2025-50662](https://cve.now/CVE-2025-50662.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name parameter in the /url\_group.asp end (CVSS 7.5)
- [CVE-2025-50663](https://cve.now/CVE-2025-50663.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name parameter in the /usb\_paswd.asp end (CVSS 7.5)
- [CVE-2025-50664](https://cve.now/CVE-2025-50664.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /user\_group.asp endpoint. (CVSS 7.5)
- [CVE-2025-50665](https://cve.now/CVE-2025-50665.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of input parameters in the /web\_keyword.asp end (CVSS 7.5)
- [CVE-2025-50666](https://cve.now/CVE-2025-50666.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of multiple parameters in the /web\_post.asp end (CVSS 7.5)
- [CVE-2025-50667](https://cve.now/CVE-2025-50667.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the iface parameter in the /wan\_line\_detecti (CVSS 7.5)
- [CVE-2025-50668](https://cve.now/CVE-2025-50668.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the s parameter in the /web\_list\_opt.asp end (CVSS 7.5)
- [CVE-2025-50669](https://cve.now/CVE-2025-50669.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 and DI-8003G 19.12.10A1 due to improper handling of the wan\_ping paramet (CVSS 7.5)
- [CVE-2025-50670](https://cve.now/CVE-2025-50670.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /xwgl\_bwr.asp endpoint. (CVSS 7.5)
- [CVE-2025-50671](https://cve.now/CVE-2025-50671.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /xwgl\_ref.asp endpoint. (CVSS 7.5)
- [CVE-2025-50672](https://cve.now/CVE-2025-50672.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /yyxz\_dlink.asp endpoint. (CVSS 7.5)
- [CVE-2025-50673](https://cve.now/CVE-2025-50673.md): A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the http\_lanport parameter in the /webgl.asp (CVSS 7.5)
- [CVE-2025-52221](https://cve.now/CVE-2025-52221.md): Tenda AC6 15.03.05.16\_multi is vulnerable to Buffer Overflow in the formSetCfm function via the funcname, funcpara1, and funcpara2 parameter (CVSS 7.5)
- [CVE-2025-52222](https://cve.now/CVE-2025-52222.md): D-Link DI-8003 v16.07.26A1, DI-8500 v16.07.26A1; DI-8003G v17.12.21A1, DI-8200G v17.12.20A1, DI-8200 v16.07.26A1, DI-8400 v16.07.26A1, DI-80 (CVSS 7.5)
- [CVE-2025-57175](https://cve.now/CVE-2025-57175.md): Siklu EtherHaul 8010 siklu-uimage-nxp-enc-10\_6\_2-18707-ea552dc00b devices have a static root password. (CVSS 6.4, Siklu EtherHaul)
- [CVE-2026-30075](https://cve.now/CVE-2026-30075.md): OpenAirInterface Version 2.2.0 has a Buffer Overflow vulnerability in processing UplinkNASTransport containing Authentication Response conta (CVSS 7.5)
- [CVE-2026-30080](https://cve.now/CVE-2026-30080.md): OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection. (CVSS 7.5)
- [CVE-2026-31017](https://cve.now/CVE-2026-31017.md): A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, (CVSS 9.1)
- [CVE-2026-31040](https://cve.now/CVE-2026-31040.md): A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lead t (CVSS 9.8, stata-mcp)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.