2026 CVEs (page 366)
Page 366 of 448 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-4568 | Medium | 6.3 | 2026-03-23 | A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown function of the file /update_supplier.php of the component… |
CVE-2026-4567 | Critical | 9.8 | 2026-03-23 | A vulnerability has been found in Tenda A15 15.13.07.13. The impacted element is the function UploadCfg of the file /cgi-bin/UploadCfg. The manipulation of the… |
CVE-2026-4566 | High | 8.8 | 2026-03-23 | A flaw has been found in Belkin F9K1122 1.00.33. The affected element is the function formWISP5G of the file /goform/formWISP5G. Executing a manipulation of th… |
CVE-2026-4606 | | 2026-03-23 | GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the… | |
CVE-2026-4565 | High | 8.8 | 2026-03-23 | A vulnerability was detected in Tenda AC21 16.03.08.16. Impacted is the function formSetQosBand of the file /goform/SetNetControlList. Performing a manipulatio… |
CVE-2026-4564 | Medium | 4.7 | 2026-03-23 | A security vulnerability has been detected in yangzongzhuan RuoYi up to 4.8.2. This issue affects some unknown processing of the file /monitor/job/ of the comp… |
CVE-2026-4563 | Medium | 4.3 | 2026-03-23 | A weakness has been identified in MacCMS up to 2025.1000.4052. This vulnerability affects the function order_info of the file application/index/controller/User… |
CVE-2026-4562 | High | 7.3 | 2026-03-23 | A security flaw has been discovered in MacCMS 2025.1000.4052. This affects an unknown part of the file application/api/controller/Timming.php of the component… |
CVE-2026-2580 | High | 7.5 | 2026-03-23 | The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to time-based SQL Injection via the… |
CVE-2026-4558 | High | 8.8 | 2026-03-22 | A flaw has been found in Linksys MR9600 2.0.6.206937. Affected is the function smartConnectConfigure of the file SmartConnect.lua. Executing a manipulation of… |
CVE-2026-4557 | Medium | 4.3 | 2026-03-22 | A vulnerability was detected in code-projects Exam Form Submission 1.0. This impacts an unknown function of the file /admin/update_s1.php. Performing a manipul… |
CVE-2026-4555 | High | 8.8 | 2026-03-22 | A weakness has been identified in D-Link DIR-513 1.10. The impacted element is the function formEasySetTimezone of the file /goform/formEasySetTimezone of the… |
CVE-2026-4554 | Medium | 6.3 | 2026-03-22 | A security flaw has been discovered in Tenda F453 1.0.0.3. The affected element is the function FormWriteFacMac of the file /goform/WriteFacMac. The manipulati… |
CVE-2026-33319 | Medium | 5.9 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, the `uploadVideoToLinkedIn()` method in the SocialMediaPublisher plugin constructs a shell… |
CVE-2026-33296 | Medium | 6.1 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains an open redirect vulnerability in the login flow where a user-supplie… |
CVE-2026-33295 | Medium | 5.4 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's downl… |
CVE-2026-33294 | Medium | 5.0 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (`plugin/BulkEmbed/save.json.php`) fetches user-suppl… |
CVE-2026-33293 | High | 8.1 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, the `deleteDump` parameter in `plugin/CloneSite/cloneServer.json.php` is passed directly t… |
CVE-2026-33292 | High | 7.5 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, the HLS streaming endpoint (`view/hls.php`) is vulnerable to a path traversal attack that… |
CVE-2026-4553 | High | 8.8 | 2026-03-22 | A vulnerability was identified in Tenda F453 1.0.0.3. Impacted is the function fromNatlimit of the file /goform/Natlimit of the component Parameters Handler. T… |
CVE-2026-4552 | High | 8.8 | 2026-03-22 | A vulnerability was determined in Tenda F453 1.0.0.3. This issue affects the function fromVirtualSer of the file /goform/VirtualSer of the component Parameters… |
CVE-2026-4551 | High | 8.8 | 2026-03-22 | A vulnerability was found in Tenda F453 1.0.0.3. This vulnerability affects the function fromSafeClientFilter of the file /goform/SafeClientFilter of the compo… |
CVE-2026-4550 | Medium | 4.7 | 2026-03-22 | A vulnerability has been found in code-projects Simple Gym Management System up to 1.0. This affects an unknown part of the file /gym/func.php. Such manipulati… |
CVE-2026-4549 | Low | 3.1 | 2026-03-22 | A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-p… |
