2026 CVEs (page 213)
Page 213 of 681 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-77075 | High | 7.3 | 2026-08-20 | n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering… |
CVE-2026-77074 | Medium | 6.5 | 2026-08-20 | n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users t… |
CVE-2026-77073 | Medium | 4.3 | 2026-08-20 | n8n versions before 2.34.1 contain a credential validation bypass in the MCP create_workflow_from_code tool when authentication type is set to an expression. A… |
CVE-2026-77072 | High | 7.6 | 2026-08-20 | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied it… |
CVE-2026-77071 | Critical | 9.8 | 2026-08-20 | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations… |
CVE-2026-77070 | Critical | 9.8 | 2026-08-20 | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations, which parse the… |
CVE-2026-77069 | Medium | 4.3 | 2026-08-20 | n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 d… |
CVE-2026-77068 | High | 8.8 | 2026-08-20 | n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema l… |
CVE-2026-74021 | High | 7.5 | 2026-08-20 | Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions. |
CVE-2026-74020 | High | 7.5 | 2026-08-20 | Unauthenticated Broken Access Control in Koji <= 2.2.1 versions. |
CVE-2026-74019 | High | 7.1 | 2026-08-20 | Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions. |
CVE-2026-74018 | Critical | 9.9 | 2026-08-20 | Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions. |
CVE-2026-74016 | Critical | 9.9 | 2026-08-20 | Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions. |
CVE-2026-74014 | Critical | 9.9 | 2026-08-20 | Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions. |
CVE-2026-74013 | High | 8.5 | 2026-08-20 | Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions. |
CVE-2026-74001 | Critical | 9.8 | 2026-08-20 | Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions. |
CVE-2026-73998 | High | 8.5 | 2026-08-20 | Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions. |
CVE-2026-73993 | Critical | 9.8 | 2026-08-20 | Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions. |
CVE-2026-73992 | Critical | 9.9 | 2026-08-20 | Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions. |
CVE-2026-73402 | Medium | 6.5 | 2026-08-20 | Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions. |
CVE-2026-68566 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions. |
CVE-2026-68564 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions. |
CVE-2026-66682 | Critical | 9.8 | 2026-08-20 | Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions. |
CVE-2026-66680 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions. |
CVE-2026-66677 | High | 7.6 | 2026-08-20 | Subscriber Broken Authentication in Leyka <= 3.32.3 versions. |
CVE-2026-66673 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions. |
CVE-2026-66672 | Critical | 9.8 | 2026-08-20 | Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions. |
CVE-2026-66649 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions. |
CVE-2026-66647 | Medium | 6.5 | 2026-08-20 | Subscriber Broken Access Control in Homlisti <= 3.1.2 versions. |
CVE-2026-66616 | High | 7.1 | 2026-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.Th… |
CVE-2026-66615 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions. |
CVE-2026-66614 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions. |
CVE-2026-66612 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions. |
CVE-2026-66611 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions. |
CVE-2026-66609 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions. |
CVE-2026-66607 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions. |
CVE-2026-66606 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions. |
CVE-2026-66605 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions. |
CVE-2026-66604 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions. |
CVE-2026-66601 | Medium | 6.5 | 2026-08-20 | Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions. |
CVE-2026-66600 | Critical | 9.1 | 2026-08-20 | Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions. |
CVE-2026-66598 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions. |
CVE-2026-66597 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions. |
CVE-2026-66595 | Medium | 5.9 | 2026-08-20 | Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions. |
CVE-2026-66594 | High | 8.5 | 2026-08-20 | Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions. |
CVE-2026-66593 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions. |
CVE-2026-66592 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions. |
CVE-2026-66590 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions. |
CVE-2026-66586 | Medium | 6.6 | 2026-08-20 | Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions. |
CVE-2026-66583 | Critical | 9.8 | 2026-08-20 | Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions. |
CVE-2026-66582 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions. |
CVE-2026-66581 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions. |
CVE-2026-28150 | High | 8.1 | 2026-08-20 | Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions. |
CVE-2026-77067 | Medium | 5.0 | 2026-08-20 | The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no v… |
CVE-2026-77066 | Medium | 5.0 | 2026-08-20 | The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no… |
