CVEs published July 2, 2026
265 CVEs were published on July 2, 2026: 33 critical, 148 high.
- Published
- 265
- Critical
- 33
- High
- 148
- Medium
- 80
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 101
Most affected products
- GeoVision GeoWebPlayer
- 18
- WatchGuard Fireware OS
- 16
- Erlang OTP
- 6
- lobehub
- 5
- Ubiquiti UniFi Network Application
- 5
- Ubiquiti UniFi OS Server · Ubiquiti Dream Machines +10
- 5
- Ubiquiti UniFi Protect Application
- 5
- Fuelthemes Werkstatt
- 3
- Gardyn Home Firmware · Gardyn Studio Firmware +1
- 3
- Little Orbit GameFirst Anti-Cheat
- 3
Critical 33
- CVE-2026-13768Gardyn IoT Hub Use of Hard-coded CredentialsGardyn Home Firmware · Gardyn Studio Firmware +1
- CVE-2026-13368WatchGuard Firebox Race Condition and Use-After-Free in Mobile VPN with IKEv2 LDAP AuthenticationWatchGuard Fireware OS
- CVE-2026-41106Microsoft 365 Copilot Elevation of Privilege VulnerabilityMicrosoft 365 Copilot
- CVE-2026-45499Azure OpenAI Elevation of Privilege VulnerabilityMicrosoft Azure Open AI
- CVE-2026-57100Microsoft Entra Provisioning Service Elevation of Privilege VulnerabilityMicrosoft Entra Provisioning Service
- CVE-2026-52830fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protectionleshchenko1979 fast-mcp-telegram · fast-mcp-telegram
- CVE-2026-58466AutoBangumi < 3.2.8 - Hard-coded Default Credentials via add_default_user()EstrellaXD Auto_Bangumi
- CVE-2026-59099Apereo CAS 7.3.0 < 8.0.0-RC6 - AES-GCM Nonce Reuse Information Disclosureapereo cas
- CVE-2022-50973Yonyou KSOA 9.0 Unauthenticated File Upload RCE via ImageUpload ServletYonyou Network Technology Co. KSOA
- CVE-2024-14037Redsea Cloud eHR Unauthenticated File Upload RCE via PtFjk.mobGuangzhou Red Sea Cloud Computing Co. Red Sea Cloud eHR
- CVE-2026-44935Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm DeployerSUSE Rancher · github.com/rancher/fleet
- CVE-2026-58455Dockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.phpNotifiarr dockwatch
- CVE-2026-56004obs-service-tar_scm: command injection via mercurial handleropenSUSE buildservice
- CVE-2026-55116A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerabilityUbiquiti Dream Machines · Ubiquiti Enterprise Fortress G… +5
- CVE-2026-55115A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect ApplicatUbiquiti UniFi Protect Application
- CVE-2026-54402A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS tUbiquiti UniFi OS Server · Ubiquiti Dream Machines +10
- CVE-2026-50747A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found Ubiquiti UniFi Talk Application
- CVE-2026-50746A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to exUbiquiti UniFi Connect Application
- CVE-2026-54400A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi AccesUbiquiti UniFi Access Application
- CVE-2026-50748A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi AcceUbiquiti UniFi Access Application
- CVE-2026-4767Improper Access Control in TR7's WAF-ASPTR7 Cyber Defense WAF-ASP
- CVE-2026-5524Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' ParameterDivi Engine Divi Form Builder
- CVE-2026-57683WordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerabilityEpsiloncool WP Fast Total Search
- CVE-2026-57679WordPress GeekyBot plugin <= 1.2.5 - SQL Injection vulnerabilityAhmadgb GeekyBot
- CVE-2026-57677WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerabilityNovalnet Payment Gateway for WooCommerce
- CVE-2026-57625WordPress Admin and Site Enhancements (ASE) Pro plugin <= 8.8.5 - Cross Site Scripting (XSS) vulnerabilityAdmin and Site Enhancements (ASE) Pro
- CVE-2026-57624WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerabilityCreative Themes Blocksy Companion Pro
- CVE-2026-57623WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerabilityBoldGrid W3 Total Cache
- CVE-2026-57621WordPress Booktics plugin <= 1.0.21 - PHP Object Injection vulnerabilityArraytics Booktics
- CVE-2026-27436WordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerabilityRustaurius Five Star Business Profile and Schema
- CVE-2026-27419WordPress Zegen theme <= 1.1.9 - Arbitrary File Upload vulnerabilityZozothemes Zegen
- CVE-2026-38968ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking.
