2026 CVEs (page 177)
Page 177 of 472 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57357 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions. |
CVE-2026-57356 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions. |
CVE-2026-57355 | Medium | 6.5 | 2026-07-02 | Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions. |
CVE-2026-57354 | Medium | 6.5 | 2026-07-02 | Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions. |
CVE-2026-57353 | Medium | 6.5 | 2026-07-02 | Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions. |
CVE-2026-57352 | Medium | 4.8 | 2026-07-02 | Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions. |
CVE-2026-57351 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions. |
CVE-2026-57350 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions. |
CVE-2026-57349 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions. |
CVE-2026-57348 | High | 7.2 | 2026-07-02 | Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions. |
CVE-2026-57347 | Medium | 6.5 | 2026-07-02 | Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions. |
CVE-2026-57345 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 versions. |
CVE-2026-57344 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions. |
CVE-2026-57343 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions. |
CVE-2026-57342 | Medium | 6.5 | 2026-07-02 | Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions. |
CVE-2026-56037 | High | 8.8 | 2026-07-02 | Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. This issue affects Themify Popup: from n/a through 1.4.3. |
CVE-2026-49779 | Medium | 6.5 | 2026-07-02 | Path Traversal: '.../...//' vulnerability in Addify Tax Exempt for WooCommerce allows Path Traversal. This issue affects Tax Exempt for WooCommerce: from n/a… |
CVE-2026-42382 | High | 8.1 | 2026-07-02 | Unauthenticated Local File Inclusion in Audrey <= 1.5 versions. |
CVE-2026-39448 | High | 7.5 | 2026-07-02 | Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions. |
CVE-2026-27436 | Critical | 9.1 | 2026-07-02 | Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions. |
CVE-2026-27433 | Medium | 6.5 | 2026-07-02 | Unauthenticated Broken Access Control in Motors <= 5.6.80 versions. |
CVE-2026-27430 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions. |
CVE-2026-27426 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions. |
CVE-2026-27425 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions. |
CVE-2026-27419 | Critical | 9.9 | 2026-07-02 | Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions. |
CVE-2026-27414 | High | 8.8 | 2026-07-02 | Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions. |
CVE-2026-27412 | High | 8.1 | 2026-07-02 | Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions. |
CVE-2026-27408 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in NativeChurch <= 4.8.8.2 versions. |
CVE-2026-27404 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions. |
CVE-2026-27402 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions. |
CVE-2026-27060 | High | 8.8 | 2026-07-02 | Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember Premium allows Object Injection. This issue affects ARMember Premium: from n/a… |
CVE-2026-14449 | | 2026-07-02 | u5CMS through v12.8.8 is vulnerable to reflected XSS via the ‘thanks’ parameter in multiple form components | |
CVE-2026-11946 | High | 7.5 | 2026-07-02 | An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest… |
CVE-2026-54431 | | 2026-07-02 | In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 sect… | |
CVE-2026-54430 | | 2026-07-02 | liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads both signer and kid from the… | |
CVE-2026-9834 | High | 7.2 | 2026-07-02 | The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all versions up to an… |
CVE-2026-9188 | Medium | 5.3 | 2026-07-02 | The Appointment Bookings for Zoom GoogleMeet and more – Wappointment plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up… |
CVE-2026-9145 | Medium | 6.5 | 2026-07-02 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via the create_entry_el() function in versi… |
CVE-2026-8482 | Medium | 4.3 | 2026-07-02 | A vulnerability was discovered on StormShield Network Security 4.3.0 to 4.3.41 (included), 4.8.0 to 4.8.15 (included) , 5.0.0 to 5.0.5 (included) There is a p… |
CVE-2026-8441 | High | 7.5 | 2026-07-02 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action in versions… |
CVE-2026-14336 | High | 8.2 | 2026-07-02 | PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py… |
CVE-2026-14029 | Medium | 6.5 | 2026-07-02 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'select' parameter in all versi… |
CVE-2026-13459 | Medium | 5.3 | 2026-07-02 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This i… |
CVE-2026-13369 | High | 7.5 | 2026-07-02 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, and including, 3.3… |
CVE-2026-13252 | Medium | 6.4 | 2026-07-02 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2026-13251 | High | 7.5 | 2026-07-02 | The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.4 via the 's' parameter. This makes it poss… |
CVE-2026-12657 | Medium | 5.3 | 2026-07-02 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up t… |
CVE-2026-12472 | Medium | 5.3 | 2026-07-02 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-12134 | Medium | 4.3 | 2026-07-02 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includ… |
CVE-2026-12122 | Medium | 5.3 | 2026-07-02 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and… |
