2026 CVEs (page 211)
Page 211 of 470 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54813 | High | 8.5 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force SureDash allows Blind SQL Injection. Th… |
CVE-2026-54809 | Critical | 9.3 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme GIFT4U allows Blind SQL Injection. This issue… |
CVE-2026-54808 | Critical | 9.3 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel Gutenberg Blocks allows Blind SQL Inj… |
CVE-2026-54417 | High | 7.5 | 2026-06-17 | An integer overflow in the mtar_next function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to cause a denial of service (uncontrolled CPU c… |
CVE-2026-54193 | High | 7.7 | 2026-06-17 | Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions. |
CVE-2026-52716 | Medium | 6.5 | 2026-06-17 | Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions. |
CVE-2026-52707 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Kastell <= 2.0 versions. |
CVE-2026-49268 | Critical | 9.1 | 2026-06-17 | A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is d… |
CVE-2026-49108 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Moderno < 1.43 versions. |
CVE-2026-40757 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Château <= 1.2.1 versions. |
CVE-2026-40756 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Zoya <= 1.4 versions. |
CVE-2026-40752 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions. |
CVE-2026-40738 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions. |
CVE-2026-40733 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions. |
CVE-2026-40720 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Royal Elementor Addons Pro < 1.7.1041 versions. |
CVE-2026-39590 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions. |
CVE-2026-39576 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions. |
CVE-2026-39560 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions. |
CVE-2026-39559 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions. |
CVE-2026-39556 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Konsept <= 1.9 versions. |
CVE-2026-39523 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions. |
CVE-2026-39445 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions. |
CVE-2026-39442 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions. |
CVE-2026-10641 | High | 7.1 | 2026-06-17 | Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetooth/host/classic/hfp_hf.c) contains an out-of-bounds write. During Ser… |
CVE-2026-9690 | High | 7.5 | 2026-06-17 | Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions. |
CVE-2026-9570 | High | 7.1 | 2026-06-17 | The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containin… |
CVE-2026-8607 | Medium | 6.4 | 2026-06-17 | The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scri… |
CVE-2026-8494 | Medium | 6.4 | 2026-06-17 | The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions… |
CVE-2026-8383 | Medium | 5.3 | 2026-06-17 | The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthe… |
CVE-2026-8089 | High | 7.1 | 2026-06-17 | The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a… |
CVE-2026-7850 | Medium | 5.9 | 2026-06-17 | The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image… |
CVE-2026-5667 | | 2026-06-17 | Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners (for Japan and outside Japan); Wireless LAN Adapters for Room Air Cond… | |
CVE-2026-55706 | Medium | 5.8 | 2026-06-17 | sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths. |
CVE-2026-54811 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in WP eMember < v10.9.4 versions. |
CVE-2026-54807 | Critical | 9.8 | 2026-06-17 | Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions. |
CVE-2026-54806 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions. |
CVE-2026-54805 | High | 8.8 | 2026-06-17 | Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions. |
CVE-2026-54804 | High | 7.6 | 2026-06-17 | Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions. |
CVE-2026-54803 | Critical | 9.8 | 2026-06-17 | Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions. |
CVE-2026-54802 | High | 7.5 | 2026-06-17 | Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions. |
CVE-2026-54196 | Medium | 6.8 | 2026-06-17 | Subscriber Privilege Escalation in JetFormBuilder <= 3.6.1 versions. |
CVE-2026-54195 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions. |
CVE-2026-54194 | Critical | 9.8 | 2026-06-17 | Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions. |
CVE-2026-54192 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions. |
CVE-2026-54189 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. |
CVE-2026-54188 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. |
CVE-2026-54187 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions. |
CVE-2026-54186 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions. |
CVE-2026-54185 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in Cornerstone < 7.8.8 versions. |
CVE-2026-54184 | High | 8.2 | 2026-06-17 | Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions. |