- CVE-2026-38971ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVLink/GCS_serial_control.cpp in GCS_MAVLIN
High 148
- CVE-2026-13053WatchGuard Firebox Authenticated Out of Bounds Write in Management CLI Command HandlerWatchGuard Fireware OS
- CVE-2026-13050WatchGuard Firebox networkd Out of Bounds Write VulnerabilityWatchGuard Fireware OS
- CVE-2026-13054WatchGuard Firebox Arbitrary File Write via Path Traversal in Management Web UIWatchGuard Fireware OS
- CVE-2026-13079WatchGuard Mobile VPN with SSL Windows Client Local Privilege EscalationWatchGuard Mobile VPN with SSL Client
- CVE-2026-8247WatchGuard Firebox admd Out of Bounds Write VulnerabilityWatchGuard Fireware OS
- CVE-2026-13084Null Pointer Dereference in WatchGuard Fireware OS iked ProcessWatchGuard Fireware OS
- CVE-2026-13722WatchGuard Firebox Firmware Image Validation Bypass in WatchGuard Fireware OSWatchGuard Fireware OS
- CVE-2026-13384WatchGuard Firebox wgagent Out of Bounds Write VulnerabilityWatchGuard Fireware OS
- CVE-2026-13383WatchGuard Firebox ikestubd Out of Bounds Write VulnerabilityWatchGuard Fireware OS
- CVE-2026-54998Microsoft Exchange Online Elevation of Privilege VulnerabilityMicrosoft Exchange Online
- CVE-2026-50721IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payloadThe Libreswan Project libreswan
- CVE-2026-50722IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payloadThe Libreswan Project libreswan
- CVE-2026-12413IKEv2 Denial of Service via malformed fragmentationThe Libreswan Project libreswan
- CVE-2026-58460react-native-receive-sharing-intent Path Traversal via _display_nameajith-ab react-native-receive-sharing-intent
- CVE-2026-58467Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.phpcockpit-hq cockpit
- CVE-2026-59096Dapr - OIDC Discovery Issuer and JWKS URI Injection via Unvalidated X-Forwarded-Hostdapr
- CVE-2026-59095LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrllobehub
- CVE-2026-59094Pathway - Unauthenticated Denial of Service via Exponential Glob Pattern Matching in Document Storepathwaycom pathway
- CVE-2026-59093Weaviate < 1.38.0 - Privilege Escalation via Unchecked Permissions in RBAC Role Assignmentweaviate
- CVE-2026-59092JuiceFS - Authentication Bypass via pprof and metrics Endpointsjuicedata juicefs
- CVE-2026-7311TinyPNG <= 3.6.13 - Authenticated (Author+) Arbitrary File Deletion via 'convert.path' in 'tiny_compress_images' Post MetaTinyPNG – JPEG, PNG & WebP image compression
- CVE-2026-58465Eclipse Wakaama CoAP Block1 Handler Unbounded Memory Allocation DoSeclipse-wakaama wakaama
- CVE-2024-58352Landray OA Unauthenticated HQL Injection via wechatLoginHelper.doShenzhen Landray Software Co. Landry Office Automation
- CVE-2026-8699Stored Cross-Site Scripting (XSS) in TP-Link Archer C5 Web Management InterfaceTP-Link Systems Archer C5
- CVE-2026-55950DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessionsErlang OTP
- CVE-2026-55952TLS 1.3 server denial of service via malformed ClientHello pre-shared key extensionErlang OTP
- CVE-2026-50281Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elementscraftcms cms · craftcms/cms
- CVE-2026-44941libzypp path traversal via "keyhint" in repomd.xmlSUSE libzypp
- CVE-2026-55119A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Talk AUbiquiti UniFi Talk Application
- CVE-2026-55114A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi NetworUbiquiti UniFi Network Application
- CVE-2026-56842A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization vulnerability found in UnUbiquiti UniFi Network Application
- CVE-2026-56841A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerability found in UniFi PrUbiquiti UniFi Protect Application
- CVE-2026-55118A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Access Control vulnerabilUbiquiti UniFi Network Application
- CVE-2026-55112A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerUbiquiti Dream Machines · Ubiquiti Dream Wall +5
