CVEs published July 23, 2026
376 CVEs were published on July 23, 2026: 57 critical, 142 high.
- Published
- 376
- Critical
- 57
- High
- 142
- Medium
- 170
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 116
Most affected products
- cure53 DOMPurify · dompurify
- 9
- GFI Software GFI Archiver
- 9
- JetBrains IntelliJ IDEA
- 6
- Logto
- 6
- Pronetiqs Panduit Intravue
- 5
- Bold Reports (By SyncFusion) Standalone Report Designer
- 4
- calcom cal.diy
- 4
- FFmpeg
- 4
- Google Chrome
- 4
- JetBrains WebStorm
- 4
Critical 57
- CVE-2026-56160Azure Red Hat OpenShift (ARO) Elevation of Privilege VulnerabilityMicrosoft Azure Red Hat OpenShift
- CVE-2026-54120Microsoft Surface Remote Code Execution VulnerabilityMicrosoft Surface Management Services
- CVE-2026-56165Microsoft Account Remote Code Execution VulnerabilityMicrosoft Account
- CVE-2026-42933Unintended Proxy or Intermediary in Panduit IntraVUE by PronetiqsPronetiqs Panduit Intravue
- CVE-2026-637329router before 0.4.60 Remote Code Execution via default passworddecolua 9router
- CVE-2025-71389Cal.com before 5.9.9 Remote Code Execution via RSCcalcom cal.diy
- CVE-2024-58355Cal.com through 4.7.15 Cross-Site Scripting via booking questionscalcom cal.diy
- CVE-2024-58353Cal.com through 4.7.15 Cross-Site Scripting via booking questionscalcom cal.diy
- CVE-2026-15981SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parametercyberlord92 SAML Single Sign On – SSO Login
- CVE-2026-47724nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalationjuev nebula-mesh · github.com/juev/nebula-mesh
- CVE-2026-15630CVE-2026-15630Casdoor
- CVE-2026-47669DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCEdbgate
- CVE-2026-47670DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injectiondbgate · dbgate-api
- CVE-2026-63359Appriss Insights VINE SQLIAppriss Insights Victim Information Notification Exchange
- CVE-2026-47668DbGate: Unauthenticated Remote Code Execution via JSON Script Runnerdbgate · dbgate-serve
- CVE-2026-6516Remote Code ExecutionZohocorp ManageEngine ADAudit Plus
- CVE-2026-65701SoftVC VITS Singing Voice Conversion Path Traversal via /wav2wav Flask Routesvc-develop-team so-vits-svc
- CVE-2026-65700h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files APIh2oai h2ogpt
- CVE-2026-47752Tugtainer has Server-Side Template Injection in notification templates that leads to Remote Code ExecutionQuenary tugtainer
- CVE-2026-65761Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1joomshaper.com Easy Store extension for Joomla
- CVE-2026-65760Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1joomshaper.com Easy Store extension for Joomla
- CVE-2026-15611Unverified email-based SSO account linkingLogto
- CVE-2026-15612LOIDC nonce validation bypassLogto
- CVE-2026-15616Local MFA not enforced during SSO sign-inLogto
- CVE-2026-15617Principal/domain lookup without case normalizationLogto
- CVE-2026-65689Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database DownloadBold Reports (By SyncFusion) Standalone Report Designer
- CVE-2026-65688Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Font ProcessingBold Reports (By SyncFusion) Standalone Report Designer
- CVE-2026-65687Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via SVG ProcessingBold Reports (By SyncFusion) Standalone Report Designer
- CVE-2026-65907In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possibleJetBrains TeamCity
- CVE-2026-65606SiYuan before v3.7.2 Cross-Site Scripting to RCEsiyuan-note siyuan
- CVE-2026-65605SiYuan before v3.7.2 Stored XSS to RCE via Attribute Viewsiyuan-note siyuan
- CVE-2026-64813In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development sessionJetBrains IntelliJ IDEA
- CVE-2026-64812In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development sessionJetBrains IntelliJ IDEA
- CVE-2026-65471WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerabilityAvada Studio Avada Core
- CVE-2026-65461WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerabilityWebの相談所 Really Simple CSV Importer
- CVE-2026-65455WordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerabilityMapSVG
- CVE-2026-61951WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerabilitythemetechmount TrueBooker
- CVE-2026-61950WordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerabilitythemetechmount TrueBooker
- CVE-2026-61949WordPress Bookly plugin <= 27.7 - SQL Injection vulnerabilityBookly
- CVE-2026-61948WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerabilityShahjada WPDM – Premium Packages
- CVE-2026-59555WordPress Participants Database plugin <= 2.7.8.3 - Arbitrary File Deletion vulnerabilityRoland Barker Participants Database
- CVE-2026-59544WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerabilityThrive Themes Coupon Thrive Quiz Builder
- CVE-2026-59543WordPress Advanced Views plugin <= 3.8.11 - Remote Code Execution (RCE) vulnerabilityWPLake Advanced Views
- CVE-2026-59540WordPress SMS Alert Order Notifications plugin <= 3.9.6 - Privilege Escalation vulnerabilityCozy Vision Technologies Pvt. SMS Alert Order Notifications
- CVE-2026-59526WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerabilityRomanCode MapSVG
- CVE-2026-59525WordPress Participants Database plugin <= 2.7.8.3 - SQL Injection vulnerabilityRoland Barker Participants Database
- CVE-2026-59514WordPress Buddyboss Platform plugin <= 3.0.5 - SQL Injection vulnerabilityMightyNetworks vs BuddyBoss Buddyboss Platform
