CVEs published June 17, 2026
396 CVEs were published on June 17, 2026: 85 critical, 195 high.
- Published
- 396
- Critical
- 85
- High
- 195
- Medium
- 105
- Low
- 11
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 175
Most affected products
- Google Chrome
- 33
- Google Android
- 17
- Dell PowerFlex
- 10
- picklescan
- 9
- undici
- 8
- Jetimpex JetEngine
- 7
- RTI Connext Professional
- 6
- Apache Software Foundation Apache DolphinScheduler · org.ap…
- 5
- harttle liquidjs · liquidjs
- 5
- Black Lantern Security BBOT · bbot
- 4
Critical 85
- CVE-2026-48768TypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileNamebaptisteArno typebot.io
- CVE-2026-54388Tinyproxy - HTTP Request Smuggling via Duplicate Content-Length Headerstinyproxy
- CVE-2026-54387Tinyproxy - HTTP Request Smuggling via CL/TE Desynchronizationtinyproxy
- CVE-2026-48814Network-AI: Empty default secret still authorizes all requests (Incomplete fix for CVE-2026-46701)Jovancoding Network-AI · network-ai
- CVE-2026-55200libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.clibssh2
- CVE-2026-55196Hermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypasshermes-webui
- CVE-2026-3894Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.RTI Connext Professional
- CVE-2026-2467Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.RTI Connext Professional
- CVE-2026-20266OS Command Injection in the btool Configuration Helper in Splunk AI ToolkitSplunk AI Toolkit
- CVE-2026-53805NVIDIA SIL GEN3C Unauthenticated RCE via Pickle Deserialization in Inference APInv-tlabs GEN3C
- CVE-2026-20181Cisco Identity Services Engine Remote Code Execution VulnerabilityCisco Identity Services Engine Software · Cisco ISE Passive…
- CVE-2026-53874picklescan - Arbitrary Code Execution via Obfuscated eval Callpicklescan
- CVE-2026-53873picklescan - Arbitrary Code Execution via profile.run() Blocklist Bypasspicklescan
- CVE-2026-3490picklescan - Universal Blocklist Bypass via pkgutil.resolve_namepicklescan
- CVE-2025-71325picklescan - Detection Bypass via STACK_GLOBAL Opcode Parsing Logic Flawpicklescan
- CVE-2025-71323picklescan - Remote Code Execution via Unblocked ctypes Modulepicklescan
- CVE-2025-71321picklescan - Arbitrary File Writing via distutils Module Bypasspicklescan
- CVE-2025-71320picklescan - Remote Code Execution via Incomplete Disallowed Inputspicklescan
- CVE-2026-47103Python StateMachine 3.0.0 < 3.2.0 RCE via SCXML eval() Injectionfgmacedo python-statemachine · python-statemachine
- CVE-2026-54812WordPress Motors plugin <= 1.4.109 - SQL Injection vulnerabilityStylemixThemes Motors
- CVE-2026-55743OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command executiontinyhumansai OpenHuman
- CVE-2026-54809WordPress GIFT4U plugin <= 1.0.10 - SQL Injection vulnerabilityVillaTheme GIFT4U
- CVE-2026-54808WordPress WP Travel Gutenberg Blocks plugin <= 3.9.4 - SQL Injection vulnerabilityWP Travel Gutenberg Blocks
- CVE-2025-60236WordPress Creatify theme <= 1.5 - PHP Object Injection vulnerabilityEMV Creatify
- CVE-2025-60231WordPress The Hospital theme <= 1.8.1 - PHP Object Injection vulnerabilityEMV The Hospital
- CVE-2026-54815WordPress Cargo Shipping Location for WooCommerce plugin <= 5.6 - SQL Injection vulnerabilityCargo RD Cargo Shipping Location for WooCommerce
- CVE-2026-54819WordPress Listdom plugin <= 5.4.0 - SQL Injection vulnerabilityWebilia Listdom
- CVE-2025-60230WordPress The Barber Shop theme <= 1.9 - PHP Object Injection vulnerabilityThemeton The Barber Shop
- CVE-2025-60229WordPress Lagom theme <= 2.0 - PHP Object Injection vulnerabilityThemeton Lagom
- CVE-2026-49108WordPress Moderno theme < 1.43 - PHP Object Injection vulnerabilitypark_of_ideas Moderno
- CVE-2025-69127WordPress Plumbing theme <= 1.6 - PHP Object Injection vulnerabilityThemeREX Plumbing
- CVE-2025-69111WordPress Reisen theme <= 1.4.1 - PHP Object Injection vulnerabilityThemeREX Reisen
- CVE-2025-59554WordPress Advanced Ads – Tracking plugin < 3.0.7 - SQL Injection vulnerabilityAdvanced Ads – Tracking
- CVE-2026-54811WordPress WP eMember plugin < v10.9.4 - SQL Injection vulnerabilityTips and Tricks HQ WP eMember
- CVE-2026-54807WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerabilityThemeGrill Registration Form for WooCommerce
- CVE-2026-54806WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerabilityMelapress WP Activity Log
- CVE-2026-54803WordPress SMS Alert Order Notifications plugin <= 3.9.4 - Privilege Escalation vulnerabilityCozy Vision Technologies Pvt. SMS Alert Order Notifications
- CVE-2026-54187WordPress JetEngine plugin <= 3.8.10.1 - SQL Injection vulnerabilityJetimpex JetEngine
- CVE-2026-54186WordPress JobSearch plugin <= 3.2.9 - SQL Injection vulnerabilityeyecix JobSearch
- CVE-2026-52706WordPress JetEngine plugin <= 3.8.10 - PHP Object Injection vulnerabilityJetimpex JetEngine
- CVE-2026-52705WordPress SigmaForms Pro – AI Generated Forms plugin <= 1.4.5 - Arbitrary File Upload vulnerabilityBDthemes SigmaForms Pro – AI Generated Forms
- CVE-2026-49767WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerabilityTomdever wpForo Forum
