# CVEs published 2026-06-15

399 CVEs were published on June 15, 2026: 80 critical, 189 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-12162](https://cve.now/CVE-2026-12162.md): Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclos (CVSS 5.5, Devolutions Remote Desktop Manager)
- [CVE-2026-12161](https://cve.now/CVE-2026-12161.md): Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH en (CVSS 8.8, Devolutions Remote Desktop Manager)
- [CVE-2026-9262](https://cve.now/CVE-2026-9262.md): Use of a non-secure protocol as the default FTP configuration in Canon EOS Network Setting Tool Version 1.5.0 or earlier (CVSS 7.1, Canon EOS Network Setting Tool for Windows · Canon EOS Netw…)
- [CVE-2026-9261](https://cve.now/CVE-2026-9261.md): Use of weak SSH cryptographic algorithms in Canon EOS Network Setting Tool Version 1.5.0 or earlier (CVSS 7.6, Canon EOS Network Setting Tool for Windows · Canon EOS Netw…)
- [CVE-2026-9260](https://cve.now/CVE-2026-9260.md): Use of hard-coded cryptographic keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier (CVSS 6.9, Canon EOS Network Setting Tool for Windows · Canon EOS Netw…)
- [CVE-2026-9259](https://cve.now/CVE-2026-9259.md): Improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlier (CVSS 7.1, Canon EOS Network Setting Tool for Windows · Canon EOS Netw…)
- [CVE-2026-9258](https://cve.now/CVE-2026-9258.md): Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier (CVSS 7.1, Canon EOS Network Setting Tool for Windows · Canon EOS Netw…)
- [CVE-2026-48723](https://cve.now/CVE-2026-48723.md): BrowserStack Cypress CL: Command Injection via cypress\_config\_file leads to arbitrary code execution through malicious browserstack.json (CVSS 7.8, browserstack-cypress-cli)
- [CVE-2026-12205](https://cve.now/CVE-2026-12205.md): Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery (CVSS 9.1, TIMLEGGE Crypt::DSA)
- [CVE-2026-48853](https://cve.now/CVE-2026-48853.md): Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc (CVSS 9.2, elixir-grpc grpc · grpc)
- [CVE-2026-53430](https://cve.now/CVE-2026-53430.md): grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1 (CVSS 8.7, elixir-grpc grpc)
- [CVE-2026-48599](https://cve.now/CVE-2026-48599.md): Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding (CVSS 7.6, elixir-grpc grpc · grpc)
- [CVE-2026-48854](https://cve.now/CVE-2026-48854.md): Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc (CVSS 8.7, elixir-grpc grpc · grpc)
- [CVE-2026-5064](https://cve.now/CVE-2026-5064.md): HP One Agent Software – Security Update (CVSS 8.5, HP One Agent Software)
- [CVE-2026-11832](https://cve.now/CVE-2026-11832.md): Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce (CVSS 9.1, BIAFRA Dancer2::Plugin::Auth::OAuth)
- [CVE-2026-12087](https://cve.now/CVE-2026-12087.md): Socket versions before 2.041 for Perl have an out-of-bounds heap read (CVSS 9.1, PEVANS Socket)
- [CVE-2026-48157](https://cve.now/CVE-2026-48157.md): Slim has Reflected XSS in the HtmlErrorRenderer (CVSS 6.1, slimphp Slim · slim/slim)
- [CVE-2026-48017](https://cve.now/CVE-2026-48017.md): DbGate: Remote Code Execution via functionName injection in loadReader endpoint (CVSS 8.8, dbgate · dbgate-api)
- [CVE-2026-48714](https://cve.now/CVE-2026-48714.md): i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names (CVSS 9.1, i18next-http-middleware)
- [CVE-2026-48713](https://cve.now/CVE-2026-48713.md): i18next-fs-backend: Prototype pollution via crafted missing-key string (CVSS 9.1, i18next-fs-backend)
- [CVE-2026-52703](https://cve.now/CVE-2026-52703.md): WordPress FastDup plugin \<= 2.7.2 - Path Traversal vulnerability (CVSS 9.6, Ninja Team FastDup)
- [CVE-2026-52702](https://cve.now/CVE-2026-52702.md): WordPress SEO Redirection plugin \<= 9.17 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wp-buy SEO Redirection)
- [CVE-2026-52700](https://cve.now/CVE-2026-52700.md): WordPress WCMultiShipping plugin \<= 3.0.2 - SQL Injection vulnerability (CVSS 8.5, WcMultishipping – Mondial Relay & Chronopost for Wooommerce…)
- [CVE-2026-52699](https://cve.now/CVE-2026-52699.md): WordPress VikRentCar plugin \<= 1.4.5 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5, e4jvikwp VikRentCar)
- [CVE-2026-52697](https://cve.now/CVE-2026-52697.md): WordPress Taskbuilder plugin \<= 5.0.7 - SQL Injection vulnerability (CVSS 8.5, Taskbuilder)
- [CVE-2026-52695](https://cve.now/CVE-2026-52695.md): WordPress ABC Crypto Checkout plugin \<= 1.8.2 - Sensitive Data Exposure vulnerability (CVSS 7.5, Al Monsor ABC Crypto Checkout)
- [CVE-2026-52694](https://cve.now/CVE-2026-52694.md): WordPress Signature Add-On for WooCommerce plugin \<= 2.0 - Sensitive Data Exposure vulnerability (CVSS 7.5, WP E-Signature Signature Add-On for WooCommerce)
- [CVE-2026-52693](https://cve.now/CVE-2026-52693.md): WordPress eCommerce Product Catalog plugin \<= 3.5.5 - SQL Injection vulnerability (CVSS 9.3, impleCode eCommerce Product Catalog)
- [CVE-2026-52692](https://cve.now/CVE-2026-52692.md): WordPress Affiliates Manager plugin \<= 2.9.50 - Sensitive Data Exposure vulnerability (CVSS 7.5, wp.insider Affiliates Manager)
- [CVE-2026-49781](https://cve.now/CVE-2026-49781.md): WordPress OttoKit plugin \<= 1.1.27 - PHP Object Injection vulnerability (CVSS 9.8, Brainstorm Force OttoKit)
- [CVE-2026-49780](https://cve.now/CVE-2026-49780.md): WordPress Dokan plugin \<= 5.0.2 - Privilege Escalation vulnerability (CVSS 8.8, Dokan)
- [CVE-2026-49776](https://cve.now/CVE-2026-49776.md): WordPress GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin \<= 2.32.6 - SQL Injection vulnerability (CVSS 9.3, JExtensions Store GPTranslate – Multilingual AI Translation…)
- [CVE-2026-49775](https://cve.now/CVE-2026-49775.md): WordPress Welcart e-Commerce plugin \<= 2.11.28 - Broken Access Control vulnerability (CVSS 6.5, info@welcart Welcart e-Commerce)
- [CVE-2026-49773](https://cve.now/CVE-2026-49773.md): WordPress FV Flowplayer Video Player plugin \< 7.5.51.7212 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, FolioVision FV Flowplayer Video Player)
- [CVE-2026-49770](https://cve.now/CVE-2026-49770.md): WordPress WP Travel Engine plugin \<= 6.7.12 - PHP Object Injection vulnerability (CVSS 9.8, WP Travel Engine)
- [CVE-2026-49769](https://cve.now/CVE-2026-49769.md): WordPress wpForo Forum plugin \<= 3.1.0 - PHP Object Injection vulnerability (CVSS 9.8, Tomdever wpForo Forum)
- [CVE-2026-49768](https://cve.now/CVE-2026-49768.md): WordPress Happyforms plugin \<= 1.26.13 - PHP Object Injection vulnerability (CVSS 9.8, Happyforms)
- [CVE-2026-49766](https://cve.now/CVE-2026-49766.md): WordPress WP User Manager plugin \<= 2.9.16 - Arbitrary File Deletion vulnerability (CVSS 9.9, WP User Manager)
- [CVE-2026-49765](https://cve.now/CVE-2026-49765.md): WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin \<= 1.1.8 - PHP Object Injection vulnerability (CVSS 9.8, CRM Perks Integration for Mailchimp and Contact Form 7, WPF…)
- [CVE-2026-49764](https://cve.now/CVE-2026-49764.md): WordPress RegistrationMagic plugin \<= 6.0.8.6 - Broken Authentication vulnerability (CVSS 9.8, Metagauss RegistrationMagic)
- [CVE-2026-49763](https://cve.now/CVE-2026-49763.md): WordPress Integration for Contact Form 7 HubSpot plugin \<= 1.3.7 - PHP Object Injection vulnerability (CVSS 9.8, CRM Perks Integration for Contact Form 7 HubSpot)
- [CVE-2026-49112](https://cve.now/CVE-2026-49112.md): WordPress Shared Files plugin \<= 1.7.64 - Path Traversal vulnerability (CVSS 7.5, Tammersoft Shared Files)
- [CVE-2026-49110](https://cve.now/CVE-2026-49110.md): WordPress Upsell Order Bump Offer for WooCommerce plugin \<= 3.1.4 - Price Manipulation vulnerability (CVSS 7.5, WP Swings Upsell Order Bump Offer for WooCommerce)
- [CVE-2026-49109](https://cve.now/CVE-2026-49109.md): WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin \<= 1.4.3 - PHP Object Injection vulnerability (CVSS 9.8, crm perks Integration for Salesforce and Contact Form 7, WP…)
- [CVE-2026-49106](https://cve.now/CVE-2026-49106.md): WordPress Integration for Contact Form 7 and Constant Contact plugin \<= 1.1.6 - PHP Object Injection vulnerability (CVSS 9.8, CRM Perks Integration for Contact Form 7 and Constant Conta…)
- [CVE-2026-49105](https://cve.now/CVE-2026-49105.md): WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin \<= 1.1.4 - PHP Object Injection vulnerability (CVSS 9.8, CRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor…)
- [CVE-2026-49104](https://cve.now/CVE-2026-49104.md): WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin \<= 1.2.1 - PHP Object Injection vulnerability (CVSS 9.8, CRM Perks Integration for Keap/infusionsoft and Contact For…)
- [CVE-2026-49085](https://cve.now/CVE-2026-49085.md): WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin \<= 1.1.4 - PHP Object Injection vulnerability (CVSS 9.8, CRM Perks WP Insightly for Contact Form 7, WPForms, Element…)