- CVE-2026-57784WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Request Forgery (CSRF) vulnerabilityNinja Forms File Uploads Extension
- CVE-2026-27064WordPress Mailster plugin <= 4.1.17 - Arbitrary File Upload vulnerabilityEverPress Mailster
- CVE-2026-15015MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpointcascadiawebservices MountDev AI MCP Connector for WordPress
- CVE-2026-64873Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extensionregularlabs.com Cache Cleaner Pro extension for Joomla
- CVE-2026-64874Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extensionregularlabs.com Cache Cleaner Pro extension for Joomla
- CVE-2026-65431Joomla Extension - regularlabs.com - Zipslip in GeoIP extensionregularlabs.com GeoIP extension for Joomla
- CVE-2026-15011Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameteremarket-design Customer Support Ticket System & Helpdesk
- CVE-2026-14282GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Fieldrtcamp GoDAM – Organize WordPress Media Library & File Mana…
- CVE-2026-16723Remote Code Execution in fastjson 1.2.68–1.2.83Alibaba Fastjson · com.alibaba:fastjson
- CVE-2026-52439An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection m
High 142
- CVE-2026-56167Azure AI Search Elevation of Privilege VulnerabilityMicrosoft Azure AI Search
- CVE-2026-28698Exposure of Sensitive System Information to an Unauthorized Control Sphere in Panduit IntraVUE by PronetiqsPronetiqs Panduit Intravue
- CVE-2026-40430Plaintext Storage of a Password in Panduit IntraVUE by PronetiqsPronetiqs Panduit Intravue
- CVE-2026-16804Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the renderer process to potenGoogle Chrome
- CVE-2026-16805Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-16806Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via aGoogle Chrome
- CVE-2026-16807Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to potentially perform a sandbox escape viaGoogle Chrome
- CVE-2026-65694Microweber CMS 2.0.20 Path Traversal via ServeStaticFileControllermicroweber
- CVE-2026-65604Skipper Incomplete Fix for CVE-2026-50197 Policy Bypasszalando skipper
- CVE-2026-633139Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetchdecolua 9router
- CVE-2024-58354cal.com Repository Takeover via pull_request_target Workflowcalcom cal.diy
- CVE-2026-6924Weak entropy initialization in Silicon Labs Matter SiWx917 TinyCrypt pathSilicon Labs Matter Github
- CVE-2026-16002Out-of-bounds Read in MZ Automation lib60870MZ Automation lib60870
- CVE-2026-50032NULL Pointer Dereference in MZ Automation libIEC61850MZ Automation libIEC61850
- CVE-2026-49035Stack-based Buffer Overflow in MZ Automation libIEC61850MZ Automation libIEC61850
- CVE-2026-50039Stack-based Buffer Overflow in MZ Automation libIEC61850MZ Automation libIEC61850
- CVE-2026-34496victor Web - Priviledge EscalationJohnson Controls victor Web
- CVE-2026-21653CCure and Victor Application Server - Server Side Request ForgeryJohnson Controls CCure 9000 and victor application server
- CVE-2026-47723nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)juev nebula-mesh · github.com/juev/nebula-mesh
- CVE-2026-21655C-CURE 9000 and Victor application server - Deserialization of Untrusted DataJohnson Control victor · Johnson Controls CCure +1
- CVE-2026-16796Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()AWS bedrock-agentcore · bedrock-agentcore
- CVE-2026-15968Stored XSS vulnerability in MOVEit TransferProgress MOVEit Transfer
- CVE-2026-15967MOVEit Transfer refresh-token processing does not enforce updated account restrictionsProgress MOVEit Transfer
- CVE-2026-15966Improper CORS handling in MOVEit TransferProgress MOVEit Transfer
- CVE-2026-10697MFA Bypass in MOVEit TransferProgress MOVEit Transfer
- CVE-2026-15212WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 43.2 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings UpdateWPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION
- CVE-2026-47722nebula-mesh: Host advanced overrides allow YAML injection into agent config.ymljuev nebula-mesh · github.com/juev/nebula-mesh
- CVE-2026-60122gpsd gpsprof Code Injection via SKY.satellites used Fieldgpsd
- CVE-2026-25800quinn-proto has remote memory exhaustion from unbounded out-of-order stream reassemblyquinn-rs quinn · quinn-proto
- CVE-2026-65706FFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame ProcessingFFmpeg
- CVE-2026-65705FFmpeg 3.4 - 8.1.2 vf_floodfill Out-of-Bounds Write via filter_frame()FFmpeg
- CVE-2026-65704FFmpeg 8.1.2 Out-of-Bounds Write via TY Demuxer and Shorten DecoderFFmpeg
- CVE-2026-65703FFmpeg 2.7 - 8.1.2 Out-of-Bounds Write in TDSC Video DecoderFFmpeg
- CVE-2026-16756Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of serviceaws-smithy-http-server
- CVE-2026-63765Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creationchatwoot
- CVE-2026-65919Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownloadmeshery
- CVE-2026-65918PyTorch torchvision GIF Decoder Out-of-bounds Heap Readpytorch vision
- CVE-2026-47743Shopper: Multiple data integrity and disclosure issues in admin Livewire componentsshopperlabs shopper · shopper/framework
- CVE-2026-65702Vanna 2.0.2 Path Traversal via FileSystemConversationStorevanna-ai vanna
- CVE-2026-65759Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1joomshaper.com Easy Store extension for Joomla
