CVEs published August 22, 2026
239 CVEs were published on August 22, 2026: 37 critical, 111 high.
- Published
- 239
- Critical
- 37
- High
- 111
- Medium
- 39
- Low
- 2
- Unrated
- 50
- Now in CISA KEV
- 0
- Fix available
- 133
Most affected products
- Linux
- 149
- fabrikar.com Fabrik extension for Joomla
- 17
- nltk
- 11
- WWBN AVideo
- 7
- hashcat
- 3
- Forminator Forms
- 2
- joomgalleryfriends.net JoomGallery extension for Joomla
- 2
- metaphorcreations Post Duplicator
- 2
- netty
- 2
- rubengc AutomatorWP – Automator plugin for no-code automati…
- 2
Critical 37
- CVE-2026-78050Comfast CF-N1-S Web Management mbox-config sub_41AD7C stack-based overflowComfast CF-N1-S
- CVE-2026-74730NFS: Pin the 'struct nfs_server' during a FREE_STATEID callLinux
- CVE-2026-74727ovpn: skip rehash for peers already removed from by_idLinux
- CVE-2026-74723btrfs: lzo: reject inline extents without valid headersLinux
- CVE-2026-74712vdpa/mlx5: Fix buffer length in create_direct_keys()Linux
- CVE-2026-74705udp: fix potential use-after-free in tunnel segmentationLinux
- CVE-2026-74688sctp: clear control chunk transport if it is being removedLinux
- CVE-2026-74669ipvs: clear IPv4 options after rebasing tunnel ICMP errorsLinux
- CVE-2026-74665net: fix skb length accounting after generic XDP frag adjustmentLinux
- CVE-2026-74662inet: frags: publish queues before arming timerLinux
- CVE-2026-74628net/x25: fix use-after-free of the socket by its timersLinux
- CVE-2026-74617dibs: initialise dibs->lock in dibs_dev_alloc()Linux
- CVE-2026-74616xdp: reject clones that overrun skb_shared_info tailroomLinux
- CVE-2026-74612veth: fix skb length accounting after XDP frag adjustmentLinux
- CVE-2026-74611tls: rx: restore msg_iter before TLS 1.3 optimistic retryLinux
- CVE-2026-74608smb: client: Fix use-after-free in cifs_try_adding_channels()Linux
- CVE-2026-74597ip6_tunnel: clear skb2->cb[] in ip6ip6_err()Linux
- CVE-2026-74591mm/filemap: __filemap_add_folio() restore index before retryingLinux
- CVE-2026-74588sctp: keep chunk->transport in step with the list it is queued onLinux
- CVE-2026-74587sctp: fix use-after-free of cached ASCONF chunkLinux
- CVE-2026-74586sctp: clear new_transport when removing a peerLinux
- CVE-2026-4703WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submissionwestguard WS Form LITE – Drag & Drop Contact Form Builder
- CVE-2026-76606Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2fabrikar.com Fabrik extension for Joomla
- CVE-2026-76602Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2fabrikar.com Fabrik extension for Joomla
- CVE-2026-76571Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2fabrikar.com Fabrik extension for Joomla
- CVE-2026-76605Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2fabrikar.com Fabrik extension for Joomla
- CVE-2026-77992Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2fabrikar.com Fabrik extension for Joomla
- CVE-2026-76604Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2fabrikar.com Fabrik extension for Joomla
- CVE-2026-76607Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2fabrikar.com Fabrik extension for Joomla
- CVE-2026-75866Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads themPunk-OAuth2
- CVE-2026-75870Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secretPunk
- CVE-2026-77946TRENDnet TEW-821DAP NTP Timezone Configuration apply_time.cgi uci_safe_get stack-based overflowTRENDnet TEW-821DAP
- CVE-2026-78003Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array KeysMailgun for WordPress
- CVE-2026-12710Missing Authorization in Application Integration QueryEngineTaskGoogle Cloud Application Integration
- CVE-2026-77002SmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentication BypassSmilePass Selfie Login
- CVE-2026-77001Social Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication BypassSocial Login & Sharing buttons with Analytics By SoClever
- CVE-2026-77000WP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login FlowWP Social Media Login
High 111
- CVE-2026-0551PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_rolesbuildwps PPWP – Password Protect Pages
- CVE-2026-16149Security Hardener <= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwritemarc4 Security Hardener
- CVE-2026-78122docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container FilesystemsTecnativa docker-socket-proxy
