2026 CVEs (page 317)
Page 317 of 689 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14167 | High | 8.8 | 2026-07-28 | A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incor… |
CVE-2026-13161 | High | 7.5 | 2026-07-28 | The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldata[truebooker_user]' parame… |
CVE-2026-12800 | High | 7.5 | 2026-07-28 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/… |
CVE-2026-55977 | Low | 3.3 | 2026-07-28 | Successful exploitation of this vulnerability could allow an attacker with local network access to bypass the application's rate-limiting mechanism, enabling b… |
CVE-2026-15730 | Medium | 6.4 | 2026-07-28 | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2026-15673 | Medium | 4.4 | 2026-07-28 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'check… |
CVE-2026-15671 | Medium | 4.9 | 2026-07-28 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via the 'i… |
CVE-2026-15670 | Medium | 4.9 | 2026-07-28 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the… |
CVE-2026-15014 | Critical | 9.8 | 2026-07-28 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to… |
CVE-2026-12741 | High | 7.5 | 2026-07-28 | The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'form_data[s]' parameter in all vers… |
CVE-2026-11756 | Critical | 10.0 | 2026-07-28 | A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEX… |
CVE-2026-6251 | Medium | 6.5 | 2026-07-28 | The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetc… |
CVE-2026-16811 | Medium | 4.9 | 2026-07-28 | The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' para… |
CVE-2026-16797 | Medium | 4.3 | 2026-07-28 | The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all version… |
CVE-2026-16587 | Medium | 4.3 | 2026-07-28 | The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6… |
CVE-2026-16585 | High | 7.2 | 2026-07-28 | The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient… |
CVE-2026-15136 | Medium | 4.3 | 2026-07-28 | The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… |
CVE-2026-15012 | Medium | 5.3 | 2026-07-28 | The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and includin… |
CVE-2026-14926 | Medium | 4.2 | 2026-07-28 | The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its p… |
CVE-2026-14924 | High | 7.5 | 2026-07-28 | The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unaut… |
CVE-2026-14870 | High | 7.1 | 2026-07-28 | The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it… |
CVE-2026-14821 | Low | 2.7 | 2026-07-28 | The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with cont… |
CVE-2026-14819 | Low | 3.5 | 2026-07-28 | The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowin… |
CVE-2026-14545 | Critical | 9.8 | 2026-07-28 | The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handler… |
CVE-2026-14490 | High | 7.5 | 2026-07-28 | The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and incl… |
CVE-2026-12124 | Medium | 5.3 | 2026-07-28 | The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized acc… |
CVE-2026-17528 | Medium | 6.1 | 2026-07-28 | Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supply a malicious pay… |
CVE-2026-17524 | High | 7.5 | 2026-07-28 | Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process… |
CVE-2026-66473 | High | 7.5 | 2026-07-27 | Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions. |
CVE-2026-65448 | Medium | 6.5 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner – AcyChecker <= 1.8.1 versions. |
CVE-2026-65447 | High | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions. |
CVE-2026-65446 | High | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions. |
CVE-2026-65445 | Medium | 6.5 | 2026-07-27 | Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions. |
CVE-2026-65443 | High | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions. |
CVE-2026-65442 | High | 7.2 | 2026-07-27 | Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions. |
CVE-2026-65441 | High | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions. |
CVE-2026-65440 | High | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions. |
CVE-2026-65439 | High | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions. |
CVE-2026-65438 | High | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions. |
CVE-2026-65437 | High | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions. |
CVE-2026-61957 | High | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions. |
CVE-2026-61953 | High | 7.2 | 2026-07-27 | Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions. |
CVE-2026-51565 | Medium | 6.1 | 2026-07-27 | Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attackers to inject arbitrary web script or HTM… |
CVE-2026-59240 | | 2026-07-27 | The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/del… | |
CVE-2026-55685 | High | 7.5 | 2026-07-27 | React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would… |
CVE-2026-53669 | Medium | 6.1 | 2026-07-27 | React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNavigate. This i… |
CVE-2026-53668 | Medium | 6.9 | 2026-07-27 | React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. A… |
CVE-2026-53667 | Medium | 6.9 | 2026-07-27 | React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untruste… |
CVE-2026-53666 | Medium | 6.1 | 2026-07-27 | React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite… |
CVE-2026-51564 | Medium | 4.9 | 2026-07-27 | An issue in the redirect parameter in Milk admin <=0.9.8 allows remote attackers to redirect users to arbitrary external URLs via a crafted request. |
CVE-2026-51078 | High | 7.5 | 2026-07-27 | An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the file_manage_control.php component |
