2026 CVEs (page 305)
Page 305 of 691 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15649 | Medium | 6.4 | 2026-08-01 | The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to… |
CVE-2026-15645 | Medium | 6.4 | 2026-08-01 | The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions… |
CVE-2026-15644 | Medium | 6.4 | 2026-08-01 | The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all version… |
CVE-2026-15601 | Medium | 4.9 | 2026-08-01 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and incl… |
CVE-2026-15450 | High | 8.1 | 2026-08-01 | The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including… |
CVE-2026-15052 | High | 7.2 | 2026-08-01 | The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Value… |
CVE-2026-15018 | Medium | 5.3 | 2026-08-01 | The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to… |
CVE-2026-13458 | Medium | 6.4 | 2026-08-01 | The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and in… |
CVE-2026-11995 | Medium | 5.3 | 2026-08-01 | The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass i… |
CVE-2026-10782 | Medium | 4.3 | 2026-08-01 | The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not… |
CVE-2026-2916 | Medium | 4.3 | 2026-08-01 | The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the `enqueue_scr… |
CVE-2026-15988 | High | 8.8 | 2026-08-01 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu… |
CVE-2026-15932 | Medium | 5.3 | 2026-08-01 | The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attack… |
CVE-2026-15368 | High | 8.1 | 2026-08-01 | The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created acc… |
CVE-2026-15262 | Medium | 5.4 | 2026-08-01 | The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin lis… |
CVE-2026-15244 | High | 7.2 | 2026-08-01 | The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion pat… |
CVE-2026-15234 | Medium | 5.4 | 2026-08-01 | The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering… |
CVE-2026-14840 | Medium | 5.3 | 2026-08-01 | The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when en… |
CVE-2026-14839 | High | 7.5 | 2026-08-01 | The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated… |
CVE-2026-14836 | High | 8.1 | 2026-08-01 | The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both th… |
CVE-2026-14823 | Low | 2.2 | 2026-08-01 | The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with… |
CVE-2026-14822 | Medium | 5.3 | 2026-08-01 | The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, all… |
CVE-2026-14596 | High | 8.8 | 2026-08-01 | The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it ema… |
CVE-2026-14561 | Medium | 6.5 | 2026-08-01 | The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid ve… |
CVE-2026-14315 | Medium | 6.5 | 2026-08-01 | The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticat… |
CVE-2026-14309 | High | 8.1 | 2026-08-01 | The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-… |
CVE-2026-14292 | Medium | 5.4 | 2026-08-01 | The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowin… |
CVE-2026-14214 | Low | 2.7 | 2026-08-01 | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allo… |
CVE-2026-14197 | Low | 3.8 | 2026-08-01 | The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted supp… |
CVE-2026-14195 | Low | 2.7 | 2026-08-01 | The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Co… |
CVE-2026-13729 | Medium | 4.3 | 2026-08-01 | The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing… |
CVE-2026-13725 | High | 7.1 | 2026-08-01 | The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions… |
CVE-2026-13604 | Medium | 5.3 | 2026-08-01 | The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, tha… |
CVE-2026-13596 | Critical | 9.1 | 2026-08-01 | The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allow… |
CVE-2026-13329 | Medium | 6.5 | 2026-08-01 | The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that process… |
CVE-2026-13158 | High | 7.2 | 2026-08-01 | The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is dis… |
CVE-2026-13157 | High | 7.2 | 2026-08-01 | The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabl… |
CVE-2026-12966 | Medium | 5.3 | 2026-08-01 | The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenti… |
CVE-2026-12696 | Medium | 5.4 | 2026-08-01 | The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public pa… |
CVE-2026-11882 | Low | 3.7 | 2026-08-01 | The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowi… |
CVE-2026-10827 | Low | 3.5 | 2026-08-01 | The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on… |
CVE-2026-3141 | Critical | 9.1 | 2026-08-01 | The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/at… |
CVE-2026-7623 | Medium | 6.4 | 2026-08-01 | The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingWrappe… |
CVE-2026-15414 | High | 8.8 | 2026-08-01 | The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the `save_… |
CVE-2026-15403 | Medium | 4.9 | 2026-08-01 | The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and includin… |
CVE-2026-15006 | High | 7.5 | 2026-08-01 | The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all ve… |
CVE-2026-13362 | Medium | 6.4 | 2026-08-01 | The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via _sp_form_code Post Meta in all versions up to, a… |
CVE-2026-9044 | High | 8.0 | 2026-07-31 | An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to ex… |
CVE-2026-54909 | Medium | 5.3 | 2026-07-31 | pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in… |