- CVE-2026-49107WordPress Thrive Apprentice plugin < 10.8.10.2 - PHP Object Injection vulnerabilityThrive Themes Thrive Apprentice
- CVE-2026-49084WordPress JetEngine plugin < 3.8.9.1 - SQL Injection vulnerabilityJetimpex JetEngine
- CVE-2026-49079WordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerabilityJetimpex JetSearch
- CVE-2026-49076WordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerabilityCrocoblock JetEngine
- CVE-2026-49075WordPress JetEngine plugin <= 3.8.9.1 - PHP Object Injection vulnerabilityJetimpex JetEngine
- CVE-2026-49058WordPress LoginPress Pro plugin <= 6.2.2 - Privilege Escalation vulnerabilityLoginPress Pro
- CVE-2026-48875WordPress JetSmartFilters plugin <= 3.8.1 - SQL Injection vulnerabilityJetimpex JetSmartFilters
- CVE-2026-42380WordPress AI Lab theme < 5.4.2 - PHP Object Injection vulnerabilityjwsthemes AI Lab
- CVE-2026-40783WordPress Blocksy Companion Pro plugin <= 2.1.37 - Remote Code Execution (RCE) vulnerabilityCreative Themes Blocksy Companion Pro
- CVE-2026-40749WordPress Charity Zone theme <= 1.1.1 - Arbitrary File Upload vulnerabilitythemagnifico52 Charity Zone
- CVE-2026-40748WordPress Kids Gift Shop theme <= 0.5.4 - Arbitrary File Upload vulnerabilitythemagnifico52 Kids Gift Shop
- CVE-2026-40747WordPress Ecommerce Zone theme <= 0.9.7 - Arbitrary File Upload vulnerabilitythemagnifico52 Ecommerce Zone
- CVE-2026-40746WordPress Restaurant Zone theme <= 0.7.8 - Arbitrary File Upload vulnerabilitythemagnifico52 Restaurant Zone
- CVE-2026-40725WordPress WooCommerce Product Filters plugin < 2.0.6 - PHP Object Injection vulnerabilityBarn2 Media WooCommerce Product Filters
- CVE-2026-39596WordPress Blocksy Companion Pro plugin < 2.1.29 - SQL Injection vulnerabilityCreative Themes Blocksy Companion Pro
- CVE-2026-39589WordPress Webenvo theme <= 0.0.6 - Arbitrary File Upload vulnerabilityA WP Life Webenvo
- CVE-2026-27041WordPress Unlimited Elements for Elementor (Premium) plugin <= 2.0.6 - Arbitrary File Upload vulnerabilityStudio Keren Aga Unlimited Elements for Elementor
- CVE-2026-25446WordPress WishList Member X plugin <= 3.29.0 - Arbitrary File Upload vulnerabilityWishList Products, LLC. WishList Member X
- CVE-2026-24611WordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerabilityWPMet MetForm Pro
- CVE-2026-22340WordPress WPJobster theme <= 6.3.5 - SQL Injection vulnerabilityJobster Marketplace WPJobster
- CVE-2026-22332WordPress Tutor LMS Pro plugin <= 3.9.6 - SQL Injection vulnerabilityThemeum Tutor LMS Pro
- CVE-2026-22327WordPress Restaurt theme <= 1.0.4 - Arbitrary File Upload vulnerabilityZozothemes Restaurt
- CVE-2025-69179WordPress Support Ticket Management System plugin <= 1.9 - Privilege Escalation vulnerabilityTheme passion Support Ticket Management System
- CVE-2025-69129WordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin <= 1.0.7 - Arbitrary File Upload vulnerabilityExtendons WordPress & WooCommerce Scraper Plugin, Import Da…
- CVE-2025-60218WordPress PT Luxa Addons Plugin <= 1.2.2 - Arbitrary File Upload VulnerabilityWPLocker PT Luxa Addons
- CVE-2025-60205WordPress ThemeREX Addons plugin <= 2.36.1.1 - PHP Object Injection vulnerabilityThemeREX Group ThemeREX Addons
- CVE-2024-52488WordPress Grip theme <= 1.0.9 - Arbitrary Plugin Activation/Deactivation to RCE vulnerabilityZidithemes Grip
- CVE-2026-0063In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the codGoogle Android
- CVE-2026-28587In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check.Google Android
- CVE-2026-28576In Contacts Provider, there is a possible way to access the contacts database due to SQL injection.Android
- CVE-2026-28615In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass.Google Android
- CVE-2026-0083In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition.Google Android
- CVE-2026-0082In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure defaultGoogle Android
- CVE-2026-0081In NFC, there is a possible way to spoof an NFC event due to a missing permission check.Google Android
- CVE-2026-0071In SettingsLib, there is a possible missing permission check due to a logic error in the code.Google Android
- CVE-2026-28575In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java, there is a poGoogle Android
- CVE-2026-0064In multiple places, there is a possible persistent denial of service due to resource exhaustion.Google Android
- CVE-2026-0092In Package Manager, there is a possible device lock controller bypass due to a missing permission check.Google Android
- CVE-2026-0068In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO coGoogle Android
- CVE-2026-10094Path Traversal vulnerability affecting SOLIDWORKS Visualize from SOLIDWORKS Desktop Release 2024 through SOLIDWORKS Desktop Release 2026Dassault Systèmes SOLIDWORKS Visualize
- CVE-2026-50203Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry namesApache Software Foundation Apache Airflow SFTP provider · a…
- CVE-2026-12440Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to potentially perform a Google Chrome
- CVE-2026-36418JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling of Aviator expressions.