- CVE-2026-44909Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer.Facebook proxygen
- CVE-2026-65695Office-Word-MCP-Server 1.1.11 Path Traversal via document toolsGongRzhe Office-Word-MCP-Server
- CVE-2026-65917CyberPanel IncBackups IDOR via Sequential Backup IDusmannasir cyberpanel
- CVE-2026-65916CyberPanel Missing Authorization in cancelBackupCreation Handlerusmannasir cyberpanel
- CVE-2026-15614IdP-initiated SAML sessions not reliably invalidated (replay)Logto
- CVE-2026-15615SAML <Conditions> element not validatedLogto
- CVE-2026-16584AWS API MCP Server Security Policy Bypass via Startup Failureaws-api-mcp-server · awslabs-aws-api-mcp-server
- CVE-2026-43823When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in Apple swift-crypto
- CVE-2026-43820NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs.Apple swift-nio-ssl
- CVE-2026-65690Bold Reports Standalone Report Designer < 14.1.12 Path Traversal RCE via File UploadBold Reports (By SyncFusion) Standalone Report Designer
- CVE-2026-14257brace-expansion DoS via unbounded expansion length causing an out-of-memory process crashjuliangruber brace-expansion · brace-expansion
- CVE-2026-65908In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project openJetBrains PyCharm
- CVE-2026-65906In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possibleJetBrains TeamCity
- CVE-2026-57626WordPress MailPoet plugin 5.30.0-5.33.0 - Cross Site Request Forgery (CSRF) vulnerabilityMailPoet
- CVE-2026-65897Grav API Plugin 1.0.9 Privilege Escalation via Invitations groupsgetgrav grav
- CVE-2026-65896Grav API Plugin before 1.0.10 Path Traversal via movegetgrav grav
- CVE-2026-65895Grav API Plugin before 1.0.10 Broken Access Controlgetgrav grav
- CVE-2026-65608Grav before 2.0.9 Remote Code Execution via FlexDirectorygetgrav grav · getgrav/grav
- CVE-2026-65607SiYuan before v3.7.2 Path Traversal via /export/temp/siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-64815In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form filesJetBrains IntelliJ IDEA
- CVE-2026-64814In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development sessionJetBrains IntelliJ IDEA
- CVE-2026-64811In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container confiJetBrains IntelliJ IDEA
- CVE-2026-64809In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreterJetBrains PhpStorm
- CVE-2026-64808In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project toolingJetBrains PhpStorm
- CVE-2026-64807In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configurationJetBrains WebStorm
- CVE-2026-64806In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpretJetBrains WebStorm
- CVE-2026-64805In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager toJetBrains WebStorm
- CVE-2026-64804In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter toolingJetBrains WebStorm
- CVE-2026-64803In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDKJetBrains GoLand
- CVE-2026-64802In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integrationJetBrains GoLand
- CVE-2026-65540WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerabilityMetin Saraç Popup for CF7 with Sweet Alert
- CVE-2026-65539WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerabilityBimal Rekhadiya Kwayy HTML Sitemap
- CVE-2026-65532WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerabilityPersianScript Persian Woocommerce SMS
- CVE-2026-65526WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerabilityThemeisle Visualizer
- CVE-2026-65516WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerabilityPepro Dev. Group PeproDev Ultimate Invoice
- CVE-2026-65511WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerabilitypixelacehq Manual - Documentation, Knowledge Base & Educati…
- CVE-2026-65510WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerabilityPepro Dev. Group PeproDev Ultimate Invoice
- CVE-2026-65500WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerabilitypixelacehq Manual - Documentation, Knowledge Base & Educati…
- CVE-2026-65497WordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerabilityComplianz
- CVE-2026-65495WordPress Dokan Pro plugin <= 5.0.3 - Broken Access Control vulnerabilityDokan Multivendor Plugin Dokan Pro
- CVE-2026-65494WordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerabilityDokan Pro
- CVE-2026-65493WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerabilityDokan Pro
- CVE-2026-65492WordPress Dokan Pro plugin < 5.0.7 - Cross Site Scripting (XSS) vulnerabilityweDevs Dokan Pro
- CVE-2026-65488WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityLA-Studio Element Kit for Elementor
- CVE-2026-65481WordPress Vino theme <= 1.9 - Local File Inclusion vulnerabilityElated-Themes Vino
- CVE-2026-65477WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerabilitySelect-Themes Tonda Core
- CVE-2026-65462WordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerabilityUncanny Owl Uncanny Automator
- CVE-2026-65454WordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerabilityExpressTech Systems Quiz And Survey Master
- CVE-2026-65451WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerabilityRomanCode MapSVG
- CVE-2026-65450WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerabilityRomanCode MapSVG
- CVE-2026-61954WordPress PayU India plugin <= 3.8.9 - Broken Access Control vulnerabilityPayU India
