CVEs published June 15, 2026
399 CVEs were published on June 15, 2026: 80 critical, 189 high. 1 is now in CISA KEV.
- Published
- 399
- Critical
- 80
- High
- 189
- Medium
- 129
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 63
Most affected products
- Red Hat Enterprise Linux
- 8
- Wertheim SafeController Software for VAULT ROOMS
- 8
- The Document Foundation LibreOffice
- 7
- Yealink SIP-T46U
- 6
- Canon EOS Network Setting Tool for Windows · Canon EOS Netw…
- 5
- Wasiliy Strecker Contest Gallery
- 4
- Discuz! X5.0
- 3
- dwbooster Booking Calendar Contact Form
- 3
- elixir-grpc grpc · grpc
- 3
- EventPrime
- 3
Critical 80
- CVE-2026-12205Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recoveryTIMLEGGE Crypt::DSA
- CVE-2026-48853Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpcelixir-grpc grpc · grpc
- CVE-2026-11832Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonceBIAFRA Dancer2::Plugin::Auth::OAuth
- CVE-2026-12087Socket versions before 2.041 for Perl have an out-of-bounds heap readPEVANS Socket
- CVE-2026-48714i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting namesi18next-http-middleware
- CVE-2026-48713i18next-fs-backend: Prototype pollution via crafted missing-key stringi18next-fs-backend
- CVE-2026-52703WordPress FastDup plugin <= 2.7.2 - Path Traversal vulnerabilityNinja Team FastDup
- CVE-2026-52693WordPress eCommerce Product Catalog plugin <= 3.5.5 - SQL Injection vulnerabilityimpleCode eCommerce Product Catalog
- CVE-2026-49781WordPress OttoKit plugin <= 1.1.27 - PHP Object Injection vulnerabilityBrainstorm Force OttoKit
- CVE-2026-49776WordPress GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin <= 2.32.6 - SQL Injection vulnerabilityJExtensions Store GPTranslate – Multilingual AI Translation…
- CVE-2026-49770WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerabilityWP Travel Engine
- CVE-2026-49769WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerabilityTomdever wpForo Forum
- CVE-2026-49768WordPress Happyforms plugin <= 1.26.13 - PHP Object Injection vulnerabilityHappyforms
- CVE-2026-49766WordPress WP User Manager plugin <= 2.9.16 - Arbitrary File Deletion vulnerabilityWP User Manager
- CVE-2026-49765WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.8 - PHP Object Injection vulnerabilityCRM Perks Integration for Mailchimp and Contact Form 7, WPF…
- CVE-2026-49764WordPress RegistrationMagic plugin <= 6.0.8.6 - Broken Authentication vulnerabilityMetagauss RegistrationMagic
- CVE-2026-49763WordPress Integration for Contact Form 7 HubSpot plugin <= 1.3.7 - PHP Object Injection vulnerabilityCRM Perks Integration for Contact Form 7 HubSpot
- CVE-2026-49109WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.3 - PHP Object Injection vulnerabilitycrm perks Integration for Salesforce and Contact Form 7, WP…
- CVE-2026-49106WordPress Integration for Contact Form 7 and Constant Contact plugin <= 1.1.6 - PHP Object Injection vulnerabilityCRM Perks Integration for Contact Form 7 and Constant Conta…
- CVE-2026-49105WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerabilityCRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor…
- CVE-2026-49104WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerabilityCRM Perks Integration for Keap/infusionsoft and Contact For…
- CVE-2026-49085WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerabilityCRM Perks WP Insightly for Contact Form 7, WPForms, Element…
- CVE-2026-49067WordPress Advanced 301 and 302 Redirect plugin <= 1.6.9 - SQL Injection vulnerabilityyydevelopment Advanced 301 and 302 Redirect
- CVE-2026-48886WordPress JS Help Desk plugin <= 3.0.9 - SQL Injection vulnerabilityAhmad JS Help Desk
- CVE-2026-48881WordPress TrueBooker plugin <= 1.1.9 - Broken Access Control vulnerabilitythemetechmount TrueBooker
- CVE-2026-48836WordPress Easy Invoice plugin <= 2.1.19 - Remote Code Execution (RCE) vulnerabilityMantraBrain Easy Invoice
- CVE-2026-45439WordPress Realtyna Organic IDX plugin plugin <= 5.1.0 - SQL Injection vulnerabilityRealtyna Organic IDX plugin
- CVE-2026-42665WordPress WP Data Access plugin <= 5.5.70 - SQL Injection vulnerabilityPassionate Programmer Peter WP Data Access
- CVE-2026-42639WordPress GD Rating System plugin <= 3.6.2 - SQL Injection vulnerabilityDev4Press GD Rating System
- CVE-2026-42386WordPress Order Delivery Date for WooCommerce plugin <= 4.5.1 - SQL Injection vulnerabilitytychesoftwares Order Delivery Date for WooCommerce
- CVE-2026-42381WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.1 - SQL Injection vulnerabilityFunnel Builder by FunnelKit
- CVE-2026-40798WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerabilityTomdever wpForo Forum
- CVE-2026-40772WordPress GeekyBot plugin <= 1.2.2 - Arbitrary File Upload vulnerabilityAhmad GeekyBot
- CVE-2026-40771WordPress Contest Gallery plugin <= 28.1.6 - SQL Injection vulnerabilityWasiliy Strecker Contest Gallery
- CVE-2026-39591WordPress WP-BusinessDirectory plugin <= 4.0.0 - Arbitrary File Upload vulnerabilityCMSJunkie – WordPress Business Directory Plugins WP-Busines…
- CVE-2026-39583WordPress Datalogics Ecommerce Delivery plugin <= 2.6.62 - Privilege Escalation vulnerabilityDatalogics Ecommerce Delivery
- CVE-2026-39530WordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerabilitySpeakOut! Email Petitions
- CVE-2026-39519WordPress GeekyBot plugin <= 1.2.0 - SQL Injection vulnerabilityAhmad GeekyBot
- CVE-2026-39512WordPress GeoDirectory plugin <= 2.8.152 - SQL Injection vulnerabilityPaolo GeoDirectory
- CVE-2026-39511WordPress WP Photo Album Plus plugin <= 9.1.08.001 - SQL Injection vulnerabilityJacob N. Breetvelt WP Photo Album Plus
- CVE-2026-39502WordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerabilityForm Maker by 10Web
- CVE-2026-39493WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerabilityNSquared Simply Schedule Appointments
- CVE-2026-39492WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerabilityFlipper Code – WordPress Development Company WP Maps
- CVE-2026-39465WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - Remote Code Execution (RCE) vulnerabilityResponsive Slider by MetaSlider
- CVE-2026-39441WordPress Feed KuantoKusta for WooCommerce – Free plugin <= 5.3 - SQL Injection vulnerabilityNaked Cat Plugins (by Webdados) Feed KuantoKusta for WooCom…
- CVE-2026-34901WordPress iControlWP plugin <= 5.5.3 - Privilege Escalation vulnerabilityPaul iControlWP
- CVE-2026-27053WordPress Broadcast Live Video plugin < 7.1.3 - PHP Object Injection vulnerabilityVideoWhisper.com Broadcast Live Video
- CVE-2026-9691WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerabilityCRM Perks Integration for ActiveCampaign and Contact Form 7…
- CVE-2026-48114Metacat has an unauthenticated SQL injection vulnerabilityNCEAS metacat
- CVE-2026-49952Discuz! X5.0 Authentication Bypass via dbbak.php Encryption OracleDiscuz! X5.0
- CVE-2026-9862Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerabilityFortra Core Privileged Access Manager
- CVE-2026-52704WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Remote Code Execution (RCE) vulnerabilityEdgar Rojas WooCommerce PDF Invoice Builder
- CVE-2018-25436WordPress Plugin Baggage Freight Shipping Australia 0.1.0 Arbitrary File UploadShipster Baggage Freight Shipping Australia
- CVE-2026-5482Remote Code Execution via Unrestricted File Upload in Responsive FileManagerTecrail Responsive FileManager
- CVE-2026-49757OAuth2/OIDC account takeover in AshAuthentication via email-based user matchingteam-alembic ash_authentication
- CVE-2026-8935Advanced Google Maps < 6.1.1 - Unauthenticated Administrator Account CreationWP MAPS PRO
- CVE-2026-30120remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability.remotion
- CVE-2026-30121remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability.remotion
- CVE-2026-36537ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange.