CVE-2026-11896 | Medium | 5.3 | 2026-07-02 | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14… |
CVE-2026-10104 | Medium | 4.4 | 2026-07-02 | The Product Video Gallery for Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom_thumbnail Parameter in all versions up t… |
CVE-2026-9563 | High | 7.5 | 2026-07-02 | In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consum… |
CVE-2026-8147 | High | 8.1 | 2026-07-02 | In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any aut… |
CVE-2026-33592 | High | 7.5 | 2026-07-02 | An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FindServersRequest is… |
CVE-2026-5821 | High | 8.1 | 2026-07-02 | The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path valid… |
CVE-2026-5348 | Medium | 5.3 | 2026-07-02 | The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to… |
CVE-2026-14249 | High | 7.5 | 2026-07-02 | The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is d… |
CVE-2026-13704 | Medium | 6.4 | 2026-07-02 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sequoia[introduction][image]'… |
CVE-2026-13357 | Medium | 4.9 | 2026-07-02 | The Houzez Property Feed plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.46 due to in… |
CVE-2026-11965 | Medium | 6.5 | 2026-07-02 | The User Registration & Membership WordPress plugin before 5.2.0 does not enforce payment completion before activating a paid membership subscription, allowin… |
CVE-2026-11781 | Low | 2.7 | 2026-07-02 | The Adminify WordPress plugin before 4.2.10 does not perform per-user read-capability checks on the results returned by one of its administration search featu… |
CVE-2026-11600 | Medium | 4.3 | 2026-07-02 | The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization c… |
CVE-2026-11592 | Medium | 4.3 | 2026-07-02 | The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization… |
CVE-2026-11578 | Low | 2.7 | 2026-07-02 | The Fluent Forms WordPress plugin before 6.2.5 does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authori… |
CVE-2026-10089 | Medium | 6.4 | 2026-07-02 | The Insert Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post custom field keys (meta key names) in all versions up to, and inclu… |
CVE-2026-10077 | Medium | 6.8 | 2026-07-02 | The yootheme WordPress theme before 5.0.35 does not prevent its bundled front-end framework from treating certain HTML attributes, which are permitted by wp_ks… |
CVE-2026-57278 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57277 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57276 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57275 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57274 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57273 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57272 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57271 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57270 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57269 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57268 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57267 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57266 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57265 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57264 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-13132 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-13131 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-13125 | High | 8.8 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-55794 | | 2026-07-02 | Craft CMS is a content management system (CMS). In versions 5.9.0 and above prior to 5.10.0, control panel users with the ability to edit entries can execute u… | |
CVE-2026-55792 | | 2026-07-02 | Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl(… | |
CVE-2026-55791 | | 2026-07-02 | Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Serv… | |
CVE-2026-50280 | | 2026-07-02 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 and above prior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates th… | |
CVE-2026-50279 | | 2026-07-02 | Craft CMS is a content management system (CMS). IN versions 5.0.0-RC1 and above prior to 5.9.21, theEntriesController::actionSaveEntry() performs entry-edit pe… | |
CVE-2026-55790 | | 2026-07-01 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can… | |
CVE-2026-50284 | | 2026-07-01 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsController::actionDeleteFolder() o… | |
CVE-2026-50283 | | 2026-07-01 | Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in the AssetsCo… | |
CVE-2026-14440 | Medium | 6.8 | 2026-07-01 | Description: To issue and renew TLS certificates on behalf of customers, Cloudflare's Universal SSL feature automatically manages the CAA RRset for the cus… |
CVE-2026-14439 | | 2026-07-01 | A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365. The service accepts a sequence of post-cl… | |
CVE-2026-14432 | High | 8.8 | 2026-07-01 | Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chr… |
CVE-2026-14431 | High | 8.8 | 2026-07-01 | Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chr… |
CVE-2026-14430 | High | 8.8 | 2026-07-01 | Integer overflow in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
CVE-2026-14429 | High | 8.3 | 2026-07-01 | Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-14428 | High | 8.3 | 2026-07-01 | Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.46 allowed a remote attacker who had compromised the rendere… |