2026 CVEs (page 266)
Page 266 of 469 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8884 | Medium | 6.4 | 2026-05-27 | The Instant-Quote.co Quotation Page plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and inclu… |
CVE-2026-8877 | Medium | 6.4 | 2026-05-27 | The Responsive Video Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rem_video' shortcode in versions up to, and including… |
CVE-2026-8875 | Medium | 6.4 | 2026-05-27 | The Easy Prism Syntax Highlighter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'code' (and 'c') shortcode in versions up… |
CVE-2026-8873 | Medium | 6.4 | 2026-05-27 | The Content Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 2.4.1 du… |
CVE-2026-8872 | Medium | 6.4 | 2026-05-27 | The Animate Your Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animation-set' shortcode in versions up to, and in… |
CVE-2026-8871 | Medium | 6.4 | 2026-05-27 | The Formidable Kinetic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'kinetic_link' shortcode in versions up to, and including, 1.1… |
CVE-2026-8870 | Medium | 6.4 | 2026-05-27 | The Team Master – A Modern WordPress Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions u… |
CVE-2026-8869 | Medium | 6.4 | 2026-05-27 | The Mutual Funds Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute in versions up to, and including, 1… |
CVE-2026-8868 | Medium | 6.4 | 2026-05-27 | The Single Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'single-mailchimp' shortcode in all versions up to, and includin… |
CVE-2026-8867 | Medium | 6.4 | 2026-05-27 | The Post Category Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'postcategorygallery' shortcode in versions up to… |
CVE-2026-8866 | Medium | 6.4 | 2026-05-27 | The jQuery googleslides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'googleslides' shortcode in all versions up to, and including… |
CVE-2026-8847 | Medium | 6.4 | 2026-05-27 | The Dideo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dideo' shortcode in version 1.0. This is due to insufficient inpu… |
CVE-2026-8846 | Medium | 6.4 | 2026-05-27 | The Tuxquote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'TUXQUOTE' shortcode in versions up to, and including, 1.3. This is due… |
CVE-2026-8845 | Medium | 6.4 | 2026-05-27 | The Islamic Database plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'islamicDB-roqya' shortcode in versions up to, and including, 1… |
CVE-2026-8844 | Medium | 6.4 | 2026-05-27 | The Responsive Check plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rspcheck' shortcode in versions up to, and including, 0.0.3. Th… |
CVE-2026-8842 | Medium | 6.4 | 2026-05-27 | The Google+ Link Name plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gplusnamelink' shortcode in versions up to, and including, 1.0… |
CVE-2026-8837 | Medium | 6.4 | 2026-05-27 | The WP Iframe Geo Style for Amazon affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'adid' Shortcode Attribute in all versions… |
CVE-2026-8787 | High | 8.8 | 2026-05-27 | The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to t… |
CVE-2026-8760 | Critical | 9.8 | 2026-05-27 | The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for… |
CVE-2026-8708 | Medium | 4.3 | 2026-05-27 | The Genzel breadcrumbs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or in… |
CVE-2026-8707 | Medium | 6.1 | 2026-05-27 | The NS Product icon badge plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF in all versions up to, and including, 1.2.4 due to… |
CVE-2026-8703 | Medium | 6.4 | 2026-05-27 | The Endless Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.0.0 due t… |
CVE-2026-8702 | Medium | 6.4 | 2026-05-27 | The GBI To Print plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0 via the 'div' attribute of the 'gbitoprint' shortcode. This i… |
CVE-2026-8701 | Medium | 6.4 | 2026-05-27 | The GNTT Post Title Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0 via the `title-ticker-slide`, `title-ticker-fade`… |
CVE-2026-8698 | Medium | 6.4 | 2026-05-27 | The Cryptocurrency Prijsvergelijking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0. This is due to insufficient outpu… |
CVE-2026-8048 | Medium | 6.4 | 2026-05-27 | The My Email Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subject' shortcode attribute in the 'my-email' shortcode in a… |
CVE-2026-8040 | Medium | 6.4 | 2026-05-27 | The faq shortocde plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' shortcode attribute in the 'faq' shortcode in all versions… |
CVE-2026-7614 | Medium | 4.3 | 2026-05-27 | The Old Posts Highlighter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing… |
CVE-2026-6268 | High | 7.1 | 2026-05-27 | The EventPress WordPress theme before 22.2 does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler befor… |
CVE-2026-9236 | Medium | 4.3 | 2026-05-27 | The CM Ad Changer – A simple tool to control and optimize your site's banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions… |
CVE-2026-8450 | Critical | 9.1 | 2026-05-27 | HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-a… |
CVE-2026-6287 | Medium | 5.4 | 2026-05-27 | The ShopLentor - WooCommerce Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blockUniqId' block at… |