- CVE-2026-38060Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_unlock_sim via the pin parameter.
- CVE-2026-38061Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_volume via the volume parameter.
- CVE-2026-38062Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_rat_mode via the ratMode parameter.
- CVE-2026-38063Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_radio_on_with_ia_apn via the ia parameter.
- CVE-2026-38064Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_dial_call via the dialNumber parameter.
- CVE-2026-38065Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_ims_on_with_apn via the ims_apn parameter.
- CVE-2026-38329Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin.
- CVE-2026-38812RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint.
- CVE-2026-39006An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.org.snmp4j:snmp4j-agent
- CVE-2026-39196Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner::pa
- CVE-2026-45388In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows impers
- CVE-2026-45390In OCaml-tar before 3.4.0, a crafted archive with ../ path segments in its name allows escaping the current working directory.
- CVE-2026-50869An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted request
- CVE-2026-50871An OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscence v0.3.0 allows atta
- CVE-2026-50872An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obta
- CVE-2026-50873An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4 allows attackers to execute arbitrary code v
- CVE-2026-50880An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a cryoutransfer
- CVE-2026-50883An HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows attackers to execute arbitrary scripts vi
- CVE-2026-50886Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via agrumpydictator/firefly-iii
- CVE-2026-50887A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internashlinkio/shlink
- CVE-2026-50890Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings.
High 189
- CVE-2026-12161Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH enDevolutions Remote Desktop Manager
- CVE-2026-9262Use of a non-secure protocol as the default FTP configuration in Canon EOS Network Setting Tool Version 1.5.0 or earlierCanon EOS Network Setting Tool for Windows · Canon EOS Netw…
- CVE-2026-9261Use of weak SSH cryptographic algorithms in Canon EOS Network Setting Tool Version 1.5.0 or earlierCanon EOS Network Setting Tool for Windows · Canon EOS Netw…
- CVE-2026-9259Improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlierCanon EOS Network Setting Tool for Windows · Canon EOS Netw…
- CVE-2026-9258Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlierCanon EOS Network Setting Tool for Windows · Canon EOS Netw…
- CVE-2026-48723BrowserStack Cypress CL: Command Injection via cypress_config_file leads to arbitrary code execution through malicious browserstack.jsonbrowserstack-cypress-cli
- CVE-2026-53430grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1elixir-grpc grpc
- CVE-2026-48599Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcodingelixir-grpc grpc · grpc
- CVE-2026-48854Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpcelixir-grpc grpc · grpc
- CVE-2026-5064HP One Agent Software – Security UpdateHP One Agent Software
- CVE-2026-48017DbGate: Remote Code Execution via functionName injection in loadReader endpointdbgate · dbgate-api
- CVE-2026-52702WordPress SEO Redirection plugin <= 9.17 - Cross Site Scripting (XSS) vulnerabilitywp-buy SEO Redirection
- CVE-2026-52700WordPress WCMultiShipping plugin <= 3.0.2 - SQL Injection vulnerabilityWcMultishipping – Mondial Relay & Chronopost for Wooommerce…
- CVE-2026-52699WordPress VikRentCar plugin <= 1.4.5 - Insecure Direct Object References (IDOR) vulnerabilitye4jvikwp VikRentCar
- CVE-2026-52697WordPress Taskbuilder plugin <= 5.0.7 - SQL Injection vulnerabilityTaskbuilder
- CVE-2026-52695WordPress ABC Crypto Checkout plugin <= 1.8.2 - Sensitive Data Exposure vulnerabilityAl Monsor ABC Crypto Checkout
- CVE-2026-52694WordPress Signature Add-On for WooCommerce plugin <= 2.0 - Sensitive Data Exposure vulnerabilityWP E-Signature Signature Add-On for WooCommerce
- CVE-2026-52692WordPress Affiliates Manager plugin <= 2.9.50 - Sensitive Data Exposure vulnerabilitywp.insider Affiliates Manager
- CVE-2026-49780WordPress Dokan plugin <= 5.0.2 - Privilege Escalation vulnerabilityDokan
- CVE-2026-49112WordPress Shared Files plugin <= 1.7.64 - Path Traversal vulnerabilityTammersoft Shared Files
- CVE-2026-49110WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.4 - Price Manipulation vulnerabilityWP Swings Upsell Order Bump Offer for WooCommerce
- CVE-2026-49083WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerabilityLatePoint
- CVE-2026-49082WordPress Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons plugin <= 1.4.8 - Sensitive Data Exposure vulnerabilityChatway Live Chat – AI Chatbot, Customer Support, FAQ…
- CVE-2026-49078WordPress WP Travel Engine plugin <= 6.7.10 - Other Vulnerability Type vulnerabilityWP Travel Engine
- CVE-2026-49070WordPress Knit Pay plugin <= 9.4.0.0 - Broken Access Control vulnerabilityKnit Pay
- CVE-2026-49068WordPress Coupon Affiliates plugin <= 7.8.1 - Sensitive Data Exposure vulnerabilityRelyWP Coupon Affiliates
- CVE-2026-49066WordPress Conekta Payment Gateway plugin <= 6.0.0 - Sensitive Data Exposure vulnerabilityConekta Group Conekta Payment Gateway
- CVE-2026-49065WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerabilityhippooo Hippoo Mobile App for WooCommerce
- CVE-2026-49063WordPress Listdom plugin <= 5.5.0 - Privilege Escalation vulnerabilityWebilia Listdom
- CVE-2026-49061WordPress WPC Product Options for WooCommerce plugin <= 3.2.1 - Arbitrary File Download vulnerabilityWPClever WPC Product Options for WooCommerce