- CVE-2026-55117A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Access Application to access files Ubiquiti UniFi Access Application
- CVE-2026-55113A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability found in UniFi Talk ApplicatioUbiquiti UniFi Talk Application
- CVE-2026-55111A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect Floodlight devices to accesUbiquiti UniFi Protect Floodlight
- CVE-2026-54401A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges wiUbiquiti UniFi OS Server · Ubiquiti Dream Machines +10
- CVE-2026-55110A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration Ubiquiti UniFi OS Server · Ubiquiti Dream Machines +10
- CVE-2026-54404A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found Ubiquiti UniFi OS Server · Ubiquiti Dream Machines +10
- CVE-2026-54406A malicious actor with access to the network and high privileges could exploit a Path Traversal vulnerability found in self-hosted instancesUbiquiti UniFi Network Application
- CVE-2026-54408A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to byUbiquiti UniFi Protect Application
- CVE-2026-54409A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UnUbiquiti UniFi Protect Application
- CVE-2026-54403A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypasUbiquiti UniFi OS Server · Ubiquiti Dream Machines +10
- CVE-2026-54405A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Network Application to Ubiquiti UniFi Network Application
- CVE-2026-54407A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to byUbiquiti UniFi Protect Application
- CVE-2026-12168CVE-2026-12168Little Orbit GameFirst Anti-Cheat
- CVE-2026-12167CVE-2026-12167Little Orbit GameFirst Anti-Cheat
- CVE-2026-8079Unintended limited set of actions with elevated privileges may be performed during PDF generation in Progress FlowmonProgress Software Flowmon
- CVE-2026-9272Possibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADSProgress Software Flowmon ADS
- CVE-2026-53358Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()Linux
- CVE-2026-53357Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()Linux
- CVE-2026-58652luci-app-travelmate - Arbitrary Command Execution via UCI Script Parameteropenwrt luci-app-travelmate · openwrt travelmate
- CVE-2026-57678WordPress Slider Revolution plugin 7.0.0-7.0.16 - Cross Site Scripting (XSS) vulnerabilityThemePunch Slider Revolution
- CVE-2026-56037WordPress Themify Popup plugin <= 1.4.3 - PHP Object Injection vulnerabilityThemify Popup
- CVE-2026-57766WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.6 - Cross Site Request Forgery (CSRF) vulnerabilityXplodedThemes WPIDE – File Manager & Code Editor
- CVE-2026-57765WordPress WP EasyCart plugin <= 5.9.0 - SQL Injection vulnerabilityLevelfourdevelopment WP EasyCart
- CVE-2026-57761WordPress SEOWP theme <= 3.12.2 - CSRF to Stored XSS vulnerabilityBlueAstralThemes SEOWP
- CVE-2026-57759WordPress ProfileGrid plugin <= 6.0.0.2 - Cross Site Request Forgery (CSRF) vulnerabilityMetagauss ProfileGrid
- CVE-2026-57758WordPress Permalink Manager for WooCommerce plugin <= 1.0.8.2 - CSRF to Stored XSS vulnerabilityBeRocket Permalink Manager for WooCommerce
- CVE-2026-57757WordPress pCloud WP Backup plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerabilityploudapp pCloud WP Backup
- CVE-2026-57756WordPress nicen-localize-image plugin <= 1.4.9 - SQL Injection vulnerability友人a丶 nicen-localize-image
- CVE-2026-57752WordPress iNET Webkit plugin 1.2.4 - SQL Injection vulnerabilityiNET Webkit
- CVE-2026-57751WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerabilityHeateor Support Heateor Social Login
- CVE-2026-57749WordPress SportsPress Pro plugin <= 2.7.29 - Local File Inclusion vulnerabilityThemeBoy SportsPress Pro
- CVE-2026-57748WordPress Shopify plugin <= 1.0.0 - Local File Inclusion vulnerabilityShopify Help Center Shopify
- CVE-2026-57746WordPress Booked plugin <= 3.0.0 - Broken Access Control vulnerabilityThemeREX Booked
- CVE-2026-57688WordPress POS Entegratör plugin <= 3.7.103 - Broken Access Control vulnerabilityGurmehub POS Entegratör
