2026 CVEs (page 155)
Page 155 of 667 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-78602 | Medium | 5.3 | 2026-09-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Trav… |
CVE-2026-78601 | Medium | 5.5 | 2026-09-02 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kib… |
CVE-2026-78600 | Low | 3.5 | 2026-09-02 | Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials p… |
CVE-2026-78599 | Medium | 6.5 | 2026-09-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of in… |
CVE-2026-78598 | Medium | 5.4 | 2026-09-02 | Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Contro… |
CVE-2026-78594 | Medium | 4.9 | 2026-09-02 | Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authent… |
CVE-2026-78591 | Medium | 6.3 | 2026-09-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of re… |
CVE-2026-78590 | High | 7.3 | 2026-09-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of pr… |
CVE-2026-78588 | Medium | 6.5 | 2026-09-02 | Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker ab… |
CVE-2026-78587 | Low | 3.1 | 2026-09-02 | Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does… |
CVE-2026-78586 | Medium | 6.5 | 2026-09-02 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-78584 | Medium | 4.3 | 2026-09-02 | Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An auth… |
CVE-2026-78153 | Medium | 5.3 | 2026-09-02 | The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection cover… |
CVE-2026-77794 | Medium | 5.3 | 2026-09-02 | The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid regist… |
CVE-2026-77793 | Medium | 5.3 | 2026-09-02 | The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to c… |
CVE-2026-77009 | Critical | 9.9 | 2026-09-02 | The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authen… |
CVE-2026-4357 | Critical | 10.0 | 2026-09-02 | The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it po… |
CVE-2026-2811 | Medium | 5.4 | 2026-09-02 | The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supp… |
CVE-2026-2688 | Medium | 6.5 | 2026-09-02 | The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server expl… |
CVE-2026-19698 | Low | 3.5 | 2026-09-02 | The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the… |
CVE-2026-17563 | Medium | 5.3 | 2026-09-02 | The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when re… |
CVE-2026-14326 | Low | 3.8 | 2026-09-02 | The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its cus… |
CVE-2026-14255 | Medium | 5.5 | 2026-09-02 | A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may lever… |
CVE-2026-10821 | Medium | 6.6 | 2026-09-02 | The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache config… |
CVE-2026-81269 | Medium | 5.3 | 2026-09-02 | Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13. |
CVE-2026-81205 | Medium | 5.3 | 2026-09-02 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP In… |
CVE-2026-81201 | Medium | 6.1 | 2026-09-02 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affect… |
CVE-2026-81168 | Low | 3.7 | 2026-09-02 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA… |
CVE-2026-81167 | Medium | 4.8 | 2026-09-02 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XS… |
CVE-2026-81166 | Medium | 5.3 | 2026-09-02 | Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0… |
CVE-2026-81165 | Medium | 5.3 | 2026-09-02 | Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18. |
CVE-2026-81164 | Medium | 5.4 | 2026-09-02 | Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5. |
CVE-2026-81162 | Medium | 5.3 | 2026-09-02 | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. T… |
CVE-2026-81161 | Low | 3.3 | 2026-09-02 | Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderati… |
CVE-2026-81160 | Medium | 6.1 | 2026-09-02 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affec… |
CVE-2026-81159 | Low | 3.7 | 2026-09-02 | Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to… |
CVE-2026-81158 | Medium | 5.3 | 2026-09-02 | Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0. |
CVE-2026-76782 | High | 7.3 | 2026-09-02 | Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*. |
CVE-2026-76759 | High | 7.3 | 2026-09-02 | Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*. |
CVE-2026-76758 | Medium | 5.9 | 2026-09-02 | Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*. |
CVE-2026-76757 | Medium | 5.9 | 2026-09-02 | Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*. |
CVE-2026-76756 | Medium | 5.9 | 2026-09-02 | Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*. |
CVE-2026-76755 | Medium | 5.9 | 2026-09-02 | Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*. |
CVE-2026-73478 | Medium | 5.3 | 2026-09-02 | Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1. |
CVE-2026-73477 | Medium | 5.3 | 2026-09-02 | Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1. |
CVE-2026-73476 | Medium | 5.4 | 2026-09-02 | Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication v… |
CVE-2026-73475 | Critical | 9.1 | 2026-09-02 | Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, fr… |
CVE-2026-73474 | Medium | 5.3 | 2026-09-02 | Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versi… |
CVE-2026-18986 | Medium | 4.8 | 2026-09-02 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affec… |
CVE-2026-16647 | Medium | 4.1 | 2026-09-02 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Log… |
