CVEs published May 20, 2026
201 CVEs were published on May 20, 2026: 21 critical, 70 high. 3 are now in CISA KEV.
- Published
- 201
- Critical
- 21
- High
- 70
- Medium
- 104
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 3
- Fix available
- 123
Most affected products
- Google Chrome
- 16
- NLnet Labs Unbound
- 11
- openises tickets
- 10
- NVIDIA Triton Inference Server
- 8
- ISC BIND
- 6
- RsyncProject rsync
- 6
- NVIDIA TensorRT-LLM
- 4
- Progress Software MOVEit Automation
- 4
- misp
- 3
- phenixdigital phoenix_storybook
- 3
Critical 21
- CVE-2026-47372Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for saltsRRWO Crypt::SaltedHash
- CVE-2026-8631HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code ExecutionHP Linux Imaging and Printing Software
- CVE-2026-9141Taiko AG1000-01A Rev 7.3/8 Authentication Bypass via Web InterfaceTaiko Network Communications Pte AG1000-01A SMS Alert Gatew…
- CVE-2026-9139Taiko AG1000-01A Rev 7.3/8 Hard-coded Credentials via login.zhtmlTaiko Network Communications Pte AG1000-01A SMS Alert Gatew…
- CVE-2026-39405Frappe has Path Transversal via SCORMfrappe lms
- CVE-2026-33137XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}xwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…
- CVE-2026-23734XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slashxwiki-commons · org.xwiki.commons:xwiki-commons-classloader…
- CVE-2026-9082Drupal core - Highly critical - SQL injection - SA-CORE-2026-004Drupal core · drupal +1
- CVE-2026-9129Path Traversal in Altium Enterprise Server Viewer StorageController Allows Arbitrary File ReadAltium Enterprise Server
- CVE-2026-45444WordPress Gift Cards For WooCommerce Pro plugin <= 4.2.6 - Arbitrary File Upload vulnerabilityWP Swings Gift Cards For WooCommerce Pro
- CVE-2026-9102Path Traversal in Altium Enterprise Server ComparisonService Allows Arbitrary File WriteAltium Enterprise Server
- CVE-2026-20223Cisco Secure Workload Unauthorized API Access VulnerabilityCisco Secure Workload
- CVE-2026-8598Unauthenticated Export Service in ZKTeco CCTV CamerasZKTeco SSC335-GC2063-Face-0b77 Solution Camera
- CVE-2026-8467Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playgroundphenixdigital phoenix_storybook
- CVE-2026-33278Possible arbitrary code execution during DNSSEC validationNLnet Labs Unbound
- CVE-2026-9065Surecart - SQL Injectionbrainstormforce Surecart
- CVE-2026-9059NextGEN Gallery - SQL Injectionawesomemotive NextGEN Gallery
- CVE-2026-24207NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass.NVIDIA Triton Inference Server
- CVE-2026-7637Boost <= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_LOCATION CookiePixelYourSite Boost
- CVE-2026-7284Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_registerthemewant Easy Elements for Elementor – Addons & Website Te…
- CVE-2026-6555ProSolution WP Client <= 2.0.0 - Unauthenticated Arbitrary File Upload via 'files'ProSolution WP Client
High 70
- CVE-2026-40165authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncationgoauthentik authentik
- CVE-2026-40092nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHTnimiq core-rs-albatross · nimiq-keys
- CVE-2026-47373Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacksRRWO Crypt::SaltedHash
- CVE-2026-8632HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code ExecutionHP Linux Imaging and Printing Software
- CVE-2026-9144Taiko AG1000-01A Rev 7.3/8 Stored XSS via Web Configuration InterfaceTaiko Network Communications Pte AG1000-01A SMS Alert Gatew…
- CVE-2026-39850Yii 2: Local file inclusion via view parameter name collisionyiisoft yii2 · yiisoft/yii2
- CVE-2026-9133Arbitrary file read in rabbitmq-aws pluginRabbitMQ AWS