CVE-2026-51077 | High | 7.5 | 2026-07-27 | SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the sys_sql_query.php… |
CVE-2026-66825 | | 2026-07-27 | Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, h… | |
CVE-2026-66824 | | 2026-07-27 | A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into… | |
CVE-2026-64783 | High | 8.8 | 2026-07-27 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS… |
CVE-2026-64776 | Medium | 5.5 | 2026-07-27 | The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to… |
CVE-2026-64775 | Critical | 9.8 | 2026-07-27 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma… |
CVE-2026-64774 | Critical | 9.8 | 2026-07-27 | An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoi… |
CVE-2026-64772 | Critical | 9.8 | 2026-07-27 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, mac… |
CVE-2026-64771 | Critical | 9.8 | 2026-07-27 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 1… |
CVE-2026-64770 | Critical | 9.8 | 2026-07-27 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macO… |
CVE-2026-64769 | Critical | 9.8 | 2026-07-27 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macO… |
CVE-2026-64768 | High | 8.1 | 2026-07-27 | An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macO… |
CVE-2026-64767 | Critical | 9.8 | 2026-07-27 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote att… |
CVE-2026-64766 | High | 7.8 | 2026-07-27 | An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoi… |
CVE-2026-64765 | High | 7.8 | 2026-07-27 | An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoi… |
CVE-2026-64764 | High | 7.8 | 2026-07-27 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macO… |
CVE-2026-64763 | High | 7.8 | 2026-07-27 | An out-of-bounds write issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, ma… |
CVE-2026-64762 | Critical | 9.8 | 2026-07-27 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS Sonoma 14… |
CVE-2026-64758 | High | 7.8 | 2026-07-27 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6… |
CVE-2026-64757 | High | 8.8 | 2026-07-27 | A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 26.6, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS… |
CVE-2026-64755 | Medium | 5.5 | 2026-07-27 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6. An app ma… |
CVE-2026-64754 | Medium | 5.5 | 2026-07-27 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 1… |
CVE-2026-64751 | Critical | 9.8 | 2026-07-27 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26… |
CVE-2026-64749 | High | 7.8 | 2026-07-27 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, m… |
CVE-2026-64747 | High | 7.8 | 2026-07-27 | A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 1… |
CVE-2026-64746 | Critical | 9.8 | 2026-07-27 | An authorization issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26… |
CVE-2026-64745 | Low | 2.4 | 2026-07-27 | This issue was addressed with additional restrictions on the lock screen. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A person with physical… |
CVE-2026-64744 | Medium | 5.5 | 2026-07-27 | An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS Sonoma 14.8… |
CVE-2026-64743 | Medium | 6.5 | 2026-07-27 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Tah… |
CVE-2026-64742 | Medium | 6.5 | 2026-07-27 | This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 2… |
CVE-2026-64741 | Medium | 5.5 | 2026-07-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.6 and iPadOS 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app… |
CVE-2026-64740 | Critical | 9.3 | 2026-07-27 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6… |
CVE-2026-64739 | High | 8.8 | 2026-07-27 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macO… |
CVE-2026-64738 | Critical | 9.8 | 2026-07-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS Sonoma 14.8… |
CVE-2026-64737 | High | 8.2 | 2026-07-27 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A mali… |
CVE-2026-64735 | Medium | 6.5 | 2026-07-27 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 2… |
CVE-2026-64734 | Medium | 5.5 | 2026-07-27 | The issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sono… |
CVE-2026-64733 | Critical | 9.8 | 2026-07-27 | This issue was addressed with improved data protection. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26… |
CVE-2026-64732 | Medium | 4.6 | 2026-07-27 | This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7… |
CVE-2026-64731 | Critical | 9.8 | 2026-07-27 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A malicious app may be able to bre… |
CVE-2026-64730 | Medium | 6.5 | 2026-07-27 | The issue was addressed with improved UI. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26… |
CVE-2026-64729 | Critical | 9.8 | 2026-07-27 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26… |
CVE-2026-64728 | Medium | 6.5 | 2026-07-27 | A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS… |
CVE-2026-64727 | Critical | 9.8 | 2026-07-27 | A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Tahoe 26.6, tvOS 26.6. An app may be able to cause unexpected… |
CVE-2026-64726 | Critical | 9.8 | 2026-07-27 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS… |
CVE-2026-64725 | High | 7.1 | 2026-07-27 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macO… |
CVE-2026-64724 | Medium | 5.5 | 2026-07-27 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, m… |
CVE-2026-64723 | Medium | 5.5 | 2026-07-27 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe… |
CVE-2026-64722 | Medium | 5.5 | 2026-07-27 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Seq… |