High-severity CVEs (page 72)
Page 72 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-52707 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Kastell <= 2.0 versions. |
CVE-2026-40757 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Château <= 1.2.1 versions. |
CVE-2026-40756 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Zoya <= 1.4 versions. |
CVE-2026-40752 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions. |
CVE-2026-40738 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions. |
CVE-2026-40733 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions. |
CVE-2026-40720 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Royal Elementor Addons Pro < 1.7.1041 versions. |
CVE-2026-39590 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions. |
CVE-2026-39576 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions. |
CVE-2026-39560 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions. |
CVE-2026-39559 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions. |
CVE-2026-39556 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Konsept <= 1.9 versions. |
CVE-2026-39523 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions. |
CVE-2026-39445 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions. |
CVE-2026-39442 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions. |
CVE-2026-10641 | High | 7.1 | 2026-06-17 | Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetooth/host/classic/hfp_hf.c) contains an out-of-bounds write. During Ser… |
CVE-2025-69189 | High | 7.3 | 2026-06-17 | Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBank: from n… |
CVE-2025-69175 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions. |
CVE-2025-69174 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Etude <= 1.6 versions. |
CVE-2025-69170 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions. |
CVE-2025-69166 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions. |
CVE-2025-69164 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Skyward <= 1.10 versions. |
CVE-2025-69158 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Granola <= 1.13 versions. |
CVE-2025-69157 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Gamic <= 1.15 versions. |
CVE-2025-69144 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Preservation <= 1.10 versions. |
CVE-2025-69140 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions. |
CVE-2025-69130 | High | 8.8 | 2026-06-17 | Subscriber PHP Object Injection in Entrepreneur - Booking for Small Businesses WordPress Theme <= 3.1.3 versions. |
CVE-2025-69128 | High | 8.6 | 2026-06-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in EMV JobCareer allows Path Traversal. This issue affects JobCar… |
CVE-2025-69126 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions. |
CVE-2025-69123 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions. |
CVE-2025-69120 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions. |
CVE-2025-69115 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions. |
CVE-2025-69106 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions. |
CVE-2025-68524 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions. |
CVE-2025-66391 | High | 8.8 | 2026-06-17 | In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write operations, e.g., the system will send a… |
CVE-2026-9690 | High | 7.5 | 2026-06-17 | Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions. |
CVE-2026-9570 | High | 7.1 | 2026-06-17 | The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containin… |
CVE-2026-8089 | High | 7.1 | 2026-06-17 | The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a… |
CVE-2026-54805 | High | 8.8 | 2026-06-17 | Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions. |
CVE-2026-54804 | High | 7.6 | 2026-06-17 | Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions. |
CVE-2026-54802 | High | 7.5 | 2026-06-17 | Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions. |
CVE-2026-54195 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions. |
CVE-2026-54192 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions. |
CVE-2026-54189 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. |
CVE-2026-54188 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. |
CVE-2026-54185 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in Cornerstone < 7.8.8 versions. |
CVE-2026-54184 | High | 8.2 | 2026-06-17 | Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions. |
CVE-2026-53876 | High | 7.2 | 2026-06-17 | RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary command execution with the root privileg… |
CVE-2026-52698 | High | 7.4 | 2026-06-17 | Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions. |
CVE-2026-52696 | High | 7.5 | 2026-06-17 | Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions. |
CVE-2026-49778 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions. |
CVE-2026-49113 | High | 8.5 | 2026-06-17 | Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions. |
CVE-2026-49081 | High | 8.2 | 2026-06-17 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions. |
CVE-2026-49074 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions. |
CVE-2026-49073 | High | 8.5 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist Booking allows Blind SQL Injection. Th… |
CVE-2026-49057 | High | 7.5 | 2026-06-17 | Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions. |
CVE-2026-48967 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions. |
CVE-2026-48929 | High | 7.5 | 2026-06-17 | Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMes… |
CVE-2026-48869 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions. |
CVE-2026-48788 | High | 8.2 | 2026-06-17 | Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-… |
CVE-2026-48779 | High | 7.5 | 2026-06-17 | ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to… |
CVE-2026-42629 | High | 8.8 | 2026-06-17 | Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions. |
CVE-2026-42385 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions. |
CVE-2026-41557 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions. |
CVE-2026-40768 | High | 7.3 | 2026-06-17 | Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions. |
CVE-2026-40765 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions. |
CVE-2026-40761 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions. |
CVE-2026-40760 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Behold <= 1.5 versions. |
CVE-2026-40759 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Esmée <= 1.4 versions. |
CVE-2026-40758 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions. |
CVE-2026-40755 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in TechLink <= 1.3 versions. |
CVE-2026-40754 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Roisin <= 1.4 versions. |
CVE-2026-40753 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions. |
CVE-2026-40751 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions. |
CVE-2026-40739 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions. |
CVE-2026-40736 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions. |
CVE-2026-40735 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Reina <= 2.1 versions. |
CVE-2026-40731 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions. |
CVE-2026-40726 | High | 8.2 | 2026-06-17 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions. |
CVE-2026-40721 | High | 7.5 | 2026-06-17 | Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions. |
CVE-2026-39598 | High | 8.0 | 2026-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell to a Web Server. This issue affects Aca… |
CVE-2026-39597 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions. |
CVE-2026-39582 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions. |
CVE-2026-39580 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions. |
CVE-2026-39573 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions. |
CVE-2026-39568 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions. |
CVE-2026-39567 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions. |
CVE-2026-39558 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Malmö <= 2.2 versions. |
CVE-2026-39557 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions. |
CVE-2026-39554 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions. |
CVE-2026-39549 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions. |
CVE-2026-39548 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions. |
CVE-2026-39547 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Getaway < 1.8 versions. |
CVE-2026-39546 | High | 7.6 | 2026-06-17 | Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions. |
CVE-2026-39545 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions. |
CVE-2026-39539 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions. |
CVE-2026-39537 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions. |
CVE-2026-39522 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Solene <= 3.4 versions. |
CVE-2026-39446 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions. |
CVE-2026-39443 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions. |