- CVE-2026-61947WordPress Form Vibes – Database Manager for Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerabilityWPVibes Form Vibes – Database Manager for Forms
- CVE-2026-61944WordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerabilityBookly
- CVE-2026-61943WordPress WPDM – Premium Packages plugin <= 6.2.0 - Broken Access Control vulnerabilityShahjada WPDM – Premium Packages
- CVE-2026-59554WordPress Ziina plugin <= 1.2.21 - Broken Authentication vulnerabilityZiina
- CVE-2026-59547WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.1.4 - Broken Access Control vulnerabilityEasy Payment Payment Gateway for PayPal on WooCommerce
- CVE-2026-59545WordPress miniOrange Discord Integration plugin <= 2.2.4 - Broken Authentication vulnerabilityminiOrange Discord Integration
- CVE-2026-59542WordPress Kali Forms plugin <= 2.4.18 - Arbitrary File Deletion vulnerabilityWP Chill Kali Forms
- CVE-2026-59541WordPress WP BASE Booking plugin <= 6.3.1 - Privilege Escalation vulnerabilityHakan Ozevin WP BASE Booking
- CVE-2026-59517WordPress Easy Form Builder plugin <= 4.0.12 - Cross Site Scripting (XSS) vulnerabilityhassantafreshi Easy Form Builder
- CVE-2026-59512WordPress Product Enquiry for WooCommerce plugin <= 2.2.34.43 - Cross Site Scripting (XSS) vulnerabilityPI Web Solution Product Enquiry for WooCommerce
- CVE-2026-57809WordPress AffiliateWP plugin <= 2.34.0 - Reflected Cross Site Scripting (XSS) vulnerabilityAffiliateWP
- CVE-2026-57785WordPress ApusListing theme <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerabilityApusTheme ApusListing
- CVE-2026-57769WordPress Grand Photography theme <= 5.7.8 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeGoods Grand Photography
- CVE-2026-57767WordPress WP Google Maps Pro plugin <= 10.1.02 - Cross Site Scripting (XSS) vulnerabilityCodeCabin.io WP Google Maps Pro
- CVE-2026-57735WordPress Breakdance plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerabilitySoflyy Breakdance
- CVE-2026-57704WordPress Smart Manager plugin <= 8.90.0 - Cross Site Scripting (XSS) vulnerabilityStoreApps Smart Manager
- CVE-2026-57701WordPress Real Estate Manager Pro plugin <= 12.8.5 - Reflected Cross Site Scripting (XSS) vulnerabilityWebCodingPlace Real Estate Manager Pro
- CVE-2026-57699WordPress Slider Pro plugin <= 4.8.13 - Cross Site Scripting (XSS) vulnerabilitybqworks Slider Pro
- CVE-2026-57696WordPress Picture Gallery plugin <= 1.6.5 - Arbitrary File Deletion vulnerabilityvideowhisper Picture Gallery
- CVE-2026-57428WordPress Sprout Clients plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerabilityBoldGrid Sprout Clients
- CVE-2026-57427WordPress Download Monitor - WPForms Lock plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerabilityDownload Monitor - WPForms Lock
- CVE-2026-57397WordPress Coaching theme <= 3.9.2 - Cross Site Scripting (XSS) vulnerabilityThimPress. Coaching
- CVE-2026-57374WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.7 - Cross Site Scripting (XSS) vulnerabilityWisetr Funnel Kit Funnel Builder PRO
- CVE-2026-57370WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityCODEPRESS IT Solutions Visitor Traffic Real Time Statistics…
- CVE-2026-57367WordPress WP Booking System plugin < 5.12.8.1 - Broken Access Control vulnerabilityWP Booking System . WP Booking System
- CVE-2026-25405WordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerabilityDigitalME eRoom
- CVE-2026-24552WordPress Create by Mediavine plugin <= 2.5.3 - SQL Injection vulnerabilityJohn-Michael L'Allier Create
- CVE-2026-64611Libcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loop in cfieee1284normalizemakemodel()Red Hat Enterprise Linux
- CVE-2026-16745Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validationRed Hat OpenShift AI
- CVE-2026-15017MDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' HandlersMDJM Event Management
- CVE-2026-65758Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2tassos.gr Convert Forms extension for Joomla
- CVE-2026-65757Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extensionregularlabs.com Modules Anywhere extension for Joomla
- CVE-2026-65755Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extensionregularlabs.com Articles Anywhere extension for Joomla · re…
- CVE-2026-65754Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extensionregularlabs.com ReReplacer PRo extension for Joomla
- CVE-2026-64876Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extensionregularlabs.com GeoIP extension for Joomla
- CVE-2026-64799Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensionsregularlabs.com Articles Anywhere Pro extension for Joomla…
- CVE-2026-65430Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extensionregularlabs.com GeoIP extension for Joomla
- CVE-2026-52688RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validationPowerDNS Recursor
- CVE-2024-58330A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analyticBosch Camera Firmware
- CVE-2024-58023Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive information.Bosch Configuration Manager
- CVE-2026-16287Root Command Injection via Offline Update in TÜBİTAK BİLGEM's pardus-updateTUBITAK BILGEM Software Technologies Research Institute par…
- CVE-2026-9713Product Designer for WooCommerce WordPress | Lumise <= 2.1.1 - Unauthenticated SQL Injection via 'id' Parameter in Cart JSON UploadKing-Theme Product Designer for WooCommerce WordPress | Lum…
