2026 CVEs (page 212)
Page 212 of 470 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-40759 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Esmée <= 1.4 versions. |
CVE-2026-40758 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions. |
CVE-2026-40755 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in TechLink <= 1.3 versions. |
CVE-2026-40754 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Roisin <= 1.4 versions. |
CVE-2026-40753 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions. |
CVE-2026-40751 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions. |
CVE-2026-40749 | Critical | 9.9 | 2026-06-17 | Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions. |
CVE-2026-40748 | Critical | 9.9 | 2026-06-17 | Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 versions. |
CVE-2026-40747 | Critical | 9.9 | 2026-06-17 | Subscriber Arbitrary File Upload in Ecommerce Zone <= 0.9.7 versions. |
CVE-2026-40746 | Critical | 9.9 | 2026-06-17 | Subscriber Arbitrary File Upload in Restaurant Zone <= 0.7.8 versions. |
CVE-2026-40739 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions. |
CVE-2026-40736 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions. |
CVE-2026-40735 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Reina <= 2.1 versions. |
CVE-2026-40731 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions. |
CVE-2026-40726 | High | 8.2 | 2026-06-17 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions. |
CVE-2026-40725 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions. |
CVE-2026-40724 | Medium | 6.5 | 2026-06-17 | CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions. |
CVE-2026-40723 | Medium | 4.3 | 2026-06-17 | Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions. |
CVE-2026-40722 | Medium | 5.5 | 2026-06-17 | Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects… |
CVE-2026-40721 | High | 7.5 | 2026-06-17 | Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions. |
CVE-2026-39598 | High | 8.0 | 2026-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell to a Web Server. This issue affects Aca… |
CVE-2026-39597 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions. |
CVE-2026-39596 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions. |
CVE-2026-39595 | Medium | 4.7 | 2026-06-17 | Author Broken Access Control in W3 Total Cache <= 2.9.1 versions. |
CVE-2026-39589 | Critical | 9.9 | 2026-06-17 | Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions. |
CVE-2026-39582 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions. |
CVE-2026-39580 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions. |
CVE-2026-39578 | Medium | 5.5 | 2026-06-17 | Unauthenticated PHP Object Injection in Valiance <= 1.2 versions. |
CVE-2026-39577 | Medium | 5.5 | 2026-06-17 | Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions. |
CVE-2026-39573 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions. |
CVE-2026-39568 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions. |
CVE-2026-39567 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions. |
CVE-2026-39558 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Malmö <= 2.2 versions. |
CVE-2026-39557 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions. |
CVE-2026-39554 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions. |
CVE-2026-39549 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions. |
CVE-2026-39548 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions. |
CVE-2026-39547 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Getaway < 1.8 versions. |
CVE-2026-39546 | High | 7.6 | 2026-06-17 | Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions. |
CVE-2026-39545 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions. |
CVE-2026-39539 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions. |
CVE-2026-39537 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions. |
CVE-2026-39529 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions. |
CVE-2026-39522 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Solene <= 3.4 versions. |
CVE-2026-39446 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions. |
CVE-2026-39443 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions. |
CVE-2026-39438 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in ListingPro <= 2.9.10 versions. |
CVE-2026-39433 | Medium | 6.5 | 2026-06-17 | Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 versions. |
CVE-2026-34895 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Softlab Core < 1.2.11 versions. |
CVE-2026-34894 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions. |
CVE-2026-34893 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions. |
CVE-2026-34888 | High | 7.5 | 2026-06-17 | Unauthenticated Sensitive Data Exposure in Bricksforge <= 3.1.8.4 versions. |
CVE-2026-32967 | Critical | 9.1 | 2026-06-17 | Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. U… |
CVE-2026-32966 | Critical | 9.8 | 2026-06-17 | DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affects Apache DolphinSch… |