- CVE-2026-49056WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.9.4 - Sensitive Data Exposure vulnerabilityWebToffee WooCommerce PDF Invoices, Packing Slips, Delivery…
- CVE-2026-49055WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin <= 1.3.9.7 - Cross Site Scripting (XSS) vulnerabilityGlen Don Mongaya Drag and Drop Multiple File Upload – Conta…
- CVE-2026-48970WordPress Really Simple SSL plugin <= 9.5.10 - Broken Authentication vulnerabilityReally Simple Plugins Really Simple SSL
- CVE-2026-48966WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.2 - Cross Site Scripting (XSS) vulnerabilityFunnel Builder by FunnelKit
- CVE-2026-48964WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.6 - SQL Injection vulnerabilityELEXtensions ELEX WordPress HelpDesk & Customer Ticketing S…
- CVE-2026-48889WordPress Amelia plugin <= 2.3 - Privilege Escalation vulnerabilityTMS Amelia
- CVE-2026-48885WordPress HollerBox plugin <= 2.3.10.1 - Cross Site Scripting (XSS) vulnerabilityGroundhogg HollerBox
- CVE-2026-48883WordPress WPC Product Bundles for WooCommerce plugin <= 8.5.3 - Broken Access Control vulnerabilityWPClever WPC Product Bundles for WooCommerce
- CVE-2026-48882WordPress WP Time Slots Booking Form plugin <= 1.2.50 - SQL Injection vulnerabilitycodepeople WP Time Slots Booking Form
- CVE-2026-48876WordPress Stop Spammers plugin <= 2026.3 - Cross Site Scripting (XSS) vulnerabilityWeb Guy Stop Spammers
- CVE-2026-48874WordPress GamiPress plugin <= 7.8.7 - SQL Injection vulnerabilityRuben Garcia GamiPress
- CVE-2026-48873WordPress Montonio for WooCommerce plugin <= 10.1.2 - Broken Access Control vulnerabilityMontonio for WooCommerce
- CVE-2026-48872WordPress EmbedPress plugin <= 4.5.2 - Sensitive Data Exposure vulnerabilityWPDeveloper EmbedPress
- CVE-2026-48871WordPress MW WP Form plugin <= 5.1.3 - Cross Site Scripting (XSS) vulnerabilityTakashi Kitajima MW WP Form
- CVE-2026-48868WordPress Simple Shopping Cart plugin <= 5.2.9 - Insecure Direct Object References (IDOR) vulnerabilitymra13 / Team Tips and Tricks HQ Simple Shopping Cart
- CVE-2026-48867WordPress Quiz And Survey Master plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerabilityExpressTech Quiz And Survey Master
- CVE-2026-48838WordPress Post SMTP plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerabilityWPExperts Post SMTP
- CVE-2026-48835WordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerabilityAwesomemotive Contact Form by WPForms
- CVE-2026-45441WordPress WpEvently plugin <= 5.3.3 - Other Vulnerability Type vulnerabilityMagepeople WpEvently
- CVE-2026-45437WordPress Product Filter Widget for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityBhavin Thummar Product Filter Widget for Elementor
- CVE-2026-42775WordPress AutomatorWP plugin <= 5.7.2 - Cross Site Scripting (XSS) vulnerabilityRuben Garcia AutomatorWP
- CVE-2026-42687WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerabilityEventPrime
- CVE-2026-42686WordPress EventPrime plugin <= 4.3.2.1 - Cross Site Scripting (XSS) vulnerabilityEventPrime
- CVE-2026-42668WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.18.0 - Broken Authentication vulnerabilityEmail Marketing for WooCommerce by Omnisend
- CVE-2026-42667WordPress Bookly plugin <= 27.4 - Sensitive Data Exposure vulnerabilityBookly
- CVE-2026-42666WordPress Salon booking system plugin <= 10.30.25 - Broken Access Control vulnerabilityDimitri Grassi Salon booking system
- CVE-2026-42664WordPress AI Product Search for WooCommerce – Motive Commerce Search plugin <= 1.38.2 - Broken Access Control vulnerabilityAI Product Search for WooCommerce – Motive Commerce S…
- CVE-2026-42661WordPress WP Customer Area plugin <= 8.3.4 - Path Traversal vulnerabilityaguilatechnologies WP Customer Area
- CVE-2026-42658WordPress Classified Listing plugin <= 5.3.8 - Cross Site Scripting (XSS) vulnerabilityMamunur Rashid Classified Listing
- CVE-2026-42655WordPress Best Payments Plugin for WP plugin <= 4.6.19 - Payment Bypass vulnerabilityWPManageNinja Best Payments Plugin for WP
- CVE-2026-42650WordPress AutomatorWP plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerabilityRuben Garcia AutomatorWP
- CVE-2026-42649WordPress Favicon Rotator plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerabilityArchetyped Favicon Rotator
- CVE-2026-42411WordPress CloudSecure WP Security plugin <= 1.4.7 - Broken Authentication vulnerabilityXServer CloudSecure WP Security
- CVE-2026-42384WordPress Simply Schedule Appointments plugin < 1.6.11.2 - Sensitive Data Exposure vulnerabilityNSquared Simply Schedule Appointments
- CVE-2026-40791WordPress WP Time Slots Booking Form plugin <= 1.2.46 - Cross Site Scripting (XSS) vulnerabilitycodepeople WP Time Slots Booking Form
- CVE-2026-40789WordPress Amelia plugin <= 2.2 - Sensitive Data Exposure vulnerabilityTMS Amelia
- CVE-2026-40788WordPress ChatBot plugin <= 7.9.7 - Broken Access Control vulnerabilityQuantumCloud ChatBot
- CVE-2026-40787WordPress Quiz And Survey Master plugin <= 11.0.0 - Cross Site Scripting (XSS) vulnerabilityExpressTech Quiz And Survey Master
- CVE-2026-40785WordPress AutomatorWP plugin <= 5.6.7 - Broken Authentication vulnerabilityRuben Garcia AutomatorWP
- CVE-2026-40781WordPress ReviewX plugin <= 2.3.6 - Broken Authentication vulnerabilityReviewX
- CVE-2026-40779WordPress Link Library plugin <= 7.8.8 - Arbitrary File Deletion vulnerabilityYannick Lefebvre Link Library
- CVE-2026-40776WordPress Eventin plugin <= 4.1.8 - Broken Access Control vulnerabilityArraytics WP Event SOlution
- CVE-2026-40775WordPress Royal MCP plugin <= 1.4.2 - Broken Access Control vulnerabilityRoyal Plugins Royal MCP
- CVE-2026-40774WordPress Booking Package plugin <= 1.7.06 - Broken Access Control vulnerabilitySaasProject Booking Package
- CVE-2026-40770WordPress Coupon Affiliates plugin <= 7.5.3 - Cross Site Scripting (XSS) vulnerabilityRelyWP Coupon Affiliates