- CVE-2026-57687WordPress Custom Field Template plugin <= 2.7.8 - SQL Injection vulnerabilityHiroaki Miyashita Custom Field Template
- CVE-2026-57686WordPress WowAddons plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerabilityWPXPO WowAddons
- CVE-2026-57682WordPress Simple Link Directory plugin <= 15.0.5 - Cross Site Scripting (XSS) vulnerabilityQuantumCloud Simple Link Directory
- CVE-2026-57675WordPress WP Photo Album Plus plugin <= 9.2.02.004 - Cross Site Scripting (XSS) vulnerabilityJacob N. Breetvelt WP Photo Album Plus
- CVE-2026-57674WordPress Timetics plugin <= 1.0.58 - Cross Site Scripting (XSS) vulnerabilityArraytics Timetics
- CVE-2026-57673WordPress Optimole plugin <= 4.2.7 - Cross Site Scripting (XSS) vulnerabilityOptimole
- CVE-2026-57672WordPress wpDataTables plugin <= 6.5.1.1 - Cross Site Scripting (XSS) vulnerabilityMelograno Venture Studio wpDataTables
- CVE-2026-57671WordPress perfmatters plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerabilityperfmatters
- CVE-2026-57670WordPress Google Maps CP plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityCodepeople Google Maps CP
- CVE-2026-57426WordPress Modula - PRO plugin <= 2.10.8 - Cross Site Scripting (XSS) vulnerabilityChill Media Labs S.R.L. Modula - PRO
- CVE-2026-57366WordPress WPAdverts plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerabilityGreg Winiarski WPAdverts
- CVE-2026-57362WordPress ChatBot plugin <= 8.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilityQuantumCloud ChatBot
- CVE-2026-57361WordPress Survey Maker plugin <= 5.2.2.5 - Cross Site Scripting (XSS) vulnerabilityAys Pro Survey Maker
- CVE-2026-57360WordPress eCommerce Product Catalog plugin <= 3.5.4 - Cross Site Scripting (XSS) vulnerabilityimpleCode eCommerce Product Catalog
- CVE-2026-57359WordPress ReviewX plugin <= 2.3.10 - Cross Site Scripting (XSS) vulnerabilityReviewX
- CVE-2026-57358WordPress Customize My Account for WooCommerce plugin <= 4.3.9 - Reflected Cross Site Scripting (XSS) vulnerabilitySysBasics Customize My Account for WooCommerce
- CVE-2026-57357WordPress Search Atlas SEO plugin <= 2.6.6 - Reflected Cross Site Scripting (XSS) vulnerabilitySearch Atlas Group Search Atlas SEO
- CVE-2026-57356WordPress MC Woocommerce Wishlist plugin <= 1.9.19 - Cross Site Scripting (XSS) vulnerabilityMoreconvert Team MC Woocommerce Wishlist
- CVE-2026-57351WordPress HandL UTM Grabber plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerabilityHaktan Suren HandL UTM Grabber
- CVE-2026-57350WordPress WP Debugging plugin <= 2.12.2 - Cross Site Scripting (XSS) vulnerabilityAndy Fragen WP Debugging
- CVE-2026-57349WordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.17 - Cross Site Scripting (XSS) vulnerabilityetruel WPeMatico RSS Feed Fetcher
- CVE-2026-57348WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerabilityCozmoslabs Paid Member Subscriptions
- CVE-2026-57345WordPress Internal Links Manager plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerabilityWebraketen Internal Links Manager
- CVE-2026-57344WordPress Classified Listing plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerabilityRadiusTheme Classified Listing
- CVE-2026-57343WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Scripting (XSS) vulnerabilityContempoinc Real Estate
- CVE-2026-42382WordPress Audrey theme <= 1.5 - Local File Inclusion vulnerabilityElated-Themes Audrey
- CVE-2026-39448WordPress NOWPayments for WooCommerce plugin <= 1.4.0 - Broken Access Control vulnerabilityCoderPress NOWPayments for WooCommerce
- CVE-2026-27430WordPress TheFox theme <= 3.9.76 - Reflected Cross Site Scripting (XSS) vulnerabilitytranmautritam TheFox
- CVE-2026-27426WordPress Automotive Car Dealership Business theme <= 13.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityThemesuite Automotive Car Dealership Business
- CVE-2026-27425WordPress Automotive Listings plugin <= 18.6 - Reflected Cross Site Scripting (XSS) vulnerabilityThemesuite Automotive Listings