- CVE-2026-12421ARforms <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'password' Field ValuesARforms
- CVE-2026-59678portprotonqt allows any users to mount and unmount arbitrary file systems and modify the network configuration via NetworkManagerLinux-Gaming PortProtonQt
- CVE-2026-14291Security Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fasecurity-ninja-premium
- CVE-2026-12082Praison AI SEO < 5.0.7 - Unauthenticated Multiple Missing Authorization (Post Permalink Modification, Plugin Settings Disclosure)Praison AI SEO
- CVE-2026-64600xfs: resample the data fork mapping after cycling ILOCKLinux
- CVE-2026-7232FormCraft <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-ParametersFormCraft
- CVE-2026-7534SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' ParameterFantasticPlugins SUMO Reward Points for WooCommerce
- CVE-2026-15074@fastify/static vulnerable to route guard bypass via path traversal@fastify/static
- CVE-2026-38764An issue in Unistal Systems Pvt.
Medium, low and unrated 177
- CVE-2026-16767Ne-Lexa php-zip ZIP ZipFile.php extractTo path traversalNe-Lexa php-zip
- CVE-2026-50044Inadequate Encryption Strength in Panduit IntraVUE by PronetiqsPronetiqs Panduit Intravue
- CVE-2026-44955Exposure of Sensitive System Information to an Unauthorized Control Sphere in Panduit IntraVUE by PronetiqsPronetiqs Panduit Intravue
- CVE-2026-16765CodeAstro Online Classroom loginlinkadmin.php sql injectionCodeAstro Online Classroom
- CVE-2026-16764OWASP DefectDojo API/Web serializers.py UserSerializer privileges managementOWASP DefectDojo
- CVE-2026-16763localstack serverless-localstack Configuration index.js os command injectionserverless-localstack
- CVE-2026-50103Improper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850MZ Automation libIEC61850
- CVE-2026-48012Shopware SSO referer trust leading to an arbitrary redirect targetshopware · shopware/core +1
- CVE-2026-48013Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validationshopware · shopware/core +1
- CVE-2026-12353Rhcs: memory leak during https connection leads to denial of serviceRed Hat Certificate System · Red Hat Enterprise Linux
- CVE-2026-64785SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 bacApple swift-nio-http2
- CVE-2026-15687Path traversal via non-tar copyDirectoryFromPodkubernetes-client/java
- CVE-2026-65010Datasets Symlink-following Arbitrary File Write via Extractor.extract()huggingface datasets
- CVE-2026-65920Diffusers Path Traversal via weight_map Arbitrary File Readhuggingface diffusers
- CVE-2026-44210Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotationskata-containers · github.com/kata-containers/kata-containers
- CVE-2026-47769APIFold Vulnerable to Unauthenticated Webhook Event InjectionWork90210 APIFold
- CVE-2026-47755ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modalitflow-org itflow
- CVE-2026-65762Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0phoca.cz Phoca Guestbook extension for Joomla
- CVE-2026-65699AgentGPT 1.0.0 Authorization Bypass via Agent Task Creationreworkd AgentGPT
- CVE-2026-65763Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4phoca.cz Phoca Maps extension for Joomla
- CVE-2026-16768Gdk-pixbuf: out-of-bounds read in ico parserGNOME gdk-pixbuf · Red Hat Enterprise Linux
- CVE-2026-65698Void 1.3.4 Path Traversal via AI Agent File-Reading Toolsvoideditor void
- CVE-2026-65697Fathom Lite 1.3.1 Stored XSS via /collect Endpointusefathom fathom
- CVE-2026-65696Overseerr 1.35.0 Authorization Bypass via pushSubscriptions APIsct overseerr
- CVE-2026-48539GFI Archiver < 15.14 Stored XSS via MailInsights.aspxGFI Software GFI Archiver
- CVE-2026-48538GFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashxGFI Software GFI Archiver
- CVE-2026-48537GFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspxGFI Software GFI Archiver
- CVE-2026-48536GFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspxGFI Software GFI Archiver
- CVE-2026-48535GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspxGFI Software GFI Archiver
- CVE-2026-48534GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspxGFI Software GFI Archiver
- CVE-2026-48532GFI Archiver < 15.13 Stored XSS via FAARetentionPolicyWizard.aspxGFI Software GFI Archiver
- CVE-2026-48531GFI Archiver < 15.13 Stored XSS via RetentionPolicyWizard.aspxGFI Software GFI Archiver
- CVE-2026-48530GFI Archiver < 15.14 Stored XSS via CategorizationPolicyWizard.aspxGFI Software GFI Archiver
- CVE-2026-11804Program Module VulnerabilityTridium Niagara Framework · Tridium Niagara Enterprise Secu…
- CVE-2026-8287Unrestricted File Upload in BizimHesap Information Systems' Online Pre-Accounting SoftwareBizimHesap Information Systems Industry and Trade Online Pr…
- CVE-2026-16735release-it conventional-changelog Changelog File index.js writeChangelog os command injectionrelease-it conventional-changelog
- CVE-2026-16733bahmutov find-cypress-specs Branch index.js shell.exec os command injectionbahmutov find-cypress-specs
- CVE-2026-65914DOMPurify before 3.3.2 Mutation XSS via Re-Contextualizationcure53 DOMPurify · dompurify
- CVE-2026-65913DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILEScure53 DOMPurify · dompurify
- CVE-2026-65912DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTRcure53 DOMPurify · dompurify