CVE-2026-84835 | Medium | 5.3 | 2026-09-02 | Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-84808 | Medium | 4.3 | 2026-09-02 | Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team ac… |
CVE-2026-84807 | Medium | 5.4 | 2026-09-02 | Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated us… |
CVE-2026-84806 | Medium | 5.4 | 2026-09-02 | Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and re… |
CVE-2026-84805 | Medium | 4.3 | 2026-09-02 | Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences… |
CVE-2026-84804 | Medium | 5.4 | 2026-09-02 | Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated us… |
CVE-2026-84803 | Critical | 9.0 | 2026-09-02 | SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable… |
CVE-2026-84802 | Medium | 4.3 | 2026-09-02 | Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume p… |
CVE-2026-84801 | High | 8.8 | 2026-09-02 | Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers perm… |
CVE-2026-84800 | High | 7.1 | 2026-09-02 | Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sou… |
CVE-2026-84799 | Medium | 4.3 | 2026-09-02 | Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revis… |
CVE-2026-84798 | High | 7.1 | 2026-09-02 | Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads… |
CVE-2026-84797 | Medium | 6.3 | 2026-09-02 | Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with c… |
CVE-2026-84796 | High | 8.8 | 2026-09-02 | Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentMa… |
CVE-2026-84795 | Critical | 9.8 | 2026-09-02 | Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can regis… |
CVE-2026-84794 | High | 7.1 | 2026-09-02 | Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset… |
CVE-2026-84793 | Medium | 4.8 | 2026-09-02 | Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Admin… |
CVE-2026-84792 | Medium | 4.3 | 2026-09-02 | Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users t… |
CVE-2026-84781 | Medium | 6.5 | 2026-09-02 | Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions. |
CVE-2026-84780 | Medium | 5.3 | 2026-09-02 | Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions. |
CVE-2026-84775 | Medium | 5.3 | 2026-09-02 | Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions. |
CVE-2026-84772 | Medium | 5.5 | 2026-09-02 | Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions. |
CVE-2026-84771 | Medium | 5.3 | 2026-09-02 | Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions. |
CVE-2026-84770 | High | 8.8 | 2026-09-02 | Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions. |
CVE-2026-84764 | High | 8.8 | 2026-09-02 | Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointments <= 1.6.12.23 versions. |
CVE-2026-84760 | Medium | 5.3 | 2026-09-02 | Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions. |
CVE-2026-84759 | High | 7.1 | 2026-09-02 | Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions. |
CVE-2026-84217 | Medium | 5.4 | 2026-09-02 | Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.Thi… |
CVE-2026-83562 | Medium | 6.5 | 2026-09-02 | Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions. |
CVE-2026-82223 | Medium | 6.5 | 2026-09-02 | Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions. |
CVE-2026-81775 | High | 7.1 | 2026-09-02 | Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions. |
CVE-2026-81774 | High | 7.5 | 2026-09-02 | Unauthenticated Sensitive Data Exposure in WooCommerce Product Attachment <= 2.3.3 versions. |
CVE-2026-81772 | High | 8.8 | 2026-09-02 | Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions. |
CVE-2026-81771 | High | 7.1 | 2026-09-02 | Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions. |
CVE-2026-81770 | High | 7.1 | 2026-09-02 | Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions. |
CVE-2026-81769 | High | 8.8 | 2026-09-02 | Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1. |
CVE-2026-81294 | Critical | 9.8 | 2026-09-02 | Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions. |
CVE-2026-81289 | High | 7.1 | 2026-09-02 | Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions. |
CVE-2026-81288 | High | 7.1 | 2026-09-02 | Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions. |
CVE-2026-81286 | Critical | 9.3 | 2026-09-02 | Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions. |
CVE-2026-81283 | High | 8.8 | 2026-09-02 | Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions. |
CVE-2026-66652 | Medium | 5.4 | 2026-09-02 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5… |
CVE-2026-82958 | | 2026-09-02 | In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting place… | |
CVE-2026-32773 | Medium | 6.1 | 2026-09-02 | There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code whi… |
CVE-2026-19219 | High | 8.1 | 2026-09-02 | In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may a… |
CVE-2026-18672 | High | 7.5 | 2026-09-02 | In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence w… |
CVE-2026-84175 | | 2026-09-02 | In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definitio… | |
CVE-2026-53683 | Medium | 4.3 | 2026-09-02 | reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionall… |
CVE-2026-75528 | High | 7.2 | 2026-09-02 | The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and includin… |
CVE-2026-14828 | High | 8.8 | 2026-09-02 | Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to a… |