- CVE-2026-27414WordPress Werkstatt theme <= 4.8.3 - PHP Object Injection vulnerabilityFuelthemes Werkstatt
- CVE-2026-27412WordPress Pearl - Corporate Business theme <= 3.4.10 - Local File Inclusion vulnerabilityStylemixThemes Pearl - Corporate Business
- CVE-2026-27408WordPress NativeChurch theme < 4.9.5 - Cross Site Scripting (XSS) vulnerabilityimithemes NativeChurch
- CVE-2026-27404WordPress LMS theme <= 9.7 - Reflected Cross Site Scripting (XSS) vulnerabilityDesignthemes LMS
- CVE-2026-27402WordPress Kids Life | Children School WordPress theme <= 5.2 - Cross Site Scripting (XSS) vulnerabilityDesignthemes Kids Life | Children School WordPress
- CVE-2026-27060WordPress ARMember Premium plugin < 7.6 - PHP Object Injection vulnerabilityRepute Infosystems ARMember Premium
- CVE-2025-69156WordPress Kids Zone - Children WordPress Theme theme <= 5.4 - Cross Site Scripting (XSS) vulnerabilityDesign themes Kids Zone - Children WordPress Theme
- CVE-2025-69155WordPress Fitness Zone WordPress Theme theme <= 5.7 - Cross Site Scripting (XSS) vulnerabilityDesignthemes Fitness Zone WordPress Theme
- CVE-2025-69154WordPress SpaLab | Beauty Salon WordPress Theme theme <= 6.7 - Cross Site Scripting (XSS) vulnerabilitydesignthemes SpaLab | Beauty Salon WordPress Theme
- CVE-2025-69153WordPress Trendy Travel theme <= 6.7 - Reflected Cross Site Scripting (XSS) vulnerabilitydesignthemes Trendy Travel
- CVE-2025-69152WordPress Artale | Wedding Photography WordPress theme <= 2.2.2 - Cross Site Scripting (XSS) vulnerabilityThemeGoods Artale | Wedding Photography WordPress
- CVE-2025-69134WordPress OpenAI Chatbot for WordPress – Helper plugin <= 1.1.4 - Arbitrary Content Deletion vulnerabilityMerkulove OpenAI Chatbot for WordPress – Helper
- CVE-2025-69133WordPress Tourmaster plugin <= 5.4.5 - Local File Inclusion vulnerabilityGoodLayers Tourmaster
- CVE-2025-69094WordPress Unicamp theme <= 2.2.2 - SQL Injection vulnerabilityThemeMove Unicamp
- CVE-2025-58902WordPress Lighthouse theme <= 1.2.12 - Local File Inclusion vulnerabilityAncoraThemes Lighthouse
- CVE-2026-11946GetEndpoints Memory Exhaustion in open62541open62541 project / o6 Automation open62541
- CVE-2026-13369Ninja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' ParameterSaturdayDrive Ninja Forms - File Uploads
- CVE-2026-8441WP Review Slider Pro <= 12.7.2 - Unauthenticated SQL Injection via 'notinstring' Parameterhttps://wpreviewslider.com/ WP Review Slider Pro
- CVE-2026-13251Perfmatters <= 2.6.4 - Unauthenticated Arbitrary File Read via 's' ParameterPerfmatters
- CVE-2026-9834WP Database Backup <= 7.11 - Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameterdatabasebackup WP Database Backup – Unlimited Database & Fi…
- CVE-2026-14336PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_kEclipse Foundation Eclipse CSI - PIA
- CVE-2026-9563In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number oEclipse Foundation Eclipse Parsson
- CVE-2026-8147Authorization Bypass in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2026-33592FindServers Memory Exhaustion in open62541open62541 project / o6 Automation open62541
- CVE-2026-5821Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injectionelemntor Image Optimizer – Compress Images and Convert to W…
- CVE-2026-14249Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameteremarket-design Request a Quote – Quote Forms for Any WordPr…
- CVE-2026-57278GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerabilityGeoVision GeoWebPlayer
- CVE-2026-57277GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerabilityGeoVision GeoWebPlayer
- CVE-2026-57276GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerabilityGeoVision GeoWebPlayer
- CVE-2026-57275GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerabilityGeoVision GeoWebPlayer
- CVE-2026-57274GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerabilityGeoVision GeoWebPlayer
- CVE-2026-57273GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerabilityGeoVision GeoWebPlayer