CVE-2026-54787 | Low | 3.1 | 2026-07-31 | sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity w… |
CVE-2026-54785 | Medium | 6.2 | 2026-07-31 | gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in i… |
CVE-2026-54768 | | 2026-07-31 | WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticat… | |
CVE-2026-53573 | | 2026-07-31 | GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAut… | |
CVE-2026-45377 | Medium | 6.5 | 2026-07-31 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data… |
CVE-2026-45376 | Medium | 5.5 | 2026-07-31 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/us… |
CVE-2026-45330 | Medium | 4.9 | 2026-07-31 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verifica… |
CVE-2026-34641 | High | 7.8 | 2026-07-31 | Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation… |
CVE-2026-68771 | Critical | 9.8 | 2026-07-31 | ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitr… |
CVE-2026-52371 | Medium | 6.5 | 2026-07-31 | A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supp… |
CVE-2026-52232 | Medium | 6.1 | 2026-07-31 | A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attackers to execute arb… |
CVE-2026-52134 | Critical | 9.8 | 2026-07-31 | An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a captured GOOSE frame. |
CVE-2026-51953 | High | 7.4 | 2026-07-31 | An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components |
CVE-2026-45086 | Medium | 5.4 | 2026-07-31 | Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demograph… |
CVE-2026-68770 | Critical | 9.8 | 2026-07-31 | sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in… |
CVE-2026-65981 | High | 7.1 | 2026-07-31 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with th… |
CVE-2026-51785 | Critical | 9.8 | 2026-07-31 | An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request |
CVE-2026-50986 | High | 8.8 | 2026-07-31 | PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). The payment validation controller has no CSRF token. An… |
CVE-2026-38713 | Critical | 9.8 | 2026-07-31 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discover… |
CVE-2026-38710 | High | 7.2 | 2026-07-31 | TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows atta… |
CVE-2026-38708 | Critical | 9.8 | 2026-07-31 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discover… |
CVE-2026-65841 | | 2026-07-31 | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SV… | |
CVE-2026-62999 | High | 7.5 | 2026-07-31 | Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separator… |
CVE-2026-62959 | | 2026-07-31 | Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a… | |
CVE-2026-62324 | Medium | 5.4 | 2026-07-31 | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl… |
CVE-2026-55825 | Low | 3.1 | 2026-07-31 | Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier contai… |
CVE-2026-53599 | High | 7.5 | 2026-07-31 | REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php l… |
CVE-2026-53551 | | 2026-07-31 | free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server Function) does not validate the supiOr… | |
CVE-2026-53510 | High | 8.1 | 2026-07-31 | Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passe… |
CVE-2026-38711 | Critical | 9.8 | 2026-07-31 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discover… |
CVE-2026-18394 | High | 7.4 | 2026-07-31 | Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_RE… |
CVE-2026-57232 | Low | 3.1 | 2026-07-31 | Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs fro… |
CVE-2026-55824 | Low | 2.6 | 2026-07-31 | Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's cr… |
CVE-2026-53505 | High | 7.5 | 2026-07-31 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on… |
CVE-2026-53504 | High | 7.5 | 2026-07-31 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on… |
CVE-2026-53503 | High | 7.5 | 2026-07-31 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter p… |
CVE-2026-53502 | | 2026-07-31 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary valid… | |
CVE-2026-53501 | High | 8.2 | 2026-07-31 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace()… |
CVE-2026-53500 | High | 8.2 | 2026-07-31 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without es… |
CVE-2026-25552 | Low | 3.7 | 2026-07-31 | Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the… |
CVE-2026-18481 | High | 7.3 | 2026-07-31 | Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens… |
CVE-2026-18321 | Medium | 4.7 | 2026-07-31 | Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd |
CVE-2026-55100 | | 2026-07-31 | hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values includin… | |
CVE-2026-54737 | High | 7.3 | 2026-07-31 | @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merge… |
CVE-2026-54729 | | 2026-07-31 | DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, is_url_safe can treat localhost as safe wh… | |
CVE-2026-54725 | Critical | 9.6 | 2026-07-31 | vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhoo… |
CVE-2026-34497 | Medium | 5.4 | 2026-07-31 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting… |
CVE-2026-34495 | Medium | 5.4 | 2026-07-31 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. … |
CVE-2026-34490 | Medium | 5.5 | 2026-07-31 | Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compro… |
CVE-2026-21662 | Critical | 9.8 | 2026-07-31 | Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Syst… |
CVE-2026-67822 | Critical | 9.8 | 2026-07-31 | Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to c… |