2026 CVEs (page 155)
Page 155 of 470 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57401 | Critical | 9.9 | 2026-07-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force SureDash suredash allows Path Traversal.This i… |
CVE-2026-57400 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in WP Swings Event Tickets Manager for WooCommerce event-tickets-manager-for-woocommerce allows Exploiting Incorrectly Conf… |
CVE-2026-57399 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Proxy & VPN Blocker Proxy & VPN Blocker proxy-vpn… |
CVE-2026-57398 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manage… |
CVE-2026-57396 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flintop Free Gifts for WooCommerce free-gifts-for-woocomm… |
CVE-2026-57395 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tour… |
CVE-2026-57394 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Re… |
CVE-2026-57393 | Medium | 6.5 | 2026-07-13 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder… |
CVE-2026-57392 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tour… |
CVE-2026-57391 | Medium | 6.5 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tangible Loops & Logic tangible-loops-and-logic allows St… |
CVE-2026-57390 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in EDGARROJAS Extra Product Options Builder for WooCommerce additional-product-fields-for-woocommerce allows Exploiting Inc… |
CVE-2026-57389 | High | 8.6 | 2026-07-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Adrian Tobey Groundhogg groundhogg allows Path Traversal.This i… |
CVE-2026-57388 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.Th… |
CVE-2026-57387 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in picu picu picu allows Stored XSS.This issue affects picu… |
CVE-2026-57386 | High | 8.8 | 2026-07-13 | Incorrect Privilege Assignment vulnerability in Kodezen LLC aBlocks ablocks allows Privilege Escalation.This issue affects aBlocks: from n/a through < 2.9.1. |
CVE-2026-57385 | High | 8.5 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsbd Vitepos vitepos-lite allows Blind SQL Injection.Th… |
CVE-2026-57383 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Stored XSS.This issu… |
CVE-2026-57382 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mitchell Bennis Simple File List simple-file-list allows… |
CVE-2026-57381 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Reflected… |
CVE-2026-57380 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map… |
CVE-2026-57379 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL FormyChat social-contact-form allows Stored XSS.Th… |
CVE-2026-57378 | High | 7.5 | 2026-07-13 | Missing Authorization vulnerability in Phil Kurth Advanced Forms advanced-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-57377 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in WPXPO WowAddons product-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2026-57376 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor eleme… |
CVE-2026-57375 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2026-57372 | High | 7.2 | 2026-07-13 | Server-Side Request Forgery (SSRF) vulnerability in denishua WPJAM Basic wpjam-basic allows Server Side Request Forgery.This issue affects WPJAM Basic: from n/… |
CVE-2026-57371 | High | 8.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object Injection.This issue affects WPJAM Basic: from n/a through <=… |
CVE-2026-57369 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Reflecte… |
CVE-2026-57368 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.T… |
CVE-2026-57365 | Medium | 6.5 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hitesh Chandwani reCAPTCHA (v2 & v3) for Asgaros Foru… |
CVE-2026-57364 | Medium | 6.5 | 2026-07-13 | Improper Validation of Specified Quantity in Input vulnerability in WPDeveloper Better Payment – Instant Payments, Donations, Fundraising with Subscriptions &a… |
CVE-2026-57363 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot chatbot allows Stored XSS.This issue… |
CVE-2026-49876 | Medium | 6.5 | 2026-07-13 | Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs… |
CVE-2026-41041 | Critical | 9.1 | 2026-07-13 | URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. U… |
CVE-2026-22103 | | 2026-07-13 | The NPC start endpoint on the web server at port 8090 is vulnerable to command injection. | |
CVE-2026-22102 | | 2026-07-13 | A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parameter in the Conte… | |
CVE-2026-22100 | | 2026-07-13 | The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating the data value, arbitrary OS commands can be executed as root. | |