- CVE-2026-57272GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerabilityGeoVision GeoWebPlayer
- CVE-2026-57271GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerabilityGeoVision GeoWebPlayer
- CVE-2026-57270GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerabilityGeoVision GeoWebPlayer
- CVE-2026-57269GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerabilityGeoVision GeoWebPlayer
- CVE-2026-57268GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerabilityGeoVision GeoWebPlayer
- CVE-2026-57267GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerabilityGeoVision GeoWebPlayer
- CVE-2026-57266GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerabilityGeoVision GeoWebPlayer
- CVE-2026-57265GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerabilityGeoVision GeoWebPlayer
- CVE-2026-57264GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerabilityGeoVision GeoWebPlayer
- CVE-2026-13132GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerabilityGeoVision GeoWebPlayer
- CVE-2026-13131GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerabilityGeoVision GeoWebPlayer
- CVE-2026-13125GeoVision GeoWebPlayer 1.1.1.0 Websocket Server function vulnerabilityGeoVision GeoWebPlayer
- CVE-2026-38970pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go.
- CVE-2026-38972Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c.
- CVE-2026-52187Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea
- CVE-2026-52189Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea
- CVE-2026-52191Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea
- CVE-2026-52192An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_445C5C componen
Medium, low and unrated 84
- CVE-2026-54477Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting SyntaxGardyn Home Firmware · Gardyn Studio Firmware +1
- CVE-2026-55726Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control SphereGardyn Home Firmware · Gardyn Studio Firmware +1
- CVE-2026-13728WatchGuard Firebox Hardcoded Fallback Encryption Key in Access Portal Resource Credential DatabaseWatchGuard Fireware OS
- CVE-2026-13377WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in SIP Proxy ConfigurationWatchGuard Fireware OS
- CVE-2026-13376WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in spamBlocker ModuleWatchGuard Fireware OS
- CVE-2026-13375WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Autotask Technology Integration ConfigurationWatchGuard Fireware OS
- CVE-2026-13374WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in ConnectWise Technology Integration ConfigurationWatchGuard Fireware OS
- CVE-2026-13373WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Tigerpaw Technology Integration ConfigurationWatchGuard Fireware OS
- CVE-2026-13371WatchGuard Firebox Management Web UI Denial of Service via Unsafe DeserializationWatchGuard Fireware OS
- CVE-2026-26145Microsoft Azure Synapse Elevation of Privilege VulnerabilityMicrosoft Azure Synapse
- CVE-2026-58381Gimp: gimp: double-free in read_layer_block()Red Hat Enterprise Linux
- CVE-2026-59102Forgejo < 15.0.3 - Stored XSS via Actions Run Full Name Renderingforgejo
- CVE-2026-59101AutoBangumi < 3.2.8 - SSRF via /api/v1/setup/test-downloaderEstrellaXD Auto_Bangumi
- CVE-2026-59100LobeChat 2.2.9 - Broken Object Level Authorization via Chat-Group Agent Operationslobehub
- CVE-2026-59098LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Searchlobehub
- CVE-2026-59097Taiga < 6.10.2 - Unauthorized Due-Date Creation via API Viewsetstaiga-back
- CVE-2026-58580LobeChat 2.2.9 - Broken Object-Level Authorization in Message Sub-Resource Writeslobehub
- CVE-2026-58579RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Nameinfiniflow ragflow
- CVE-2026-58578LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Importlobehub
- CVE-2025-71385Netdata < 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg Endpointnetdata
- CVE-2026-13743Improper verification of cryptographic signature in CubeSpace CW0057 Reaction WheelCubeSpace CW0057 Reaction Wheel