CVE-2026-4548 | Medium | 6.3 | 2026-03-22 | A vulnerability was detected in mickasmt next-saas-stripe-starter 1.0.0. Affected by this vulnerability is the function updateUserrole of the file actions/upda… |
CVE-2026-4547 | Medium | 4.3 | 2026-03-22 | A security vulnerability has been detected in mickasmt next-saas-stripe-starter 1.0.0. Affected is the function generateUserStripe of the file actions/generate… |
CVE-2026-4546 | High | 7.0 | 2026-03-22 | A weakness has been identified in Flos Freeware Notepad2 4.2.25. This impacts an unknown function in the library TextShaping.dll. Executing a manipulation can… |
CVE-2026-4115 | Low | 3.7 | 2026-03-22 | A vulnerability was detected in PuTTY 0.83. Affected is the function eddsa_verify of the file crypto/ecc-ssh.c of the component Ed25519 Signature Handler. The… |
CVE-2026-4545 | High | 7.0 | 2026-03-22 | A security flaw has been discovered in Flos Freeware Notepad2 4.2.25. This affects an unknown function in the library PROPSYS.dll. Performing a manipulation re… |
CVE-2026-4544 | Low | 2.4 | 2026-03-22 | A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects an unknown function of the file /cgi-bin/login.cgi of the component POST Request Hand… |
CVE-2026-4543 | Medium | 6.3 | 2026-03-22 | A vulnerability was found in Wavlink WL-WN578W2 221110. The impacted element is an unknown function of the file /cgi-bin/firewall.cgi of the component POST Req… |
CVE-2026-4542 | Medium | 5.4 | 2026-03-22 | A vulnerability has been found in SSCMS 4.7.0. The affected element is an unknown function of the file LayerImageController.Submit.cs of the component layerIma… |
CVE-2026-4541 | Low | 2.5 | 2026-03-22 | A flaw has been found in janmojzis tinyssh up to 20250501. Impacted is an unknown function of the file tinyssh/crypto_sign_ed25519_tinyssh.c of the component E… |
CVE-2026-4540 | High | 7.3 | 2026-03-22 | A vulnerability was detected in projectworlds Online Notes Sharing System 1.0. This issue affects some unknown processing of the file /login.php of the compone… |
CVE-2026-4539 | Low | 3.3 | 2026-03-22 | A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manip… |
CVE-2026-4538 | Medium | 5.3 | 2026-03-22 | A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to d… |
CVE-2026-4537 | Medium | 4.7 | 2026-03-22 | A vulnerability was determined in Cudy TR1200 R46-2.4.15-20250721-164017. Impacted is the function action_ipsec_conn of the file /usr/bin/lib/lua/luci/controll… |
CVE-2026-4536 | High | 7.3 | 2026-03-22 | A vulnerability was found in Acrel Environmental Monitoring Cloud Platform 1.1.0. This issue affects some unknown processing. Performing a manipulation results… |
CVE-2026-4535 | High | 8.8 | 2026-03-22 | A vulnerability has been found in Tenda FH451 1.0.0.9. This vulnerability affects the function WrlclientSet of the file /goform/WrlclientSet. Such manipulation… |
CVE-2026-4534 | High | 8.8 | 2026-03-22 | A flaw has been found in Tenda FH451 1.0.0.9. This affects the function formWrlExtraSet of the file /goform/WrlExtraSet. This manipulation of the argument GO c… |
CVE-2026-4314 | High | 8.8 | 2026-03-22 | The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This… |
CVE-2026-3427 | Medium | 6.4 | 2026-03-22 | The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the `jsonText` b… |
CVE-2026-4533 | Medium | 6.3 | 2026-03-22 | A vulnerability was detected in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file all-tickets.php… |
CVE-2026-33550 | Low | 2.0 | 2026-03-22 | SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended). |
CVE-2026-33549 | Medium | 6.7 | 2026-03-22 | SPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended privilege assignment (of administrator privileges) during the editing of an author data structure be… |
CVE-2026-4532 | Medium | 5.3 | 2026-03-22 | A security vulnerability has been detected in code-projects Simple Food Ordering System up to 1.0. Affected by this vulnerability is an unknown functionality o… |
CVE-2026-4531 | Medium | 5.3 | 2026-03-22 | A weakness has been identified in Free5GC 4.1.0. Affected is the function HandleRegistrationComplete of the file internal/gmm/handler.go of the component AMF… |
CVE-2026-4530 | Medium | 5.3 | 2026-03-22 | A security flaw has been discovered in apconw Aix-DB up to 1.2.3. This impacts an unknown function of the file agent/text2sql/rag/terminology_retriever.py. Per… |