- CVE-2026-74733gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lockLinux
- CVE-2026-74731sched_ext: Skip sub-disable teardown for never-linked sub-schedulersLinux
- CVE-2026-74726bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitorLinux
- CVE-2026-74725enic: fix tx_hang_reset use-after-free on device removalLinux
- CVE-2026-74724ipvs: avoid out-of-bounds write in ip_vs_nat_icmpLinux
- CVE-2026-74721accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()Linux
- CVE-2026-74720bpf: Preserve pointer state for commuted arithmeticLinux
- CVE-2026-74717net/mlx5: fw_tracer, return NULL on create errorLinux
- CVE-2026-74715bpf: Fix netns reference imbalance in conntrack kfuncsLinux
- CVE-2026-74714bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()Linux
- CVE-2026-74713vhost_iotlb: bound map allocation in add_rangeLinux
- CVE-2026-74711hwmon: (pmbus) Fix type confusion in notification logicLinux
- CVE-2026-74710xsk: require at least 16 bytes of TX metadataLinux
- CVE-2026-74708xsk: validate launch-time metadata sizeLinux
- CVE-2026-74707xsk: validate metadata when processing requestsLinux
- CVE-2026-74704net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filterLinux
- CVE-2026-74703vhost-scsi: Validate T10 PI scatterlist countsLinux
- CVE-2026-74702vhost-scsi: reject feature changes after endpointLinux
- CVE-2026-74701net/openvswitch: check Ethernet header length in key_extract()Linux
- CVE-2026-74700net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiersLinux
- CVE-2026-74697bnxt_en: Disable EOP for TPA on all chips to prevent data corruptionLinux
- CVE-2026-74696tcp: fix TFO max_qlen accounting across reuseport migrationLinux
- CVE-2026-74695netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()Linux
- CVE-2026-74692net/smc: fix TOCTOU race between smc_listen_out() and listener closeLinux
- CVE-2026-74691net: thunderbolt: Tear down DMA paths before stopping the ringsLinux
- CVE-2026-74690s390/ism: Fix UAF of sba and ieq during ism_dev_exit()Linux
- CVE-2026-74689net/atm: fix slab-out-of-bounds read in vcc_setsockopt()Linux
- CVE-2026-74687watchdog: at91sam9_wdt: prevent timer rearm during teardownLinux
- CVE-2026-74684net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()Linux
- CVE-2026-74678net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()Linux
- CVE-2026-74675vt: stabilize tty reference in kbd_keycode with tty_port_tty_getLinux
- CVE-2026-74674mm: fix incorrect flush address in direct page table reclaimLinux
- CVE-2026-74670ipvs: stop estimator after disabled calc phaseLinux
- CVE-2026-74668packet: use consistent hard_header_len in TX_RING send pathLinux
- CVE-2026-74667net/packet: reset the MAC header on the packet-socket transmit pathLinux
- CVE-2026-74666packet: synchronize pressure clearing with ring reconfigurationLinux
- CVE-2026-74663net/sched: reject overly deep qdisc hierarchiesLinux
- CVE-2026-74661mac802154: fix netdev use-after-free in beacon workerLinux
- CVE-2026-74660netfilter: ebt_nflog: pin the NFLOG backendLinux
- CVE-2026-74656ipv4: fix use-after-free in fib_nhc_update_mtu()Linux
- CVE-2026-74655serial: qcom-geni: fix TX DMA buffer flushLinux
- CVE-2026-74652serial: amba-pl011: cancel RS485 hrtimers after freeing IRQLinux
- CVE-2026-74651staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()Linux
- CVE-2026-74649staging: rtl8723bs: fix missing shared-key auth challenge length checkLinux
- CVE-2026-74648staging: rtl8723bs: validate monitor transmit frame lengthsLinux
- CVE-2026-74647misc: fastrpc: Remove buffer from list prior to unmap operationLinux
- CVE-2026-74646misc: fastrpc: take fl->lock when moving mmaps on interrupted invokeLinux
- CVE-2026-74641ALSA: usx2y: bound the hwdep mmap fault offsetLinux
- CVE-2026-74640ALSA: FCP: fix OOB write in fcp_meter_ctl_get()Linux
- CVE-2026-74637perf/core: Fix group leader use-after-free after sibling detachLinux
- CVE-2026-74635fbdev: bitblit: bound-check glyph index in bit_cursor()Linux
- CVE-2026-74634ring-buffer: Prevent subbuf order change when resizing is disabledLinux
- CVE-2026-74632mm/huge_memory: fix huge_zero_pfn raceLinux
- CVE-2026-74631net: smc: fix splice entry lifetime imbalance in smc_rx_spliceLinux
- CVE-2026-74630ipv6: prevent in6_dev_get() from resurrecting inet6_devLinux