- CVE-2026-50282Craft CMS: Unauthorized Deletion of Destination Folders During Forced Movescraftcms cms · craftcms/cms
- CVE-2026-54891Plaintext APPLICATION_DATA injected during TLS handshake delivered to client application post-handshake in sslErlang OTP
- CVE-2026-54886SSH SFTP server denial of service via extended channel data infinite loopErlang OTP
- CVE-2026-54887DTLS server cookie bypass during startup window due to empty initial cookie secretErlang OTP
- CVE-2026-53422SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured rootErlang OTP
- CVE-2026-12166CVE-2026-12166Little Orbit GameFirst Anti-Cheat
- CVE-2026-4772Stored XSS in TR7's WAF-ASPTR7 Cyber Defense WAF-ASP
- CVE-2026-4770DOM-Based XSS in TR7's WAF-ASPTR7 Cyber Defense WAF-ASP
- CVE-2026-58653PraisonAI - Authorization Bypass via Unvalidated project_id in Issue Create/UpdatePraisonAI · praisonai-platform
- CVE-2026-14449POST-based reflected XSS via the thanks parameter in form componentsu5CMS
- CVE-2026-57760WordPress Sendcloud Shipping plugin <= 1.0.29 - Broken Access Control vulnerabilitySendcloud Shipping
- CVE-2026-57764WordPress Surbma | Yoast SEO Breadcrumb Shortcode plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilitySurbma | Yoast SEO Breadcrumb Shortcode
- CVE-2026-57763WordPress Structured Content plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerabilityGordon Böhme Structured Content
- CVE-2026-57762WordPress Simple URLs plugin <= 151 - Cross Site Scripting (XSS) vulnerabilityAndrew Fiebert Simple URLs
- CVE-2026-57755WordPress Mosaic Gallery – Advanced Gallery plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityMisbah WP Mosaic Gallery – Advanced Gallery
- CVE-2026-57754WordPress Livemesh Addons for WPBakery Page Builder plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerabilityLivemesh Addons for WPBakery Page Builder
- CVE-2026-57753WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.1.5 - Sensitive Data Exposure vulnerabilityNathanbarry Kit (formerly ConvertKit) for WooCommerce
- CVE-2026-57750WordPress ez Form Calculator Premium plugin <= 2.14.1.2 - Broken Access Control vulnerabilityKeksdieb ez Form Calculator Premium
- CVE-2026-57747WordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerabilityThemeREX Booked
- CVE-2026-57731WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerabilityUX-themes Flatsome
- CVE-2026-57730WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerabilityUX-themes Flatsome
- CVE-2026-57690WordPress Werkstatt theme <= 4.7.2 - Cross Site Request Forgery (CSRF) vulnerabilityFuelthemes Werkstatt
- CVE-2026-57689WordPress Werkstatt theme <= 4.7.2 - Broken Access Control vulnerabilityFuelthemes Werkstatt
- CVE-2026-57685WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.2.8 - Broken Access Control vulnerabilitydrfuri Martfury - WooCommerce Marketplace WordPress Theme
- CVE-2026-57684WordPress TheFox theme <= 3.9.70 - Cross Site Scripting (XSS) vulnerabilitytranmautritam TheFox
- CVE-2026-57681WordPress GeoDirectory plugin <= 2.8.161 - Server Side Request Forgery (SSRF) vulnerabilityPaolo GeoDirectory
- CVE-2026-57680WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerabilityThemeum Kirki
- CVE-2026-57669WordPress Advanced Contact form 7 DB plugin <= 2.0.9 - Broken Access Control vulnerabilityVsourz Digital Advanced Contact form 7 DB
- CVE-2026-57355WordPress Classified Listing plugin <= 5.4.2 - Broken Access Control vulnerabilityRadiusTheme Classified Listing
- CVE-2026-57354WordPress JetReviews plugin <= 3.0.0.1 - Cross Site Scripting (XSS) vulnerabilityCrocoblock. Jetimpex JetReviews
- CVE-2026-57353WordPress Link Whisper Premium plugin <= 2.9.0 - Broken Access Control vulnerabilityLinkWhisper Link Whisper Premium
- CVE-2026-57352WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.0 - Broken Authentication vulnerabilityVillaTheme ALD – Dropshipping and Fulfillment for AliExpres…