- [CVE-2026-49083](https://cve.now/CVE-2026-49083.md): WordPress LatePoint plugin \<= 5.5.1 - Privilege Escalation vulnerability (CVSS 7.5, LatePoint)
- [CVE-2026-49082](https://cve.now/CVE-2026-49082.md): WordPress Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons plugin \<= 1.4.8 - Sensitive Data Exposure vulnerability (CVSS 7.4, Chatway Live Chat &#8211; AI Chatbot, Customer Support, FAQ…)
- [CVE-2026-49078](https://cve.now/CVE-2026-49078.md): WordPress WP Travel Engine plugin \<= 6.7.10 - Other Vulnerability Type vulnerability (CVSS 7.5, WP Travel Engine)
- [CVE-2026-49070](https://cve.now/CVE-2026-49070.md): WordPress Knit Pay plugin \<= 9.4.0.0 - Broken Access Control vulnerability (CVSS 7.5, Knit Pay)
- [CVE-2026-49068](https://cve.now/CVE-2026-49068.md): WordPress Coupon Affiliates plugin \<= 7.8.1 - Sensitive Data Exposure vulnerability (CVSS 7.5, RelyWP Coupon Affiliates)
- [CVE-2026-49067](https://cve.now/CVE-2026-49067.md): WordPress Advanced 301 and 302 Redirect plugin \<= 1.6.9 - SQL Injection vulnerability (CVSS 9.3, yydevelopment Advanced 301 and 302 Redirect)
- [CVE-2026-49066](https://cve.now/CVE-2026-49066.md): WordPress Conekta Payment Gateway plugin \<= 6.0.0 - Sensitive Data Exposure vulnerability (CVSS 7.5, Conekta Group Conekta Payment Gateway)
- [CVE-2026-49065](https://cve.now/CVE-2026-49065.md): WordPress Hippoo Mobile App for WooCommerce plugin \<= 1.9.5 - Broken Access Control vulnerability (CVSS 8.2, hippooo Hippoo Mobile App for WooCommerce)
- [CVE-2026-49063](https://cve.now/CVE-2026-49063.md): WordPress Listdom plugin \<= 5.5.0 - Privilege Escalation vulnerability (CVSS 7.3, Webilia Listdom)
- [CVE-2026-49061](https://cve.now/CVE-2026-49061.md): WordPress WPC Product Options for WooCommerce plugin \<= 3.2.1 - Arbitrary File Download vulnerability (CVSS 7.5, WPClever WPC Product Options for WooCommerce)
- [CVE-2026-49056](https://cve.now/CVE-2026-49056.md): WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin \<= 4.9.4 - Sensitive Data Exposure vulnerability (CVSS 7.5, WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery…)
- [CVE-2026-49055](https://cve.now/CVE-2026-49055.md): WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin \<= 1.3.9.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Glen Don Mongaya Drag and Drop Multiple File Upload – Conta…)
- [CVE-2026-49043](https://cve.now/CVE-2026-49043.md): WordPress WP Migrate Lite plugin \<= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.7, WP Engine WP Migrate Lite)
- [CVE-2026-48970](https://cve.now/CVE-2026-48970.md): WordPress Really Simple SSL plugin \<= 9.5.10 - Broken Authentication vulnerability (CVSS 8.1, Really Simple Plugins Really Simple SSL)
- [CVE-2026-48966](https://cve.now/CVE-2026-48966.md): WordPress Funnel Builder by FunnelKit plugin \<= 3.15.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Funnel Builder by FunnelKit)
- [CVE-2026-48965](https://cve.now/CVE-2026-48965.md): WordPress XCloner plugin \<= 4.8.6 - Sensitive Data Exposure vulnerability (CVSS 6.5, watchful XCloner)
- [CVE-2026-48964](https://cve.now/CVE-2026-48964.md): WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin \<= 3.3.6 - SQL Injection vulnerability (CVSS 8.5, ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing S…)
- [CVE-2026-48889](https://cve.now/CVE-2026-48889.md): WordPress Amelia plugin \<= 2.3 - Privilege Escalation vulnerability (CVSS 8.8, TMS Amelia)
- [CVE-2026-48887](https://cve.now/CVE-2026-48887.md): WordPress JS Help Desk plugin \<= 3.0.9 - Broken Access Control vulnerability (CVSS 6.5, Ahmad JS Help Desk)
- [CVE-2026-48886](https://cve.now/CVE-2026-48886.md): WordPress JS Help Desk plugin \<= 3.0.9 - SQL Injection vulnerability (CVSS 9.3, Ahmad JS Help Desk)
- [CVE-2026-48885](https://cve.now/CVE-2026-48885.md): WordPress HollerBox plugin \<= 2.3.10.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Groundhogg HollerBox)
- [CVE-2026-48883](https://cve.now/CVE-2026-48883.md): WordPress WPC Product Bundles for WooCommerce plugin \<= 8.5.3 - Broken Access Control vulnerability (CVSS 7.5, WPClever WPC Product Bundles for WooCommerce)
- [CVE-2026-48882](https://cve.now/CVE-2026-48882.md): WordPress WP Time Slots Booking Form plugin \<= 1.2.50 - SQL Injection vulnerability (CVSS 8.5, codepeople WP Time Slots Booking Form)
- [CVE-2026-48881](https://cve.now/CVE-2026-48881.md): WordPress TrueBooker plugin \<= 1.1.9 - Broken Access Control vulnerability (CVSS 9.1, themetechmount TrueBooker)
- [CVE-2026-48880](https://cve.now/CVE-2026-48880.md): WordPress WP Job Portal plugin \<= 2.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ahmad WP Job Portal)
- [CVE-2026-48878](https://cve.now/CVE-2026-48878.md): WordPress Visual Link Preview plugin \<= 2.4.1 - Sensitive Data Exposure vulnerability (CVSS 6.5, Bootstrapped Ventures Visual Link Preview)
- [CVE-2026-48876](https://cve.now/CVE-2026-48876.md): WordPress Stop Spammers plugin \<= 2026.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Web Guy Stop Spammers)
- [CVE-2026-48874](https://cve.now/CVE-2026-48874.md): WordPress GamiPress plugin \<= 7.8.7 - SQL Injection vulnerability (CVSS 8.5, Ruben Garcia GamiPress)
- [CVE-2026-48873](https://cve.now/CVE-2026-48873.md): WordPress Montonio for WooCommerce plugin \<= 10.1.2 - Broken Access Control vulnerability (CVSS 7.5, Montonio for WooCommerce)
- [CVE-2026-48872](https://cve.now/CVE-2026-48872.md): WordPress EmbedPress plugin \<= 4.5.2 - Sensitive Data Exposure vulnerability (CVSS 7.5, WPDeveloper EmbedPress)
- [CVE-2026-48871](https://cve.now/CVE-2026-48871.md): WordPress MW WP Form plugin \<= 5.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Takashi Kitajima MW WP Form)
- [CVE-2026-48870](https://cve.now/CVE-2026-48870.md): WordPress King Addons for Elementor plugin \<= 51.1.62 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, King Addons for Elementor)
- [CVE-2026-48868](https://cve.now/CVE-2026-48868.md): WordPress Simple Shopping Cart plugin \<= 5.2.9 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5, mra13 / Team Tips and Tricks HQ Simple Shopping Cart)
- [CVE-2026-48867](https://cve.now/CVE-2026-48867.md): WordPress Quiz And Survey Master plugin \<= 11.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ExpressTech Quiz And Survey Master)
- [CVE-2026-48838](https://cve.now/CVE-2026-48838.md): WordPress Post SMTP plugin \<= 3.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPExperts Post SMTP)
- [CVE-2026-48836](https://cve.now/CVE-2026-48836.md): WordPress Easy Invoice plugin \<= 2.1.19 - Remote Code Execution (RCE) vulnerability (CVSS 10.0, MantraBrain Easy Invoice)
- [CVE-2026-48835](https://cve.now/CVE-2026-48835.md): WordPress Contact Form by WPForms plugin \<= 1.10.0.4 - Broken Access Control vulnerability (CVSS 7.5, Awesomemotive Contact Form by WPForms)
- [CVE-2026-45441](https://cve.now/CVE-2026-45441.md): WordPress WpEvently plugin \<= 5.3.3 - Other Vulnerability Type vulnerability (CVSS 7.5, Magepeople WpEvently)
- [CVE-2026-45439](https://cve.now/CVE-2026-45439.md): WordPress Realtyna Organic IDX plugin plugin \<= 5.1.0 - SQL Injection vulnerability (CVSS 9.3, Realtyna Organic IDX plugin)
- [CVE-2026-45437](https://cve.now/CVE-2026-45437.md): WordPress Product Filter Widget for Elementor plugin \<= 1.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bhavin Thummar Product Filter Widget for Elementor)
- [CVE-2026-42775](https://cve.now/CVE-2026-42775.md): WordPress AutomatorWP plugin \<= 5.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ruben Garcia AutomatorWP)
- [CVE-2026-42752](https://cve.now/CVE-2026-42752.md): WordPress Stripe Payments plugin \<= 2.0.98 - Bypass Vulnerability vulnerability (CVSS 6.5, mra13 / Team Tips and Tricks HQ Stripe Payments)
- [CVE-2026-42743](https://cve.now/CVE-2026-42743.md): WordPress Masteriyo - LMS plugin \<= 2.1.8 - Broken Authentication vulnerability (CVSS 6.5, ThemeGrill Masteriyo - LMS)
- [CVE-2026-42688](https://cve.now/CVE-2026-42688.md): WordPress Modula Image Gallery plugin \<= 2.14.23 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Chill Modula Image Gallery)
- [CVE-2026-42687](https://cve.now/CVE-2026-42687.md): WordPress EventPrime plugin \<= 4.3.2.1 - PHP Object Injection vulnerability (CVSS 8.1, EventPrime)
- [CVE-2026-42686](https://cve.now/CVE-2026-42686.md): WordPress EventPrime plugin \<= 4.3.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, EventPrime)
- [CVE-2026-42668](https://cve.now/CVE-2026-42668.md): WordPress Email Marketing for WooCommerce by Omnisend plugin \<= 1.18.0 - Broken Authentication vulnerability (CVSS 7.5, Email Marketing for WooCommerce by Omnisend)
- [CVE-2026-42667](https://cve.now/CVE-2026-42667.md): WordPress Bookly plugin \<= 27.4 - Sensitive Data Exposure vulnerability (CVSS 7.5, Bookly)