CVE-2026-53876 | High | 7.2 | 2026-06-17 | RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary command execution with the root privileg… |
CVE-2026-52706 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions. |
CVE-2026-52705 | Critical | 9.0 | 2026-06-17 | Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions. |
CVE-2026-52698 | High | 7.4 | 2026-06-17 | Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions. |
CVE-2026-52696 | High | 7.5 | 2026-06-17 | Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions. |
CVE-2026-50203 | Critical | 9.1 | 2026-06-17 | A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write f… |
CVE-2026-49778 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions. |
CVE-2026-49767 | Critical | 9.8 | 2026-06-17 | Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions. |
CVE-2026-49113 | High | 8.5 | 2026-06-17 | Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions. |
CVE-2026-49107 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions. |
CVE-2026-49084 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions. |
CVE-2026-49081 | High | 8.2 | 2026-06-17 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions. |
CVE-2026-49080 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions. |
CVE-2026-49079 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions. |
CVE-2026-49076 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JetEngine <= 3.8.9.1 versions. |
CVE-2026-49075 | Critical | 9.8 | 2026-06-17 | Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions. |
CVE-2026-49074 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions. |
CVE-2026-49073 | High | 8.5 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist Booking allows Blind SQL Injection. Th… |
CVE-2026-49072 | Medium | 6.5 | 2026-06-17 | Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions. |
CVE-2026-49071 | Medium | 6.5 | 2026-06-17 | Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions. |
CVE-2026-49058 | Critical | 9.8 | 2026-06-17 | Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions. |
CVE-2026-49057 | High | 7.5 | 2026-06-17 | Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions. |
CVE-2026-48967 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions. |
CVE-2026-48929 | High | 7.5 | 2026-06-17 | Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMes… |
CVE-2026-48875 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions. |
CVE-2026-48869 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions. |
CVE-2026-48797 | | 2026-06-17 | Backpropagate is a Python library for fine-tuning large language models on a single GPU. In versions 1.1.0 and 1.1.1, the optional Reflex web UI exposes a trai… | |
CVE-2026-48788 | High | 8.2 | 2026-06-17 | Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-… |
CVE-2026-48783 | Medium | 4.8 | 2026-06-17 | Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscript… |
CVE-2026-48782 | Medium | 6.8 | 2026-06-17 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2, t… |
CVE-2026-48781 | Critical | 9.9 | 2026-06-17 | Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an attacker-controlled JSON blob into a sessio… |
CVE-2026-48779 | High | 7.5 | 2026-06-17 | ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to… |
CVE-2026-48745 | Critical | 9.3 | 2026-06-17 | Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and belo… |
CVE-2026-48616 | Critical | 9.3 | 2026-06-17 | Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads… |
CVE-2026-48055 | Critical | 10.0 | 2026-06-17 | Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability… |
CVE-2026-47340 | Medium | 6.5 | 2026-06-17 | Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler. This issue… |
CVE-2026-47277 | Medium | 6.5 | 2026-06-17 | Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos from files inside cloned app-store reposit… |
CVE-2026-45436 | Medium | 6.5 | 2026-06-17 | Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions. |
CVE-2026-44587 | Medium | 4.7 | 2026-06-17 | CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex… |
CVE-2026-42629 | High | 8.8 | 2026-06-17 | Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions. |
CVE-2026-42385 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions. |
CVE-2026-42380 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions. |
CVE-2026-42357 | Medium | 6.5 | 2026-06-17 | Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. This i… |
CVE-2026-41557 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions. |
CVE-2026-41280 | Medium | 4.9 | 2026-06-17 | Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache… |
CVE-2026-40783 | Critical | 9.9 | 2026-06-17 | Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions. |
CVE-2026-40768 | High | 7.3 | 2026-06-17 | Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions. |
CVE-2026-40765 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions. |
CVE-2026-40761 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions. |
CVE-2026-40760 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Behold <= 1.5 versions. |