2026 CVEs (page 320)
Page 320 of 689 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54890 | High | 7.5 | 2026-07-27 | Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Ex… |
CVE-2026-47078 | | 2026-07-27 | Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archiv… | |
CVE-2026-42792 | High | 7.5 | 2026-07-27 | Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erla… |
CVE-2026-17574 | Medium | 5.5 | 2026-07-27 | HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type fi… |
CVE-2026-17573 | Medium | 5.5 | 2026-07-27 | A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause… |
CVE-2026-17572 | Medium | 5.5 | 2026-07-27 | Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (cr… |
CVE-2026-17530 | Medium | 6.3 | 2026-07-27 | A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolset of the file Astr… |
CVE-2026-17529 | Medium | 6.3 | 2026-07-27 | A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The manipulati… |
CVE-2026-16812 | Critical | 10.0 | 2026-07-27 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact t… |
CVE-2026-66477 | Medium | 5.3 | 2026-07-27 | Unauthenticated Broken Access Control in Gillion <= 4.13 versions. |
CVE-2026-66476 | Medium | 4.9 | 2026-07-27 | Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions. |
CVE-2026-66475 | Medium | 5.9 | 2026-07-27 | Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce – Checkout Manager <= 3.0.5 versions. |
CVE-2026-66474 | Medium | 4.3 | 2026-07-27 | Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions. |
CVE-2026-66448 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions. |
CVE-2026-66445 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions. |
CVE-2026-66442 | Medium | 5.4 | 2026-07-27 | Subscriber Broken Access Control in YayPricing <= 3.5.6 versions. |
CVE-2026-66438 | Medium | 5.3 | 2026-07-27 | Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions. |
CVE-2026-66437 | Medium | 4.9 | 2026-07-27 | Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions. |
CVE-2026-66434 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions. |
CVE-2026-66433 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions. |
CVE-2026-66428 | Medium | 4.3 | 2026-07-27 | Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions. |
CVE-2026-66427 | High | 7.6 | 2026-07-27 | Administrator SQL Injection in WP Google Review Slider <= 18.4 versions. |
CVE-2026-66050 | High | 7.5 | 2026-07-27 | NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same netw… |
CVE-2026-65568 | Medium | 5.0 | 2026-07-27 | Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions. |
CVE-2026-65567 | Medium | 5.3 | 2026-07-27 | Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions. |
CVE-2026-65564 | Medium | 5.3 | 2026-07-27 | Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions. |
CVE-2026-65563 | Medium | 5.9 | 2026-07-27 | Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions. |
CVE-2026-65562 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions. |
CVE-2026-65561 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions. |
CVE-2026-65558 | Medium | 5.4 | 2026-07-27 | Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions. |
CVE-2026-65557 | Medium | 5.9 | 2026-07-27 | Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions. |
CVE-2026-65436 | Medium | 6.8 | 2026-07-27 | Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions. |
CVE-2026-65435 | Medium | 6.5 | 2026-07-27 | Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions. |
CVE-2026-65434 | Medium | 6.5 | 2026-07-27 | Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions. |
CVE-2026-65433 | Medium | 6.5 | 2026-07-27 | Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions. |
CVE-2026-59560 | Medium | 6.5 | 2026-07-27 | Subscriber Broken Access Control in FundEngine <= 1.7.8 versions. |
CVE-2026-59559 | Medium | 6.5 | 2026-07-27 | Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions. |
CVE-2026-59558 | High | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 versions. |
CVE-2026-59557 | Medium | 6.5 | 2026-07-27 | Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions. |
CVE-2026-59556 | High | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 versions. |
CVE-2026-59553 | High | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions. |
CVE-2026-59552 | High | 7.2 | 2026-07-27 | Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer & Embedder <= 1.4.2 versions. |
CVE-2026-59551 | High | 8.5 | 2026-07-27 | Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions. |
CVE-2026-59550 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions. |
CVE-2026-59549 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions. |
CVE-2026-59548 | High | 7.5 | 2026-07-27 | Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking <= 1.0.0 versions. |
CVE-2026-59546 | High | 7.4 | 2026-07-27 | Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions. |
CVE-2026-59539 | High | 7.5 | 2026-07-27 | Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions. |
CVE-2026-59538 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions. |
CVE-2026-59537 | High | 7.6 | 2026-07-27 | Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions. |
CVE-2026-59536 | High | 7.5 | 2026-07-27 | Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions. |
CVE-2026-59535 | High | 7.3 | 2026-07-27 | Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions. |
CVE-2026-59534 | High | 7.5 | 2026-07-27 | Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions. |
CVE-2026-59533 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions. |