CVE-2026-22099 | | 2026-07-13 | The charging station does not require authentication for Bluetooth commands to perform actions. The functionality exposed includes sensitive information leakag… | |
CVE-2026-22098 | | 2026-07-13 | Various sensitive information such as passwords and charging card UIDs are written to log files. | |
CVE-2026-22097 | | 2026-07-13 | The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update capability to upload a… | |
CVE-2026-22096 | | 2026-07-13 | The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading fi… | |
CVE-2026-22095 | | 2026-07-13 | The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection. | |
CVE-2026-22093 | | 2026-07-13 | The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This allows an attacker o… | |
CVE-2026-15557 | High | 7.3 | 2026-07-13 | A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthSession/requireUser… |
CVE-2026-15548 | High | 8.8 | 2026-07-13 | A security vulnerability has been detected in Shibby Tomato up to 1.28.0000. This vulnerability affects the function sub_407220 of the file /usr/sbin/httpd of… |
CVE-2026-14846 | | 2026-07-13 | In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ par… | |
CVE-2026-13014 | | 2026-07-13 | A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwri… | |
CVE-2026-9708 | Medium | 4.9 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned incoming webhook user has access to the target te… |
CVE-2026-9597 | Medium | 5.4 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token… |
CVE-2026-9571 | Medium | 5.9 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deactivation, which allow… |
CVE-2026-6850 | Medium | 6.5 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and content of message attachment field values, which a… |
CVE-2026-62143 | | 2026-07-13 | A Server-Side Request Forgery (SSRF) protection bypass existed in the html_to_markdown expansion module of misp-modules. The module attempts to prevent reques… | |
CVE-2026-15574 | High | 7.5 | 2026-07-13 | A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming authorization headers and full chat payloads, whi… |
CVE-2026-15547 | Medium | 6.3 | 2026-07-13 | A weakness has been identified in Shibby Tomato up to 1.28.0000. This affects the function sub_2D048 of the component CIFS Mount Handler. Executing a manipulat… |
CVE-2026-15546 | Medium | 6.3 | 2026-07-13 | A security flaw has been discovered in Shibby Tomato up to 1.28.0000. Affected by this issue is the function sub_2D568 of the component start_jffs2. Performing… |
CVE-2026-15545 | High | 8.8 | 2026-07-13 | A vulnerability was identified in Shibby Tomato up to 1.28.0000. Affected by this vulnerability is the function main of the file www/apcupsd/tomatodata.cgi of… |
CVE-2026-14453 | Critical | 9.6 | 2026-07-13 | This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The mess… |
CVE-2026-10106 | Medium | 6.5 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify that the channel referenced in an action cookie matches the channel… |
CVE-2026-10103 | Medium | 4.3 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which all… |
CVE-2026-10085 | Medium | 5.4 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict the group_constrained channel flag to public and private channels… |
CVE-2026-57830 | Critical | 9.1 | 2026-07-13 | Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an… |
CVE-2026-57829 | Medium | 6.1 | 2026-07-13 | Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthentica… |
CVE-2026-4769 | Critical | 9.8 | 2026-07-13 | Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not f… |
CVE-2026-15544 | High | 8.8 | 2026-07-13 | A vulnerability was determined in Shibby Tomato up to 1.28.0000. Affected is the function getupsvar of the file www/apcupsd/tomatodata.cgi of the component apc… |
CVE-2026-15543 | High | 8.8 | 2026-07-13 | A vulnerability was found in Tenda CH22 1.0.0.1. This impacts the function formCertListInfo of the file /goform/CertListInfo. The manipulation of the argument… |
CVE-2026-15542 | High | 7.3 | 2026-07-13 | A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.go of the component Websocket Connection… |
CVE-2026-15541 | High | 7.3 | 2026-07-13 | A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file app/server/server/server.go of the compo… |
CVE-2026-15540 | Medium | 4.3 | 2026-07-13 | A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the co… |
CVE-2026-14165 | High | 7.5 | 2026-07-13 | An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to access… |
CVE-2026-15539 | Medium | 4.7 | 2026-07-13 | A security vulnerability has been detected in SourceCodester Online Book Store System 1.0. Impacted is an unknown function of the file /admin/index.php?page=bo… |
CVE-2026-15538 | Medium | 6.3 | 2026-07-13 | A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This ma… |