High 195
- CVE-2026-48764TypeBot has SSRF in HTTP request and script fetch flows via DNS rebinding bypassbaptisteArno typebot.io
- CVE-2026-53676ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user whoThingsBoard
- CVE-2026-45357LiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime)harttle liquidjs · liquidjs
- CVE-2026-45617LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regexharttle liquidjs · liquidjs
- CVE-2026-48759TypeBot: Cross-Workspace Theme Template IDOR (Modification and Deletion)baptisteArno typebot.io
- CVE-2026-50200Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwordsSteeltoeOSS Steeltoe.Management.Endpoint · SteeltoeOSS S… +2
- CVE-2026-48997e107: Command Injection via shell expansion in ImageMagick resize destination pathe107inc e107
- CVE-2026-50196Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetchSteeltoeOSS Steeltoe.Discovery.Eureka · Steeltoe.Discovery.…
- CVE-2026-8050CVE-2026-8050SignalRGB kernel driver
- CVE-2026-12530Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()AWS bedrock-agentcore · bedrock-agentcore
- CVE-2026-50194Steeltoe vulnerable to management-port isolation bypass via spoofed Host headerSteeltoeOSS Steeltoe.Management.Endpoint · SteeltoeOSS S… +2
- CVE-2026-48989Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORSCursorTouch Windows-MCP · windows-mcp
- CVE-2026-48979PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smugglingphp-standard-library · php-standard-library/h2 +1
- CVE-2026-49133Typemill < 2.24.0 Path Traversal via ControllerApiImage::getPagemedia()typemill
- CVE-2026-11407Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowedPimcore CMS/DXP · pimcore/pimcore
- CVE-2026-50107NGINX Gateway Fabric vulnerabilityF5 NGINX Gateway Fabric
- CVE-2026-55202Tinyproxy - Stathost Detection Bypass via Host Header Manipulationtinyproxy
- CVE-2026-55201Evil-WinRM - Path Traversal in download_dir() FunctionHackplayers evil-winrm
- CVE-2026-55199libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handlerlibssh2
- CVE-2026-10696Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet communiDevolutions UniGetUI
- CVE-2026-55198Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpointnesquena hermes-webui
- CVE-2026-55197Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpointnesquena hermes-webui
- CVE-2026-53871Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookienesquena hermes-webui
- CVE-2026-53869Hermes Agent < 0.16.0 - DNS Rebinding Bypass via WebSocket EndpointsNousResearch hermes-agent · hermes-agent
- CVE-2026-48818Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on WindowsKludex starlette · starlette
- CVE-2026-30803Integer Underflow (Wrap or Wraparound) vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers.RTI Connext Micro
- CVE-2026-30802Out-of-bounds Read vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers.RTI Connext Micro
- CVE-2026-7300Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Web Integration Service) allows Filter Failure through Buffer Overflow.RTI Connext Professional
- CVE-2026-47774Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplificationenvoyproxy envoy
- CVE-2026-9697undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgentundici
- CVE-2026-6734undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuseundici
- CVE-2026-9675undici WebSocket client vulnerable to denial of service via cumulative fragment bypassundici
- CVE-2026-20190Cisco Identity Services Engine Information Disclosure VulnerabilityCisco Identity Services Engine Software · Cisco ISE Passive…
- CVE-2026-12151undici WebSocket client vulnerable to denial of service via fragment count bypassundici
- CVE-2026-32652Dell AIOps Collector versions prior to 1.18.3 contain a "Use of Default Credentials" vulnerability.Dell AIOps
- CVE-2026-53875picklescan - Scanning Bypass via Dynamic Eval in scan_pytorchpicklescan
- CVE-2026-53872picklescan - Arbitrary File Read via Unsafe Pickle Deserializationpicklescan
- CVE-2025-71322PickleScan - Unsafe Globals Check Bypass via pty.spawn FunctionPickleScan
- CVE-2026-35066Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control vulnerability.Dell PowerFlex
- CVE-2026-35065Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Missing Authentication for Critical Function vulnerability.Dell PowerFlex
- CVE-2026-32804Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Authentication vulnerability.Dell PowerFlex
- CVE-2026-49502Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Authentication vulnerability.Dell PowerFlex
- CVE-2026-22283Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Inclusion of Functionality from Untrusted Control Sphere vulnerability.Dell PowerFlex
- CVE-2026-54810WordPress Nexi XPay plugin <= 8.3.1 - Broken Access Control vulnerabilityNexi Payments Nexi XPay
- CVE-2026-54415Broken Access Control in Azuriom CMS Server Routes Allows Account TakeoverAzuriom CMS
- CVE-2026-11311NGINX Gateway Fabric vulnerabilityF5 NGINX Gateway Fabric
- CVE-2026-42055NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerabilityF5 NGINX Open Source · F5 NGINX Plus
- CVE-2026-42530NGINX Open-Source ngx_http_v3_module vulnerabilityF5 NGINX Open Source
- CVE-2025-69189WordPress JobBank plugin <= 1.2.3 - Broken Access Control vulnerabilityEMV JobBank
- CVE-2025-69128WordPress JobCareer theme <= 7.3 - Arbitrary File Deletion vulnerabilityEMV JobCareer
- CVE-2026-55738Stack Buffer Overflow in rxi/microtar raw_to_header() via non-null-terminated TAR name fieldrxi microtar
- CVE-2026-54813WordPress SureDash plugin <= 1.8.0 - SQL Injection vulnerabilityBrainstorm Force SureDash
- CVE-2026-54814WordPress Motors plugin <= 1.4.109 - Local File Inclusion vulnerabilityStylemixThemes Motors
- CVE-2026-54816WordPress Advanced Ads plugin <= 2.0.21 - Remote Code Execution (RCE) vulnerabilityMonetizemore Advanced Ads
- CVE-2026-54818WordPress Slimstat Analytics plugin <= 5.4.11 - SQL Injection vulnerabilityVeronaLabs Slimstat Analytics