CVE-2026-49000 | High | 7.0 | 2026-05-27 | An insecure password scheme refers to vulnerabilities arising from improper selection of encryption algorithms, inadequate key management, or flawed code imple… |
CVE-2026-9022 | Medium | 6.4 | 2026-05-27 | The Splide Carousel Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'url' Block Attribute in all versions up to, and including, 1.7… |
CVE-2026-48999 | Medium | 5.7 | 2026-05-27 | Attackers carefully craft malicious scripts, such as JavaScript, and inject them into target systems; when other users access pages containing such malicious c… |
CVE-2026-48962 | High | 7.3 | 2026-05-27 | IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps th… |
CVE-2026-48961 | High | 7.3 | 2026-05-27 | IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-by… |
CVE-2026-48959 | High | 7.5 | 2026-05-27 | IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the di… |
CVE-2026-2255 | Medium | 4.3 | 2026-05-27 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in pla… |
CVE-2026-2254 | Medium | 6.3 | 2026-05-27 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, does not apply ACLs on certain API endpo… |
CVE-2026-2253 | High | 7.7 | 2026-05-27 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers fro… |
CVE-2026-9632 | High | 8.8 | 2026-05-27 | A flaw has been found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this issue is the function strcpy of the file /goform/formGroupConfig of the c… |
CVE-2026-9631 | High | 8.8 | 2026-05-27 | A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/formConfi… |
CVE-2026-9628 | High | 8.8 | 2026-05-27 | A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is an unknown function of the file /goform/formPptpClientConfig of the componen… |
CVE-2026-9627 | High | 8.8 | 2026-05-27 | A security flaw has been discovered in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/setSysAdm of the component Web… |
CVE-2026-9609 | Medium | 4.7 | 2026-05-27 | A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password rec… |
CVE-2026-9608 | Low | 2.4 | 2026-05-27 | A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator… |
CVE-2026-9207 | High | 8.8 | 2026-05-27 | Tanium addressed an unauthorized code execution vulnerability in Connect. |
CVE-2026-9156 | Medium | 6.5 | 2026-05-27 | Tanium addressed a denial of service vulnerability in Tanium Server. |
CVE-2026-7493 | Medium | 5.3 | 2026-05-27 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to denial of service in all versions up to, a… |
CVE-2026-6565 | Medium | 6.4 | 2026-05-27 | The Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2026-49017 | | 2026-05-27 | In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingIn… | |
CVE-2026-49014 | High | 7.4 | 2026-05-27 | In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attri… |
CVE-2026-9607 | Medium | 6.3 | 2026-05-27 | A vulnerability was found in itsourcecode Courier Management System 1.0. The affected element is an unknown function of the file /parcel_list.php. Performing a… |
CVE-2026-9606 | High | 7.3 | 2026-05-27 | A vulnerability has been found in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /manage_user.php. Such manipulation o… |
CVE-2026-9605 | High | 7.3 | 2026-05-27 | A flaw has been found in GNU libredwg up to 0.13.4.8160. This issue affects the function bit_read_RC of the file bits.c of the component Dwgbmp Utility. This m… |
CVE-2026-9312 | High | 8.2 | 2026-05-27 | A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to send crafted requests… |
CVE-2026-8606 | Medium | 5.9 | 2026-05-27 | A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP reques… |
CVE-2026-9604 | Medium | 4.3 | 2026-05-26 | A vulnerability was detected in JeecgBoot up to 3.9.1. This vulnerability affects unknown code of the component AiragModelController. The manipulation of the a… |
CVE-2026-8647 | Medium | 4.8 | 2026-05-26 | Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available. The random_bytes function fell back to… |
CVE-2026-46740 | Medium | 5.3 | 2026-05-26 | Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections. The metric names and set values were not checked for newlines, colons or… |
CVE-2026-9603 | Medium | 6.5 | 2026-05-26 | A security vulnerability has been detected in SourceCodester eDoc Doctor Appointment System 1.0. This affects an unknown part of the file /admin/delete-session… |
CVE-2026-9584 | High | 7.3 | 2026-05-26 | A security vulnerability has been detected in code-projects Project Management System 1.0. Affected is an unknown function of the file chk.php of the component… |
CVE-2026-5260 | High | 8.2 | 2026-05-26 | A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed… |
CVE-2026-48710 | Medium | 6.5 | 2026-05-26 | Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `r… |
CVE-2026-45574 | High | 8.1 | 2026-05-26 | epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker on the network path between the ePA service… |
CVE-2026-45298 | High | 8.6 | 2026-05-26 | Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy (the documented quickstart, no DOZZLE_AUTH_PROVIDER set), PO… |
CVE-2026-44985 | Critical | 9.6 | 2026-05-26 | Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, he WebSocket upgrader for the /exec and /attach endpoints uses CheckOrigin: func(r *htt… |