- CVE-2026-39352Frappe has an Arbitrary File Read via Path Traversal in render_includefrappe
- CVE-2026-9123Heap buffer overflow in Chromecast in Google Chrome on Android, Linux, ChromeOS prior to 148.0.7778.179 allowed a local attacker to execute Google Chrome
- CVE-2026-9121Out of bounds read in GPU in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2026-9126Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via aGoogle Chrome
- CVE-2026-9120Use after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML pagGoogle Chrome
- CVE-2026-9119Heap buffer overflow in WebRTC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandGoogle Chrome
- CVE-2026-9118Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HGoogle Chrome
- CVE-2026-9117Type Confusion in GFX in Google Chrome on Linux, ChromeOS prior to 148.0.7778.179 allowed a remote attacker who had compromised the rendererGoogle Chrome
- CVE-2026-9114Use after free in QUIC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via Google Chrome
- CVE-2026-9112Use after free in GPU in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbGoogle Chrome
- CVE-2026-9111Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a craftedGoogle Chrome
- CVE-2026-39310Trilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) BuildsTriliumNext Trilium
- CVE-2026-9136Unauthorized ShadowAttribute modification in MISP via client-supplied identifiermisp
- CVE-2026-24217NVIDIA BioNeMo Core for Linux contains a vulnerability where a user could cause a path traversal by loading a malicious file.NVIDIA BioNeMo Framework
- CVE-2026-24216NVIDIA BioNemo for Linux contains a vulnerability where a user could cause a deserialization of untrusted data.NVIDIA BioNeMo Framework
- CVE-2026-24218NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes identical SSH host keyNVIDIA DGX Spark
- CVE-2026-24188NVIDIA TensorRT contains a vulnerability where an attacker could cause an out-of-bounds write.NVIDIA TensorRT
- CVE-2026-20239Sensitive Information Disclosure through Log Files in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2026-20240Denial of Service through coldToFrozen.sh Script in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2026-7613Cost of Goods by PixelYourSite <= 1.2.12 - Unauthenticated Stored Cross-Site Scripting via Cost of Goods ImportCost of Goods by PixelYourSite
- CVE-2025-32750Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability.Dell PowerFlex Manager
- CVE-2026-5783Reflected XSS in Beyaz Computer's CityPLusBeyaz Computer Software Design Industry and Trade Ltd. City…
- CVE-2026-22554A heap-based buffer overflow vulnerability exists in the Channel Splitting functionality of MediaInfoLib (version(s): 26.01).MediaArea MediaInfoLib
- CVE-2026-24425Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterfacetwigphp Twig · twig/twig
- CVE-2026-8469Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybookphenixdigital phoenix_storybook
- CVE-2026-5947SIG(0) validation during query flood may lead to undefined behaviorISC BIND
- CVE-2026-5946Invalid handling of CLASS != INISC BIND
- CVE-2026-3593Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementationISC BIND
- CVE-2026-42834Windows Admin Center in Azure Portal Elevation of Privilege VulnerabilityMicrosoft Windows Admin Center in Azure Portal
- CVE-2026-45584Microsoft Defender Remote Code Execution VulnerabilityMicrosoft Malware Protection Engine
- CVE-2026-41091Microsoft Defender Elevation of Privilege VulnerabilityMicrosoft Malware Protection Engine
- CVE-2026-3039BIND 9 server memory exhaustion during GSS-API TKEY negotiationISC BIND