CVE-2026-4529 | High | 8.8 | 2026-03-21 | A vulnerability was identified in D-Link DHP-1320 1.00WWB04. This affects the function redirect_count_down_page of the component SOAP Handler. Such manipulatio… |
CVE-2026-3629 | High | 8.1 | 2026-03-21 | The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7. This is due… |
CVE-2026-4528 | High | 7.3 | 2026-03-21 | A vulnerability was determined in trueleaf ApiFlow 0.9.7. The impacted element is the function validateUrlSecurity of the file packages/server/src/service/prox… |
CVE-2026-2756 | Medium | 5.0 | 2026-03-21 | A security vulnerability has been detected in OmniPEMF NeoRhythm up to 20260308. This affects an unknown function of the component BLE Interface. Such manipula… |
CVE-2026-4516 | Medium | 6.3 | 2026-03-21 | A vulnerability was found in Foundation Agents MetaGPT up to 0.8.1. This vulnerability affects unknown code of the file metagpt/actions/di/write_analysis_code… |
CVE-2026-4515 | Medium | 6.3 | 2026-03-21 | A vulnerability has been found in Foundation Agents MetaGPT up to 0.8.1. This affects the function code_generate of the file metagpt/ext/aflow/scripts/operator… |
CVE-2026-4514 | Medium | 6.3 | 2026-03-21 | A flaw has been found in PbootCMS up to 3.2.12. Affected by this issue is some unknown functionality of the file apps/admin/controller/system/UserController.ph… |
CVE-2026-4513 | Medium | 6.3 | 2026-03-21 | A vulnerability was detected in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is the function ask of the file vanna\legacy\base\base.py. Performin… |
CVE-2026-4511 | Medium | 6.3 | 2026-03-21 | A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. Affected is the function exec of the file /src/vanna/legacy. Such manipulation leads… |
CVE-2026-4510 | Medium | 4.3 | 2026-03-21 | A weakness has been identified in PbootCMS up to 3.2.12. This impacts the function alert_location of the file apps/home/controller/MemberController.php of the… |
CVE-2026-4373 | High | 7.5 | 2026-03-21 | The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to t… |
CVE-2026-4509 | Medium | 6.3 | 2026-03-21 | A security flaw has been discovered in PbootCMS up to 3.2.12. This affects an unknown function of the file core/function/file.php of the component File Upload… |
CVE-2026-4261 | High | 8.8 | 2026-03-21 | The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.2. This is due to the plugin allowing a u… |
CVE-2026-4161 | Medium | 4.4 | 2026-03-21 | The Review Map by RevuKangaroo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including… |
CVE-2026-4143 | Medium | 4.3 | 2026-03-21 | The Neos Connector for Fakturama plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.0.14. This is due to mi… |
CVE-2026-4127 | Medium | 4.3 | 2026-03-21 | The Speedup Optimization plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.5.9. The `speedup01_ajax_enabled()`… |
CVE-2026-4087 | Medium | 6.5 | 2026-03-21 | The Pre* Party Resource Hints plugin for WordPress is vulnerable to SQL Injection via the 'hint_ids' parameter of the pprh_update_hints AJAX action in all vers… |
CVE-2026-4086 | Medium | 6.4 | 2026-03-21 | The WP Random Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cat', 'nocat', and 'text' shortcode attributes of the 'wp_rando… |
CVE-2026-4084 | Medium | 6.4 | 2026-03-21 | The fyyd podcast shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fyyd-podcast', 'fyyd-episode', and 'fyyd' shortcodes in… |
CVE-2026-4077 | Medium | 6.4 | 2026-03-21 | The Ecover Builder For Dummies plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'ecover' shortcode in all versio… |
CVE-2026-4072 | Medium | 6.4 | 2026-03-21 | The WordPress PayPal Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'donate' shortcode in all versions up to, and including… |
CVE-2026-4069 | Medium | 6.1 | 2026-03-21 | The Alfie – Feed Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'naam' parameter in all versions up to, and including, 1.2.1… |
CVE-2026-4067 | Medium | 6.4 | 2026-03-21 | The Ad Short plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ad' shortcode's 'client' attribute in all versions up to and including… |
CVE-2026-4022 | Medium | 6.4 | 2026-03-21 | The Show Posts list – Easy designs, filters and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_type' shortcode attribute… |