CVE-2026-44983 | High | 7.3 | 2026-05-26 | smallbitvec is a growable bit-vector for Rust, optimized for size. From 1.0.1 to 2.6.0, an integer overflow in the internal capacity calculation of smallbitvec… |
CVE-2026-44966 | High | 8.3 | 2026-05-26 | Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in… |
CVE-2026-44905 | High | 7.5 | 2026-05-26 | Vanetza is an open-source implementation of the ETSI C-ITS protocol suite. In 26.02 and earlier, a denial-of-service vulnerability was identified in the crypto… |
CVE-2026-44903 | Medium | 6.1 | 2026-05-26 | Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enab… |
CVE-2026-44900 | High | 8.1 | 2026-05-26 | epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.1, in SignedPublicKeysTrustValidatorImpl.isTrusted(), the… |
CVE-2026-44895 | | 2026-05-26 | GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the HTTP transport in src/transport.ts ships with no authentication layer at all an… | |
CVE-2026-44788 | Medium | 5.9 | 2026-05-26 | SharpCompress is a fully managed C# library to deal with many compression types and formats. In 0.47.4 and earlier, a path traversal vulnerability in IArchive… |
CVE-2026-44213 | Medium | 6.5 | 2026-05-26 | The OpenTelemetry.Exporter.Instana exports telemetry to Instana backend. Prior to 1.1.0, the OpenTelemetry.Exporter.Instana NuGet package does not validate HTT… |
CVE-2026-43988 | High | 7.5 | 2026-05-26 | Vanetza is an open-source implementation of the ETSI C-ITS protocol suite. In 26.02 and earlier, a denial-of-service vulnerability was identified in the ASN.1/… |
CVE-2026-42015 | Medium | 5.3 | 2026-05-26 | A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the… |
CVE-2026-42013 | High | 8.2 | 2026-05-26 | A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall ba… |
CVE-2026-42012 | High | 7.1 | 2026-05-26 | A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Ide… |
CVE-2026-9583 | Medium | 4.3 | 2026-05-26 | A weakness has been identified in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This impacts an unknown function of the file /i… |
CVE-2026-9582 | Medium | 4.3 | 2026-05-26 | A security flaw has been discovered in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects an unknown function. Performi… |
CVE-2026-9581 | Medium | 6.3 | 2026-05-26 | A vulnerability was identified in JeecgBoot up to 3.9.1. The impacted element is an unknown function of the file /sys/comment/add. Such manipulation leads to i… |
CVE-2026-9580 | High | 7.3 | 2026-05-26 | A vulnerability was determined in JeecgBoot up to 3.9.1. The affected element is the function LoginController.selectDepart of the file /sys/selectDepart. This… |
CVE-2026-9579 | Medium | 6.3 | 2026-05-26 | A vulnerability was found in JeecgBoot up to 3.9.1. Impacted is the function user.getUsername of the file /sys/user/login/setting/userEdit of the component Sys… |
CVE-2026-8676 | High | 8.8 | 2026-05-26 | An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the bonded device and creating a new bond. |
CVE-2026-48593 | | 2026-05-26 | Uncontrolled Resource Consumption vulnerability in oban-bg oban_web ('Elixir.Oban.Web.CronExpr' modules) allows memory exhaustion via unbounded cron range expa… | |
CVE-2026-48592 | | 2026-05-26 | Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker substitution. The hand… | |
CVE-2026-47672 | Medium | 6.5 | 2026-05-26 | epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. In 1.2.4 and earlier, any network-reachable caller can write arbitrary… |
CVE-2026-45575 | High | 7.4 | 2026-05-26 | epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker who can MITM the TLS connection between the… |
CVE-2026-45413 | | 2026-05-26 | MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, user passwords are stored using unsalted MD5 hashes, making them trivially crackable via r… | |
CVE-2026-45412 | | 2026-05-26 | MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, SSRF via work_flow_template Import. Authenticated users can supply arbitrary URLs in work_… | |
CVE-2026-44899 | Medium | 4.7 | 2026-05-26 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the :width: and :height: options with a re… |
CVE-2026-44898 | Medium | 6.1 | 2026-05-26 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_toc_ul() builds a <ul> table-of-contents tree from a list of (level, id… |
CVE-2026-44897 | Medium | 6.1 | 2026-05-26 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading() builds the opening <hN> tag by string-concatenating the… |
CVE-2026-44896 | Medium | 6.1 | 2026-05-26 | Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the render_figure() function concaten… |
CVE-2026-44847 | High | 7.5 | 2026-05-26 | MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.0, MaxKB's webhook trigger endpoint (/api/trigger/v1/webhook/{trigger_id}) is accessible with… |
CVE-2026-44844 | | 2026-05-26 | eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0… | |
CVE-2026-44843 | High | 8.2 | 2026-05-26 | LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserial… |
CVE-2026-44837 | Medium | 5.9 | 2026-05-26 | view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoi… |