- CVE-2026-42383WordPress YITH WooCommerce Product Add-Ons plugin <= 4.29.0 - SQL Injection vulnerabilityYITH WooCommerce Product Add-Ons
- CVE-2026-29518Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File WriteRsyncProject rsync
- CVE-2025-11954CSRF in Sitemio's WISECPSitemio Information Technologies Trade Ltd. WISECP
- CVE-2026-0856Improper Access Control vulnerability in Mesalvo MEONA (MEONA Client and MEONA Server) allows an authenticated MEONA user to access administMesalvo Meona Client · Mesalvo Meona Server
- CVE-2026-42959Crash during DNSSEC validation of malicious contentNLnet Labs Unbound
- CVE-2026-42944Heap overflow with multiple NSID, COOKIE, PADDING EDNS optionsNLnet Labs Unbound
- CVE-2026-9064389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)389-ds-base · Red Hat Directory Server 11.5 E4S for RHEL +6
- CVE-2026-41054Missing exit out of permission check in haveged could lead to root exploitContainer suse/sle-micro-rancher/5.3:latest · Container… +30
- CVE-2026-44933Path Traversal in Plugin Loading in libzyppSUSE Linux Enterprise · openSUSE
- CVE-2026-5200AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'acyba AcyMailing – An Ultimate Newsletter Plugin and Market…
- CVE-2026-47784In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by saslmemcached
- CVE-2026-47783In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon amemcached
- CVE-2026-9057Security fix for Qlik Talend Administration Center URL access control vulnerabilityTalend Administration Center
- CVE-2026-7522Advanced Database Cleaner – Premium <= 4.1.0 - Authenticated (Subscriber+) Local File Inclusion via 'template'SigmaPlugin Advanced Database Cleaner – Premium
- CVE-2026-24163NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could cause an unsafe deserialization.NVIDIA TensorRT-LLM
- CVE-2025-33255NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an attacker could cause an unsafe deserialization.NVIDIA TensorRT-LLM
- CVE-2026-24214NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an integer overflow.NVIDIA Triton Inference Server
- CVE-2026-24213NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an out-of-bounds read.NVIDIA Triton Inference Server
- CVE-2026-24210NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an integer overflow.NVIDIA Triton Inference Server
- CVE-2026-24209NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue.NVIDIA Triton Inference Server
- CVE-2026-9003TONNET｜E-LAN Hybrid Recording System - SQL InjectionTONNET TPR7308
- CVE-2026-24206NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass.NVIDIA Triton Inference Server
- CVE-2026-9010Boost <= 2.0.3 - Unauthenticated Blind SQL Injection via Multiple ParametersPixelYourSite Boost
- CVE-2026-7460mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescapedmailcow-dockerized
- CVE-2026-7467Read More & Accordion <= 3.5.7 - Privilege Escalation via importDataedmonparker Read More & Accordion
- CVE-2026-6456Account Switcher <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalationbeycanpress Account Switcher
- CVE-2026-3985Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Unauthenticated SQL Injection via 'checkout_uuid' Parameterconstantcontact Creative Mail – Easier WordPress & WooComme…
- CVE-2026-43619Rsync < 3.4.3 Symlink Race Condition via Path-Based SyscallsRsyncProject rsync
- CVE-2026-39047Buffer Overflow vulnerability in EPSON L14150 FL27PB allows a remote attacker to execute arbitrary code via the RAW Printing Service (JetDir
- CVE-2026-44925Cross-Site Request Forgery (CSRF) vulnerability in InfoScale v.9.1.3 Operations Manager (VIOM) allows an attacker to force the user with an
- CVE-2026-44926InfoScale CmdServer before 7.4.2 mishandles access control.