CVE-2026-15537 | High | 7.3 | 2026-07-13 | A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file admin/login.php. The ma… |
CVE-2026-15536 | Medium | 6.3 | 2026-07-13 | A vulnerability was identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /patviewprescription.php. The manipulat… |
CVE-2026-12582 | High | 8.6 | 2026-07-13 | The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing… |
CVE-2026-12397 | Medium | 4.3 | 2026-07-13 | The WP Job Portal WordPress plugin before 2.5.5 does not verify ownership when returning an employer's contact email for a given job, allowing authenticated u… |
CVE-2026-12396 | Medium | 5.4 | 2026-07-13 | The WP Job Portal WordPress plugin before 2.5.5 does not perform capability or ownership checks before allowing job moderation actions, allowing authenticated… |
CVE-2026-12275 | High | 7.1 | 2026-07-13 | The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment, purchase, and private-course c… |
CVE-2026-12274 | Medium | 6.5 | 2026-07-13 | The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its con… |
CVE-2026-12273 | Medium | 4.3 | 2026-07-13 | The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, an… |
CVE-2026-12271 | Medium | 5.4 | 2026-07-13 | The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with su… |
CVE-2026-12081 | Medium | 5.0 | 2026-07-13 | The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacke… |
CVE-2026-11964 | Critical | 9.1 | 2026-07-13 | The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before ac… |
CVE-2026-11963 | High | 8.1 | 2026-07-13 | The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user t… |
CVE-2026-10551 | Medium | 6.1 | 2026-07-13 | The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used du… |
CVE-2026-15535 | Medium | 6.3 | 2026-07-13 | A vulnerability was determined in AkariAsai self-rag up to 1fcdc420e48f50a7d7ab1ece5494221b93252e99. Affected by this issue is the function Indexer.deserialize… |
CVE-2026-15533 | Medium | 4.7 | 2026-07-13 | A security flaw has been discovered in DedeCMS 5.7.118. Impacted is an unknown function of the file /plus/search.php of the component Column Management. Perfor… |
CVE-2026-15532 | Low | 2.4 | 2026-07-13 | A vulnerability was identified in SourceCodester Online Book Store System 1.0. This issue affects some unknown processing of the component User Management Modu… |
CVE-2026-15531 | Medium | 5.3 | 2026-07-13 | A vulnerability has been found in yashbhalgat HashNeRF-pytorch up to 82885e698295982504eb6a26d060a6b2473e3706. Affected by this issue is the function torch.loa… |
CVE-2026-15530 | Medium | 5.3 | 2026-07-13 | A flaw has been found in WuzhiCMS up to 4.1.0. Affected by this vulnerability is the function config/listimage of the file /index.php?m=attachment&f=index&v=up… |
CVE-2026-9492 | High | 7.8 | 2026-07-13 | The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYTE Technology has an Improper Access Control vulnerability… |
CVE-2026-7162 | High | 7.8 | 2026-07-13 | Successful exploitation of the integer overflow vulnerability could allow an attacker to achieve system-level access to the affected software. |
CVE-2026-15553 | Medium | 5.3 | 2026-07-13 | Enterprise Cloud Database developed by Ragic has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload malicious files and… |
CVE-2026-15552 | Medium | 6.1 | 2026-07-13 | Enterprise Cloud Database developed by Ragic has a Stored Cross-Site Scripting vulnerability, allowing unauthenticated remote attackers to inject persistent Ja… |
CVE-2026-15529 | Medium | 6.3 | 2026-07-13 | A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performi… |
CVE-2026-15528 | Low | 3.3 | 2026-07-13 | A vulnerability was found in lamaalrajih kicad-mcp up to 3.3.1. This issue affects some unknown processing of the file kicad_mcp/utils/path_validator.py. Perfo… |
CVE-2026-15527 | Medium | 5.3 | 2026-07-13 | A vulnerability has been found in better-auth better-icons up to 1.0.5. This vulnerability affects unknown code of the component scan_project_icons/sync_icon… |
CVE-2026-15526 | Low | 3.3 | 2026-07-13 | A flaw has been found in augmnt augments-mcp-server 7.1.0. This issue affects the function scanProjectDeps of the file src/tools/v4/scan-project-deps.ts of the… |
CVE-2026-15525 | Medium | 6.3 | 2026-07-13 | A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnerability affects the function _validate_urls of the file src/adloop/ads/write.py. Performin… |
CVE-2026-15524 | Low | 3.3 | 2026-07-13 | A security vulnerability has been detected in alioshr memory-bank-mcp up to 0.2.1/3.1. This affects an unknown part of the file list-project-files-validation-f… |
CVE-2026-15523 | Medium | 6.3 | 2026-07-13 | A weakness has been identified in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /Simple… |