- CVE-2026-57347WordPress Hotel Booking Lite plugin <= 6.0.3 - Sensitive Data Exposure vulnerabilityjetmonsters Hotel Booking Lite
- CVE-2026-57342WordPress ShortPixel Adaptive Images plugin <= 3.11.3 - Cross Site Scripting (XSS) vulnerabilityShortPixel Adaptive Images
- CVE-2026-49779WordPress Tax Exempt for WooCommerce plugin < 1.9.5 - Path Traversal vulnerabilityAddify Tax Exempt for WooCommerce
- CVE-2026-27433WordPress Motors theme < 5.6.85 - Broken Access Control vulnerabilityStylemixThemes Motors
- CVE-2025-69132WordPress Corpkit theme <= 1.0.5 - Sensitive Data Exposure vulnerabilityZozothemes Corpkit
- CVE-2025-66076WordPress Woostify Sites Library plugin <= 1.6.2 - Broken Access Control vulnerabilitydylan ngo Woostify Sites Library
- CVE-2026-54431Improper Data Validation in liboauth2OpenIDC liboauth2
- CVE-2026-54430Server-Site Request Forgery in liboauth2OpenIDC liboauth2
- CVE-2026-9145Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'crmperks Database for Contact Form 7, WPforms, Elementor fo…
- CVE-2026-8482Information leak in NSRPC client historyStormshield Network Security
- CVE-2026-14029Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parametertrainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…
- CVE-2026-10104Product Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail Parameternikhilgadhiya Product Video Gallery for Woocommerce
- CVE-2026-13252RSS Aggregator by Feedzy <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aspectRatio' Attributethemeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…
- CVE-2026-12472Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parametersthemeum Kirki – Freeform Page Builder, Website Builder & Cu…
- CVE-2026-11896My Calendar <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameterjoedolson My Calendar – Accessible Event Manager
- CVE-2026-12134JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Creation/Modification via season_groupedit AJAX actionbeardev JoomSport – for Sports: Team & League, Football, Ho…
- CVE-2026-12122Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Actionthemeum Kirki – Freeform Page Builder, Website Builder & Cu…
- CVE-2026-13459JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameterjetmonsters JetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-12657LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' ParameterLatePoint – Calendar Booking Plugin for Appointments and Ev…
- CVE-2026-9188Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.7.6 - Unauthenticated Insecure Direct Object Reference via Predictable 'edit_key' / 'appointmentkey' ParameterAppointment Bookings for Zoom GoogleMeet and more – Wappoin…
- CVE-2026-11965User Registration & Membership < 5.2.0 - Unauthenticated Paid Membership BypassUser Registration & Membership
- CVE-2026-11781Adminify < 4.2.10 - Contributor+ Sensitive Information Disclosure via Global Search AJAXAdminify
- CVE-2026-11578Fluent Forms < 6.2.5 - Form Manager+ Cross-Form Submission Entry Deletion via IDORFluent Forms
- CVE-2026-10077YOOtheme Pro < 5.0.35 - Author+ Stored XSS via UIkit Data Attributesyootheme
- CVE-2026-13704GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Formstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2026-5348Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosurekodezen Academy LMS – WordPress LMS Plugin for Complete eLe…
- CVE-2026-10089Insert Pages <= 3.11.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Keys (Meta Key Names)figureone Insert Pages
- CVE-2026-11592Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX ActionEmail Subscribers & Newsletters by Icegram Express – Email…
- CVE-2026-13357Houzez Property Feed <= 2.5.46 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameterpropertyhive Houzez Property Feed
- CVE-2026-11600Envo's Templates & Widgets for Elementor and WooCommerce <= 1.4.26 - Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Settingenvothemes Envo's Templates & Widgets for Elementor and Woo…
- CVE-2026-52188Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea