2026 CVEs (page 329)
Page 329 of 689 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57717 | Medium | 6.5 | 2026-07-23 | Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions. |
CVE-2026-57716 | Medium | 5.3 | 2026-07-23 | Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions. |
CVE-2026-57704 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions. |
CVE-2026-57703 | Medium | 6.3 | 2026-07-23 | Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions. |
CVE-2026-57701 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions. |
CVE-2026-57699 | High | 7.1 | 2026-07-23 | Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions. |
CVE-2026-57696 | High | 7.1 | 2026-07-23 | Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions. |
CVE-2026-57626 | High | 7.1 | 2026-07-23 | Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 through 5.33.0. |
CVE-2026-57428 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions. |
CVE-2026-57427 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions. |
CVE-2026-57425 | Medium | 6.5 | 2026-07-23 | Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions. |
CVE-2026-57397 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions. |
CVE-2026-57384 | Medium | 6.5 | 2026-07-23 | Subscriber Cross Site Scripting (XSS) in WishList Member X <= 3.32.0 versions. |
CVE-2026-57374 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.7 versions. |
CVE-2026-57373 | Medium | 6.5 | 2026-07-23 | Customer Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.4 versions. |
CVE-2026-57370 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions. |
CVE-2026-57367 | High | 7.1 | 2026-07-23 | Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions. |
CVE-2026-27423 | Medium | 4.3 | 2026-07-23 | Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions. |
CVE-2026-27422 | Medium | 5.3 | 2026-07-23 | Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-27418 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions. |
CVE-2026-27403 | Medium | 6.5 | 2026-07-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affe… |
CVE-2026-27399 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions. |
CVE-2026-27392 | Medium | 4.3 | 2026-07-23 | Contributor Broken Access Control in uListing <= 2.2.0 versions. |
CVE-2026-27391 | Medium | 5.4 | 2026-07-23 | Subscriber Broken Access Control in uListing <= 2.2.0 versions. |
CVE-2026-27377 | Medium | 6.7 | 2026-07-23 | Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions. |
CVE-2026-27372 | Medium | 6.5 | 2026-07-23 | Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions. |
CVE-2026-27355 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions. |
CVE-2026-27064 | Critical | 9.1 | 2026-07-23 | Editor Arbitrary File Upload in Mailster <= 4.1.17 versions. |
CVE-2026-25466 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions. |
CVE-2026-25427 | Medium | 5.4 | 2026-07-23 | Subscriber Broken Access Control in eRoom <= 1.7.1 versions. |
CVE-2026-25424 | Medium | 4.3 | 2026-07-23 | Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions. |
CVE-2026-25405 | High | 8.5 | 2026-07-23 | Contributor SQL Injection in eRoom <= 1.7.1 versions. |
CVE-2026-24639 | Medium | 4.4 | 2026-07-23 | Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions. |
CVE-2026-24628 | Medium | 5.9 | 2026-07-23 | Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions. |
CVE-2026-24552 | High | 8.5 | 2026-07-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael L'Allier Create mediavine-create allows Blin… |
CVE-2026-24537 | Medium | 4.3 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions. |
CVE-2026-64611 | High | 7.5 | 2026-07-23 | A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device I… |
CVE-2026-16745 | High | 8.8 | 2026-07-23 | A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cl… |
CVE-2026-65758 | | 2026-07-23 | Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control… | |
CVE-2026-65757 | High | 8.1 | 2026-07-23 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted… |
CVE-2026-65756 | Medium | 6.1 | 2026-07-23 | Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript. |
CVE-2026-65755 | High | 7.5 | 2026-07-23 | Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did… |
CVE-2026-65754 | High | 7.5 | 2026-07-23 | Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site direct… |
CVE-2026-65713 | Medium | 6.5 | 2026-07-23 | Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories. |
CVE-2026-65712 | Medium | 6.2 | 2026-07-23 | Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory… |
CVE-2026-65431 | Critical | 9.8 | 2026-07-23 | Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading… |
CVE-2026-65430 | High | 7.5 | 2026-07-23 | Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where leaked in request URLs, causing a credential lea… |
CVE-2026-64876 | High | 8.8 | 2026-07-23 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token a… |
CVE-2026-64875 | Medium | 6.5 | 2026-07-23 | Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forwarded client-IP headers, this could cau… |
CVE-2026-64874 | Critical | 9.8 | 2026-07-23 | Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs. |
CVE-2026-64873 | Critical | 9.8 | 2026-07-23 | Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services. |
CVE-2026-64872 | Medium | 6.5 | 2026-07-23 | Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory. |
CVE-2026-64871 | Medium | 5.4 | 2026-07-23 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistent… |
CVE-2026-64799 | High | 7.5 | 2026-07-23 | Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could r… |
CVE-2026-16078 | Medium | 6.5 | 2026-07-23 | The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 vi… |
CVE-2026-15906 | Medium | 6.5 | 2026-07-23 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions u… |
CVE-2026-15827 | Medium | 5.3 | 2026-07-23 | The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/g… |
CVE-2026-15794 | Medium | 6.4 | 2026-07-23 | The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to… |
CVE-2026-15786 | Medium | 4.4 | 2026-07-23 | The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all… |
CVE-2026-15761 | Medium | 6.5 | 2026-07-23 | The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up t… |
CVE-2026-15647 | Medium | 4.4 | 2026-07-23 | The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field in all versions up to, and… |
CVE-2026-15646 | Medium | 6.4 | 2026-07-23 | The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and includi… |
CVE-2026-15448 | Medium | 6.5 | 2026-07-23 | The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_order_status_filter' parameter in all versio… |
CVE-2026-15404 | Medium | 6.4 | 2026-07-23 | The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insuffici… |
CVE-2026-15394 | Medium | 6.4 | 2026-07-23 | The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asm_code' Snippet… |
CVE-2026-15348 | Medium | 6.3 | 2026-07-23 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 v… |
CVE-2026-15017 | High | 8.8 | 2026-07-23 | The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capa… |
CVE-2026-15015 | Critical | 9.8 | 2026-07-23 | The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due… |
CVE-2026-15011 | Critical | 9.8 | 2026-07-23 | The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and includin… |
CVE-2026-14481 | Medium | 6.4 | 2026-07-23 | The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… |
CVE-2026-14282 | Critical | 9.8 | 2026-07-23 | The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary fi… |
CVE-2026-13119 | Medium | 6.5 | 2026-07-23 | The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtec_rec… |
CVE-2026-13009 | Medium | 6.5 | 2026-07-23 | The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and includi… |
CVE-2026-52688 | High | 7.5 | 2026-07-23 | RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation |
CVE-2026-52686 | Low | 3.7 | 2026-07-23 | The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer… |
CVE-2026-52684 | Low | 3.7 | 2026-07-23 | If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resol… |
CVE-2026-16723 | Critical | 9.0 | 2026-07-23 | A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configur… |
CVE-2026-16287 | High | 7.8 | 2026-07-23 | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Insti… |
CVE-2026-9729 | Medium | 6.4 | 2026-07-23 | The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'webpushr_notification_title' and 'webpushr_notificat… |
CVE-2026-9713 | High | 7.5 | 2026-07-23 | The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON f… |
CVE-2026-9635 | Medium | 6.4 | 2026-07-23 | The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the [tab] shortcode in versions… |
CVE-2026-59678 | | 2026-07-23 | An Incorrect Authorization vulnerability in Linux-Gaming PortProtonQt allows any users to mount and unmount arbitrary file systems and modify the network confi… | |
CVE-2026-59677 | | 2026-07-23 | A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned process… | |
CVE-2026-12421 | High | 7.2 | 2026-07-23 | The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to in… |
CVE-2026-9577 | Medium | 4.8 | 2026-07-23 | The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page… |
CVE-2026-9066 | Medium | 6.1 | 2026-07-23 | The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the… |
CVE-2026-59676 | | 2026-07-23 | A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in th… | |
CVE-2026-14291 | High | 7.5 | 2026-07-23 | The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, a… |
CVE-2026-12082 | High | 7.5 | 2026-07-23 | The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to mod… |
CVE-2026-7534 | High | 7.2 | 2026-07-23 | The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint `/wp-json/wc-srp/v1/earning`… |
CVE-2026-7232 | High | 7.2 | 2026-07-23 | The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up to, and including, 3.9… |
CVE-2026-64600 | High | 7.8 | 2026-07-23 | In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delall… |
CVE-2026-63226 | Medium | 5.8 | 2026-07-23 | Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitra… |
CVE-2026-6390 | Medium | 6.8 | 2026-07-23 | A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specia… |
CVE-2026-7120 | Medium | 5.3 | 2026-07-23 | @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Vers… |
CVE-2026-15074 | High | 7.5 | 2026-07-23 | @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypas… |
CVE-2026-21723 | Medium | 5.3 | 2026-07-23 | The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing t… |
CVE-2026-16653 | Medium | 5.3 | 2026-07-23 | A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function http_sendfile2 of the file lib/facil/http/http.c of the compo… |
CVE-2026-16632 | High | 7.3 | 2026-07-23 | A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library lib/facil/http/parsers/websocket_p… |
CVE-2026-16631 | Medium | 5.3 | 2026-07-23 | A vulnerability was detected in publint up to 0.1.4. This impacts the function child_process.exec of the file src/node/pack.js of the component package-manager… |