CVE-2026-4004 | Medium | 6.5 | 2026-03-21 | The Task Manager plugin for WordPress is vulnerable to arbitrary shortcode execution via the 'search' AJAX action in all versions up to, and including, 3.0.2… |
CVE-2026-3997 | Medium | 6.4 | 2026-03-21 | The Text Toggle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute of the [tt_part] and [tt] shortcodes in a… |
CVE-2026-3996 | Medium | 6.4 | 2026-03-21 | The WP Games Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [game] shortcode in all versions up to and including 0.1beta. This… |
CVE-2026-3651 | Medium | 5.3 | 2026-03-21 | The Build App Online plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.23. This is due to the plugin register… |
CVE-2026-3645 | Medium | 5.3 | 2026-03-21 | The Punnel – Landing Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.1. The save_config() fu… |
CVE-2026-3641 | Medium | 5.3 | 2026-03-21 | The Appmax plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.0.3. This is due to the plugin registering a… |
CVE-2026-3619 | Medium | 6.4 | 2026-03-21 | The Sheets2Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titles' shortcode attribute in the [sheets2table-render-table] shor… |
CVE-2026-3617 | Medium | 6.4 | 2026-03-21 | The Paypal Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'amount' and 'name' shortcode attributes in all versions up to… |
CVE-2026-3570 | Medium | 5.3 | 2026-03-21 | The Smarter Analytics plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0. This is due to missing authenticatio… |
CVE-2026-3554 | Medium | 6.4 | 2026-03-21 | The Sherk Custom Post Type Displays plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute in all versions up to… |
CVE-2026-3546 | Medium | 5.3 | 2026-03-21 | The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.2. The eshot_form_builde… |
CVE-2026-3506 | Medium | 5.3 | 2026-03-21 | The WP-Chatbot for Messenger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9. This is due to the plugin no… |
CVE-2026-3478 | High | 7.2 | 2026-03-21 | The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3 via the redux_p AJA… |
CVE-2026-3460 | Medium | 5.3 | 2026-03-21 | The REST API TO MiniProgram plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.2. This is due to… |
CVE-2026-3354 | Medium | 4.4 | 2026-03-21 | The Wikilookup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Popup Width' setting in all versions up to, and including, 1.1.5. Thi… |
CVE-2026-3353 | Medium | 4.4 | 2026-03-21 | The Comment SPAM Wiper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'API Key' setting in all versions up to, and including, 1.2.1… |
CVE-2026-3347 | Medium | 5.5 | 2026-03-21 | The Multi Functional Flexi Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `arv_lb[message]` parameter in all versions up to… |
CVE-2026-3335 | Medium | 5.3 | 2026-03-21 | The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1 via the `/wp-content/plugins/canto/includes/l… |
CVE-2026-3334 | High | 8.8 | 2026-03-21 | The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname', 'or_blogdescription', and 'or_admin_email' parameters in all versi… |
CVE-2026-3333 | Medium | 6.4 | 2026-03-21 | The MinhNhut Link Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linkgate' shortcode in all versions up to, and in… |
CVE-2026-3332 | Medium | 4.3 | 2026-03-21 | The Xhanch - My Advanced Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to… |
CVE-2026-3331 | Medium | 4.3 | 2026-03-21 | The Lobot Slider Administrator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.0. This is due to missing… |
CVE-2026-3003 | High | 7.2 | 2026-03-21 | The Vagaro Booking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vagaro_code’ parameter in all versions up to, and includin… |
CVE-2026-2941 | High | 8.8 | 2026-03-21 | The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy_search_a… |
CVE-2026-2837 | Medium | 4.4 | 2026-03-21 | The Ricerca – advanced search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings in all versions up to, and including, 1.1… |
CVE-2026-2723 | Medium | 6.1 | 2026-03-21 | The Post Snippits plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce vali… |
CVE-2026-2720 | Medium | 6.5 | 2026-03-21 | The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the `hrp-fetch-empl… |
CVE-2026-2503 | Medium | 6.5 | 2026-03-21 | The ElementCamp plugin for WordPress is vulnerable to time-based SQL Injection via the 'meta_query[compare]' parameter in the 'tcg_select2_search_post' AJAX ac… |