Medium, low and unrated 110
- CVE-2026-9149Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv fileRed Hat Enterprise Linux · Red Hat Hardened Images +3
- CVE-2026-9150Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksumsRed Hat Enterprise Linux · Red Hat Hardened Images +3
- CVE-2026-47782Android App "RoboForm Password Manager" provided by Siber Systems, Inc.Siber Systems Android App "RoboForm Password Manager"
- CVE-2026-40102Plane: ORM Field Reference Injection via `segment` Parameter in Saved Analyticsmakeplane plane
- CVE-2026-40094nimiq-blockchain: network-libp2p untrusted peer can crash address book via empty peer contact addressesnimiq core-rs-albatross
- CVE-2026-39960MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Valuesmantisbt · mantisbt/mantisbt
- CVE-2026-35016Open ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query Parameteropenises tickets
- CVE-2026-35015Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameteropenises tickets
- CVE-2026-35014Open ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id Parameteropenises tickets
- CVE-2026-35013Open ISES Tickets < 3.44.2 Reflected XSS via street_view.php thelat and thelng Parametersopenises tickets
- CVE-2026-35012Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameteropenises tickets
- CVE-2026-35011Open ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call Parameteropenises tickets
- CVE-2026-35010Open ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id Parameteropenises tickets
- CVE-2026-35009Open ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameteropenises tickets
- CVE-2026-35008Open ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameteropenises tickets
- CVE-2026-35007Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameteropenises tickets
- CVE-2026-39311Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG AttachmentsTriliumNext Trilium
- CVE-2026-9124Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromiseGoogle Chrome
- CVE-2026-9122Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to obtain potentially sensitive informatGoogle Chrome
- CVE-2026-9116Insufficient policy enforcement in ServiceWorker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to leak cross-origin Google Chrome
- CVE-2026-9115Insufficient policy enforcement in Service Worker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to bypass same origiGoogle Chrome
- CVE-2026-9113Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to perform an out of bounds memory read Google Chrome
- CVE-2026-9110Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who had compromised the renGoogle Chrome
- CVE-2026-26028CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSScryptpad
- CVE-2026-9137CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limitmisp
- CVE-2026-47099TeleJSON < 6.0.0 DOM-based XSS via parse() Functionstorybookjs telejson · telejson
- CVE-2026-2813Unvalidated Redirect in ArcGIS ServerEsri ArcGIS Server
- CVE-2026-2812Improper Authentication issue in ArcGIS ServerEsri ArcGIS Server
- CVE-2026-20238Improper Access Control through Role Inheritance in Splunk AI Toolkit appSplunk AI Toolkit
- CVE-2026-9101Prototype pollution in csv parsingMongoDB Compass
- CVE-2026-20199A vulnerability in the SSL certificate handling of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to exeCisco ThousandEyes Enterprise Agent
- CVE-2026-9087Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-loginRed Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-20171Cisco Nexus 3000 and 9000 Series Border Gateway Protocol Denial of Service VulnerabilityCisco NX-OS Software
- CVE-2026-20206Cisco ThousandEyes BrowserBot Command Injection VulnerabilityCisco ThousandEyes Enterprise Agent
- CVE-2026-9100Heap memory out of bounds read and crash in C Driver legacy GridFS file readerMongoDB C Driver
- CVE-2026-4293Kieback & Peter DDC Building Controllers Cross-site ScriptingKieback & Peter DDC4002 · Kieback & Peter DDC4100 +9
- CVE-2026-9084MISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurationsmisp
- CVE-2026-8488Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit AutomationProgress Software MOVEit Automation
- CVE-2023-7346Ledger Bitcoin App 2.1.0 Address Derivation Error via MiniscriptLedger Bitcoin app