- CVE-2026-65911DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakagecure53 DOMPurify
- CVE-2026-65904DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE modecure53 DOMPurify
- CVE-2026-65903DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGScure53 DOMPurify · dompurify
- CVE-2026-65902DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTagscure53 DOMPurify · dompurify
- CVE-2026-65901DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeNamecure53 DOMPurify · dompurify
- CVE-2026-65900DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOMcure53 DOMPurify · dompurify
- CVE-2026-65899DOMPurify before 3.4.9 Trusted Types Policy State Contaminationcure53 DOMPurify · dompurify
- CVE-2026-65898DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfigcure53 DOMPurify · dompurify
- CVE-2026-15037XML injection vulnerability in QDom comment, CDATA and processing-instruction serializationQt
- CVE-2026-65475WordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulnerabilityWP Chill Modula Image Gallery
- CVE-2026-61945WordPress WooCommerce Product Stock Alert plugin <= 3.0.6 - Sensitive Data Exposure vulnerabilityMultiVendorX WooCommerce Product Stock Alert
- CVE-2026-64810In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity trackingJetBrains IntelliJ IDEA
- CVE-2026-64800In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by defaultJetBrains GoLand
- CVE-2026-65550WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerabilitywpshopmart Tabs
- CVE-2026-65538WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerabilityNilo Velez Machete
- CVE-2026-65537WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerabilityThemeisle Cyr to Lat reloaded – transliteration of links an…
- CVE-2026-65536WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cross Site Request Forgery (CSRF) vulnerabilityMahdi Yousefi افزونه حمل و نقل ووکامرس
- CVE-2026-65535WordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnerabilityTakayuki Miyauchi TinyMCE Templates
- CVE-2026-65534WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityCharlie Etienne Custom links in Elementor Image Carousel
- CVE-2026-65533WordPress Smart SEO Tool plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerabilitywbolt.com Smart SEO Tool
- CVE-2026-65531WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerabilityThemeum Qubely
- CVE-2026-65530WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerabilityTemplateSpare
- CVE-2026-65529WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerabilityIqonic Designs Graphina – Charts and Graphs For Elementor
- CVE-2026-65528WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerabilitybannersky BSK PDF Manager
- CVE-2026-65527WordPress LIQUID SPEECH BALLOON plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilitylqd LIQUID SPEECH BALLOON
- CVE-2026-65525WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerabilityuxper Civi Framework
- CVE-2026-65524WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerabilityThemeFusion Avada Custom Branding
- CVE-2026-65522WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerabilitypixelacehq Manual - Documentation, Knowledge Base & Educati…
- CVE-2026-65521WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerabilityMahmudul Hasan Arif WP Social Ninja
- CVE-2026-65519WordPress Photo Gallery plugin <= 2.7.7.29 - Cross Site Scripting (XSS) vulnerabilitygt3themes Photo Gallery
- CVE-2026-65518WordPress Accept Donations with PayPal & Stripe plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerabilityScott Paterson Accept Donations with PayPal & Stripe
- CVE-2026-65514WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerabilitycodepeople Appointment Hour Booking
- CVE-2026-65512WordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerabilityMelapress WP Activity Log
- CVE-2026-65506WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.12 - Broken Access Control vulnerabilityMP3 Audio Player for Music, Radio & Podcast by Sonaar
- CVE-2026-65505WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerabilitybdthemes Ultimate Store Kit Elementor Addons
- CVE-2026-65503WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerabilitybdthemes Ultimate Store Kit Elementor Addons
- CVE-2026-65501WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerabilityvendidero Shiptastic for WooCommerce
- CVE-2026-65499WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerabilityPepro Dev. Group PeproDev Ultimate Invoice
- CVE-2026-65498WordPress Complianz plugin <= 7.5.0 - Sensitive Data Exposure vulnerabilityComplianz
- CVE-2026-65496WordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerabilityComplianz
- CVE-2026-65491WordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerabilityJonathan Daggerhart Query Wrangler
- CVE-2026-65490WordPress Create by Mediavine plugin <= 2.6.0 - Sensitive Data Exposure vulnerabilityJohn-Michael L'Allier Create
- CVE-2026-65489WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerabilityLA-Studio Element Kit for Elementor
- CVE-2026-65487WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerabilityThemeGoods Photography
- CVE-2026-65486WordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerabilityBastien Ho Event post
- CVE-2026-65485WordPress Content Control plugin <= 2.6.5 - Broken Access Control vulnerabilityDaniel Iser Content Control
- CVE-2026-65484WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerabilityAnalogWP Style Kits