- CVE-2026-40769WordPress Contact Form Extender for Divi – Save Entries, File Upload & Country Code Field plugin <= 1.0.6 - Arbitrary File Deletion vulnerabilitySatinder Singh Contact Form Extender for Divi – Save…
- CVE-2026-40767WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerabilityTomdever wpForo Forum
- CVE-2026-40766WordPress MasterStudy LMS plugin <= 3.7.25 - SQL Injection vulnerabilityStylemixThemes MasterStudy LMS
- CVE-2026-40762WordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerabilityWPGraphQL
- CVE-2026-40741WordPress Redsys for WooCommerce Light plugin <= 7.0.0 - Broken Access Control vulnerabilityJose Conti Redsys for WooCommerce Light
- CVE-2026-40732WordPress Notification for Telegram plugin <= 3.5 - Cross Site Scripting (XSS) vulnerabilityrainafarai Notification for Telegram
- CVE-2026-40727WordPress Groundhogg plugin <= 4.4 - Arbitrary File Deletion vulnerabilityGroundhogg
- CVE-2026-39587WordPress WP BASE Booking plugin <= 5.9.0 - Privilege Escalation vulnerabilityHakan Ozevin WP BASE Booking
- CVE-2026-39579WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerabilitybPlugins B Blocks
- CVE-2026-39534WordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerabilityWP Directory Kit
- CVE-2026-39533WordPress AWP Classifieds plugin <= 4.4.4 - Broken Access Control vulnerabilityWPTasty AWP Classifieds
- CVE-2026-39532WordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerabilityStiofan Events Calendar for GeoDirectory
- CVE-2026-39524WordPress Masteriyo - LMS plugin <= 2.1.5 - Payment Bypass vulnerabilityThemeGrill Masteriyo - LMS
- CVE-2026-39518WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerabilityEventPrime
- CVE-2026-39514WordPress Paid Member Subscriptions plugin <= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerabilityCozmoslabs Paid Member Subscriptions
- CVE-2026-39513WordPress Easy Appointments plugin <= 3.12.21 - Broken Access Control vulnerabilityEasy Appointments
- CVE-2026-39507WordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerabilityThemeisle Social Slider Feed
- CVE-2026-39503WordPress Easy Digital Downloads plugin <= 3.6.5 - Broken Access Control vulnerabilityAwesomemotive Easy Digital Downloads
- CVE-2026-39499WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.19 - PHP Object Injection vulnerabilityWombat Plugins Advanced Product Fields (Product Addons) for…
- CVE-2026-39498WordPress YayMail plugin <= 4.3.3 - PHP Object Injection vulnerabilityYeeaddons YayMail
- CVE-2026-39481WordPress Modula Image Gallery plugin <= 2.14.18 - PHP Object Injection vulnerabilityWP Chill Modula Image Gallery
- CVE-2026-39480WordPress Backup Migration plugin <= 2.1.1 - Sensitive Data Exposure vulnerabilityInisev Backup Migration
- CVE-2026-39478WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.87 - PHP Object Injection vulnerabilityEli Scheetz Anti-Malware Security and Brute-Force Firewall
- CVE-2026-39474WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerabilitymetaphorcreations Post Duplicator
- CVE-2026-39472WordPress WooCommerce PDF Invoices & Packing Slips plugin < 5.9.0 - PHP Object Injection vulnerabilityWP Overnight WooCommerce PDF Invoices & Packing Slips
- CVE-2026-39471WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerabilityShortPixel Image Optimizer
- CVE-2026-39470WordPress WooCommerce Cart Abandonment Recovery plugin < 2.1.0 - Privilege Escalation vulnerabilityBrainstorm Force WooCommerce Cart Abandonment Recovery
- CVE-2026-39463WordPress ManageWP Worker plugin <= 4.9.31 - Cross Site Scripting (XSS) vulnerabilityManageWP Worker
- CVE-2026-39450WordPress FunnelKit Automations plugin <= 3.7.3 - Broken Authentication vulnerabilityAman FunnelKit Automations
- CVE-2026-39449WordPress Contact Form to Any API plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerabilityIT Path Solutions Contact Form to Any API
- CVE-2026-39447WordPress Simply Schedule Appointments plugin <= 1.6.10.6 - Cross Site Scripting (XSS) vulnerabilityNSquared Simply Schedule Appointments
- CVE-2026-39435WordPress CformsII plugin <= 15.1.3 - Cross Site Scripting (XSS) vulnerabilitybgermann CformsII
- CVE-2026-39434WordPress CTX Feed plugin <= 6.6.26 - PHP Object Injection vulnerabilityWebAppick CTX Feed
- CVE-2026-34902WordPress WooCommerce Product Table Lite plugin <= 4.6.3 - Cross Site Scripting (XSS) vulnerabilityWC Product Table WooCommerce Product Table Lite
- CVE-2026-34900WordPress GiveWP plugin <= 4.14.2 - Reflected Cross Site Scripting (XSS) vulnerabilityLiquid Web / StellarWP GiveWP
- CVE-2026-34898WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.3 - Broken Access Control vulnerabilityWP Swings Event Tickets Manager for WooCommerce
- CVE-2026-34891WordPress IDPay Payment Gateway for Woocommerce plugin <= 2.2.5 - Sensitive Data Exposure vulnerabilityIDPay Payment Gateway for Woocommerce
- CVE-2026-34886WordPress Simple Membership plugin <= 4.7.1 - Broken Access Control vulnerabilitywp.insider Simple Membership
- CVE-2026-27407WordPress AI Engine plugin <= 3.4.9 - Privilege Escalation vulnerabilityMeow Apps AI Engine
- CVE-2026-27333WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Deserialization of untrusted data vulnerabilityVideoWhisper.com Paid Videochat Turnkey Site
- CVE-2026-27089WordPress WpTravelly plugin <= 2.1.7 - Bypass Vulnerability vulnerabilityMagepeople WpTravelly
- CVE-2026-25425WordPress User Registration plugin <= 5.1.2 - Broken Access Control vulnerabilityThemeGrill User Registration
- CVE-2026-24637WordPress PowerPress Podcasting plugin <= 11.15.10 - SQL Injection vulnerabilityBlubrry Podcasting PowerPress Podcasting
- CVE-2026-23970WordPress Redirection for Contact Form 7 plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerabilityThemeisle Redirection for Contact Form
- CVE-2025-68872WordPress Eli's WordCents adSense Widget with Analytics plugin <= 1.3.03.27 - Reflected Cross Site Scripting (XSS) vulnerabilityEli's WordCents adSense Widget with Analytics