- CVE-2026-74629net/dibs: Correct freeing of dmb_clientid_arrLinux
- CVE-2026-74627net: devmem: prevent net-iov / page mixingLinux
- CVE-2026-74626NTB: ntb_netdev: Preserve RX queue depth on allocation failureLinux
- CVE-2026-74625netfilter: bridge: release template ct on non-IP pathLinux
- CVE-2026-74624netfilter: nf_conntrack: defer invalid log until after unlockLinux
- CVE-2026-74621net/sched: act_ct: fix sk_buff leak when the header checks reject a packetLinux
- CVE-2026-74615vxlan: do not arm the ageing timer on a device that is downLinux
- CVE-2026-74614vsock/virtio: read virtqueues under worker locksLinux
- CVE-2026-74613vsock/virtio: avoid refilling the RX queue after teardownLinux
- CVE-2026-74610tls: don't leave a full plaintext sk_msg ring unpushedLinux
- CVE-2026-74609tipc: read le->link under the node lock in tipc_node_link_down()Linux
- CVE-2026-74607KVM: SVM: Serialize accesses to the owner and mirror list with separate lockLinux
- CVE-2026-74606eventfs: Fix use-after-free in eventfs_remove_rec()Linux
- CVE-2026-74605eventfs: Use children field for rcu head and add memory barriersLinux
- CVE-2026-74604Revert "thermal/drivers/hwmon: Cleanup coding style a bit"Linux
- CVE-2026-74603ptp: ocp: Fix board ID over-readLinux
- CVE-2026-74601ring-buffer: Use current_context for safe per-CPU buffer swapLinux
- CVE-2026-74598ipv6: fix Route Information option length validationLinux
- CVE-2026-74595fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()Linux
- CVE-2026-74594sched/psi: Shut down rtpoll_timer in psi_cgroup_free()Linux
- CVE-2026-74592ima: Instantiate file_truncate and path_truncate hooksLinux
- CVE-2026-74590fsverity: Fix bpf_get_fsverity_digest() dynptr assumptionsLinux
- CVE-2026-74589bpf, sockmap: Fix sk_redir use-after-free in send verdictLinux
- CVE-2026-74584RDMA/bnxt_re: zero shared page before exposing to userspaceLinux
- CVE-2026-77027Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2fabrikar.com Fabrik extension for Joomla
- CVE-2026-76597Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2fabrikar.com Fabrik extension for Joomla
- CVE-2026-76598Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2fabrikar.com Fabrik extension for Joomla
- CVE-2026-76596Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2fabrikar.com Fabrik extension for Joomla
- CVE-2026-76599Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2fabrikar.com Fabrik extension for Joomla
- CVE-2026-70626NLTK before 3.9.4 Symlink Escape via CorpusReadernltk
- CVE-2026-68766hashcat through 7.1.2 Arbitrary File Write via Restore File Option Injectionhashcat
- CVE-2026-66393NLTK before 3.9.4 Denial of Service via JSONTaggedDecodernltk
- CVE-2026-65915NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointernltk
- CVE-2026-63312NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File Readnltk
- CVE-2026-62388NLTK before 3.10.0 Insecure Default Configuration in pathsec.pynltk
- CVE-2026-62385NLTK 3.9.4 Path Traversal via FrameNet and NKJP Readersnltk
- CVE-2026-62384NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2nltk
- CVE-2026-71513NLTK 3.10.0 through 3.10.2 Remote Code Execution via AllowlistUnpickler Dotted-Name Bypassnltk
- CVE-2026-2996Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Requestmaartenbelmans Advanced Product Fields (Product Addons) for…
- CVE-2026-62243Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypassnetty
- CVE-2026-60084SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplatesiyuan-note siyuan
- CVE-2026-59808AVideo Authentication Bypass via Unkeyed Video Hash DisclosureWWBN AVideo
- CVE-2026-59256WWBN AVideo Unbound Token Authorization Bypass via GalleryWWBN AVideo
- CVE-2026-58003WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.phpWWBN AVideo
- CVE-2026-58002WWBN AVideo Authorization Bypass via Users_affiliations add.json.phpWWBN AVideo
- CVE-2026-57998better-npm-audit OS Command Injection via registry flagjeemok better-npm-audit
- CVE-2026-66917Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0joomgalleryfriends.net JoomGallery extension for Joomla
- CVE-2026-76793Firebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email ClaimFirebase Authentication
- CVE-2026-76789Slider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider HandlersSlider Hero with Video Background, Animation