- [CVE-2026-42666](https://cve.now/CVE-2026-42666.md): WordPress Salon booking system plugin \<= 10.30.25 - Broken Access Control vulnerability (CVSS 7.5, Dimitri Grassi Salon booking system)
- [CVE-2026-42665](https://cve.now/CVE-2026-42665.md): WordPress WP Data Access plugin \<= 5.5.70 - SQL Injection vulnerability (CVSS 9.3, Passionate Programmer Peter WP Data Access)
- [CVE-2026-42664](https://cve.now/CVE-2026-42664.md): WordPress AI Product Search for WooCommerce – Motive Commerce Search plugin \<= 1.38.2 - Broken Access Control vulnerability (CVSS 8.2, AI Product Search for WooCommerce &#8211; Motive Commerce S…)
- [CVE-2026-42663](https://cve.now/CVE-2026-42663.md): WordPress Simple Membership plugin \<= 4.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wp.insider Simple Membership)
- [CVE-2026-42662](https://cve.now/CVE-2026-42662.md): WordPress Event Tickets plugin \<= 5.27.5 - Bypass Vulnerability vulnerability (CVSS 6.5, Liquid Web / StellarWP Event Tickets)
- [CVE-2026-42661](https://cve.now/CVE-2026-42661.md): WordPress WP Customer Area plugin \<= 8.3.4 - Path Traversal vulnerability (CVSS 8.8, aguilatechnologies WP Customer Area)
- [CVE-2026-42660](https://cve.now/CVE-2026-42660.md): WordPress Contest Gallery plugin \<= 28.1.7 - Sensitive Data Exposure vulnerability (CVSS 6.5, Wasiliy Strecker Contest Gallery)
- [CVE-2026-42659](https://cve.now/CVE-2026-42659.md): WordPress Advanced Form Integration plugin \<= 1.126.12 - Broken Access Control vulnerability (CVSS 6.5, Nasir Ahmed Advanced Form Integration)
- [CVE-2026-42658](https://cve.now/CVE-2026-42658.md): WordPress Classified Listing plugin \<= 5.3.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mamunur Rashid Classified Listing)
- [CVE-2026-42657](https://cve.now/CVE-2026-42657.md): WordPress Contest Gallery plugin \<= 28.1.7 - Other Vulnerability Type vulnerability (CVSS 6.5, Wasiliy Strecker Contest Gallery)
- [CVE-2026-42656](https://cve.now/CVE-2026-42656.md): WordPress Contest Gallery plugin \<= 28.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Wasiliy Strecker Contest Gallery)
- [CVE-2026-42655](https://cve.now/CVE-2026-42655.md): WordPress Best Payments Plugin for WP plugin \<= 4.6.19 - Payment Bypass vulnerability (CVSS 7.5, WPManageNinja Best Payments Plugin for WP)
- [CVE-2026-42651](https://cve.now/CVE-2026-42651.md): WordPress Classified Listing plugin \<= 5.3.9 - Broken Access Control vulnerability (CVSS 6.3, Mamunur Rashid Classified Listing)
- [CVE-2026-42650](https://cve.now/CVE-2026-42650.md): WordPress AutomatorWP plugin \<= 5.6.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.2, Ruben Garcia AutomatorWP)
- [CVE-2026-42649](https://cve.now/CVE-2026-42649.md): WordPress Favicon Rotator plugin \<= 1.2.11 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Archetyped Favicon Rotator)
- [CVE-2026-42640](https://cve.now/CVE-2026-42640.md): WordPress Classified Listing plugin \<= 5.3.8 - Broken Access Control vulnerability (CVSS 6.5, Mamunur Rashid Classified Listing)
- [CVE-2026-42639](https://cve.now/CVE-2026-42639.md): WordPress GD Rating System plugin \<= 3.6.2 - SQL Injection vulnerability (CVSS 9.3, Dev4Press GD Rating System)
- [CVE-2026-42411](https://cve.now/CVE-2026-42411.md): WordPress CloudSecure WP Security plugin \<= 1.4.7 - Broken Authentication vulnerability (CVSS 8.1, XServer CloudSecure WP Security)
- [CVE-2026-42386](https://cve.now/CVE-2026-42386.md): WordPress Order Delivery Date for WooCommerce plugin \<= 4.5.1 - SQL Injection vulnerability (CVSS 9.3, tychesoftwares Order Delivery Date for WooCommerce)
- [CVE-2026-42384](https://cve.now/CVE-2026-42384.md): WordPress Simply Schedule Appointments plugin \< 1.6.11.2 - Sensitive Data Exposure vulnerability (CVSS 7.5, NSquared Simply Schedule Appointments)
- [CVE-2026-42381](https://cve.now/CVE-2026-42381.md): WordPress Funnel Builder by FunnelKit plugin \<= 3.15.0.1 - SQL Injection vulnerability (CVSS 9.3, Funnel Builder by FunnelKit)
- [CVE-2026-42378](https://cve.now/CVE-2026-42378.md): WordPress WP Full Stripe Free plugin \<= 8.4.1 - Broken Authentication vulnerability (CVSS 6.5, Themeisle WP Full Stripe Free)
- [CVE-2026-41556](https://cve.now/CVE-2026-41556.md): WordPress ProfilePress plugin \<= 4.16.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, properfraction ProfilePress)
- [CVE-2026-40799](https://cve.now/CVE-2026-40799.md): WordPress Simple Cloudflare Turnstile plugin \<= 1.38.0 - Broken Authentication vulnerability (CVSS 5.8, RelyWP Simple Cloudflare Turnstile)
- [CVE-2026-40798](https://cve.now/CVE-2026-40798.md): WordPress wpForo Forum plugin \<= 3.0.4 - SQL Injection vulnerability (CVSS 9.3, Tomdever wpForo Forum)
- [CVE-2026-40796](https://cve.now/CVE-2026-40796.md): WordPress WPPizza plugin \<= 3.19.9 - Sensitive Data Exposure vulnerability (CVSS 6.5, ollybach WPPizza)
- [CVE-2026-40795](https://cve.now/CVE-2026-40795.md): WordPress Amelia plugin \<= 2.2 - Broken Access Control vulnerability (CVSS 6.5, TMS Amelia)
- [CVE-2026-40794](https://cve.now/CVE-2026-40794.md): WordPress myCred plugin \<= 3.0.3 - Broken Access Control vulnerability (CVSS 6.5, myCred)
- [CVE-2026-40793](https://cve.now/CVE-2026-40793.md): WordPress Groundhogg plugin \< 4.4.1 - Broken Access Control vulnerability (CVSS 6.5, Groundhogg)
- [CVE-2026-40792](https://cve.now/CVE-2026-40792.md): WordPress KiviCare plugin \<= 4.2.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.3, Iqonic Design KiviCare)
- [CVE-2026-40791](https://cve.now/CVE-2026-40791.md): WordPress WP Time Slots Booking Form plugin \<= 1.2.46 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, codepeople WP Time Slots Booking Form)
- [CVE-2026-40790](https://cve.now/CVE-2026-40790.md): WordPress WP SMS plugin \<= 7.2.1 - Sensitive Data Exposure vulnerability (CVSS 6.5, VeronaLabs WP SMS)
- [CVE-2026-40789](https://cve.now/CVE-2026-40789.md): WordPress Amelia plugin \<= 2.2 - Sensitive Data Exposure vulnerability (CVSS 7.5, TMS Amelia)
- [CVE-2026-40788](https://cve.now/CVE-2026-40788.md): WordPress ChatBot plugin \<= 7.9.7 - Broken Access Control vulnerability (CVSS 7.1, QuantumCloud ChatBot)
- [CVE-2026-40787](https://cve.now/CVE-2026-40787.md): WordPress Quiz And Survey Master plugin \<= 11.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ExpressTech Quiz And Survey Master)
- [CVE-2026-40785](https://cve.now/CVE-2026-40785.md): WordPress AutomatorWP plugin \<= 5.6.7 - Broken Authentication vulnerability (CVSS 7.1, Ruben Garcia AutomatorWP)
- [CVE-2026-40782](https://cve.now/CVE-2026-40782.md): WordPress WPAdverts plugin \<= 2.3.0 - Broken Access Control vulnerability (CVSS 6.5, Greg Winiarski WPAdverts)
- [CVE-2026-40781](https://cve.now/CVE-2026-40781.md): WordPress ReviewX plugin \<= 2.3.6 - Broken Authentication vulnerability (CVSS 7.5, ReviewX)
- [CVE-2026-40779](https://cve.now/CVE-2026-40779.md): WordPress Link Library plugin \<= 7.8.8 - Arbitrary File Deletion vulnerability (CVSS 7.7, Yannick Lefebvre Link Library)
- [CVE-2026-40776](https://cve.now/CVE-2026-40776.md): WordPress Eventin plugin \<= 4.1.8 - Broken Access Control vulnerability (CVSS 7.5, Arraytics WP Event SOlution)
- [CVE-2026-40775](https://cve.now/CVE-2026-40775.md): WordPress Royal MCP plugin \<= 1.4.2 - Broken Access Control vulnerability (CVSS 7.3, Royal Plugins Royal MCP)
- [CVE-2026-40774](https://cve.now/CVE-2026-40774.md): WordPress Booking Package plugin \<= 1.7.06 - Broken Access Control vulnerability (CVSS 7.5, SaasProject Booking Package)
- [CVE-2026-40773](https://cve.now/CVE-2026-40773.md): WordPress rtMedia for WordPress, BuddyPress and bbPress plugin \<= 4.7.9 - Broken Access Control vulnerability (CVSS 6.5, rtCamp rtMedia for WordPress, BuddyPress and bbPress)
- [CVE-2026-40772](https://cve.now/CVE-2026-40772.md): WordPress GeekyBot plugin \<= 1.2.2 - Arbitrary File Upload vulnerability (CVSS 10.0, Ahmad GeekyBot)
- [CVE-2026-40771](https://cve.now/CVE-2026-40771.md): WordPress Contest Gallery plugin \<= 28.1.6 - SQL Injection vulnerability (CVSS 9.3, Wasiliy Strecker Contest Gallery)
- [CVE-2026-40770](https://cve.now/CVE-2026-40770.md): WordPress Coupon Affiliates plugin \<= 7.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, RelyWP Coupon Affiliates)
- [CVE-2026-40769](https://cve.now/CVE-2026-40769.md): WordPress Contact Form Extender for Divi – Save Entries, File Upload & Country Code Field plugin \<= 1.0.6 - Arbitrary File Deletion vulnerability (CVSS 8.6, Satinder Singh Contact Form Extender for Divi &#8211; Save…)
- [CVE-2026-40767](https://cve.now/CVE-2026-40767.md): WordPress wpForo Forum plugin \< 3.0.2 - Broken Access Control vulnerability (CVSS 7.5, Tomdever wpForo Forum)
- [CVE-2026-40766](https://cve.now/CVE-2026-40766.md): WordPress MasterStudy LMS plugin \<= 3.7.25 - SQL Injection vulnerability (CVSS 8.5, StylemixThemes MasterStudy LMS)