- CVE-2026-65483WordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerabilityHashThemes Demo Importer
- CVE-2026-65482WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerabilityLA-Studio Element Kit for Elementor
- CVE-2026-65480WordPress TheGem theme < 5.12.1.1 - Cross Site Scripting (XSS) vulnerabilityCodexThemes TheGem
- CVE-2026-65479WordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerabilityMVP Themes Reviewer
- CVE-2026-65478WordPress ListingPro plugin <= 2.9.10 - Broken Access Control vulnerabilityCridioStudio ListingPro
- CVE-2026-65476WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerabilityuxper Civi
- CVE-2026-65474WordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerabilityWPManageNinja Ninja Tables
- CVE-2026-65473WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerabilityNexcess Virtue/Ascend/Pinnacle Toolkit
- CVE-2026-65472WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerabilityKit
- CVE-2026-65470WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerabilityWPManageNinja Fluent Support
- CVE-2026-65469WordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Control vulnerabilityStrategy11 Team AWP Classifieds
- CVE-2026-65468WordPress JetBooking plugin <= 4.1.2 - Broken Access Control vulnerabilityCrocoblock. Jetimpex JetBooking
- CVE-2026-65467WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerabilityCrocoblock. Jetimpex JetEngine
- CVE-2026-65466WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerabilityCrocoblock. Jetimpex JetBooking
- CVE-2026-65465WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerabilityCrocoblock. Jetimpex JetElements For Elementor
- CVE-2026-65464WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerabilityNexcess GiveWP
- CVE-2026-65463WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerabilityMasteriyo - LMS
- CVE-2026-65460WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerabilityZarinpal Gateway
- CVE-2026-65458WordPress Polylang and Polylang Pro plugins <= 3.8.5 - Sensitive Data Exposure vulnerabilityChouby Polylang
- CVE-2026-65457WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerabilityyoomoney ЮKassa для WooCommerce
- CVE-2026-65456WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerabilityPickPlugins Product Slider for WooCommerce
- CVE-2026-65453WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerabilitymotov.net Ebook Store
- CVE-2026-65452WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerabilitymotov.net Ebook Store
- CVE-2026-65449WordPress MapSVG plugin <= 8.14.0 - Cross Site Scripting (XSS) vulnerabilityRomanCode MapSVG
- CVE-2026-61981WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request Forgery (CSRF) vulnerabilityQuantumCloud Simple Link Directory Pro
- CVE-2026-61973WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerabilityWooLentor ShopLentor Pro
- CVE-2026-61972WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerabilityWooLentor ShopLentor Pro
- CVE-2026-61946WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerabilityEasy Appointments
- CVE-2026-59524WordPress Easy Digital Downloads plugin <= 3.6.7 - Broken Authentication vulnerabilitySandhills Development Easy Digital Downloads
- CVE-2026-59522WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerabilityweDevs WP ERP
- CVE-2026-59513WordPress Masteriyo - LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerabilityMasteriyo - LMS
- CVE-2026-57808WordPress WP EasyPay plugin <= 4.5.0 - Arbitrary Content Deletion vulnerabilitySaad Iqbal WP EasyPay
- CVE-2026-57717WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerabilityknitpay Knit Pay
- CVE-2026-57716WordPress Broadcast Live Video plugin <= 7.2.4 - Arbitrary File Deletion vulnerabilityvideowhisper Broadcast Live Video
- CVE-2026-57703WordPress Sunshine Photo Cart plugin <= 3.6.10.1 - Broken Access Control vulnerabilitysunshinephotocart Sunshine Photo Cart
- CVE-2026-57425WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerabilitywpdesk Autopay dla WooCommerce
- CVE-2026-57384WordPress WishList Member X plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerabilityMembership Software WishList Member X
- CVE-2026-57373WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.4 - Cross Site Scripting (XSS) vulnerabilityWisetr Funnel Kit Funnel Builder PRO
- CVE-2026-27423WordPress Participants Database plugin <= 2.7.8.4 - Broken Access Control vulnerabilityRoland Barker Participants Database
- CVE-2026-27422WordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerabilitybPlugins YT Player
- CVE-2026-27418WordPress WP Fast Total Search plugin <= 1.81.282 - Broken Access Control vulnerabilityEpsiloncool WP Fast Total Search
- CVE-2026-27403WordPress Hubbub Lite plugin <= 1.36.3 - Cross Site Scripting (XSS) vulnerabilityNerdPress Hubbub Lite
- CVE-2026-27399WordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerabilityWebWizards MarketKing
- CVE-2026-27392WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerabilityStylemix uListing
- CVE-2026-27391WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerabilityStylemix uListing
- CVE-2026-27377WordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control vulnerabilityaxiomthemes QuickCal - Appointment Booking Calendar for Wor…
- CVE-2026-27372WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerabilityPepro Dev. Group PeproDev Ultimate Invoice