CVE-2026-59532 | High | 7.5 | 2026-07-27 | Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions. |
CVE-2026-59531 | High | 7.5 | 2026-07-27 | Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks <= 2.10.0 versions. |
CVE-2026-59530 | High | 7.5 | 2026-07-27 | Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions. |
CVE-2026-59529 | High | 7.5 | 2026-07-27 | Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions. |
CVE-2026-59528 | High | 7.5 | 2026-07-27 | Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions. |
CVE-2026-59527 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. |
CVE-2026-10819 | Medium | 6.5 | 2026-07-27 | Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, 11.7.x <= 11.7.4 fail to limit the number of frames and enforce the file size cap… |
CVE-2026-10600 | Medium | 4.3 | 2026-07-27 | Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side do… |
CVE-2026-65879 | Critical | 9.8 | 2026-07-27 | Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed att… |
CVE-2026-65878 | | 2026-07-27 | Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- Improper path validation and ACL checks lead to a file dele… | |
CVE-2026-65877 | | 2026-07-27 | Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager se… | |
CVE-2026-65876 | | 2026-07-27 | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper validation of catid parameters in the loadMoreArticles… | |
CVE-2026-65766 | | 2026-07-27 | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of order parameters in the Dynamic Content… | |
CVE-2026-61511 | Critical | 9.8 | 2026-07-27 | vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template r… |
CVE-2026-17514 | Medium | 5.3 | 2026-07-27 | A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This… |
CVE-2026-17513 | Low | 3.3 | 2026-07-27 | A vulnerability was found in ggml-org whisper.cpp 95ea8f9b. Affected is the function ggml_ftype_to_ggml_type of the file ggml/src/ggml.c. The manipulation of t… |
CVE-2026-15003 | Medium | 5.6 | 2026-07-27 | A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a s… |
CVE-2026-59690 | High | 8.0 | 2026-07-27 | A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant al… |
CVE-2026-59689 | High | 8.0 | 2026-07-27 | An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an aut… |
CVE-2026-59688 | High | 8.4 | 2026-07-27 | An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authen… |
CVE-2026-59687 | High | 8.4 | 2026-07-27 | An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authen… |
CVE-2026-59686 | High | 8.4 | 2026-07-27 | An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authen… |
CVE-2026-56538 | Low | 3.5 | 2026-07-27 | An endpoint in HCL Connections is vulnerable to information disclosure. In certain scenarios this might lead to disclosing sensitive information to unauthorize… |
CVE-2026-56537 | Low | 3.5 | 2026-07-27 | HCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper h… |
CVE-2026-17512 | Low | 3.3 | 2026-07-27 | A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function log_mel_spectrogram of the file src/whisper.cpp. The manipulation le… |
CVE-2026-12991 | | 2026-07-27 | The lack of cryptographic mechanisms to ensure the integrity and authenticity of communications in Ghost Robotics' Vision 60 robot (APK v5.5.0) exposes the sys… | |
CVE-2026-12990 | | 2026-07-27 | An access control vulnerability in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to run without proper… | |
CVE-2026-12989 | | 2026-07-27 | A lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's intern… | |
CVE-2026-66053 | Medium | 5.9 | 2026-07-27 | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users… |
CVE-2026-58662 | Critical | 9.1 | 2026-07-27 | Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0… |
CVE-2026-58389 | High | 7.5 | 2026-07-27 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are… |
CVE-2026-58023 | Critical | 9.1 | 2026-07-27 | Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to versi… |
CVE-2026-57917 | | 2026-07-27 | proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing the reading of local files, dep… | |
CVE-2026-57916 | | 2026-07-27 | proCertum SmartSign opens Certificate Practice Statement (CPS) URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointi… | |
CVE-2026-55971 | Critical | 9.8 | 2026-07-27 | Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to… |
CVE-2026-55970 | Medium | 6.5 | 2026-07-27 | Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0… |
CVE-2026-55969 | High | 7.5 | 2026-07-27 | Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24… |
CVE-2026-55968 | High | 7.5 | 2026-07-27 | Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects A… |
CVE-2026-49158 | High | 7.5 | 2026-07-27 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0… |
CVE-2026-48586 | High | 7.5 | 2026-07-27 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects… |
CVE-2026-48145 | High | 7.5 | 2026-07-27 | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are… |
CVE-2026-48144 | Critical | 9.1 | 2026-07-27 | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users… |
CVE-2026-45112 | High | 7.5 | 2026-07-27 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0… |
CVE-2026-43871 | High | 7.5 | 2026-07-27 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: befor… |
CVE-2026-41608 | High | 7.5 | 2026-07-27 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24… |
CVE-2026-14856 | | 2026-07-27 | A stored Cross-Site Scripting (XSS) vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validati… |