- [CVE-2026-40762](https://cve.now/CVE-2026-40762.md): WordPress WPGraphQL plugin \< 2.11.1 - SQL Injection vulnerability (CVSS 7.5, WPGraphQL)
- [CVE-2026-40743](https://cve.now/CVE-2026-40743.md): WordPress Tutor LMS plugin \<= 3.9.7 - Broken Access Control vulnerability (CVSS 6.5, Themeum Tutor LMS)
- [CVE-2026-40741](https://cve.now/CVE-2026-40741.md): WordPress Redsys for WooCommerce Light plugin \<= 7.0.0 - Broken Access Control vulnerability (CVSS 7.5, Jose Conti Redsys for WooCommerce Light)
- [CVE-2026-40732](https://cve.now/CVE-2026-40732.md): WordPress Notification for Telegram plugin \<= 3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, rainafarai Notification for Telegram)
- [CVE-2026-40727](https://cve.now/CVE-2026-40727.md): WordPress Groundhogg plugin \<= 4.4 - Arbitrary File Deletion vulnerability (CVSS 7.7, Groundhogg)
- [CVE-2026-39594](https://cve.now/CVE-2026-39594.md): WordPress Ultra Addons for WPForms plugin \<= 1.0.11 - Broken Access Control vulnerability (CVSS 6.4, Themefic Ultra Addons for WPForms)
- [CVE-2026-39591](https://cve.now/CVE-2026-39591.md): WordPress WP-BusinessDirectory plugin \<= 4.0.0 - Arbitrary File Upload vulnerability (CVSS 9.9, CMSJunkie – WordPress Business Directory Plugins WP-Busines…)
- [CVE-2026-39587](https://cve.now/CVE-2026-39587.md): WordPress WP BASE Booking plugin \<= 5.9.0 - Privilege Escalation vulnerability (CVSS 8.1, Hakan Ozevin WP BASE Booking)
- [CVE-2026-39584](https://cve.now/CVE-2026-39584.md): WordPress RepairBuddy plugin \<= 4.1132 - Broken Access Control vulnerability (CVSS 6.5, Webful Creations RepairBuddy)
- [CVE-2026-39583](https://cve.now/CVE-2026-39583.md): WordPress Datalogics Ecommerce Delivery plugin \<= 2.6.62 - Privilege Escalation vulnerability (CVSS 9.8, Datalogics Ecommerce Delivery)
- [CVE-2026-39579](https://cve.now/CVE-2026-39579.md): WordPress B Blocks plugin \<= 2.0.31 - Privilege Escalation vulnerability (CVSS 8.8, bPlugins B Blocks)
- [CVE-2026-39540](https://cve.now/CVE-2026-39540.md): WordPress Shipment Tracker for Woocommerce plugin \<= 1.5.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Amit Mittal Shipment Tracker for Woocommerce)
- [CVE-2026-39534](https://cve.now/CVE-2026-39534.md): WordPress WP Directory Kit plugin \<= 1.5.0 - Broken Access Control vulnerability (CVSS 7.5, WP Directory Kit)
- [CVE-2026-39533](https://cve.now/CVE-2026-39533.md): WordPress AWP Classifieds plugin \<= 4.4.4 - Broken Access Control vulnerability (CVSS 7.5, WPTasty AWP Classifieds)
- [CVE-2026-39532](https://cve.now/CVE-2026-39532.md): WordPress Events Calendar for GeoDirectory plugin \<= 2.3.25 - PHP Object Injection vulnerability (CVSS 8.8, Stiofan Events Calendar for GeoDirectory)
- [CVE-2026-39530](https://cve.now/CVE-2026-39530.md): WordPress SpeakOut! Email Petitions plugin \<= 4.6.5 - SQL Injection vulnerability (CVSS 9.3, SpeakOut! Email Petitions)
- [CVE-2026-39527](https://cve.now/CVE-2026-39527.md): WordPress WpStream plugin \< 4.11.2 - Arbitrary File Upload vulnerability (CVSS 5.4, sc Internet Vivoo WpStream)
- [CVE-2026-39525](https://cve.now/CVE-2026-39525.md): WordPress Booking Activities plugin \<= 1.16.48.1 - Broken Access Control vulnerability (CVSS 6.5, Booking Activities Team Booking Activities)
- [CVE-2026-39524](https://cve.now/CVE-2026-39524.md): WordPress Masteriyo - LMS plugin \<= 2.1.5 - Payment Bypass vulnerability (CVSS 7.5, ThemeGrill Masteriyo - LMS)
- [CVE-2026-39519](https://cve.now/CVE-2026-39519.md): WordPress GeekyBot plugin \<= 1.2.0 - SQL Injection vulnerability (CVSS 9.3, Ahmad GeekyBot)
- [CVE-2026-39518](https://cve.now/CVE-2026-39518.md): WordPress EventPrime plugin \<= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.1, EventPrime)
- [CVE-2026-39515](https://cve.now/CVE-2026-39515.md): WordPress Motors plugin \< 1.4.107 - Broken Access Control vulnerability (CVSS 6.5, StylemixThemes Motors)
- [CVE-2026-39514](https://cve.now/CVE-2026-39514.md): WordPress Paid Member Subscriptions plugin \<= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Cozmoslabs Paid Member Subscriptions)
- [CVE-2026-39513](https://cve.now/CVE-2026-39513.md): WordPress Easy Appointments plugin \<= 3.12.21 - Broken Access Control vulnerability (CVSS 7.5, Easy Appointments)
- [CVE-2026-39512](https://cve.now/CVE-2026-39512.md): WordPress GeoDirectory plugin \<= 2.8.152 - SQL Injection vulnerability (CVSS 9.3, Paolo GeoDirectory)
- [CVE-2026-39511](https://cve.now/CVE-2026-39511.md): WordPress WP Photo Album Plus plugin \<= 9.1.08.001 - SQL Injection vulnerability (CVSS 9.3, Jacob N. Breetvelt WP Photo Album Plus)
- [CVE-2026-39507](https://cve.now/CVE-2026-39507.md): WordPress Social Slider Feed plugin \<= 2.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Themeisle Social Slider Feed)
- [CVE-2026-39503](https://cve.now/CVE-2026-39503.md): WordPress Easy Digital Downloads plugin \<= 3.6.5 - Broken Access Control vulnerability (CVSS 7.5, Awesomemotive Easy Digital Downloads)
- [CVE-2026-39502](https://cve.now/CVE-2026-39502.md): WordPress Form Maker by 10Web plugin \<= 1.15.38 - SQL Injection vulnerability (CVSS 9.3, Form Maker by 10Web)
- [CVE-2026-39499](https://cve.now/CVE-2026-39499.md): WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin \<= 1.6.19 - PHP Object Injection vulnerability (CVSS 7.2, Wombat Plugins Advanced Product Fields (Product Addons) for…)
- [CVE-2026-39498](https://cve.now/CVE-2026-39498.md): WordPress YayMail plugin \<= 4.3.3 - PHP Object Injection vulnerability (CVSS 7.2, Yeeaddons YayMail)
- [CVE-2026-39493](https://cve.now/CVE-2026-39493.md): WordPress Simply Schedule Appointments plugin \<= 1.6.9.27 - SQL Injection vulnerability (CVSS 9.3, NSquared Simply Schedule Appointments)
- [CVE-2026-39492](https://cve.now/CVE-2026-39492.md): WordPress WP Maps plugin \<= 4.9.1 - SQL Injection vulnerability (CVSS 9.3, Flipper Code – WordPress Development Company WP Maps)
- [CVE-2026-39491](https://cve.now/CVE-2026-39491.md): WordPress JupiterX Core plugin \<= 4.14.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, artbees JupiterX Core)
- [CVE-2026-39489](https://cve.now/CVE-2026-39489.md): WordPress Download Monitor plugin \<= 5.1.9 - Non-Arbitrary File Download vulnerability (CVSS 4.4, WP Chill Download Monitor)
- [CVE-2026-39481](https://cve.now/CVE-2026-39481.md): WordPress Modula Image Gallery plugin \<= 2.14.18 - PHP Object Injection vulnerability (CVSS 7.2, WP Chill Modula Image Gallery)
- [CVE-2026-39480](https://cve.now/CVE-2026-39480.md): WordPress Backup Migration plugin \<= 2.1.1 - Sensitive Data Exposure vulnerability (CVSS 7.5, Inisev Backup Migration)
- [CVE-2026-39478](https://cve.now/CVE-2026-39478.md): WordPress Anti-Malware Security and Brute-Force Firewall plugin \<= 4.23.87 - PHP Object Injection vulnerability (CVSS 8.8, Eli Scheetz Anti-Malware Security and Brute-Force Firewall)
- [CVE-2026-39474](https://cve.now/CVE-2026-39474.md): WordPress Post Duplicator plugin \<= 3.0.10 - PHP Object Injection vulnerability (CVSS 8.8, metaphorcreations Post Duplicator)
- [CVE-2026-39472](https://cve.now/CVE-2026-39472.md): WordPress WooCommerce PDF Invoices & Packing Slips plugin \< 5.9.0 - PHP Object Injection vulnerability (CVSS 7.2, WP Overnight WooCommerce PDF Invoices & Packing Slips)
- [CVE-2026-39471](https://cve.now/CVE-2026-39471.md): WordPress ShortPixel Image Optimizer plugin \<= 6.4.3 - PHP Object Injection vulnerability (CVSS 7.2, ShortPixel Image Optimizer)
- [CVE-2026-39470](https://cve.now/CVE-2026-39470.md): WordPress WooCommerce Cart Abandonment Recovery plugin \< 2.1.0 - Privilege Escalation vulnerability (CVSS 7.2, Brainstorm Force WooCommerce Cart Abandonment Recovery)
- [CVE-2026-39468](https://cve.now/CVE-2026-39468.md): WordPress Meta Box – WordPress Custom Fields Framework plugin \<= 5.11.1 - Arbitrary File Deletion vulnerability (CVSS 6.8, eLightUp Meta Box – WordPress Custom Fields Framework)
- [CVE-2026-39465](https://cve.now/CVE-2026-39465.md): WordPress Responsive Slider by MetaSlider plugin \<= 3.106.0 - Remote Code Execution (RCE) vulnerability (CVSS 9.1, Responsive Slider by MetaSlider)
- [CVE-2026-39463](https://cve.now/CVE-2026-39463.md): WordPress ManageWP Worker plugin \<= 4.9.31 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ManageWP Worker)
- [CVE-2026-39451](https://cve.now/CVE-2026-39451.md): WordPress WP Google Review Slider plugin \<= 18.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.3, jgwhite33 WP Google Review Slider)
- [CVE-2026-39450](https://cve.now/CVE-2026-39450.md): WordPress FunnelKit Automations plugin \<= 3.7.3 - Broken Authentication vulnerability (CVSS 7.1, Aman FunnelKit Automations)
- [CVE-2026-39449](https://cve.now/CVE-2026-39449.md): WordPress Contact Form to Any API plugin \<= 3.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, IT Path Solutions Contact Form to Any API)
- [CVE-2026-39447](https://cve.now/CVE-2026-39447.md): WordPress Simply Schedule Appointments plugin \<= 1.6.10.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NSquared Simply Schedule Appointments)
- [CVE-2026-39441](https://cve.now/CVE-2026-39441.md): WordPress Feed KuantoKusta for WooCommerce – Free plugin \<= 5.3 - SQL Injection vulnerability (CVSS 9.3, Naked Cat Plugins (by Webdados) Feed KuantoKusta for WooCom…)
- [CVE-2026-39435](https://cve.now/CVE-2026-39435.md): WordPress CformsII plugin \<= 15.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, bgermann CformsII)
- [CVE-2026-39434](https://cve.now/CVE-2026-39434.md): WordPress CTX Feed plugin \<= 6.6.26 - PHP Object Injection vulnerability (CVSS 7.2, WebAppick CTX Feed)
- [CVE-2026-34902](https://cve.now/CVE-2026-34902.md): WordPress WooCommerce Product Table Lite plugin \<= 4.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WC Product Table WooCommerce Product Table Lite)
- [CVE-2026-34901](https://cve.now/CVE-2026-34901.md): WordPress iControlWP plugin \<= 5.5.3 - Privilege Escalation vulnerability (CVSS 9.8, Paul iControlWP)
- [CVE-2026-34900](https://cve.now/CVE-2026-34900.md): WordPress GiveWP plugin \<= 4.14.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Liquid Web / StellarWP GiveWP)
- [CVE-2026-34898](https://cve.now/CVE-2026-34898.md): WordPress Event Tickets Manager for WooCommerce plugin \<= 1.5.3 - Broken Access Control vulnerability (CVSS 7.5, WP Swings Event Tickets Manager for WooCommerce)
- [CVE-2026-34892](https://cve.now/CVE-2026-34892.md): WordPress Rank Math SEO plugin \<= 1.0.271 - Broken Access Control vulnerability (CVSS 6.5, Rank Math SEO)
- [CVE-2026-34891](https://cve.now/CVE-2026-34891.md): WordPress IDPay Payment Gateway for Woocommerce plugin \<= 2.2.5 - Sensitive Data Exposure vulnerability (CVSS 7.5, IDPay Payment Gateway for Woocommerce)
- [CVE-2026-34886](https://cve.now/CVE-2026-34886.md): WordPress Simple Membership plugin \<= 4.7.1 - Broken Access Control vulnerability (CVSS 7.5, wp.insider Simple Membership)
- [CVE-2026-27407](https://cve.now/CVE-2026-27407.md): WordPress AI Engine plugin \<= 3.4.9 - Privilege Escalation vulnerability (CVSS 7.2, Meow Apps AI Engine)
- [CVE-2026-27333](https://cve.now/CVE-2026-27333.md): WordPress Paid Videochat Turnkey Site plugin \<= 7.3.23 - Deserialization of untrusted data vulnerability (CVSS 8.1, VideoWhisper.com Paid Videochat Turnkey Site)
- [CVE-2026-27089](https://cve.now/CVE-2026-27089.md): WordPress WpTravelly plugin \<= 2.1.7 - Bypass Vulnerability vulnerability (CVSS 7.5, Magepeople WpTravelly)
- [CVE-2026-27053](https://cve.now/CVE-2026-27053.md): WordPress Broadcast Live Video plugin \< 7.1.3 - PHP Object Injection vulnerability (CVSS 9.8, VideoWhisper.com Broadcast Live Video)
- [CVE-2026-25440](https://cve.now/CVE-2026-25440.md): WordPress Essential Addons for Elementor plugin \< 6.6.0 - Broken Access Control vulnerability (CVSS 5.3, WPDeveloper Essential Addons for Elementor)
- [CVE-2026-25425](https://cve.now/CVE-2026-25425.md): WordPress User Registration plugin \<= 5.1.2 - Broken Access Control vulnerability (CVSS 7.5, ThemeGrill User Registration)
- [CVE-2026-24637](https://cve.now/CVE-2026-24637.md): WordPress PowerPress Podcasting plugin \<= 11.15.10 - SQL Injection vulnerability (CVSS 8.5, Blubrry Podcasting PowerPress Podcasting)
- [CVE-2026-23970](https://cve.now/CVE-2026-23970.md): WordPress Redirection for Contact Form 7 plugin \<= 3.2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Themeisle Redirection for Contact Form)
- [CVE-2026-9691](https://cve.now/CVE-2026-9691.md): WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin \<= 1.1.1 - PHP Object Injection vulnerability (CVSS 9.8, CRM Perks Integration for ActiveCampaign and Contact Form 7…)
- [CVE-2025-69332](https://cve.now/CVE-2025-69332.md): WordPress Bookify plugin \<= 1.1.1 - Broken Access Control vulnerability (CVSS 6.5, myCred Bookify)
- [CVE-2025-68872](https://cve.now/CVE-2025-68872.md): WordPress Eli's WordCents adSense Widget with Analytics plugin \<= 1.3.03.27 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Eli&#039;s WordCents adSense Widget with Analytics)
- [CVE-2025-68851](https://cve.now/CVE-2025-68851.md): WordPress Okay Toolkit plugin \<= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ArrayHQ Okay Toolkit)
- [CVE-2025-68840](https://cve.now/CVE-2025-68840.md): WordPress iRobots.txt SEO plugin \<= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, markbeljaars iRobots.txt SEO)
- [CVE-2025-68049](https://cve.now/CVE-2025-68049.md): WordPress bunny.net plugin \<= 2.3.6 - Broken Access Control vulnerability (CVSS 6.3, bunny.net)
- [CVE-2025-60175](https://cve.now/CVE-2025-60175.md): WordPress PopAd Plugin \<= 1.0.4 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.4, vynnus PopAd)
- [CVE-2025-59133](https://cve.now/CVE-2025-59133.md): WordPress Projectopia plugin \<= 5.1.25.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5, Projectopia)
- [CVE-2026-48709](https://cve.now/CVE-2026-48709.md): OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration (CVSS 3.7, OliveTin · github.com/OliveTin/OliveTin)
- [CVE-2026-48708](https://cve.now/CVE-2026-48708.md): OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination (CVSS 7.5, OliveTin · github.com/OliveTin/OliveTin)
- [CVE-2026-48124](https://cve.now/CVE-2026-48124.md): Cursor Desktop sandbox escape via Claude hook configuration (CVSS 8.5, cursor)
- [CVE-2026-47261](https://cve.now/CVE-2026-47261.md): Wasmtime: WASI path\_open(TRUNCATE) bypasses \`FilePerms::WRITE\` host restriction (CVSS 7.5, bytecodealliance wasmtime · wasmtime-wasi)
- [CVE-2026-47825](https://cve.now/CVE-2026-47825.md): Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations (CVSS 8.6, Spring Cloud Gateway)
- [CVE-2026-48518](https://cve.now/CVE-2026-48518.md): MultiJuicer: Login CSRF allows attacker to force victims into their team (CVSS 4.3, juice-shop multi-juicer)
- [CVE-2026-52718](https://cve.now/CVE-2026-52718.md): Gstreamer1-plugins-bad-free: gstreamer: denial of service via av1 tile\_list\_obu parser byte/bit confusion (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-52722](https://cve.now/CVE-2026-52722.md): Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling (CVSS 7.1, Red Hat Enterprise Linux)
- [CVE-2026-52720](https://cve.now/CVE-2026-52720.md): Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb (CVSS 8.8, Red Hat Enterprise Linux)
- [CVE-2026-53704](https://cve.now/CVE-2026-53704.md): Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer fileinfo metadata parser (CVSS 7.1, Red Hat Enterprise Linux)
- [CVE-2026-53703](https://cve.now/CVE-2026-53703.md): Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer audio stream header parser (CVSS 7.1, Red Hat Enterprise Linux)
- [CVE-2026-52721](https://cve.now/CVE-2026-52721.md): Gstreamer1-plugins-bad-free: gstreamer: multiple out-of-bounds reads in pcapparse ipv4/tcp header parsing (CVSS 5.3, Red Hat Enterprise Linux)
- [CVE-2026-53705](https://cve.now/CVE-2026-53705.md): Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow (CVSS 7.6, Red Hat Enterprise Linux)
- [CVE-2026-52719](https://cve.now/CVE-2026-52719.md): Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoder (CVSS 7.1, Red Hat Enterprise Linux)
- [CVE-2026-41708](https://cve.now/CVE-2026-41708.md): Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability (CVSS 7.5, Spring Cloud Sleuth · org.springframework.cloud:spring-clou…)
- [CVE-2026-47835](https://cve.now/CVE-2026-47835.md): Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores (CVSS 8.6, Spring AI · org.springframework.ai:spring-ai-opensearch-… +2)
- [CVE-2026-48114](https://cve.now/CVE-2026-48114.md): Metacat has an unauthenticated SQL injection vulnerability (CVSS 9.8, NCEAS metacat)
- [CVE-2026-49954](https://cve.now/CVE-2026-49954.md): Discuz! X5.0 Local File Inclusion via enable\_disable.php Plugin Directory (CVSS 8.6, Discuz! X5.0)
- [CVE-2026-49953](https://cve.now/CVE-2026-49953.md): Discuz! X5.0 CAPTCHA Bypass via Predictable Character Set (CVSS 6.9, Discuz! X5.0)
- [CVE-2026-49952](https://cve.now/CVE-2026-49952.md): Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle (CVSS 9.3, Discuz! X5.0)
- [CVE-2026-11931](https://cve.now/CVE-2026-11931.md): Insecure Permissions on Authentication Token Cache File in Kiro IDE (CVSS 6.8, AWS Kiro IDE)
- [CVE-2026-47777](https://cve.now/CVE-2026-47777.md): Mastodon has a consent-check bypass in its remote Collections (CVSS 7.5, mastodon)
- [CVE-2026-49294](https://cve.now/CVE-2026-49294.md): Valhalla has reflected XSS via unsanitized JSONP callback parameter (CVSS 6.1, valhalla)
- [CVE-2026-8358](https://cve.now/CVE-2026-8358.md): Heap buffer overflow in spreadsheet tracked-changes import (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-8357](https://cve.now/CVE-2026-8357.md): Heap buffer overflow in Calc formula compilation (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-8356](https://cve.now/CVE-2026-8356.md): Stack buffer overflow in PPT presentation import (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-6047](https://cve.now/CVE-2026-6047.md): Heap buffer overflow in OOXML text box element import (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-6045](https://cve.now/CVE-2026-6045.md): Heap buffer overflow in EMF+ gradient brush import (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-6040](https://cve.now/CVE-2026-6040.md): Heap use-after-free in ODF number-format blank-width parsing (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-6039](https://cve.now/CVE-2026-6039.md): Heap buffer overflow in DXF polyline import (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-20262](https://cve.now/CVE-2026-20262.md): Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability (CVSS 6.5, KEV, Cisco Catalyst SD-WAN Manager)
- [CVE-2026-9863](https://cve.now/CVE-2026-9863.md): Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability (CVSS 7.5, Fortra Core Privileged Access Manager)
- [CVE-2025-15659](https://cve.now/CVE-2025-15659.md): WordPress Elizaibots plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, liseperu Elizaibots)
- [CVE-2025-15658](https://cve.now/CVE-2025-15658.md): WordPress WP Emmet plugin \<= 0.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, rewish WP Emmet)
- [CVE-2026-9862](https://cve.now/CVE-2026-9862.md): Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability (CVSS 9.8, Fortra Core Privileged Access Manager)
- [CVE-2026-9595](https://cve.now/CVE-2026-9595.md): webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies (CVSS 5.3, webpack-dev-server)
- [CVE-2026-5038](https://cve.now/CVE-2026-5038.md): multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads (CVSS 5.3, multer)
- [CVE-2026-10634](https://cve.now/CVE-2026-10634.md): Use-after-free in Zephyr native TCP \`net\_tcp\_foreach()\` due to dropping \`tcp\_lock\` during the callback (CVSS 4.8, zephyrproject zephyr)
- [CVE-2026-8683](https://cve.now/CVE-2026-8683.md): Overly long URLs crash the Mattermost Desktop App (CVSS 6.5, Mattermost)
- [CVE-2026-5079](https://cve.now/CVE-2026-5079.md): multer vulnerable to Denial of Service via deeply nested field names (CVSS 7.5, multer)
- [CVE-2026-6517](https://cve.now/CVE-2026-6517.md): Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed (CVSS 6.3, Mattermost)
- [CVE-2025-64215](https://cve.now/CVE-2025-64215.md): WordPress MasterStudy LMS Pro plugin \< 4.7.16 - Broken Access Control vulnerability (CVSS 6.5, StylemixThemes MasterStudy LMS Pro)
- [CVE-2026-49064](https://cve.now/CVE-2026-49064.md): WordPress GetPaid plugin \<= 2.8.49 - Sensitive Data Exposure vulnerability (CVSS 7.5, Stiofan GetPaid)
- [CVE-2026-48969](https://cve.now/CVE-2026-48969.md): WordPress Really Simple SSL plugin \<= 9.5.9 - Broken Access Control vulnerability (CVSS 6.5, Really Simple Plugins B.V. Really Simple SSL)
- [CVE-2026-49111](https://cve.now/CVE-2026-49111.md): WordPress Masteriyo - LMS plugin \<= 2.2.0 - Privilege Escalation vulnerability (CVSS 8.8, ThemeGrill Masteriyo - LMS)
- [CVE-2026-49062](https://cve.now/CVE-2026-49062.md): WordPress Faust.js plugin \<= 1.8.7 - Broken Authentication vulnerability (CVSS 8.8, WP Engine Faust.js)
- [CVE-2026-52704](https://cve.now/CVE-2026-52704.md): WordPress WooCommerce PDF Invoice Builder plugin \<= 2.0.8 - Remote Code Execution (RCE) vulnerability (CVSS 10.0, Edgar Rojas WooCommerce PDF Invoice Builder)
- [CVE-2026-5242](https://cve.now/CVE-2026-5242.md): Code Injection in Mia Technologies' Pizzy Library (CVSS 8.8, MIA Technology Pizzy Library)
- [CVE-2026-5233](https://cve.now/CVE-2026-5233.md): Missing Rate Limiting in Mia Technologies' Pizzy Library (CVSS 7.1, MIA Technology Pizzy Library)
- [CVE-2026-5230](https://cve.now/CVE-2026-5230.md): Improper Access Control in Mia Technologies' Pizzy Library (CVSS 7.1, MIA Technology Pizzy Library)
- [CVE-2016-20068](https://cve.now/CVE-2016-20068.md): WordPress Booking Calendar Contact Form 1.0.23 SQL Injection (CVSS 8.8, dwbooster Booking Calendar Contact Form)
- [CVE-2019-25746](https://cve.now/CVE-2019-25746.md): WordPress Sliced Invoices 3.8.2 SQL Injection via post Parameter (CVSS 7.1, SlicedInvoices Sliced Invoices)
- [CVE-2018-25437](https://cve.now/CVE-2018-25437.md): WordPress CherryFramework Themes 3.1.4 Backup File Download (CVSS 8.7, Cherryframework Cherry Framework Themes)
- [CVE-2018-25436](https://cve.now/CVE-2018-25436.md): WordPress Plugin Baggage Freight Shipping Australia 0.1.0 Arbitrary File Upload (CVSS 9.3, Shipster Baggage Freight Shipping Australia)
- [CVE-2016-20084](https://cve.now/CVE-2016-20084.md): WordPress appointment-booking-calendar 1.1.24 Privilege Escalation XSS (CVSS 5.1, dwbooster Appointment Booking Calendar)
- [CVE-2016-20083](https://cve.now/CVE-2016-20083.md): WordPress More Fields Plugin 2.1 Cross-Site Request Forgery (CVSS 6.9, henrikmelin More Fields)
- [CVE-2016-20082](https://cve.now/CVE-2016-20082.md): WordPress Plugin Abtest Local File Inclusion via abtest\_admin.php (CVSS 6.9, Abtest)
- [CVE-2016-20081](https://cve.now/CVE-2016-20081.md): WordPress Plugin HB Audio Gallery Lite 1.0.0 Path Traversal File Download (CVSS 8.7, Husain HB Audio Gallery Lite)
- [CVE-2016-20080](https://cve.now/CVE-2016-20080.md): WordPress Brandfolder Plugin 3.0 Local File Inclusion via callback.php (CVSS 6.9, Brandfolder)
- [CVE-2016-20079](https://cve.now/CVE-2016-20079.md): WordPress Dharma Booking 2.28.3 Local File Inclusion via proccess.php (CVSS 6.9, jamie Dharma Booking)
- [CVE-2016-20078](https://cve.now/CVE-2016-20078.md): WordPress IMDb Profile Widget 1.0.8 Local File Inclusion via pic.php (CVSS 6.9, Henrique Dias IMDb Profile Widget)
- [CVE-2016-20077](https://cve.now/CVE-2016-20077.md): WordPress Plugin Photocart Link 1.6 Local File Inclusion via decode.php (CVSS 6.9, KaymeePhotography Photocart Link)
- [CVE-2016-20076](https://cve.now/CVE-2016-20076.md): WordPress Simple-Backup 2.7.11 Arbitrary File Deletion and Download (CVSS 8.7, ChrisHurst Simple Backup)
- [CVE-2016-20075](https://cve.now/CVE-2016-20075.md): WordPress Ultimate Product Catalog 3.8.6 Arbitrary File Upload RCE (CVSS 8.7, Etoilewebdesign Ultimate Product Catalog)
- [CVE-2016-20074](https://cve.now/CVE-2016-20074.md): WordPress Lazy Content Slider Plugin 3.4 CSRF (CVSS 5.3, leethompson Lazy Content Slider Plugin)
- [CVE-2016-20073](https://cve.now/CVE-2016-20073.md): Answer My Question 1.3 Plugin WordPress SQL Injection via modal.php (CVSS 8.8, mattkaye Answer My Question)
- [CVE-2016-20072](https://cve.now/CVE-2016-20072.md): BBS e-Franchise 1.1.1 WordPress Plugin SQL Injection via uid (CVSS 8.8, bbsetheme BBS e-Franchise)
- [CVE-2016-20071](https://cve.now/CVE-2016-20071.md): WordPress 404 Redirection Manager Plugin 1.0 SQL Injection (CVSS 8.8, 404-redirection-manager 404 Redirection Manager)
- [CVE-2016-20070](https://cve.now/CVE-2016-20070.md): WordPress Booking Calendar Contact Form 1.0.23 Privilege Escalation Stored XSS (CVSS 5.1, dwbooster Booking Calendar Contact Form)
- [CVE-2016-20069](https://cve.now/CVE-2016-20069.md): WordPress Booking Calendar Contact Form 1.0.23 SQL Injection (CVSS 8.8, dwbooster Booking Calendar Contact Form)
- [CVE-2016-20067](https://cve.now/CVE-2016-20067.md): WordPress CP Polls 1.0.8 Cross-Site Request Forgery (CVSS 5.3, dwbooster CP Polls)
- [CVE-2016-20066](https://cve.now/CVE-2016-20066.md): WordPress CP Polls 1.0.8 Persistent Cross-Site Scripting (CVSS 5.1, dwbooster CP Polls)
- [CVE-2026-5482](https://cve.now/CVE-2026-5482.md): Remote Code Execution via Unrestricted File Upload in Responsive FileManager (CVSS 9.3, Tecrail Responsive FileManager)
- [CVE-2026-12057](https://cve.now/CVE-2026-12057.md): DoS + Remote Code Execution via PDF JavaScript in Foxit AI (CVSS 8.6, Foxit Software Foxit AI)
- [CVE-2026-49757](https://cve.now/CVE-2026-49757.md): OAuth2/OIDC account takeover in AshAuthentication via email-based user matching (CVSS 9.2, team-alembic ash\_authentication)
- [CVE-2026-34030](https://cve.now/CVE-2026-34030.md): Improper branch-code validation in Wertheim SafeController Software allows file path manipulation (CVSS 6.9, Wertheim SafeController Software for VAULT ROOMS)
- [CVE-2026-34029](https://cve.now/CVE-2026-34029.md): Hard-coded cryptographic key in Wertheim SafeController Software allows decryption of sensitive configuration data (CVSS 6.8, Wertheim SafeController Software for VAULT ROOMS)
- [CVE-2026-34028](https://cve.now/CVE-2026-34028.md): Unauthenticated direct access to web data in Wertheim SafeController Software exposes files (CVSS 6.9, Wertheim SafeController Software for VAULT ROOMS)
- [CVE-2026-34027](https://cve.now/CVE-2026-34027.md): Upload restriction bypass in Wertheim SafeController Software allows authenticated users to upload arbitrary files (CVSS 5.3, Wertheim SafeController Software for VAULT ROOMS)
- [CVE-2026-34026](https://cve.now/CVE-2026-34026.md): Path traversal in Wertheim SafeController Software allows authenticated users to download arbitrary files (CVSS 7.1, Wertheim SafeController Software for VAULT ROOMS)
- [CVE-2026-34025](https://cve.now/CVE-2026-34025.md): IP restriction bypass in Wertheim SafeController Software allows logins from unauthorized network locations (CVSS 5.3, Wertheim SafeController Software for VAULT ROOMS)
- [CVE-2026-34024](https://cve.now/CVE-2026-34024.md): Missing authorization checks in Wertheim SafeController Software allow low-privileged users to access restricted functions (CVSS 8.6, Wertheim SafeController Software for VAULT ROOMS)
- [CVE-2026-34023](https://cve.now/CVE-2026-34023.md): Broken WebSocket authorization in Wertheim SafeController Software allows cross-branch access to restricted functions (CVSS 7.1, Wertheim SafeController Software for VAULT ROOMS)
- [CVE-2026-34022](https://cve.now/CVE-2026-34022.md): Weak custom cryptography and hard-coded keys in Wertheim SafeController 65000 allow traffic decryption (CVSS 7.1, Wertheim SafeController Family 65000 Hardware for VAULT ROO…)
- [CVE-2026-34021](https://cve.now/CVE-2026-34021.md): Lack of cryptographic protection in Wertheim SafeController 5400 enables RS-485 message sniffing and replay (CVSS 8.6, Wertheim SafeController 5400 Hardware for VAULT ROOMS)
- [CVE-2026-11860](https://cve.now/CVE-2026-11860.md): Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS (CVSS 7.5, OpenSolution Quick.CMS)
- [CVE-2026-44188](https://cve.now/CVE-2026-44188.md): Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expiration (CVSS 5.3, Red Hat Ansible Automation Platform)
- [CVE-2026-50100](https://cve.now/CVE-2026-50100.md): Multiple printer drivers provided by Ricoh Company, Ltd. (CVSS 7.8, Ricoh Company Multiple printer drivers · KONICA MINOLTA JAP…)
- [CVE-2026-9278](https://cve.now/CVE-2026-9278.md): Form Builder CP \< 1.2.47 - Editor+ Stored XSS via form\_structure (CVSS 5.4, Form Builder CP)
- [CVE-2026-8935](https://cve.now/CVE-2026-8935.md): Advanced Google Maps \< 6.1.1 - Unauthenticated Administrator Account Creation (CVSS 9.8, WP MAPS PRO)
- [CVE-2026-8386](https://cve.now/CVE-2026-8386.md): WP Go Maps \< 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker ID (CVSS 5.3, WP Go Maps)
- [CVE-2026-8385](https://cve.now/CVE-2026-8385.md): WP Go Maps \< 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback (CVSS 5.3, WP Go Maps)
- [CVE-2026-12223](https://cve.now/CVE-2026-12223.md): Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod\_webd.TFTPUploadIperf command injection (CVSS 5.1, Yealink SIP-T46U)
- [CVE-2026-12222](https://cve.now/CVE-2026-12222.md): Yealink SIP-T46U Web FastCGI Service bttest mod\_webd.BlueToothTest stack-based overflow (CVSS 8.6, Yealink SIP-T46U)
- [CVE-2026-12221](https://cve.now/CVE-2026-12221.md): Yealink SIP-T46U Firmware Chunk Upload upgrade sprintf stack-based overflow (CVSS 8.6, Yealink SIP-T46U)
- [CVE-2026-12220](https://cve.now/CVE-2026-12220.md): Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod\_upgrade.SparePartsUpload stack-based overflow (CVSS 8.6, Yealink SIP-T46U)
- [CVE-2026-12219](https://cve.now/CVE-2026-12219.md): Yealink SIP-T46U Web FastCGI Service start mod\_diagnose.CommandShellByType command injection (CVSS 5.3, Yealink SIP-T46U)
- [CVE-2026-12218](https://cve.now/CVE-2026-12218.md): Yealink SIP-T46U Web FastCGI Service beforewifitest StartReportInformation stack-based overflow (CVSS 8.6, Yealink SIP-T46U)
- [CVE-2026-12217](https://cve.now/CVE-2026-12217.md): DVDFab Virtual Drive Signed Kernel Driver dvdfabio.sys privileges management (CVSS 8.5, DVDFab Virtual Drive)
- [CVE-2026-12216](https://cve.now/CVE-2026-12216.md): svaarala duktape duk\_api\_bytecode.c memory corruption (CVSS 4.8, svaarala duktape)
- [CVE-2026-12214](https://cve.now/CVE-2026-12214.md): Qihoo 360 Total Security Nucleus Engine Monitoring Logic RpcStringBindingComposeW protection mechanism (CVSS 8.5, Qihoo 360 Total Security)
- [CVE-2026-12213](https://cve.now/CVE-2026-12213.md): hcengineering Huly Platform User Information operations.ts getAccountInfo improper authorization (CVSS 5.3, hcengineering Huly Platform)
- [CVE-2026-12212](https://cve.now/CVE-2026-12212.md): hcengineering Huly Platform RPC operations.ts getMailboxSecret access control (CVSS 5.3, hcengineering Huly Platform)
- [CVE-2026-12211](https://cve.now/CVE-2026-12211.md): Intelbras iNVU 7016 FT Web syslog path traversal (CVSS 5.1, Intelbras iNVU 7016 FT)
- [CVE-2026-12210](https://cve.now/CVE-2026-12210.md): universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery (CVSS 5.3, universal-tool-calling-protocol python-utcp · utcp-gql +1)
- [CVE-2026-12209](https://cve.now/CVE-2026-12209.md): RubyLouvre avalon Template Filter index.js prototype pollution (CVSS 6.9, RubyLouvre avalon)
- [CVE-2026-12208](https://cve.now/CVE-2026-12208.md): jsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollution (CVSS 6.9, jsonata-js jsonata · jsonata)
- [CVE-2026-12207](https://cve.now/CVE-2026-12207.md): medkey-org medkey HTTP REST API PatientController.php actionGetPatientById resource injection (CVSS 5.3, medkey-org medkey)
- [CVE-2026-12206](https://cve.now/CVE-2026-12206.md): Grit42 Grit data\_table\_entity.rb DataTableEntity sql injection (CVSS 5.3, Grit42 Grit)
- [CVE-2026-12204](https://cve.now/CVE-2026-12204.md): ShopXO Scheduled Task Endpoint Crontab.php GoodsGiveIntegral authorization (CVSS 6.9, ShopXO)
- [CVE-2026-12203](https://cve.now/CVE-2026-12203.md): HKUDS AI-Trader Research Export agents.csv information disclosure (CVSS 6.9, HKUDS AI-Trader)
- [CVE-2026-12202](https://cve.now/CVE-2026-12202.md): Intelliants Subrion CMS Blocks Endpoint cross site scripting (CVSS 4.8, Intelliants Subrion CMS · intelliants/subrion)
- [CVE-2026-12201](https://cve.now/CVE-2026-12201.md): IObit Malware Fighter DLL permission (CVSS 4.8, IObit Malware Fighter)
- [CVE-2026-12200](https://cve.now/CVE-2026-12200.md): Ritlabs TinyWeb Server Header libeay32.dll.html stack-based overflow (CVSS 6.9, Ritlabs TinyWeb Server)
- [CVE-2026-12198](https://cve.now/CVE-2026-12198.md): Microweber API Endpoint thumbnail\_img userfiles\_path path traversal (CVSS 6.9, Microweber · microweber/microweber)
- [CVE-2025-55641](https://cve.now/CVE-2025-55641.md): A NULL pointer dereference in the gf\_isom\_copy\_sample\_info function (isomedia/isom\_write.c) of GPAC MP4Box v2.4 allows attackers to cause a (CVSS 5.5)
- [CVE-2025-55642](https://cve.now/CVE-2025-55642.md): GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmx\_process function (isomedia/isom\_write.c). (CVSS 6.5)
- [CVE-2025-55643](https://cve.now/CVE-2025-55643.md): A NULL pointer dereference in the TrackWriter handling component (filters/mux\_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial (CVSS 5.5)
- [CVE-2025-55644](https://cve.now/CVE-2025-55644.md): A heap use-after-free in the gf\_node\_get\_tag function (scenegraph/base\_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial (CVSS 5.5)
- [CVE-2025-55645](https://cve.now/CVE-2025-55645.md): A heap buffer overflow in the gf\_cenc\_set\_pssh function (isomedia/drm\_sample.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Se (CVSS 5.5)
- [CVE-2025-55647](https://cve.now/CVE-2025-55647.md): An Out-of-Memory in the mp4\_mux\_cenc\_insert\_pssh function (filters/mux\_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Ser (CVSS 5.5)
- [CVE-2025-55648](https://cve.now/CVE-2025-55648.md): A heap buffer overflow in the gf\_opus\_parse\_packet\_header function (media\_tools/av\_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause (CVSS 5.5)
- [CVE-2025-55649](https://cve.now/CVE-2025-55649.md): A NULL pointer dereference in the gf\_media\_map\_esd function (media\_tools/isom\_tools.c) of GPAC MP4Box v2.4 allows attackers to cause a Denia (CVSS 5.5)
- [CVE-2025-55650](https://cve.now/CVE-2025-55650.md): A heap use-after-free in the gf\_node\_get\_tag function (scenegraph/base\_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial (CVSS 5.5)
- [CVE-2025-55652](https://cve.now/CVE-2025-55652.md): A heap buffer overflow in the gf\_isom\_vp\_config\_new function (isomedia/avc\_ext.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of (CVSS 5.5)
- [CVE-2025-55660](https://cve.now/CVE-2025-55660.md): A stack overflow in the gf\_opus\_read\_length function (media\_tools/av\_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Se (CVSS 5.5)
- [CVE-2025-55661](https://cve.now/CVE-2025-55661.md): A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via (CVSS 5.5)
- [CVE-2025-55663](https://cve.now/CVE-2025-55663.md): A segmentation violation in the Track\_SetStreamDescriptor function (isomedia/track.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial (CVSS 5.5)
- [CVE-2025-56814](https://cve.now/CVE-2025-56814.md): A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell (CVSS 7.8)
- [CVE-2025-68713](https://cve.now/CVE-2025-68713.md): An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. (CVSS 8.0)
- [CVE-2025-70102](https://cve.now/CVE-2025-70102.md): A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. (CVSS 6.3)
- [CVE-2026-30120](https://cve.now/CVE-2026-30120.md): remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability. (CVSS 9.8, remotion)
- [CVE-2026-30121](https://cve.now/CVE-2026-30121.md): remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability. (CVSS 9.1, remotion)
- [CVE-2026-36213](https://cve.now/CVE-2026-36213.md): An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.exe component. (CVSS 7.8)
- [CVE-2026-36521](https://cve.now/CVE-2026-36521.md): PublicCMS V5.202506.d has a Cross Site Scripting (XSS) vulnerability in the site configuration management module. (CVSS 6.1)
- [CVE-2026-36537](https://cve.now/CVE-2026-36537.md): ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. (CVSS 9.8)
- [CVE-2026-36670](https://cve.now/CVE-2026-36670.md): A Time-Based Blind SQL Injection vulnerability in the alias\_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3 (CVSS 8.8)
- [CVE-2026-36933](https://cve.now/CVE-2026-36933.md): An issue in Boyleep K11, y108 firmware v.2.3.0.11291 allows a physically proximate attacker to execute arbitrary code via the factory test f (CVSS 6.8)
- [CVE-2026-37216](https://cve.now/CVE-2026-37216.md): Ruoyi 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add. (CVSS 6.1)
- [CVE-2026-38060](https://cve.now/CVE-2026-38060.md): Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action\_unlock\_sim via the pin parameter. (CVSS 9.8)
- [CVE-2026-38061](https://cve.now/CVE-2026-38061.md): Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action\_set\_volume via the volume parameter. (CVSS 9.8)
- [CVE-2026-38062](https://cve.now/CVE-2026-38062.md): Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action\_set\_rat\_mode via the ratMode parameter. (CVSS 9.8)
- [CVE-2026-38063](https://cve.now/CVE-2026-38063.md): Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action\_radio\_on\_with\_ia\_apn via the ia parameter. (CVSS 9.8)
- [CVE-2026-38064](https://cve.now/CVE-2026-38064.md): Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action\_dial\_call via the dialNumber parameter. (CVSS 9.8)
- [CVE-2026-38065](https://cve.now/CVE-2026-38065.md): Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action\_ims\_on\_with\_apn via the ims\_apn parameter. (CVSS 9.8)
- [CVE-2026-38329](https://cve.now/CVE-2026-38329.md): Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. (CVSS 9.8)
- [CVE-2026-38812](https://cve.now/CVE-2026-38812.md): RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. (CVSS 9.8)
- [CVE-2026-39006](https://cve.now/CVE-2026-39006.md): An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component. (CVSS 9.8, org.snmp4j:snmp4j-agent)
- [CVE-2026-39007](https://cve.now/CVE-2026-39007.md): An issue in Observeinc's Observe v.2026-01-28 and before allows a remote attacker to obtain sensitive information via the CSV Log export com (CVSS 7.5)
- [CVE-2026-39118](https://cve.now/CVE-2026-39118.md): An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client validation gap to invoke (CVSS 8.4)
- [CVE-2026-39196](https://cve.now/CVE-2026-39196.md): Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set\_uri\_query parameter in the KeyPartitioner::pa (CVSS 9.8)
- [CVE-2026-39197](https://cve.now/CVE-2026-39197.md): An issue in the /util/http/prelude.rs endpoint of Datadog, Inc Vector v0.54.0 allows attackers to cause a Denial of Service (DoS) via a craf (CVSS 6.5)
- [CVE-2026-45388](https://cve.now/CVE-2026-45388.md): In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows impers (CVSS 9.1)
- [CVE-2026-45389](https://cve.now/CVE-2026-45389.md): In OCaml-TLS before 2.1.0, the server implementation does insufficient checks of the certificate provided by the client (when doing client a (CVSS 7.4)
- [CVE-2026-45390](https://cve.now/CVE-2026-45390.md): In OCaml-tar before 3.4.0, a crafted archive with ../ path segments in its name allows escaping the current working directory. (CVSS 9.1)
- [CVE-2026-50869](https://cve.now/CVE-2026-50869.md): An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted request (CVSS 9.8)
- [CVE-2026-50870](https://cve.now/CVE-2026-50870.md): An information disclosure vulnerability in the configuration endpoint of Ben Busby whoogle-search v1.2.3 allows attackers to obtain sensitiv (CVSS 7.5)
- [CVE-2026-50871](https://cve.now/CVE-2026-50871.md): An OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscence v0.3.0 allows atta (CVSS 9.8)
- [CVE-2026-50872](https://cve.now/CVE-2026-50872.md): An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obta (CVSS 9.8)
- [CVE-2026-50873](https://cve.now/CVE-2026-50873.md): An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4 allows attackers to execute arbitrary code v (CVSS 9.8)
- [CVE-2026-50874](https://cve.now/CVE-2026-50874.md): An OS command injection vulnerability in the /manage/features/media component of kanishka-linux Reminiscence v0.3.0 allows attackers to exec (CVSS 8.1)
- [CVE-2026-50875](https://cve.now/CVE-2026-50875.md): Incorrect access control in the /{form}/webhooks/{webhook} endpoint of Deck9 Input v2.0.1 allows authenticated attackers to arbitrarily modi (CVSS 8.1)
- [CVE-2026-50876](https://cve.now/CVE-2026-50876.md): A cross-site scripting (XSS) vulnerability in Deck9 Input v2.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted pay (CVSS 5.4)
- [CVE-2026-50877](https://cve.now/CVE-2026-50877.md): An issue in Zhoros SuperBin v1.0.0 allows attackers to execute a directory traversal via supplying files with names containing traversal cha (CVSS 7.5)
- [CVE-2026-50878](https://cve.now/CVE-2026-50878.md): An issue in the attachment handling component of Feuerhamster MailForm v1.1.0 allows attackers to cause a Denial of Service (DoS) via a craf (CVSS 7.5)
- [CVE-2026-50879](https://cve.now/CVE-2026-50879.md): An issue in the uploadPostHandler component of Andrei Marcu linx-server v2.3.8 allows attackers to cause a Denial of Service (DoS) via a cra (CVSS 7.5, github.com/andreimarcu/linx-server)
- [CVE-2026-50880](https://cve.now/CVE-2026-50880.md): An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a cr (CVSS 9.8, youtransfer)
- [CVE-2026-50881](https://cve.now/CVE-2026-50881.md): Incorrect access control in the impworks Bonsai v6.0 allows authenticated attackers with Editor privileges to escalate privileges to Adminis (CVSS 8.1)
- [CVE-2026-50882](https://cve.now/CVE-2026-50882.md): An issue in the /api/v0/pastes endpoint of anna-is-cute paste v0.1.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST (CVSS 7.5)
- [CVE-2026-50883](https://cve.now/CVE-2026-50883.md): An HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows attackers to execute arbitrary scripts vi (CVSS 9.6)
- [CVE-2026-50884](https://cve.now/CVE-2026-50884.md): Incorrect access control in statping-ng v0.93.0 allows attackers to escalate privileges to Administrator and access sensitive components. (CVSS 8.8, github.com/statping-ng/statping-ng)
- [CVE-2026-50885](https://cve.now/CVE-2026-50885.md): Incorrect access control in the share-based read endpoints of Sismics Docs (Teedy) v1.11 allow unauthorized attackers to access sensitive en (CVSS 7.5)
- [CVE-2026-50886](https://cve.now/CVE-2026-50886.md): Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a (CVSS 9.1, grumpydictator/firefly-iii)
- [CVE-2026-50887](https://cve.now/CVE-2026-50887.md): A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan interna (CVSS 9.1, shlinkio/shlink)
- [CVE-2026-50888](https://cve.now/CVE-2026-50888.md): An authenticated Server-Side Request Forgery (SSRF) in the custom scraper subsystem component of Benjamin Jonard Koillection v1.8.0 allows a (CVSS 8.1, koillection/koillection)
- [CVE-2026-50889](https://cve.now/CVE-2026-50889.md): An input handling flaw in the HTTP refresh token process of LLDAP v0.6.2 allows attackers to cause a Denial of Service (DoS) via sending a c (CVSS 7.5)
- [CVE-2026-50890](https://cve.now/CVE-2026-50890.md): Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings. (CVSS 9.8)
- [CVE-2026-50891](https://cve.now/CVE-2026-50891.md): Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafte (CVSS 8.1, github.com/mickael-kerjean/filestash)
- [CVE-2026-50892](https://cve.now/CVE-2026-50892.md): Incorrect access control in the "Let's Encrypt" certificate download endpoint of Nginx Proxy Manager v2.14.0 allows authenticated attackers (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.