CVE-2026-2604 | Medium | 5.6 | 2026-06-17 | A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craf… |
CVE-2026-28615 | High | 7.8 | 2026-06-17 | In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to local escalation of privilege with… |
CVE-2026-28587 | Medium | 5.5 | 2026-06-17 | In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This could lead to local… |
CVE-2026-28576 | Medium | 5.5 | 2026-06-17 | In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no add… |
CVE-2026-28575 | Medium | 5.5 | 2026-06-17 | In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java, there is a possible memory exhau… |
CVE-2026-27870 | | 2026-06-17 | An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action IS required) who has the vulnerable s… | |
CVE-2026-27869 | | 2026-06-17 | An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerabl… | |
CVE-2026-27868 | | 2026-06-17 | An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerabl… | |
CVE-2026-27429 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions. |
CVE-2026-27410 | Medium | 6.5 | 2026-06-17 | Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions. |
CVE-2026-27400 | High | 8.6 | 2026-06-17 | Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions. |
CVE-2026-27395 | Critical | 9.8 | 2026-06-17 | Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions. |
CVE-2026-27041 | Critical | 9.9 | 2026-06-17 | Contributor Arbitrary File Upload in Unlimited Elements for Elementor (Premium) <= 2.0.6 versions. |
CVE-2026-25470 | Critical | 10.0 | 2026-06-17 | Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom Post Types Plugin for WordPress allows Remote Code Inclusio… |
CVE-2026-25446 | Critical | 9.9 | 2026-06-17 | Subscriber Arbitrary File Upload in WishList Member X <= 3.29.0 versions. |
CVE-2026-25439 | High | 8.1 | 2026-06-17 | Unauthenticated Broken Authentication in Booknetic <= 4.8.5 versions. |
CVE-2026-24611 | Critical | 9.1 | 2026-06-17 | Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions. |
CVE-2026-24610 | Medium | 4.3 | 2026-06-17 | Subscriber Broken Access Control in MetForm Pro <= 3.9.1 versions. |
CVE-2026-24575 | Medium | 4.3 | 2026-06-17 | Subscriber Broken Access Control in WishList Member X <= 3.29.0 versions. |
CVE-2026-22343 | High | 8.6 | 2026-06-17 | Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions. |
CVE-2026-22342 | High | 8.8 | 2026-06-17 | Unauthenticated Cross Site Request Forgery (CSRF) in WordPress Dating Theme <= 11.2.0 versions. |
CVE-2026-22340 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in WPJobster <= 6.3.5 versions. |
CVE-2026-22339 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in WPJobster <= 6.3.5 versions. |
CVE-2026-22338 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions. |
CVE-2026-22335 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions. |
CVE-2026-22334 | High | 7.5 | 2026-06-17 | Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions. |
CVE-2026-22332 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions. |
CVE-2026-22331 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions. |
CVE-2026-22330 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Right Way <= 4.0 versions. |
CVE-2026-22329 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions. |
CVE-2026-22328 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Auto Repair <= 22.6 versions. |
CVE-2026-22327 | Critical | 9.9 | 2026-06-17 | Subscriber Arbitrary File Upload in Restaurt <= 1.0.4 versions. |
CVE-2026-22326 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions. |
CVE-2026-22325 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Promo <= 1.3.0 versions. |
CVE-2026-12491 | Medium | 4.8 | 2026-06-17 | A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specif… |
CVE-2026-12469 | Medium | 4.3 | 2026-06-17 | Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chro… |
CVE-2026-12468 | High | 8.3 | 2026-06-17 | Race in Updater in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
CVE-2026-12467 | High | 8.3 | 2026-06-17 | Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-12466 | High | 8.8 | 2026-06-17 | Heap buffer overflow in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page… |
CVE-2026-12465 | High | 8.3 | 2026-06-17 | Object lifecycle issue in Metrics in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-12464 | High | 8.3 | 2026-06-17 | Use after free in Browser in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-12463 | Medium | 4.7 | 2026-06-17 | Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to i… |
CVE-2026-12462 | High | 7.5 | 2026-06-17 | Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to execute arbitrary code i… |
CVE-2026-12461 | Medium | 6.5 | 2026-06-17 | Out of bounds read in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to obtain potentially sensitive information from pro… |
CVE-2026-12460 | Medium | 4.2 | 2026-06-17 | Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-12459 | Medium | 6.1 | 2026-06-17 | Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a craf… |