- CVE-2025-68851WordPress Okay Toolkit plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityArrayHQ Okay Toolkit
- CVE-2025-68840WordPress iRobots.txt SEO plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilitymarkbeljaars iRobots.txt SEO
- CVE-2025-59133WordPress Projectopia plugin <= 5.1.25.2 - Insecure Direct Object References (IDOR) vulnerabilityProjectopia
- CVE-2026-48708OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command ContaminationOliveTin · github.com/OliveTin/OliveTin
- CVE-2026-48124Cursor Desktop sandbox escape via Claude hook configurationcursor
- CVE-2026-47261Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restrictionbytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-47825Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situationsSpring Cloud Gateway
- CVE-2026-52722Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handlingRed Hat Enterprise Linux
- CVE-2026-52720Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfbRed Hat Enterprise Linux
- CVE-2026-53704Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer fileinfo metadata parserRed Hat Enterprise Linux
- CVE-2026-53703Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer audio stream header parserRed Hat Enterprise Linux
- CVE-2026-53705Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflowRed Hat Enterprise Linux
- CVE-2026-52719Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoderRed Hat Enterprise Linux
- CVE-2026-41708Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerabilitySpring Cloud Sleuth · org.springframework.cloud:spring-clou…
- CVE-2026-47835Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector StoresSpring AI · org.springframework.ai:spring-ai-opensearch-… +2
- CVE-2026-49954Discuz! X5.0 Local File Inclusion via enable_disable.php Plugin DirectoryDiscuz! X5.0
- CVE-2026-47777Mastodon has a consent-check bypass in its remote Collectionsmastodon
- CVE-2026-9863Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerabilityFortra Core Privileged Access Manager
- CVE-2026-5079multer vulnerable to Denial of Service via deeply nested field namesmulter
- CVE-2026-49064WordPress GetPaid plugin <= 2.8.49 - Sensitive Data Exposure vulnerabilityStiofan GetPaid
- CVE-2026-49111WordPress Masteriyo - LMS plugin <= 2.2.0 - Privilege Escalation vulnerabilityThemeGrill Masteriyo - LMS
- CVE-2026-49062WordPress Faust.js plugin <= 1.8.7 - Broken Authentication vulnerabilityWP Engine Faust.js
- CVE-2026-5242Code Injection in Mia Technologies' Pizzy LibraryMIA Technology Pizzy Library
- CVE-2026-5233Missing Rate Limiting in Mia Technologies' Pizzy LibraryMIA Technology Pizzy Library
- CVE-2026-5230Improper Access Control in Mia Technologies' Pizzy LibraryMIA Technology Pizzy Library
- CVE-2016-20068WordPress Booking Calendar Contact Form 1.0.23 SQL Injectiondwbooster Booking Calendar Contact Form
- CVE-2019-25746WordPress Sliced Invoices 3.8.2 SQL Injection via post ParameterSlicedInvoices Sliced Invoices
- CVE-2018-25437WordPress CherryFramework Themes 3.1.4 Backup File DownloadCherryframework Cherry Framework Themes
- CVE-2016-20081WordPress Plugin HB Audio Gallery Lite 1.0.0 Path Traversal File DownloadHusain HB Audio Gallery Lite
- CVE-2016-20076WordPress Simple-Backup 2.7.11 Arbitrary File Deletion and DownloadChrisHurst Simple Backup
- CVE-2016-20075WordPress Ultimate Product Catalog 3.8.6 Arbitrary File Upload RCEEtoilewebdesign Ultimate Product Catalog
- CVE-2016-20073Answer My Question 1.3 Plugin WordPress SQL Injection via modal.phpmattkaye Answer My Question
- CVE-2016-20072BBS e-Franchise 1.1.1 WordPress Plugin SQL Injection via uidbbsetheme BBS e-Franchise
- CVE-2016-20071WordPress 404 Redirection Manager Plugin 1.0 SQL Injection404-redirection-manager 404 Redirection Manager
- CVE-2016-20069WordPress Booking Calendar Contact Form 1.0.23 SQL Injectiondwbooster Booking Calendar Contact Form
- CVE-2026-12057DoS + Remote Code Execution via PDF JavaScript in Foxit AIFoxit Software Foxit AI
- CVE-2026-34026Path traversal in Wertheim SafeController Software allows authenticated users to download arbitrary filesWertheim SafeController Software for VAULT ROOMS
- CVE-2026-34024Missing authorization checks in Wertheim SafeController Software allow low-privileged users to access restricted functionsWertheim SafeController Software for VAULT ROOMS
- CVE-2026-34023Broken WebSocket authorization in Wertheim SafeController Software allows cross-branch access to restricted functionsWertheim SafeController Software for VAULT ROOMS
- CVE-2026-34022Weak custom cryptography and hard-coded keys in Wertheim SafeController 65000 allow traffic decryptionWertheim SafeController Family 65000 Hardware for VAULT ROO…
- CVE-2026-34021Lack of cryptographic protection in Wertheim SafeController 5400 enables RS-485 message sniffing and replayWertheim SafeController 5400 Hardware for VAULT ROOMS
- CVE-2026-11860Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMSOpenSolution Quick.CMS
- CVE-2026-50100Multiple printer drivers provided by Ricoh Company, Ltd.Ricoh Company Multiple printer drivers · KONICA MINOLTA JAP…
- CVE-2026-12222Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflowYealink SIP-T46U
- CVE-2026-12221Yealink SIP-T46U Firmware Chunk Upload upgrade sprintf stack-based overflowYealink SIP-T46U
- CVE-2026-12220Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflowYealink SIP-T46U
- CVE-2026-12218Yealink SIP-T46U Web FastCGI Service beforewifitest StartReportInformation stack-based overflowYealink SIP-T46U
- CVE-2026-12217DVDFab Virtual Drive Signed Kernel Driver dvdfabio.sys privileges managementDVDFab Virtual Drive
- CVE-2026-12214Qihoo 360 Total Security Nucleus Engine Monitoring Logic RpcStringBindingComposeW protection mechanismQihoo 360 Total Security
- CVE-2025-56814A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell
- CVE-2025-68713An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9.