- CVE-2026-19221Forminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on MultisiteForminator Forms
- CVE-2026-18052ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login ParametersManageWP Worker
- CVE-2026-19883WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_actionetruel WPeMatico RSS Feed Fetcher
- CVE-2026-47895In strongSwan before 6.0.7, identity parsing/cloning is mishandled.strongSwan
Medium, low and unrated 91
- CVE-2026-78051alexta69 MeTube Cookie File cookies.txt file accessalexta69 MeTube
- CVE-2026-18027WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' ParameterWebToffee WooCommerce PDF Invoices, Packing Slips, Delivery…
- CVE-2026-78049Systerel S2OPC AddNodes Service sopc_node_mgt_helper_internal.c out-of-boundsSysterel S2OPC
- CVE-2026-12999Infineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustionzephyrproject zephyr
- CVE-2026-74729soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_readLinux
- CVE-2026-74728xfs: handle NULL b_addr in xfs_buf_freeLinux
- CVE-2026-74722btrfs: fix memory leak in btrfs_do_encoded_write()Linux
- CVE-2026-74719net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()Linux
- CVE-2026-74718devlink: fix net namespace reference leak in reloadLinux
- CVE-2026-74716accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()Linux
- CVE-2026-74709xsk: clear metadata pointer when no timestamp is requestedLinux
- CVE-2026-74706bnge: Fix NULL pointer dereference in aux device releaseLinux
- CVE-2026-74699drm/xe: Fix memory leak in exec_queue_set_hang_replay_state()Linux
- CVE-2026-74698net/mlx5e: fix BQL reset on SQ re-activationLinux
- CVE-2026-74694net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload lengthLinux
- CVE-2026-74693net: prestera: validate firmware header lengthLinux
- CVE-2026-74686rqspinlock: Reset tail when preserving queue on deadlockLinux
- CVE-2026-74685hwmon: (ltc4282) Clamp negative current limitsLinux
- CVE-2026-74683Input: evdev - sanitize event type index when fetching event masksLinux
- CVE-2026-74682ALSA: usb-audio: fix OOB write on Type II inbound URBsLinux
- CVE-2026-74681usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msgLinux
- CVE-2026-74680usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()Linux
- CVE-2026-74679usb: gadget: f_ncm: Use unsigned int for ndp_indexLinux
- CVE-2026-74677net: usb: ipheth: fix carrier_work UAF on disconnectLinux
- CVE-2026-74676vt: add permission check for KDSKBMETA ioctlLinux
- CVE-2026-74673Input: evdev - fix information leak in evdev_pass_values()Linux
- CVE-2026-74672mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAFLinux
- CVE-2026-74671ima: fix out-of-bounds read in xattr_verify()Linux
- CVE-2026-74664net: openvswitch: reallocate update replies for mismatched IDsLinux
- CVE-2026-74659net: bridge: mrp: fix uninitialised bytes on the wireLinux
- CVE-2026-74658futex: Prevent robust futex exit race some moreLinux
- CVE-2026-74657ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthopsLinux
- CVE-2026-74654serial: 8250_dma: Clear stale RX state on shutdownLinux
- CVE-2026-74653serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xxLinux
- CVE-2026-74650staging: rtl8723bs: fix OOB read in WMM_param_handler()Linux
- CVE-2026-74645mm/damon/lru_sort: error out for >10000 active_mem_bpLinux
- CVE-2026-74644mm/damon/ops-common: putback folios on invalid migrate nidLinux
- CVE-2026-74643samples/damon/mtier: error out for zero quota goal target valuesLinux
- CVE-2026-74642ALSA: usb: Fix UAF at delayed release of MIDI2 EPsLinux
- CVE-2026-74639ALSA: us144mkii: re-anchor capture URBs on resubmissionLinux
- CVE-2026-74638drm/v3d: Serialize the scheduler timeout handlersLinux
- CVE-2026-74636tracing: Fix race between update_event_fields and, event_define_fieldsLinux
- CVE-2026-74633tracing: Fix NULL pointer dereference in module event cache removalLinux
- CVE-2026-74623net: atlantic: free stranded TX buffers on ring deinitLinux
- CVE-2026-74622net: atlantic: free RX pages of consumed but not refilled buffersLinux
- CVE-2026-74620net/sched: act_gact, act_police: range check the fallback control actionLinux
- CVE-2026-74619ovl: don't warn when the mount is completed from another user namespaceLinux
- CVE-2026-74618binfmt_misc: don't warn when the mount is completed from another user namespaceLinux
- CVE-2026-74602ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()Linux