- CVE-2026-8487Incorrect default permissions vulnerability in Progress Software MOVEit AutomationProgress Software MOVEit Automation
- CVE-2026-8486Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit AutomationProgress Software MOVEit Automation
- CVE-2026-8485Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit AutomationProgress Software MOVEit Automation
- CVE-2026-21836HCL DominoIQ is affected by broken access controlHCLSoftware DominoIQ
- CVE-2026-47068Cross-session PubSub topic injection via URL parameter in phoenix_storybookphenixdigital phoenix_storybook
- CVE-2026-5950Unbounded resend loop in BIND 9 resolverISC BIND
- CVE-2026-3592Amplification vulnerabilities via self-pointed glue recordsISC BIND
- CVE-2026-45498Microsoft Defender Denial of Service VulnerabilityMicrosoft Defender Antimalware Platform
- CVE-2026-24573WordPress Visualizer plugin < 4.0.0 - Cross Site Scripting (XSS) vulnerabilityThemeisle Visualizer
- CVE-2026-27405WordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerabilityMagepeople WpBookingly
- CVE-2026-27424WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Broken Access Control vulnerabilityWP Chill Image Photo Gallery Final Tiles Grid
- CVE-2026-45443WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 5.5.1 - Broken Access Control vulnerabilityADD-ONS.ORG PDF for Elementor Forms + Drag And Drop Templat…
- CVE-2025-31985HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” headerHCL BigFix Service Management
- CVE-2025-31973HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'HCL BigFix Service Management
- CVE-2026-25602Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA (MEONA Client and MEONA Server).Mesalvo Meona Server · Mesalvo Meona Client
- CVE-2026-0857Use of a Password Hash With Insufficient Computational Effort in Mesalvo MEONA (MEONA Server and MEONA Client) for user accounts whose passwMesalvo Meona Client · Mesalvo Meona Server
- CVE-2026-6728Slider Revolution <= 7.0.9 - Unauthenticated Sensitive Information Exposure via 'sliders/stream'Revolution Slider Slider Revolution
- CVE-2026-35070Dell SmartFabric Storage Software, versions prior to 1.4.5, contains an Improper Neutralization of Special Elements used in a Command ('CommDell SmartFabric Storage Software
- CVE-2026-44608Use after free and crash under special conditions in RPZ codeNLnet Labs Unbound
- CVE-2026-44390Unbounded name compression in certain cases causes degradation of serviceNLnet Labs Unbound
- CVE-2026-42960Possible cache poisoning via promiscuous records for the authority sectionNLnet Labs Unbound
- CVE-2026-42923Degradation of service with unbounded NSEC3 hash calculationsNLnet Labs Unbound
- CVE-2026-42534Jostle logic bypass degrades resolution performanceNLnet Labs Unbound
- CVE-2026-41292Long list of incoming EDNS options degrades performanceNLnet Labs Unbound
- CVE-2026-40622Another 'ghost domain names' attack variantNLnet Labs Unbound
- CVE-2026-32792Packet of death with DNSCryptNLnet Labs Unbound
- CVE-2026-6405Anomify AI <= 0.3.6 - Cross-Site Request Forgerysimonholliday Anomify AI – Anomaly Detection and Alerting
- CVE-2026-7385Decent Comments < 3.0.2 - Unauthenticated Email Address DisclosureDecent Comments
- CVE-2026-5776Email Encoder < 2.4.7 - Unauthenticated Stored XSSEmail Encoder
- CVE-2026-2955AI Chatbot & Workflow Automation by AIWU <= 1.4.14 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For' Headerwupsales AI Chatbot & Workflow Automation by AIWU
- CVE-2026-6566Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST APIsmub Photo Gallery, Sliders, Proofing and Themes – NextGEN…
- CVE-2026-44392Missing authorization vulnerability exists in Movable Type.Six Apart Movable Type
- CVE-2026-9056Security fix for Qlik Talend Administration Center cross-site scripting vulnerabilityTalend Administration Center
- CVE-2026-5075All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Datasmub All in One SEO – Powerful SEO Plugin to Boost SEO Rank…
- CVE-2026-24160NVIDIA TRT-LLM for any platform contains a vulnerability where an attacker could cause an unchecked return value to a null pointer derefereNVIDIA TensorRT-LLM
- CVE-2026-24142NVIDIA TRT-LLM for any platform contains a deserialization vulnerability and unsafe serialized handle.NVIDIA TensorRT-LLM