- CVE-2026-36213An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.exe component.
- CVE-2026-36670A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3
- CVE-2026-39007An issue in Observeinc's Observe v.2026-01-28 and before allows a remote attacker to obtain sensitive information via the CSV Log export com
- CVE-2026-39118An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client validation gap to invoke
- CVE-2026-45389In OCaml-TLS before 2.1.0, the server implementation does insufficient checks of the certificate provided by the client (when doing client a
- CVE-2026-50870An information disclosure vulnerability in the configuration endpoint of Ben Busby whoogle-search v1.2.3 allows attackers to obtain sensitiv
- CVE-2026-50874An OS command injection vulnerability in the /manage/features/media component of kanishka-linux Reminiscence v0.3.0 allows attackers to exec
- CVE-2026-50875Incorrect access control in the /{form}/webhooks/{webhook} endpoint of Deck9 Input v2.0.1 allows authenticated attackers to arbitrarily modi
- CVE-2026-50877An issue in Zhoros SuperBin v1.0.0 allows attackers to execute a directory traversal via supplying files with names containing traversal cha
- CVE-2026-50878An issue in the attachment handling component of Feuerhamster MailForm v1.1.0 allows attackers to cause a Denial of Service (DoS) via a craf
- CVE-2026-50879An issue in the uploadPostHandler component of Andrei Marcu linx-server v2.3.8 allows attackers to cause a Denial of Service (DoS) via a cragithub.com/andreimarcu/linx-server
- CVE-2026-50881Incorrect access control in the impworks Bonsai v6.0 allows authenticated attackers with Editor privileges to escalate privileges to Adminis
- CVE-2026-50882An issue in the /api/v0/pastes endpoint of anna-is-cute paste v0.1.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST
- CVE-2026-50884Incorrect access control in statping-ng v0.93.0 allows attackers to escalate privileges to Administrator and access sensitive components.github.com/statping-ng/statping-ng
- CVE-2026-50885Incorrect access control in the share-based read endpoints of Sismics Docs (Teedy) v1.11 allow unauthorized attackers to access sensitive en
- CVE-2026-50888An authenticated Server-Side Request Forgery (SSRF) in the custom scraper subsystem component of Benjamin Jonard Koillection v1.8.0 allows akoillection/koillection
- CVE-2026-50889An input handling flaw in the HTTP refresh token process of LLDAP v0.6.2 allows attackers to cause a Denial of Service (DoS) via sending a c
- CVE-2026-50891Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a craftegithub.com/mickael-kerjean/filestash
Medium, low and unrated 130
- CVE-2026-12162Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclosDevolutions Remote Desktop Manager
- CVE-2026-9260Use of hard-coded cryptographic keys in Canon EOS Network Setting Tool Version 1.5.0 or earlierCanon EOS Network Setting Tool for Windows · Canon EOS Netw…
- CVE-2026-48157Slim has Reflected XSS in the HtmlErrorRendererslimphp Slim · slim/slim
- CVE-2026-49775WordPress Welcart e-Commerce plugin <= 2.11.28 - Broken Access Control vulnerabilityinfo@welcart Welcart e-Commerce
- CVE-2026-49773WordPress FV Flowplayer Video Player plugin < 7.5.51.7212 - Cross Site Scripting (XSS) vulnerabilityFolioVision FV Flowplayer Video Player
- CVE-2026-49043WordPress WP Migrate Lite plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerabilityWP Engine WP Migrate Lite
- CVE-2026-48965WordPress XCloner plugin <= 4.8.6 - Sensitive Data Exposure vulnerabilitywatchful XCloner
- CVE-2026-48887WordPress JS Help Desk plugin <= 3.0.9 - Broken Access Control vulnerabilityAhmad JS Help Desk
- CVE-2026-48880WordPress WP Job Portal plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerabilityAhmad WP Job Portal
- CVE-2026-48878WordPress Visual Link Preview plugin <= 2.4.1 - Sensitive Data Exposure vulnerabilityBootstrapped Ventures Visual Link Preview
- CVE-2026-48870WordPress King Addons for Elementor plugin <= 51.1.62 - Cross Site Scripting (XSS) vulnerabilityKing Addons for Elementor
- CVE-2026-42752WordPress Stripe Payments plugin <= 2.0.98 - Bypass Vulnerability vulnerabilitymra13 / Team Tips and Tricks HQ Stripe Payments
- CVE-2026-42743WordPress Masteriyo - LMS plugin <= 2.1.8 - Broken Authentication vulnerabilityThemeGrill Masteriyo - LMS
- CVE-2026-42688WordPress Modula Image Gallery plugin <= 2.14.23 - Cross Site Scripting (XSS) vulnerabilityWP Chill Modula Image Gallery
- CVE-2026-42663WordPress Simple Membership plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerabilitywp.insider Simple Membership
- CVE-2026-42662WordPress Event Tickets plugin <= 5.27.5 - Bypass Vulnerability vulnerabilityLiquid Web / StellarWP Event Tickets
- CVE-2026-42660WordPress Contest Gallery plugin <= 28.1.7 - Sensitive Data Exposure vulnerabilityWasiliy Strecker Contest Gallery
- CVE-2026-42659WordPress Advanced Form Integration plugin <= 1.126.12 - Broken Access Control vulnerabilityNasir Ahmed Advanced Form Integration
- CVE-2026-42657WordPress Contest Gallery plugin <= 28.1.7 - Other Vulnerability Type vulnerabilityWasiliy Strecker Contest Gallery
- CVE-2026-42656WordPress Contest Gallery plugin <= 28.1.6 - Cross Site Scripting (XSS) vulnerabilityWasiliy Strecker Contest Gallery
- CVE-2026-42651WordPress Classified Listing plugin <= 5.3.9 - Broken Access Control vulnerabilityMamunur Rashid Classified Listing
- CVE-2026-42640WordPress Classified Listing plugin <= 5.3.8 - Broken Access Control vulnerabilityMamunur Rashid Classified Listing
- CVE-2026-42378WordPress WP Full Stripe Free plugin <= 8.4.1 - Broken Authentication vulnerabilityThemeisle WP Full Stripe Free
- CVE-2026-41556WordPress ProfilePress plugin <= 4.16.13 - Cross Site Scripting (XSS) vulnerabilityproperfraction ProfilePress
- CVE-2026-40799WordPress Simple Cloudflare Turnstile plugin <= 1.38.0 - Broken Authentication vulnerabilityRelyWP Simple Cloudflare Turnstile
- CVE-2026-40796WordPress WPPizza plugin <= 3.19.9 - Sensitive Data Exposure vulnerabilityollybach WPPizza