- CVE-2026-74600mm/page_table_check: skip special zero mappingsLinux
- CVE-2026-74599mm/ptdump: always stabilise against page table freeing using init_mmLinux
- CVE-2026-74596fs,fsverity: remove check for fsverity being enabled in setattr_prepare()Linux
- CVE-2026-74593sched_ext: Take cgroup_lock() first in scx_cgroup_lock()Linux
- CVE-2026-74585thunderbolt: Bound the DROM dual link port number before indexing sw->portsLinux
- CVE-2026-76603Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2fabrikar.com Fabrik extension for Joomla
- CVE-2026-76600Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2fabrikar.com Fabrik extension for Joomla
- CVE-2026-76609Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2fabrikar.com Fabrik extension for Joomla
- CVE-2026-76608Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2fabrikar.com Fabrik extension for Joomla
- CVE-2026-76601Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2fabrikar.com Fabrik extension for Joomla
- CVE-2026-68768hashcat through 7.1.2 Heap Buffer Overflow in outfile_write() via Oversized Usernamehashcat
- CVE-2026-68767hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl()hashcat
- CVE-2026-63311NLTK before 3.10.0 SSRF via DNS Resolution Failurenltk
- CVE-2026-62383nltk IPIPANCorpusReader Symlink Arbitrary File Readnltk
- CVE-2026-71514NLTK 3.9.4 through 3.10.2 Path Traversal via CrubadanCorpusReader pathsec Bypassnltk
- CVE-2026-4559Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attributewpchill Image Photo Gallery Final Tiles Grid
- CVE-2026-5093Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'wpsoul Greenshift – animation and page builder blocks
- CVE-2026-4561MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messagesdvankooten MC4WP: Mailchimp for WordPress
- CVE-2026-4244Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attributionmetaphorcreations Post Duplicator
- CVE-2026-62382PasswordPusher before v2.9.6 Authentication Bypass via Null Comparisonpglombardo PasswordPusher
- CVE-2026-62381luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflowopenwrt luci
- CVE-2026-62380Netty before 4.2.16.Final SOCKS Proxy Null Byte Injectionnetty
- CVE-2026-62204SiYuan before v3.7.4 Plugin Overwrite via Bazaar Installsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-60083SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file toolsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-59809SiYuan before v3.8.0 Secret Exfiltration via http_request URLsiyuan-note siyuan
- CVE-2026-58001WWBN AVideo Cross-Site Request Forgery via videoEditLight.phpWWBN AVideo
- CVE-2026-57944AVideo channelToGallery.json.php Cross-Site Request ForgeryWWBN AVideo
- CVE-2026-56380AVideo feed/index.php Exposure of Channel Owner Email AddressWWBN AVideo
- CVE-2026-77988TRENDnet TEW-823DRU CLI Configuration Tool nvram_get command injectionTRENDnet TEW-823DRU
- CVE-2026-4245Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplicationmetaphorcreations Post Duplicator
- CVE-2026-3424kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameterproperfraction kk Star Ratings – Rate Post & Collect User F…
- CVE-2026-66916Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0joomgalleryfriends.net JoomGallery extension for Joomla
- CVE-2026-77945TRENDnet TEW-821DAP ssi upload.cgi command injectionTRENDnet TEW-821DAP
- CVE-2026-19222Forminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role BypassForminator Forms
- CVE-2026-19093Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video PathTutor LMS
- CVE-2026-16738Conekta Payment Gateway < 6.2.2 - Unauthenticated Order Payment Completion via Webhook ForgeryConekta Payment Gateway
- CVE-2026-16612FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information DisclosureFiboSearch
- CVE-2026-16260Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title FieldPost Grid, Slider & Carousel Ultimate
- CVE-2026-14187Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDORTutor LMS
- CVE-2026-76074AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Actionrubengc AutomatorWP – Automator plugin for no-code automati…
- CVE-2026-75027Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Actionthemifyme Themify Builder
- CVE-2026-76057AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Actionrubengc AutomatorWP – Automator plugin for no-code automati…