- CVE-2026-27355WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerabilitymetaphorcreations Ditty
- CVE-2026-25466WordPress WP Go Maps plugin <= 10.1.04 - Broken Access Control vulnerabilityWPGMaps WP Go Maps
- CVE-2026-25427WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerabilityDigitalME eRoom
- CVE-2026-25424WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerabilityMediavine Control Panel
- CVE-2026-24639WordPress Photo Block plugin <= 1.7.1 - Server Side Request Forgery (SSRF) vulnerabilityRonald Huereca Photo Block
- CVE-2026-24628WordPress Photo Gallery by Supsystic plugin <= 1.16.3 - Cross Site Scripting (XSS) vulnerabilityPhoto Gallery by Supsystic
- CVE-2026-24537WordPress WP Accessibility Helper (WAH) plugin <= 0.6.6 - Cross Site Request Forgery (CSRF) vulnerabilityAlex Volkov WP Accessibility Helper
- CVE-2025-68081WordPress WP-Polls plugin <= 2.77.3 - Cross Site Scripting (XSS) vulnerabilityLester Chan WP-Polls
- CVE-2026-15394Header Footer Script Adder <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Metamahethekiller Header Footer Script Adder
- CVE-2026-15448Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' ParameterTickera – Sell Tickets & Manage Events
- CVE-2026-13119Registrations for the Events Calendar <= 3.2 - Authenticated (Contributor+) SQL Injection via 'standard' Parameterroundupwp Registrations for the Events Calendar – Event Reg…
- CVE-2026-15786WP Encryption <= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Write via 'imploded' Parametergowebsmarty WP Encryption – Lifetime Free SSL Cert & HTTPS,…
- CVE-2026-13009AI Copilot <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'order[0][dir]' Parameterwupsales AI Copilot – Content Generator
- CVE-2026-15348Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parametercodename065 Premium Packages – Sell Digital Products Secure…
- CVE-2026-65713Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extensionregularlabs.com Modals Pro extension for Joomla
- CVE-2026-64871Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extensionregularlabs.com Cache Cleaner extension for Joomla
- CVE-2026-64875Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extensionregularlabs.com GeoIP extension for Joomla
- CVE-2026-64872Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extensionregularlabs.com Cache Cleaner Pro extension for Joomla
- CVE-2026-65712Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extensionregularlabs.com CDN for Joomla Pro extension for Joomla
- CVE-2026-65756Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extensionregularlabs.com Keyboard Shortcuts extension for Joomla
- CVE-2026-15794Grid/List View for WooCommerce <= 3.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode Attributeberocket Grid/List View for WooCommerce
- CVE-2026-14481Equalize Digital Accessibility Checker <= 1.46.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'html' Parameterequalizedigital Equalize Digital Accessibility Checker – WC…
- CVE-2026-15906Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parametercodename065 Premium Packages – Sell Digital Products Secure…
- CVE-2026-15646Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attributeberocket Brands for WooCommerce
- CVE-2026-15647Brands for WooCommerce <= 3.8.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Fieldberocket Brands for WooCommerce
- CVE-2026-15761Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_event_filter' ParameterTickera – Sell Tickets & Manage Events
- CVE-2026-15827GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpointsataurr GutenKit – Page Builder Blocks, Patterns, and Templa…
- CVE-2026-15404Bulk Page Generator <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Titleniklaslindemann Bulk Page Generator – LPagery
- CVE-2026-16078WCPOS <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameterkilbot WCPOS – Point of Sale (POS) plugin for WooCommerce
- CVE-2026-52686Wildcard CNAME proof validation bypassPowerDNS Recursor
- CVE-2026-52684Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning AttackPowerDNS Recursor
- CVE-2026-9635WP Shortcode by MyThemeShop <= 1.4.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode AttributeWP Shortcode by MyThemeShop
- CVE-2026-9729Web Push Notifications <= 4.39.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'webpushr_notification_title' Post Meta ParameterWeb Push Notifications – Webpushr
- CVE-2026-59677Process Kill Attack Vector in killall() in seunshareSELinuxProject selinux
- CVE-2026-59676Local File Deletion Attack Vector in rm_rf() in seunshareSELinuxProject selinux
- CVE-2026-9577Post Status Notifier Lite < 1.13.0 - Reflected XSS via mod ParameterPost Status Notifier Lite
- CVE-2026-9066WP Compress < 7.10.04 - Reflected XSS via test_zoneWP Compress
- CVE-2026-63226Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd.Ricoh Company Ricoh printers and Multifunction Printers
- CVE-2026-6390Nano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling.Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-7120@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths@fastify/static
- CVE-2026-21723CVE-2026-21723 RecordGrafana OSS
- CVE-2026-16653boazsegev facil.io Public Folder http.c http_sendfile2 path traversalboazsegev facil.io
- CVE-2026-39155Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed inco