- CVE-2026-40795WordPress Amelia plugin <= 2.2 - Broken Access Control vulnerabilityTMS Amelia
- CVE-2026-40794WordPress myCred plugin <= 3.0.3 - Broken Access Control vulnerabilitymyCred
- CVE-2026-40793WordPress Groundhogg plugin < 4.4.1 - Broken Access Control vulnerabilityGroundhogg
- CVE-2026-40792WordPress KiviCare plugin <= 4.2.1 - Insecure Direct Object References (IDOR) vulnerabilityIqonic Design KiviCare
- CVE-2026-40790WordPress WP SMS plugin <= 7.2.1 - Sensitive Data Exposure vulnerabilityVeronaLabs WP SMS
- CVE-2026-40782WordPress WPAdverts plugin <= 2.3.0 - Broken Access Control vulnerabilityGreg Winiarski WPAdverts
- CVE-2026-40773WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.9 - Broken Access Control vulnerabilityrtCamp rtMedia for WordPress, BuddyPress and bbPress
- CVE-2026-40743WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerabilityThemeum Tutor LMS
- CVE-2026-39594WordPress Ultra Addons for WPForms plugin <= 1.0.11 - Broken Access Control vulnerabilityThemefic Ultra Addons for WPForms
- CVE-2026-39584WordPress RepairBuddy plugin <= 4.1132 - Broken Access Control vulnerabilityWebful Creations RepairBuddy
- CVE-2026-39540WordPress Shipment Tracker for Woocommerce plugin <= 1.5.3.2 - Cross Site Scripting (XSS) vulnerabilityAmit Mittal Shipment Tracker for Woocommerce
- CVE-2026-39527WordPress WpStream plugin < 4.11.2 - Arbitrary File Upload vulnerabilitysc Internet Vivoo WpStream
- CVE-2026-39525WordPress Booking Activities plugin <= 1.16.48.1 - Broken Access Control vulnerabilityBooking Activities Team Booking Activities
- CVE-2026-39515WordPress Motors plugin < 1.4.107 - Broken Access Control vulnerabilityStylemixThemes Motors
- CVE-2026-39491WordPress JupiterX Core plugin <= 4.14.1 - Cross Site Scripting (XSS) vulnerabilityartbees JupiterX Core
- CVE-2026-39489WordPress Download Monitor plugin <= 5.1.9 - Non-Arbitrary File Download vulnerabilityWP Chill Download Monitor
- CVE-2026-39468WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion vulnerabilityeLightUp Meta Box – WordPress Custom Fields Framework
- CVE-2026-39451WordPress WP Google Review Slider plugin <= 18.0 - Cross Site Scripting (XSS) vulnerabilityjgwhite33 WP Google Review Slider
- CVE-2026-34892WordPress Rank Math SEO plugin <= 1.0.271 - Broken Access Control vulnerabilityRank Math SEO
- CVE-2026-25440WordPress Essential Addons for Elementor plugin < 6.6.0 - Broken Access Control vulnerabilityWPDeveloper Essential Addons for Elementor
- CVE-2025-69332WordPress Bookify plugin <= 1.1.1 - Broken Access Control vulnerabilitymyCred Bookify
- CVE-2025-68049WordPress bunny.net plugin <= 2.3.6 - Broken Access Control vulnerabilitybunny.net
- CVE-2025-60175WordPress PopAd Plugin <= 1.0.4 - Server Side Request Forgery (SSRF) Vulnerabilityvynnus PopAd
- CVE-2026-48709OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument EnumerationOliveTin · github.com/OliveTin/OliveTin
- CVE-2026-48518MultiJuicer: Login CSRF allows attacker to force victims into their teamjuice-shop multi-juicer
- CVE-2026-52718Gstreamer1-plugins-bad-free: gstreamer: denial of service via av1 tile_list_obu parser byte/bit confusionRed Hat Enterprise Linux
- CVE-2026-52721Gstreamer1-plugins-bad-free: gstreamer: multiple out-of-bounds reads in pcapparse ipv4/tcp header parsingRed Hat Enterprise Linux
- CVE-2026-49953Discuz! X5.0 CAPTCHA Bypass via Predictable Character SetDiscuz! X5.0
- CVE-2026-11931Insecure Permissions on Authentication Token Cache File in Kiro IDEAWS Kiro IDE
- CVE-2026-49294Valhalla has reflected XSS via unsanitized JSONP callback parametervalhalla
- CVE-2026-8358Heap buffer overflow in spreadsheet tracked-changes importThe Document Foundation LibreOffice
- CVE-2026-8357Heap buffer overflow in Calc formula compilationThe Document Foundation LibreOffice
- CVE-2026-8356Stack buffer overflow in PPT presentation importThe Document Foundation LibreOffice
- CVE-2026-6047Heap buffer overflow in OOXML text box element importThe Document Foundation LibreOffice
- CVE-2026-6045Heap buffer overflow in EMF+ gradient brush importThe Document Foundation LibreOffice
- CVE-2026-6040Heap use-after-free in ODF number-format blank-width parsingThe Document Foundation LibreOffice
- CVE-2026-6039Heap buffer overflow in DXF polyline importThe Document Foundation LibreOffice
- CVE-2026-20262Cisco Catalyst SD-WAN Manager Arbitrary File Write VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2025-15659WordPress Elizaibots plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityliseperu Elizaibots
- CVE-2025-15658WordPress WP Emmet plugin <= 0.3.4 - Cross Site Scripting (XSS) vulnerabilityrewish WP Emmet
- CVE-2026-9595webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxieswebpack-dev-server
- CVE-2026-5038multer vulnerable to Denial of Service via incomplete cleanup of aborted uploadsmulter
- CVE-2026-10634Use-after-free in Zephyr native TCP `net_tcp_foreach()` due to dropping `tcp_lock` during the callbackzephyrproject zephyr
- CVE-2026-8683Overly long URLs crash the Mattermost Desktop AppMattermost
- CVE-2026-6517Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passedMattermost
- CVE-2025-64215WordPress MasterStudy LMS Pro plugin < 4.7.16 - Broken Access Control vulnerabilityStylemixThemes MasterStudy LMS Pro
- CVE-2026-48969WordPress Really Simple SSL plugin <= 9.5.9 - Broken Access Control vulnerabilityReally Simple Plugins B.V. Really Simple SSL
- CVE-2016-20084WordPress appointment-booking-calendar 1.1.24 Privilege Escalation XSSdwbooster Appointment Booking Calendar
- CVE-2016-20083WordPress More Fields Plugin 2.1 Cross-Site Request Forgeryhenrikmelin More Fields
- CVE-2016-20082WordPress Plugin Abtest Local File Inclusion via abtest_admin.phpAbtest
- CVE-2016-20080WordPress Brandfolder Plugin 3.0 Local File Inclusion via callback.phpBrandfolder
- CVE-2016-20079WordPress Dharma Booking 2.28.3 Local File Inclusion via proccess.phpjamie Dharma Booking
- CVE-2016-20078WordPress IMDb Profile Widget 1.0.8 Local File Inclusion via pic.phpHenrique Dias IMDb Profile Widget