- CVE-2026-54417Integer Overflow in rxi/microtar mtar_next() Causes Infinite Loop DoSrxi microtar
- CVE-2026-10641Out-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values)zephyrproject zephyr
- CVE-2026-49268Apache Shiro: LDAP DN Injection in DefaultLdapRealmApache Software Foundation Apache Shiro · org.apache.shiro:…
- CVE-2026-52707WordPress Kastell theme <= 2.0 - Local File Inclusion vulnerabilityMikado-Themes Kastell
- CVE-2026-40757WordPress Château theme <= 1.2.1 - PHP Object Injection vulnerabilityMikado-Themes Château
- CVE-2026-40756WordPress Zoya theme <= 1.4 - PHP Object Injection vulnerabilityMikado-Themes Zoya
- CVE-2026-40752WordPress Manufaktur Solutions theme <= 1.1.1 - PHP Object Injection vulnerabilitySelect-Themes Manufaktur Solutions
- CVE-2026-40738WordPress Eldon theme <= 1.4.1 - PHP Object Injection vulnerabilityEdge-Themes Eldon
- CVE-2026-40733WordPress ShiftUp theme <= 1.3 - PHP Object Injection vulnerabilityMikado-Themes ShiftUp
- CVE-2026-40720WordPress Royal Elementor Addons Pro plugin < 1.7.1041 - Cross Site Scripting (XSS) vulnerabilityRoyal Elementor Addons Pro
- CVE-2026-39590WordPress Atomlab theme <= 2.4.5 - Local File Inclusion vulnerabilityThemeMove Atomlab
- CVE-2026-39576WordPress SingleMalt theme <= 1.5 - PHP Object Injection vulnerabilityElated-Themes SingleMalt
- CVE-2026-39560WordPress Hiroshi theme <= 1.5.1 - PHP Object Injection vulnerabilitySelect-Themes Hiroshi
- CVE-2026-39559WordPress Uppercase theme < 1.2.2 - Local File Inclusion vulnerabilitycodesupplyco Uppercase
- CVE-2026-39556WordPress Konsept theme <= 1.9 - PHP Object Injection vulnerabilityElated-Themes Konsept
- CVE-2026-39523WordPress Solene Core plugin <= 2.3.2 - Local File Inclusion vulnerabilityElated-Themes Solene Core
- CVE-2026-39445WordPress Alukas theme < 3.0.0 - PHP Object Injection vulnerabilityPressLayouts Alukas
- CVE-2026-39442WordPress PressMart theme <= 1.2.26 - PHP Object Injection vulnerabilityPressLayouts PressMart
- CVE-2025-69175WordPress Line Agency theme <= 1.3.1 - Local File Inclusion vulnerabilityThemeREX Line Agency
- CVE-2025-69174WordPress Etude theme <= 1.6 - Local File Inclusion vulnerabilityThemeREX Etude
- CVE-2025-69170WordPress Eventicity theme <= 1.5 - Local File Inclusion vulnerabilityThemeREX Eventicity
- CVE-2025-69166WordPress Gunslinger theme <= 1.7 - Local File Inclusion vulnerabilityThemeREX Gunslinger
- CVE-2025-69164WordPress Skyward theme <= 1.10 - Local File Inclusion vulnerabilityThemeREX Skyward
- CVE-2025-69158WordPress Granola theme <= 1.13 - Local File Inclusion vulnerabilityThemeREX Granola
- CVE-2025-69157WordPress Gamic theme <= 1.15 - Local File Inclusion vulnerabilityThemeREX Gamic
- CVE-2025-69144WordPress Preservation theme <= 1.10 - Local File Inclusion vulnerabilityThemeREX Preservation
- CVE-2025-69140WordPress SweetDate Core plugin < 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerabilitySeventhQueen SweetDate Core
- CVE-2025-69130WordPress Entrepreneur - Booking for Small Businesses WordPress Theme theme < 3.1.5 - PHP Object Injection vulnerabilityPixel Makers Creative Entrepreneur - Booking for Small Busi…
- CVE-2025-69126WordPress Fortius theme <= 2.3.0 - Local File Inclusion vulnerabilityThemeREX Fortius
- CVE-2025-69123WordPress Snow Club theme <= 1.1 - Local File Inclusion vulnerabilityThemeREX Snow Club
- CVE-2025-69120WordPress Dazzle theme <= 1.0.0 - Local File Inclusion vulnerabilityThemeREX Dazzle
- CVE-2025-69115WordPress LuxMed | Medicine & Healthcare Doctor WordPress Theme theme <= 1.2.2 - Local File Inclusion vulnerabilityThemeREX LuxMed | Medicine & Healthcare Doctor WordPress Th…
- CVE-2025-69106WordPress Imba theme <= 1.5.0 - Local File Inclusion vulnerabilityThemeREX Imba
- CVE-2025-68524WordPress Avante theme < 3.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeGoods Avante
- CVE-2026-54193WordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerabilityThemeFusion Fusion Builder
- CVE-2024-32949WordPress Integrate Google Drive plugin <= 1.3.8 - Broken Access Control vulnerabilityPrince Integrate Google Drive
- CVE-2024-32729WordPress ChatBot Conversational Forms plugin <= 1.1.8 - Arbitrary File Download vulnerabilityQuantumCloud Conversational Forms for ChatBot
- CVE-2026-11858Missing authorization in Quanos SCHEMA ST4 Client Update Service allows arbitrary file overwrite as SYSTEMQuanos Solutions SCHEMA ST4
- CVE-2026-11857Insecure .NET Remoting deserialization in Quanos SCHEMA ST4 Client Update Service allows local privilege escalationQuanos Solutions SCHEMA ST4
- CVE-2025-31013WordPress Themify Folo theme <= 1.9.6 - Reflected Cross Site Scripting (XSS) vulnerabilityThemify Folo
- CVE-2026-5667Information Disclosure, Information Tampering, or Denial-of-Service (DoS) Vulnerability in Multiple Home AppliancesMitsubishi Electric Room Air Conditioners (for Japan)… +2478
- CVE-2026-54805WordPress Falang multilanguage plugin <= 1.4.2 - Privilege Escalation vulnerabilitysbouey Falang multilanguage
- CVE-2026-54804WordPress Melhor Envio plugin <= 2.16.3 - Broken Authentication vulnerabilitymelhorenvio Melhor Envio
- CVE-2026-54802WordPress SMS Alert Order Notifications plugin <= 3.9.3 - Broken Authentication vulnerabilityCozy Vision Technologies Pvt. SMS Alert Order Notifications
- CVE-2026-54195WordPress JetFormBuilder plugin <= 3.6.0.1 - Cross Site Scripting (XSS) vulnerabilityJetmonsters JetFormBuilder
- CVE-2026-54192WordPress Popup box plugin <= 6.2.9 - Reflected Cross Site Scripting (XSS) vulnerabilityAys Pro Popup box
- CVE-2026-54189WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerabilityJetimpex JetEngine
- CVE-2026-54188WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerabilityJetimpex JetEngine
- CVE-2026-54185WordPress Cornerstone plugin < 7.8.8 - SQL Injection vulnerabilityTHEMECO Cornerstone
- CVE-2026-54184WordPress Clean Login plugin <= 1.15 - Insecure Direct Object References (IDOR) vulnerabilityAlberto Hornero Clean Login
- CVE-2026-52698WordPress PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget plugin <= 4.2.3 - Sensitive Data Exposure vulnerabilitySyed Balkhi PushEngage – Web Push Notifications, eCommerce…
- CVE-2026-52696WordPress JetBlog plugin <= 2.4.8 - Sensitive Data Exposure vulnerabilityJetimpex JetBlog
- CVE-2026-49778WordPress WPFunnels Pro plugin <= 2.9.4 - Cross Site Scripting (XSS) vulnerabilityWPFunnels Pro
- CVE-2026-49081WordPress User Registration Stripe plugin <= 1.3.12 - Broken Access Control vulnerabilityThemeGrill User Registration Stripe
- CVE-2026-49074WordPress JetEngine plugin <= 3.8.9.1 - Cross Site Scripting (XSS) vulnerabilityJetimpex JetEngine
- CVE-2026-48967WordPress Geo Mashup plugin <= 1.13.19 - SQL Injection vulnerabilityDylan Kuhn Geo Mashup
- CVE-2026-42629WordPress PowerPack Pro for Elementor plugin < v2.13.0 - Broken Authentication vulnerabilityPowerpackelements PowerPack Pro for Elementor
- CVE-2026-42385WordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerabilityCozmoslabs Profile Builder Pro
- CVE-2026-41557WordPress Kapee theme < 1.7.1 - Cross Site Scripting (XSS) vulnerabilityPressLayouts Kapee
- CVE-2026-40768WordPress Salon booking system plugin <= 10.30.24 - Insecure Direct Object References (IDOR) vulnerabilityDimitri Grassi Salon booking system
- CVE-2026-40765WordPress collectchat plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerabilitycollectchat
- CVE-2026-40753WordPress EasyMeals theme <= 1.5.1 - PHP Object Injection vulnerabilityMikado-Themes EasyMeals
- CVE-2026-40735WordPress Reina theme <= 2.1 - PHP Object Injection vulnerabilityEdge-Themes Reina
- CVE-2026-40731WordPress ChapterOne theme <= 1.7 - Local File Inclusion vulnerabilityMikado-Themes ChapterOne
- CVE-2026-40726WordPress User Registration Stripe plugin <= 1.3.14 - Broken Access Control vulnerabilityThemeGrill User Registration Stripe
- CVE-2026-40721WordPress Element Pack Pro plugin <= 9.0.6 - Local File Inclusion vulnerabilityBdThemes Element Pack Pro
- CVE-2026-39597WordPress WPZOOM Addons for Elementor plugin <= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerabilityWPZOOM Addons for Elementor
- CVE-2026-39582WordPress Hitek theme < 1.8.3 - Local File Inclusion vulnerabilityxtemos Hitek
- CVE-2026-39573WordPress Mildhill theme <= 1.5 - PHP Object Injection vulnerabilitySelect-Themes Mildhill
- CVE-2026-39558WordPress Malmö theme <= 2.2 - Local File Inclusion vulnerabilityElated-Themes Malmö
- CVE-2026-39546WordPress MultiLoca plugin <= 4.2.15 - Privilege Escalation vulnerabilityTechspawn MultiLoca
- CVE-2026-39545WordPress Zermatt theme <= 1.6.1 - PHP Object Injection vulnerabilitySelect-Themes Zermatt
- CVE-2026-39537WordPress Mikado Core plugin <= 1.6 - Local File Inclusion vulnerabilityMikado-Themes Mikado Core
- CVE-2026-34888WordPress Bricksforge plugin <= 3.1.8.4 - Sensitive Data Exposure vulnerabilityBricksforge
- CVE-2026-27400WordPress BookPro plugin <= 1.1.0 - Arbitrary File Deletion vulnerabilityOvatheme BookPro
- CVE-2026-25439WordPress Booknetic plugin < 5.10.3 - Broken Authentication vulnerabilityBooknetic
- CVE-2026-22343WordPress WordPress Dating Theme theme <= 11.2.0 - Broken Access Control vulnerabilityPremiumPress Limited. WordPress Dating Theme
- CVE-2026-22342WordPress WordPress Dating Theme theme <= 11.2.0 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerabilityPremiumPress Limited. WordPress Dating Theme
- CVE-2026-22339WordPress WPJobster theme <= 6.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityJobster Marketplace WPJobster
- CVE-2026-22338WordPress EcoBlue theme <= 1.15 - Local File Inclusion vulnerabilityThemeREX EcoBlue
- CVE-2026-22335WordPress WooCommerce Frontend Manager – Ultimate plugin < 6.7.7 - SQL Injection vulnerabilityWC Lovers. WooCommerce Frontend Manager – Ultimate
- CVE-2026-22334WordPress Woocommerce Book Price plugin <= 1.3 - Arbitrary File Download vulnerabilityWPos Woocommerce Book Price
- CVE-2026-22331WordPress AutoParts theme <= 1.5.8 - Local File Inclusion vulnerabilityThemeREX AutoParts
- CVE-2026-22330WordPress Right Way theme <= 4.0 - Local File Inclusion vulnerabilityThemeum Right Way
- CVE-2026-22329WordPress Skillate theme <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeum Skillate
- CVE-2026-22328WordPress Auto Repair theme <= 22.6 - Reflected Cross Site Scripting (XSS) vulnerabilityVamTam Auto Repair
- CVE-2026-22326WordPress Reprizo theme <= 1.0.8 - Local File Inclusion vulnerabilityAxiomThemes Reprizo
- CVE-2026-22325WordPress Promo theme <= 1.3.0 - Local File Inclusion vulnerabilityAxiomThemes Promo
- CVE-2026-9690WordPress WP Media folder Addon plugin <= 4.0.1 - Arbitrary File Download vulnerabilityJoomunited WP Media folder Addon
- CVE-2025-69173WordPress Tipsy theme <= 1.1 - Local File Inclusion vulnerabilityThemeREX Tipsy
- CVE-2025-69172WordPress Resurs theme <= 1.3 - Local File Inclusion vulnerabilityThemeREX Resurs
- CVE-2025-69171WordPress Orpheus theme <= 1.3 - Local File Inclusion vulnerabilityThemeREX Orpheus
- CVE-2025-69161WordPress Snowy theme <= 1.13 - Local File Inclusion vulnerabilityThemeREX Snowy
- CVE-2025-69148WordPress Quirky theme <= 1.23 - Local File Inclusion vulnerabilityThemeREX Quirky
- CVE-2025-69145WordPress Gat theme <= 1.16 - Local File Inclusion vulnerabilityThemeREX Gat
- CVE-2025-69138WordPress Genemy theme <= 1.6.6 - Privilege Escalation vulnerabilityJthemes Genemy
- CVE-2025-69135WordPress Events Schedule - WordPress Events Calendar Plugin plugin <= 2.7.2 - SQL Injection vulnerabilityCurlyThemes Events Schedule - WordPress Events Calendar Plu…
- CVE-2025-69117WordPress Ingenioso theme <= 1.14.0 - Local File Inclusion vulnerabilityThemeREX Ingenioso
- CVE-2025-69110WordPress AirSupply theme <= 2.0.0 - Local File Inclusion vulnerabilityThemeREX AirSupply
- CVE-2025-60223WordPress WPBot Pro Wordpress Chatbot plugin <= 13.6.5 - Arbitrary File Deletion vulnerabilityQuantumCloud WPBot Pro Wordpress Chatbot
- CVE-2025-59563WordPress Sonaar theme <= 4.27.4 - Privilege Escalation vulnerabilitySONAAR MUSIC Sonaar
- CVE-2025-59560WordPress Sonaar theme <= 4.27.4 - Cross Site Scripting (XSS) vulnerabilitySONAAR MUSIC Sonaar
- CVE-2025-58954WordPress HomeRoofer theme <= 2.11.0 - Local File Inclusion vulnerabilityThemeREX HomeRoofer
- CVE-2025-58953WordPress Joly theme <= 1.22.0 - Local File Inclusion vulnerabilityThemeREX Joly
- CVE-2025-58952WordPress Neuronet theme < 1.14.0 - Local File Inclusion vulnerabilityThemeREX Neuronet
- CVE-2025-49403WordPress Premium Age Verification / Restriction for WordPress Plugin <= 3.0.2 - Arbitrary File Download VulnerabilityAA-Team Premium Age Verification / Restriction for WordPress
- CVE-2024-49269WordPress my flatonica theme <= 0.0.8 - Reflected Cross Site Scripting (XSS) vulnerabilityMythemes my flatonica
- CVE-2026-12165Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parametercontest-gallery Contest Gallery – Upload & Vote Photos, Med…
- CVE-2026-32966Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata DisclosureApache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2026-12199Unauthenticated Denial of Service in nltk.app.wordnet_appnltk/nltk
- CVE-2026-9570Taskbuilder < 5.0.8 - Reflected XSS via ShortcodeTaskbuilder
- CVE-2026-8089weMail < 2.1.3 - Reflected Cross-Site ScriptingweMail: Email Marketing, Email Automation, Newsletters, Sub…
- CVE-2026-0019In SettingsLib, there is a possible way to disable system components due to a logic error in the code.Google Android
- CVE-2025-48643In multiple locations there is a possible provisioning bypass due to improper input validation.Google Android
- CVE-2025-48640In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check.Google Android
- CVE-2025-48617In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass.Google Android
- CVE-2026-53876RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary command execution witMicro-Star International Co. RadiX AX6600 WiFi 6 Tri-Band G…
- CVE-2026-12360JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX EndpointCrocoblock JetEngine
- CVE-2026-12468Race in Updater in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2026-12467Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-12466Heap buffer overflow in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via aGoogle Chrome
- CVE-2026-12465Object lifecycle issue in Metrics in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-12464Use after free in Browser in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potGoogle Chrome
- CVE-2026-12462Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to execuGoogle Chrome
- CVE-2026-12455Use after free in Tab Strip in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to engage in specific UIGoogle Chrome
- CVE-2026-12454Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-12452Use after free in Downloads in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corrupGoogle Chrome
- CVE-2026-12451Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-12449Use after free in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to perform OS-level privilege escaGoogle Chrome
- CVE-2026-12448Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to perform privilege eGoogle Chrome
- CVE-2026-12447Heap buffer overflow in WebRTC in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code inside a sandboxGoogle Chrome
- CVE-2026-12445Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extensGoogle Chrome
- CVE-2026-12443Use after free in Web Authentication in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafGoogle Chrome
- CVE-2026-12442Use after free in Passwords in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crGoogle Chrome
- CVE-2026-12441Use after free in File Input in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruptGoogle Chrome
- CVE-2026-12439Use after free in Digital Credentials in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruptGoogle Chrome
- CVE-2026-12438Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker who had compromised thGoogle Chrome
- CVE-2026-12437Use after free in WebShare in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer prGoogle Chrome
- CVE-2025-26240In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server applicatiopdfkit
- CVE-2025-66391In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write operations, e.g., the
Medium, low and unrated 116
- CVE-2026-44646LiquidJS: `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`harttle liquidjs · liquidjs
- CVE-2026-54533vantage6 node has an Improper Access Control issuevantage6
- CVE-2026-54445Vantage6: Set admin user and password from environment or configurationvantage6
- CVE-2024-27928Vantage6: 2FA can be circumvented with hacked email accessvantage6
- CVE-2026-44645LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` bodyharttle liquidjs · liquidjs
- CVE-2024-24769Vantage6: No limit on emails sent for password/MFA resetvantage6
- CVE-2026-50268Steeltoe: OAEP setting silently selects PKCS#1 v1.5 paddingSteeltoeOSS Steeltoe.Configuration.Encryption · Steeltoe.Co…
- CVE-2026-50267Steeltoe: TLS private keys written to /tmp with default permissions, never deletedSteeltoeOSS Steeltoe.Configuration.Abstractions · Steeltoe.…
- CVE-2026-12568Arbitrary File Write in postman_download moduleBlack Lantern Security BBOT · bbot
- CVE-2026-50202Steeltoe's static JWKS cache shared across schemes and never invalidatedSteeltoeOSS Steeltoe.Security.Authentication.CloudFoundr… +4
- CVE-2026-12567Symlink-following arbitrary write via github_workflows moduleBlack Lantern Security BBOT · bbot
- CVE-2026-44644LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSSharttle liquidjs · liquidjs
- CVE-2026-12566SSRF via unvalidated WWW-Authenticate realm in docker_pull moduleBlack Lantern Security BBOT · bbot