- CVE-2026-24215NVIDIA Triton Inference Server contains a vulnerability in the DALI backend, where an attacker could cause uncontrolled resource consumptionNVIDIA Triton Inference Server
- CVE-2026-24208NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue.NVIDIA Triton Inference Server
- CVE-2025-15369Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template CreationXpro Addons — 140+ Widgets for Elementor
- CVE-2026-6549Logo Manager For Enamad <= 0.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attributegoback2 Logo Manager For Enamad
- CVE-2026-8038Faces of Users <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attributemcinvale Faces of Users
- CVE-2026-6395Word 2 Cash <= 0.9.2 - Cross-Site Request Forgeryto Stored Cross-Site Scripting via Settings Pagewinking Word 2 Cash
- CVE-2026-6400Child Height Predictor by Ostheimer <= 1.3 - Cross-Site Request Forgery to Settings Update via Plugin Settings Formhelpstring Child Height Predictor by Ostheimer
- CVE-2026-6401Bottom Bar <= 0.1.7 - Cross-Site Request Forgery to Settings Updatesvil4ok Bottom Bar
- CVE-2026-6399General Options <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ad_contact_number' Parameteryog2515 General Options
- CVE-2026-7472Read More & Accordion <= 3.5.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameteredmonparker Read More & Accordion
- CVE-2026-6072Oliver POS <= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Headeroliverpos Oliver POS – A WooCommerce Point of Sale
- CVE-2026-8419Amazon Scraper <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Updatesubmone Amazon Scraper
- CVE-2026-8424Remove Yellow BGBOX <= 1.0 - Cross-Site Request Forgeryjay_patel Remove Yellow BGBOX
- CVE-2026-5293診断ジェネレータ作成プラグイン <= 1.4.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'js' Parameterolivesystem 診断ジェネレータ作成プラグイン
- CVE-2026-6394Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameterwpdive Nexa Blocks – Gutenberg Blocks, Page Builder for Gut…
- CVE-2026-6391Sentence To SEO (keywords, description and tags) <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page Parameterseazyserver Sentence To SEO
- CVE-2026-8420BLOGCHAT Chat System <= 1.3.6.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Updaterdbeach BLOGCHAT Chat System
- CVE-2026-7462VatanSMS WP SMS <= 1.01 - Reflected Cross-Site Scripting via 'page' Parametervatanyazilim VatanSMS WP SMS
- CVE-2026-8610TypeSquare Webfonts for ConoHa <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via 'fontThemeUseType' ParameterTypeSquare Webfonts for ConoHa
- CVE-2026-8626SponsorMe <= 0.5.2 - Reflected Cross-Site Scripting via PHP_SELF Parameterowencutajar SponsorMe
- CVE-2026-8423JaviBola Custom Theme Test <= 2.0.5 - Cross-Site Request ForgeryJaviBola Custom Theme Test
- CVE-2026-6452Bigfishgames Syndicate <= 1.2 - Cross-Site Request Forgery to Settings Reset and Updatektulhu Bigfishgames Syndicate
- CVE-2026-8627Correct Prices <= 1.0 - Reflected Cross-Site Scripting via PHP_SELF Parameterlykich Correct Prices
- CVE-2026-6404Anomify AI <= 0.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'anomify_api_key' Parametersimonholliday Anomify AI – Anomaly Detection and Alerting
- CVE-2026-8685Infility Global <= 2.15.16 - Authenticated (Subscriber+) SQL Injection via 'orderby' ParameterInfility Global
- CVE-2026-6397Sticky <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'readmoretext' Shortcode Attributecvmh Sticky
- CVE-2026-8624LJ comments import: reloaded <= 0.97.1 - Reflected Cross-Site Scripting via PHP_SELF Parameteretspring LJ comments import: reloaded
- CVE-2026-8418Games Catalog <= 1.2.0 - Cross-Site Request Forgery to Arbitrary Game/Post Deletionaskywhale Games Catalog
- CVE-2026-43617Rsync < 3.4.3 Authorization Bypass via Hostname ResolutionRsyncProject rsync
- CVE-2026-43618Rsync < 3.4.3 Integer Overflow Information DisclosureRsyncProject rsync
- CVE-2026-43620Rsync < 3.4.3 Out-of-Bounds Array Read via recv_files()RsyncProject rsync
- CVE-2026-45232Rsync < 3.4.3 Off-by-One Stack Write via HTTP ProxyRsyncProject rsync
- CVE-2026-30691Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a @cyntler/react-doc-viewer
- CVE-2026-44923SQL injection in InfoScale VIOM before v9.1.3 allows remote attackers to escalate privileges.
- CVE-2026-44924InfoScale VIOM 9.1.3 allows XSS.