2026 CVEs (page 246)

Page 246 of 696 — CVEs published in 2026, newest first, with CVSS severity and publication dates.

All CVEs published in 2026 — newest first (page 246 of 696)
CVESeverityScorePublishedSummary
CVE-2026-72532Medium5.42026-08-18Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthor…
CVE-2026-71574Medium6.52026-08-18Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unau…
CVE-2026-71477Medium6.72026-08-18mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and pa…
CVE-2026-71365High7.72026-08-18A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extr…
CVE-2026-633282026-08-18Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confi…
CVE-2026-62684Low2.72026-08-18File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the…
CVE-2026-623572026-08-18Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width ti…
CVE-2026-55839High8.72026-08-18Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows…
CVE-2026-49227High7.62026-08-18Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allo…
CVE-2026-49226High8.32026-08-18Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a…
CVE-2026-49221High8.82026-08-18Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operation…
CVE-2026-47245Medium4.32026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly…
CVE-2026-46482Medium5.32026-08-18### Impact The registration component does not validate the text-based _Security Question_ CAPTCHA correctly, allowing attackers to bypass the challenge via a…
CVE-2026-45734Medium5.32026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attacker…
CVE-2026-45129Medium4.62026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attac…
CVE-2026-45128Low3.52026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attack…
CVE-2026-45127Low3.52026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attacke…
CVE-2026-45126Low3.52026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing…
CVE-2026-45125Medium5.32026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header inje…
CVE-2026-45124Medium4.32026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without rep…
CVE-2026-45123Medium4.32026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side…
CVE-2026-45122Medium4.32026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when mo…
CVE-2026-45121Medium4.32026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing auth…
CVE-2026-45120Medium5.42026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewin…
CVE-2026-45119Medium4.62026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-…
CVE-2026-45118Critical9.32026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open r…
CVE-2026-45117Critical9.82026-08-18MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration value…
CVE-2026-45116High8.72026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, res…
CVE-2026-45115High8.72026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform J…
CVE-2026-19501High8.82026-08-18CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-controlled form field nam…
CVE-2026-19500High7.52026-08-18The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-controlled form fields or submitted con…
CVE-2026-158062026-08-18The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not tak…
CVE-2026-12564Critical9.62026-08-18A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the c…
CVE-2026-75898High8.52026-08-18RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component…
CVE-2026-758722026-08-18HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message…
CVE-2026-75784Critical10.02026-08-18A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of the file /usr/nginx/sbin/nginx of the com…
CVE-2026-75032Medium6.32026-08-18A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) im…
CVE-2026-74015Critical9.32026-08-18Unauthenticated SQL Injection in Readabler < 2.0.18 versions.
CVE-2026-74012High8.82026-08-18Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0.
CVE-2026-74009Medium5.32026-08-18Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.
CVE-2026-74008Medium5.32026-08-18Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embe…
CVE-2026-74007Medium5.32026-08-18Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions.
CVE-2026-74006Medium4.32026-08-18Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.
CVE-2026-74004Medium5.42026-08-18Subscriber Broken Access Control in Gravity Booster &#8211; Styles &amp; Layouts for Gravity Forms <= 6.0 versions.
CVE-2026-74003Medium4.32026-08-18Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.
CVE-2026-73997High7.52026-08-18Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.
CVE-2026-73996Critical9.82026-08-18Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.
CVE-2026-73995Medium5.42026-08-18Subscriber Broken Authentication in User Registration <= 5.2.6 versions.
CVE-2026-73994High7.52026-08-18Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.
CVE-2026-73426Medium4.62026-08-18Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-seri…
CVE-2026-73404Medium6.52026-08-18Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.
CVE-2026-73400High8.12026-08-18Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.
CVE-2026-73399Medium6.52026-08-18Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.
CVE-2026-73398Medium6.52026-08-18Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.
CVE-2026-73397Critical9.82026-08-18Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.
CVE-2026-73396High7.12026-08-18Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.
CVE-2026-73395Medium6.52026-08-18Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.
CVE-2026-73393High7.12026-08-18Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.
CVE-2026-73383Medium4.92026-08-18Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.
CVE-2026-73382High7.12026-08-18Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.T…
CVE-2026-73381Critical9.12026-08-18Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.
CVE-2026-73380Critical9.82026-08-18Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
CVE-2026-73379Medium6.52026-08-18Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.
CVE-2026-73378High7.12026-08-18Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.
CVE-2026-73377High7.52026-08-18Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.
CVE-2026-73376Critical9.82026-08-18Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
CVE-2026-73375High7.12026-08-18Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.
CVE-2026-73367High7.22026-08-18Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.
CVE-2026-73366Critical9.82026-08-18Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.
CVE-2026-73365Critical9.32026-08-18Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.
CVE-2026-73362High7.12026-08-18Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.
CVE-2026-73361High7.12026-08-18Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.
CVE-2026-73360High7.12026-08-18Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.
CVE-2026-73359Medium6.52026-08-18Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions.
CVE-2026-73358High7.12026-08-18Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.
CVE-2026-73356High8.22026-08-18Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.
CVE-2026-73355Critical9.32026-08-18Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.
CVE-2026-73352Medium6.52026-08-18Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.
CVE-2026-73351High7.12026-08-18Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.
CVE-2026-73350High8.22026-08-18Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.
CVE-2026-73348Medium6.52026-08-18Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
CVE-2026-73345High7.12026-08-18Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions.
CVE-2026-73343Critical10.02026-08-18Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
CVE-2026-73342High7.12026-08-18Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.
CVE-2026-73341Critical9.82026-08-18Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.
CVE-2026-73339Critical9.32026-08-18Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.
CVE-2026-73338High7.12026-08-18Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.
CVE-2026-73190High7.12026-08-18Unauthenticated Cross Site Scripting (XSS) in WPDM – Premium Packages <= 7.0.5 versions.
CVE-2026-73187Critical9.32026-08-18Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.
CVE-2026-73181High7.52026-08-18Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.
CVE-2026-715392026-08-18n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user t…
CVE-2026-70657Medium4.32026-08-18Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can co…
CVE-2026-69189High7.62026-08-18Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLS…
CVE-2026-689392026-08-18Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .pyt…
CVE-2026-68568Medium6.32026-08-18Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.
CVE-2026-68567High7.12026-08-18Unauthenticated Cross Site Scripting (XSS) in Convert Pro <= 1.0.1 versions.
CVE-2026-68565Medium6.52026-08-18Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.
CVE-2026-66793High8.82026-08-18A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate…
CVE-2026-66679Medium6.52026-08-18Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.
CVE-2026-66667High7.12026-08-18Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.