- CVE-2026-50201Steeltoe's sensitive actuators (heapdump/env) only require Restricted permissionSteeltoeOSS Steeltoe.Management.Endpoint · SteeltoeOSS S… +2
- CVE-2026-12565Path Traversal (Zip-Slip) in unarchive moduleBlack Lantern Security BBOT · bbot
- CVE-2026-54386marimo < 0.23.9 XSS via file Query Parameter in assets.pymarimo-team marimo · marimo
- CVE-2026-48991XianYuLauncher: Legacy Microsoft account OAuth sign-in flow lacks PKCE and state validationXianYuLauncher
- CVE-2026-48820CakePHP: View::element() is missing a path containment checkcakephp · cakephp/cakephp
- CVE-2026-48990joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserializationauthlib joserfc · joserfc
- CVE-2026-8049CVE-2026-8049SignalRGB kernel driver
- CVE-2026-48988markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operationsmarkdown-it
- CVE-2026-48821Shaarli: DOM-based Cross-Site Scripting (XSS) in Thumbnail SynchronizerShaarli
- CVE-2026-48823Shaarli has Stored Cross-Site Scripting (XSS) via Tags SearchShaarli
- CVE-2026-32682NGINX Gateway Fabric vulnerabilityF5 NGINX Gateway Fabric
- CVE-2026-48822Shaarli has Stored Cross-Site Scripting (XSS) via Markdown Reference LinksShaarli
- CVE-2026-48817Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`Kludex starlette · starlette
- CVE-2026-10741Nexus Repository Manager - Incorrect Authorization allows credential disclosure via proxy repository configurationSonatype Nexus Repository Manager
- CVE-2026-12529SourceCodester CET Automated Grading System with AI Predictive Analytics Student Self-Registration Endpoint index.php access controlSourceCodester CET Automated Grading System with AI Predict…
- CVE-2026-53870Hermes Agent < 0.16.0 - Sensitive File Permission Vulnerability in Store FilesNousResearch hermes-agent · hermes-agent
- CVE-2026-11525undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matchingundici
- CVE-2026-2674Out-of-bounds Write vulnerability in RTI Connext Professional (Queueing Service,Core Libraries,Persistence Service) allows Overflow Buffers.RTI Connext Professional
- CVE-2026-30799Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plugins) allows Identity Spoofing.RTI Connext Professional
- CVE-2026-2675Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plugins) allows Fake the Source of Data.RTI Connext Professional
- CVE-2026-6733undici vulnerable to HTTP response queue poisoning via keep-alive socket reuseundici
- CVE-2026-20265Insecure Default Domain Allowlist in Splunk AI ToolkitSplunk AI Toolkit
- CVE-2026-9678undici vulnerable to cross-user information disclosure via shared cache whitespace bypassundici
- CVE-2026-9679undici vulnerable to HTTP header injection via Set-Cookie percent-decodingundici
- CVE-2026-48591Stored XSS via unescaped HTML attribute values in earmarkpragdave earmark
- CVE-2026-20178A vulnerability in the browser-based version of Cisco Webex App could have allowed an unauthenticated, remote attacker to redirect users to Cisco Webex App
- CVE-2026-20246Cisco Umbrella Virtual Appliance Privilege Escalation VulnerabilityCisco Umbrella Insights Virtual Appliance
- CVE-2026-20220Cisco Crosswork Network Controller Remote Code Execution VulnerabilityCisco Crosswork Network Change Automation
- CVE-2026-12515Katello: missing repository authorization in content_uploads exposes cross-product content existenceRed Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +5
- CVE-2026-1288RFA File Parsing Vulnerability in Autodesk RevitAutodesk Revit
- CVE-2025-32748Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Host Header Injection vulnerability.Dell PowerFlex rack
- CVE-2026-35069Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Dell PowerFlex
- CVE-2026-35068Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Dell PowerFlex
- CVE-2026-35067Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control vulnerability.Dell PowerFlex
- CVE-2026-35162Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control vulnerability.Dell PowerFlex
- CVE-2026-10850Plane 1.3.1 - Stored XSS in intake issue description_htmlPlane
- CVE-2026-12528389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt()Red Hat Directory Server · Red Hat Enterprise Linux
- CVE-2026-40641Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Use of a Broken or Risky Cryptographic Algorithm vulnerability.Dell PowerFlex
- CVE-2026-55748OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharaOpenStack Horizon · horizon
- CVE-2024-47477Dell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation vulnerability.Dell PowerFlex Manager
- CVE-2026-48142NGINX ngx_http_charset_module vulnerabilityF5 NGINX Open Source · F5 NGINX Plus
- CVE-2026-48117DroneAware's Improper Account Activation in Registration and SSO Flows Leads to Account Takeoverfduflyer DroneAware-Node-Releases
- CVE-2026-9591Cross-Site Request Forgery (CSRF) in SimplCommerce News ModuleSimplCommerce
- CVE-2026-54817WordPress MStore API plugin <= 4.18.4 - Broken Authentication vulnerabilityFluxBuilder MStore API
- CVE-2026-52716WordPress WorkScout-Core plugin <= 1.7.11 - Arbitrary File Deletion vulnerabilitypurethemes WorkScout-Core
- CVE-2025-15657WordPress School Management plugin <= 93.1.0 - Insecure Direct Object References (IDOR) vulnerabilityMojoomla School Management
- CVE-2025-59872HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability,HCL Software ZIE
- CVE-2026-11975Stored Cross-Site Scripting (XSS) in SimplCommerce News Module Admin InterfaceSimplCommerce
- CVE-2025-62340HCL iControl was affected by Inadequate Session Timeout vulnerabilityHCL Software iControl
- CVE-2024-37496WordPress Metro Magazine theme <= 1.3.7 - Broken Access Control on Notice Dismissal vulnerabilityRara Themes Metro Magazine
- CVE-2024-37210WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Broken Access Control vulnerabilityali2woo AliNext
- CVE-2024-35690WordPress Widget Options plugin <= 4.0.1 - Subscriber+ User Meta Data Exposure VulnerabilityMarketingFire Widget Options