- CVE-2016-20077WordPress Plugin Photocart Link 1.6 Local File Inclusion via decode.phpKaymeePhotography Photocart Link
- CVE-2016-20074WordPress Lazy Content Slider Plugin 3.4 CSRFleethompson Lazy Content Slider Plugin
- CVE-2016-20070WordPress Booking Calendar Contact Form 1.0.23 Privilege Escalation Stored XSSdwbooster Booking Calendar Contact Form
- CVE-2016-20067WordPress CP Polls 1.0.8 Cross-Site Request Forgerydwbooster CP Polls
- CVE-2016-20066WordPress CP Polls 1.0.8 Persistent Cross-Site Scriptingdwbooster CP Polls
- CVE-2026-34030Improper branch-code validation in Wertheim SafeController Software allows file path manipulationWertheim SafeController Software for VAULT ROOMS
- CVE-2026-34029Hard-coded cryptographic key in Wertheim SafeController Software allows decryption of sensitive configuration dataWertheim SafeController Software for VAULT ROOMS
- CVE-2026-34028Unauthenticated direct access to web data in Wertheim SafeController Software exposes filesWertheim SafeController Software for VAULT ROOMS
- CVE-2026-34027Upload restriction bypass in Wertheim SafeController Software allows authenticated users to upload arbitrary filesWertheim SafeController Software for VAULT ROOMS
- CVE-2026-34025IP restriction bypass in Wertheim SafeController Software allows logins from unauthorized network locationsWertheim SafeController Software for VAULT ROOMS
- CVE-2026-44188Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expirationRed Hat Ansible Automation Platform
- CVE-2026-9278Form Builder CP < 1.2.47 - Editor+ Stored XSS via form_structureForm Builder CP
- CVE-2026-8386WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker IDWP Go Maps
- CVE-2026-8385WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX FallbackWP Go Maps
- CVE-2026-12223Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injectionYealink SIP-T46U
- CVE-2026-12219Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injectionYealink SIP-T46U
- CVE-2026-12216svaarala duktape duk_api_bytecode.c memory corruptionsvaarala duktape
- CVE-2026-12213hcengineering Huly Platform User Information operations.ts getAccountInfo improper authorizationhcengineering Huly Platform
- CVE-2026-12212hcengineering Huly Platform RPC operations.ts getMailboxSecret access controlhcengineering Huly Platform
- CVE-2026-12211Intelbras iNVU 7016 FT Web syslog path traversalIntelbras iNVU 7016 FT
- CVE-2026-12210universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgeryuniversal-tool-calling-protocol python-utcp · utcp-gql +1
- CVE-2026-12209RubyLouvre avalon Template Filter index.js prototype pollutionRubyLouvre avalon
- CVE-2026-12208jsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollutionjsonata-js jsonata · jsonata
- CVE-2026-12207medkey-org medkey HTTP REST API PatientController.php actionGetPatientById resource injectionmedkey-org medkey
- CVE-2026-12206Grit42 Grit data_table_entity.rb DataTableEntity sql injectionGrit42 Grit
- CVE-2026-12204ShopXO Scheduled Task Endpoint Crontab.php GoodsGiveIntegral authorizationShopXO
- CVE-2026-12203HKUDS AI-Trader Research Export agents.csv information disclosureHKUDS AI-Trader
- CVE-2026-12202Intelliants Subrion CMS Blocks Endpoint cross site scriptingIntelliants Subrion CMS · intelliants/subrion
- CVE-2026-12201IObit Malware Fighter DLL permissionIObit Malware Fighter
- CVE-2026-12200Ritlabs TinyWeb Server Header libeay32.dll.html stack-based overflowRitlabs TinyWeb Server
- CVE-2026-12198Microweber API Endpoint thumbnail_img userfiles_path path traversalMicroweber · microweber/microweber
- CVE-2025-55641A NULL pointer dereference in the gf_isom_copy_sample_info function (isomedia/isom_write.c) of GPAC MP4Box v2.4 allows attackers to cause a
- CVE-2025-55642GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmx_process function (isomedia/isom_write.c).
- CVE-2025-55643A NULL pointer dereference in the TrackWriter handling component (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial
- CVE-2025-55644A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial
- CVE-2025-55645A heap buffer overflow in the gf_cenc_set_pssh function (isomedia/drm_sample.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Se
- CVE-2025-55647An Out-of-Memory in the mp4_mux_cenc_insert_pssh function (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Ser
- CVE-2025-55648A heap buffer overflow in the gf_opus_parse_packet_header function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause
- CVE-2025-55649A NULL pointer dereference in the gf_media_map_esd function (media_tools/isom_tools.c) of GPAC MP4Box v2.4 allows attackers to cause a Denia
- CVE-2025-55650A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial
- CVE-2025-55652A heap buffer overflow in the gf_isom_vp_config_new function (isomedia/avc_ext.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of
- CVE-2025-55660A stack overflow in the gf_opus_read_length function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Se
- CVE-2025-55661A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via
- CVE-2025-55663A segmentation violation in the Track_SetStreamDescriptor function (isomedia/track.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial
- CVE-2025-70102A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options.
- CVE-2026-36521PublicCMS V5.202506.d has a Cross Site Scripting (XSS) vulnerability in the site configuration management module.
- CVE-2026-36933An issue in Boyleep K11, y108 firmware v.2.3.0.11291 allows a physically proximate attacker to execute arbitrary code via the factory test f
- CVE-2026-37216Ruoyi 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add.
- CVE-2026-39197An issue in the /util/http/prelude.rs endpoint of Datadog, Inc Vector v0.54.0 allows attackers to cause a Denial of Service (DoS) via a craf
- CVE-2026-50876A cross-site scripting (XSS) vulnerability in Deck9 Input v2.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted pay
- CVE-2026-50892Incorrect access control in the "Let's Encrypt" certificate download endpoint of Nginx Proxy Manager v2.14.0 allows authenticated attackers