2026 CVEs (page 157)
Page 157 of 470 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9017 | Medium | 5.3 | 2026-07-11 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. Thi… |
CVE-2026-6939 | High | 7.2 | 2026-07-11 | The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approval_code' parameter in all versions u… |
CVE-2026-6801 | Medium | 5.3 | 2026-07-11 | The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the context_blog_modal_pop… |
CVE-2026-4661 | High | 7.5 | 2026-07-11 | The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' paramete… |
CVE-2026-1382 | Medium | 6.4 | 2026-07-11 | The fresh Podcaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'freshpodcaster' shortcode in all versions up to, and including… |
CVE-2026-15155 | High | 8.8 | 2026-07-11 | The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Heade… |
CVE-2026-15010 | Medium | 6.4 | 2026-07-11 | The bbp Style Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.4.5 via the Topic Form Additional Fiel… |
CVE-2026-12994 | Medium | 5.3 | 2026-07-11 | The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is du… |
CVE-2026-12738 | Medium | 4.3 | 2026-07-11 | The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-12126 | Medium | 6.4 | 2026-07-11 | The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment 'post_title' in… |
CVE-2026-12103 | Medium | 4.3 | 2026-07-11 | The Wallet for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.4. This is due to the plugin no… |
CVE-2026-11901 | Medium | 5.3 | 2026-07-11 | The WP Hotel Booking plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 2.3.1. This is… |
CVE-2026-11898 | Medium | 4.4 | 2026-07-11 | The White Label CMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.7.12 due to in… |
CVE-2026-11591 | Medium | 4.4 | 2026-07-11 | The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3… |
CVE-2026-10865 | Medium | 5.3 | 2026-07-11 | The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template… |
CVE-2026-10041 | Medium | 4.3 | 2026-07-11 | The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27… |
CVE-2026-7655 | High | 8.1 | 2026-07-11 | The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin… |
CVE-2026-13378 | High | 7.2 | 2026-07-11 | The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up… |
CVE-2026-9738 | Medium | 4.4 | 2026-07-11 | The Print, PDF, Email by PrintFriendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content_position_css' parameter in all versio… |
CVE-2026-7620 | Medium | 4.3 | 2026-07-11 | The Notification for Telegram plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.1. This is due to the plugin… |
CVE-2026-7559 | Medium | 4.3 | 2026-07-11 | The Affilia – Affiliate Program & Referral Tracking for WordPress plugin for WordPress is vulnerable to unauthorized access in all versions up to, and includin… |
CVE-2026-6804 | Medium | 5.3 | 2026-07-11 | The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.12. This is d… |
CVE-2026-6803 | Medium | 5.3 | 2026-07-11 | The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.12. This is… |
CVE-2026-3576 | High | 7.2 | 2026-07-11 | The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, a… |
CVE-2026-3552 | Medium | 4.3 | 2026-07-11 | The SurfLink - Ultimate Link Manager plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the ajax_import_… |
CVE-2026-2354 | High | 8.8 | 2026-07-11 | The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed file type validation bypass in the `upload_extension_files… |
CVE-2026-1832 | Medium | 4.3 | 2026-07-11 | The ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base plugin for WordPress is vulnerable to unauthorized cache deletion due to a missing capability… |
CVE-2026-15335 | High | 7.5 | 2026-07-11 | The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter (form<N>) in all versions up to, and including, 1.7… |
CVE-2026-15097 | Medium | 6.4 | 2026-07-11 | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'height_slider' Slider Module Field in all versions up to, and includ… |
CVE-2026-15096 | Medium | 6.4 | 2026-07-11 | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Map Module 'b_width_map' Field in all versions up to, and including… |
CVE-2026-14262 | High | 8.8 | 2026-07-11 | The Simple JWT Login – Allows you to use JWT on REST endpoints. plugin for WordPress is vulnerable to Authentication Bypass to Privilege Escalation in all vers… |
CVE-2026-13250 | Medium | 5.3 | 2026-07-11 | The Solace Extra plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.3. This is due to the plugin not properly… |
CVE-2026-13116 | Medium | 4.3 | 2026-07-11 | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5… |
CVE-2026-12141 | Medium | 4.9 | 2026-07-11 | The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_to… |
CVE-2026-8678 | Medium | 4.3 | 2026-07-11 | The MyParcel plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.25.1. This is due to the plugin not properly ve… |
CVE-2026-7544 | Medium | 4.3 | 2026-07-11 | The Mux Video Uploader plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the muxvideo_enqueu… |
CVE-2026-5743 | Medium | 6.4 | 2026-07-11 | The SimpLy Gallery Block & Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block attributes in all versions up to, and including… |
CVE-2026-3367 | Medium | 4.4 | 2026-07-11 | The Lockme OAuth2 calendars integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'App ID' setting in all versions up to, and i… |
CVE-2026-15338 | High | 7.5 | 2026-07-11 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the get_type… |
CVE-2026-15073 | Medium | 6.5 | 2026-07-11 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions… |
CVE-2026-15072 | Medium | 6.5 | 2026-07-11 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions… |
CVE-2026-13353 | High | 8.8 | 2026-07-11 | The WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin for WordPress is vulnerable to Remote Code Execution in all versions up to… |
CVE-2026-13262 | Medium | 6.5 | 2026-07-11 | The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'val' parameter… |
CVE-2026-13114 | High | 7.2 | 2026-07-11 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biograp… |