- CVE-2024-35648WordPress Emergency Password Reset plugin <= 8.0 - Cross Site Request Forgery (CSRF) vulnerabilityAndy Moyle Emergency Password Reset
- CVE-2024-33909WordPress iPages Flipbook plugin <= 1.5.1 - Broken Access Control vulnerabilityAvirtum iPages Flipbook
- CVE-2024-24709WordPress Shareaholic plugin <= 9.7.11 - Broken Access Control vulnerabilityShareaholic
- CVE-2024-31435WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.6 - Broken Access Control vulnerabilityInisev Social Media & Share Icons
- CVE-2024-33685WordPress Startupzy theme <= 1.1.1 - Broken Access Control vulnerabilityJegstudio Startupzy
- CVE-2026-10839Open redirection vulnerability in Password ManagerPassword Manager
- CVE-2026-10837Open redirection vulnerability in Password ManagerPassword Manager
- CVE-2026-10836Improper neutralization of HTTP headers in Password ManagerPassword Manager
- CVE-2024-34810WordPress Skyline WP theme <= 1.0.10 - Cross Site Request Forgery (CSRF) vulnerabilityExtend Themes Skyline WP
- CVE-2026-12491Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectationsvllm-project vLLM · Red Hat AI Inference Server +3
- CVE-2026-54196WordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerabilityJetmonsters JetFormBuilder
- CVE-2026-49072WordPress WooCommerce Anti-Fraud plugin <= 7.2.6 - Broken Access Control vulnerabilityOPMC WooCommerce Anti-Fraud
- CVE-2026-49071WordPress WooCommerce Dropshipping plugin <= 5.2.4 - Broken Authentication vulnerabilityOPMC WooCommerce Dropshipping
- CVE-2026-45436WordPress WPBakery Page Builder plugin <= 8.7.2 - Broken Access Control vulnerabilityRain-Task WPBakery Page Builder
- CVE-2026-40724WordPress Client Portal (Pro) plugin <= 5.6.2 - Arbitrary File Download vulnerabilityClient Portal
- CVE-2026-40723WordPress Bricks Builder theme <= 2.1.4 - Broken Access Control vulnerabilityBricks Builder
- CVE-2026-39595WordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerabilityBoldGrid W3 Total Cache
- CVE-2026-27410WordPress Slimstat Analytics plugin < 5.4.0 - Deserialization of untrusted data vulnerabilityVeronaLabs Slimstat Analytics
- CVE-2026-24610WordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerabilityWPMet MetForm Pro
- CVE-2026-24575WordPress WishList Member X plugin <= 3.29.0 - Broken Access Control vulnerabilityWishList Member X
- CVE-2026-12115Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Importwpcalc Counter Box – Add Countdowns, Timers & Dynamic Count…
- CVE-2026-47340Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.Apache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2026-32967Apache DolphinScheduler: The `/v2` experimental interface lacks permission checksApache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2026-42357Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.Apache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2026-41280Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projectsApache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2026-40722WordPress Yoast SEO Premium plugin <= 26.6 - Broken Access Control vulnerabilityYoast BV Yoast SEO Premium
- CVE-2026-27869WEB SERVICE (HTTP) DENIAL OF SERVICE VIA SLOW HEADERS ON REGESTA SMART HD-PLC OF TELDATTeldat Regesta Smart HD-PLC - TLDPH16D2
- CVE-2026-27870CROSS-SITE SCRIPTING (XSS) VIA MALICIOUS FILE UPLOAD ON REGESTA SMART HD-PLC OF TELDATTeldat Regesta Smart HD-PLC - TLDPH16D2
- CVE-2026-27868PUBLICATION OF SENSITIVE INFORMATION ON REGESTA SMART HD-PLC OF TELDATTeldat Regesta Smart HD-PLC - TLDPH16D2
- CVE-2026-8494Permalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Titlembis Permalink Manager Lite
- CVE-2026-8607myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attributesaadiqbal Points Management System For Gamification, Ranks,…
- CVE-2026-8383LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST APILearnPress
- CVE-2026-7850WP Magnific Popup <= 1.0 - Author+ Stored XSS via href AttributeWP Magnific Popup
- CVE-2026-0057In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission Google Android
- CVE-2025-48571In multiple functions of btm_sec.cc, there is a possible way for an attacker to intercept SMS messages due to a logic error in the code.Google Android
- CVE-2025-15642Netskope Client Service Insufficient Access ControlsNetskope Client
- CVE-2026-12469Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a craftGoogle Chrome
- CVE-2026-12463Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who had compromised the reGoogle Chrome
- CVE-2026-12461Out of bounds read in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to obtain potentially sensitive iGoogle Chrome
- CVE-2026-12460Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromisedGoogle Chrome
- CVE-2026-12459Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arbitrary scripts or HTMGoogle Chrome
- CVE-2026-12458Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to engage Google Chrome
- CVE-2026-12457Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderGoogle Chrome
- CVE-2026-12456Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to install a maGoogle Chrome
- CVE-2026-12453Insufficient validation of untrusted input in Input in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised tGoogle Chrome
- CVE-2026-12450Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to obtain potentially sensitive infGoogle Chrome
- CVE-2026-12446Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via aGoogle Chrome
- CVE-2026-12444Out of bounds read in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to obtain potentially sensitivGoogle Chrome
- CVE-2025-15641Netskope Client Exposed IOCTL with Insufficient Access ControlsNetskope Client
- CVE-2026-55706sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths.OpenBSD
- CVE-2026-39199snes9x 1.63 allows an out-of-bounds write and denial of service via a crafted .ups file.Snes9X team Snes9X