CVE-2026-77026 | | 2026-08-20 | Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Submissions view did not enforce access c… | |
CVE-2026-73199 | Medium | 6.5 | 2026-08-20 | A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malforme… |
CVE-2026-73198 | High | 7.5 | 2026-08-20 | A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily larg… |
CVE-2026-73197 | High | 7.5 | 2026-08-20 | A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/m… |
CVE-2026-73196 | Medium | 4.3 | 2026-08-20 | A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value. Th… |
CVE-2026-13097 | High | 8.7 | 2026-08-20 | A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does… |
CVE-2026-11861 | Critical | 9.6 | 2026-08-20 | A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for… |
CVE-2026-18917 | High | 7.8 | 2026-08-20 | A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows c… |
CVE-2026-77014 | Medium | 5.3 | 2026-08-20 | A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction re… |
CVE-2026-76610 | | 2026-08-20 | Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized… | |
CVE-2026-14953 | Medium | 4.3 | 2026-08-20 | A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all… |
CVE-2026-14952 | High | 7.5 | 2026-08-20 | An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under… |
CVE-2026-14951 | High | 8.0 | 2026-08-20 | An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages. |
CVE-2026-14950 | Critical | 9.8 | 2026-08-20 | An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increas… |
CVE-2026-14949 | Medium | 6.5 | 2026-08-20 | A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new a… |
CVE-2026-14948 | High | 8.8 | 2026-08-20 | A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext se… |
CVE-2026-14947 | High | 7.2 | 2026-08-20 | A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction dire… |
CVE-2026-14946 | High | 7.2 | 2026-08-20 | A high privileged remote attacker can upload a .php file and then request it directly from /uploads/<filename>.php to achieve arbitrary code execution due to i… |
CVE-2026-76569 | | 2026-08-20 | Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4 | |
CVE-2026-76565 | | 2026-08-20 | Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7 | |
CVE-2026-76564 | | 2026-08-20 | Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7 | |
CVE-2026-75948 | | 2026-08-20 | Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `image` and `file` fie… | |
CVE-2026-71368 | Medium | 6.1 | 2026-08-20 | F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be p… |
CVE-2026-14163 | High | 7.5 | 2026-08-20 | In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in… |
CVE-2026-75963 | High | 7.5 | 2026-08-20 | The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_templ… |
CVE-2026-75860 | Critical | 9.8 | 2026-08-20 | The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and… |
CVE-2026-74992 | Medium | 6.8 | 2026-08-20 | The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove… |
CVE-2026-73542 | Low | 3.7 | 2026-08-20 | Multiple SEIKO EPSON printers and scanners contain revoked root certificates. A man-in-the-middle attack may allow an attacker to obtain communication data tra… |
CVE-2026-19699 | Low | 2.7 | 2026-08-20 | The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor… |
CVE-2026-19697 | Medium | 6.8 | 2026-08-20 | The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload cap… |
CVE-2026-19615 | Medium | 6.8 | 2026-08-20 | The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users… |
CVE-2026-17153 | Medium | 5.3 | 2026-08-20 | The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin no… |
CVE-2026-15049 | High | 7.2 | 2026-08-20 | The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remov… |
CVE-2026-13405 | Medium | 6.6 | 2026-08-20 | The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later exe… |
CVE-2026-76957 | Medium | 4.9 | 2026-08-20 | libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-502… |
CVE-2026-76956 | Medium | 5.9 | 2026-08-20 | In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to has… |
CVE-2026-76800 | Medium | 6.3 | 2026-08-20 | A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_media_post.php. Executing a m… |
CVE-2026-76799 | Medium | 5.3 | 2026-08-20 | A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the file /loginsystem/database/login_registr… |
CVE-2026-76795 | High | 7.3 | 2026-08-20 | A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API Endpoint. The manipul… |
CVE-2026-76785 | Medium | 6.3 | 2026-08-20 | A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file appli… |
CVE-2026-76783 | High | 7.3 | 2026-08-20 | A security vulnerability has been detected in DeDeCMS 53_1_UTF8. This vulnerability affects unknown code of the file /plus/advancedsearch.php. Such manipulatio… |
CVE-2026-75628 | Medium | 5.7 | 2026-08-20 | Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the re… |
CVE-2026-8619 | High | 7.5 | 2026-08-20 | An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper… |
CVE-2026-76764 | High | 7.3 | 2026-08-20 | A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the com… |
CVE-2026-76762 | High | 7.3 | 2026-08-20 | A vulnerability was detected in code-projects Assessment Management 1.0. The affected element is an unknown function of the file /welcome.php. The manipulation… |