CVE-2026-12426 | Medium | 5.3 | 2026-07-11 | The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3… |
CVE-2026-10628 | Medium | 4.3 | 2026-07-11 | The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to… |
CVE-2026-13756 | High | 8.8 | 2026-07-11 | The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorizatio… |
CVE-2026-11426 | Medium | 6.5 | 2026-07-11 | The UnderConstructionPage PRO plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.76. This is due to the plugin a… |
CVE-2026-55175 | High | 7.5 | 2026-07-10 | Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release… |
CVE-2026-44383 | High | 7.5 | 2026-07-10 | Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious O… |
CVE-2026-42952 | High | 7.5 | 2026-07-10 | Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to execute a denial-of… |
CVE-2026-20744 | Critical | 9.8 | 2026-07-10 | The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation. |
CVE-2026-15089 | Critical | 9.1 | 2026-07-10 | vulnerability in Drupal Commerce guest registration allows . This issue affects Commerce guest registration versions: *.*. |
CVE-2026-15087 | Medium | 5.9 | 2026-07-10 | vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*. |
CVE-2026-15086 | Medium | 5.9 | 2026-07-10 | vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*. |
CVE-2026-14480 | Critical | 9.9 | 2026-07-10 | OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attac… |
CVE-2026-11915 | Medium | 5.9 | 2026-07-10 | vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*. |
CVE-2026-11914 | Medium | 5.9 | 2026-07-10 | vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*. |
CVE-2026-11913 | Critical | 9.8 | 2026-07-10 | vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*. |
CVE-2026-59155 | | 2026-07-10 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notificati… | |
CVE-2026-58591 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This i… |
CVE-2026-58590 | Medium | 5.4 | 2026-07-10 | Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0. |
CVE-2026-58589 | Medium | 5.4 | 2026-07-10 | Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0. |
CVE-2026-58588 | Medium | 6.1 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). T… |
CVE-2026-58587 | Medium | 6.1 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). T… |
CVE-2026-58503 | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the reset_password endpoint. This issu… | |
CVE-2026-57584 | | 2026-07-10 | Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route… | |
CVE-2026-55884 | | 2026-07-10 | Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla… | |
CVE-2026-55883 | | 2026-07-10 | Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebSocket at /ws/view is gated by a CSRF to… | |
CVE-2026-55882 | | 2026-07-10 | Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers un… | |
CVE-2026-55852 | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not su… | |
CVE-2026-55810 | High | 8.1 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue a… |
CVE-2026-55809 | High | 8.1 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issu… |
CVE-2026-55808 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Thi… |
CVE-2026-55807 | Low | 3.1 | 2026-07-10 | Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0… |
CVE-2026-55806 | Medium | 5.9 | 2026-07-10 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from… |
CVE-2026-55804 | Medium | 5.9 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects… |
CVE-2026-55803 | Medium | 5.9 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects… |
CVE-2026-55187 | Medium | 5.8 | 2026-07-10 | Mailpit is an email testing tool and API for developers. Prior to 1.30.2, the remediation shipped for CVE-2026-27808 is incomplete because the tools.IsInternal… |
CVE-2026-54736 | | 2026-07-10 | Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt::decrypt compares the attacker-supplied HMAC tag against the… | |
CVE-2026-52761 | Medium | 5.8 | 2026-07-10 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode t… |
CVE-2026-52747 | High | 8.6 | 2026-07-10 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request… |
CVE-2026-49844 | Medium | 5.9 | 2026-07-10 | Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This iss… |
CVE-2026-49394 | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_page endpoint in Workspace because public… | |
CVE-2026-49213 | High | 8.1 | 2026-07-10 | TypeBot is a chatbot builder tool. Prior to 3.17.2, Typebot's shared SSRF validator in packages/lib/src/ssrf/validateHttpReqUrl.ts can be bypassed with the IPv… |
CVE-2026-48127 | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.110.0, users without write access could attach files to any doctype through file-hand… | |
CVE-2026-47422 | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has si… | |
CVE-2026-47199 | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 16.18.3 and 15.108.0, check_safe_sql_query permitted SELECT INTO OUTFILE queries, which could potent… | |
CVE-2026-44795 | High | 8.8 | 2026-07-10 | Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses saf… |
CVE-2026-42219 | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was possible due to lack of hardening. Thi… | |
CVE-2026-41482 | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through secure local resourc… | |
CVE-2026-15085 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue… |
CVE-2026-15084 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS… |
CVE-2026-15083 | Medium | 4.2 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection… |
CVE-2026-15082 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting… |
CVE-2026-15081 | High | 7.4 | 2026-07-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL Injection. This issue… |
CVE-2026-15080 | Medium | 4.3 | 2026-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Trans… |
CVE-2026-15079 | Medium | 5.4 | 2026-07-10 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions… |
CVE-2026-13244 | High | 8.1 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This… |
CVE-2026-13243 | Medium | 4.8 | 2026-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: fro… |