2026 CVEs (page 370)
Page 370 of 687 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-61462 | High | 8.6 | 2026-07-13 | mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that allows attackers to redirect GitLab API requests to arbitrary… |
CVE-2026-60103 | Medium | 6.1 | 2026-07-13 | Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or read adjacent heap memory by supplying a c… |
CVE-2026-53365 | Medium | 5.5 | 2026-07-13 | In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb sends When a large message is fragmen… |
CVE-2026-53364 | Medium | 5.5 | 2026-07-13 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() hci_le_big_terminate() all… |
CVE-2026-57433 | Critical | 9.8 | 2026-07-13 | Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit… |
CVE-2026-57432 | High | 8.4 | 2026-07-13 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bo… |
CVE-2026-13221 | Critical | 9.1 | 2026-07-13 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an altern… |
CVE-2026-59245 | High | 8.1 | 2026-07-13 | In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`… |
CVE-2026-58065 | High | 8.1 | 2026-07-13 | The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification. An attacker w… |
CVE-2026-6847 | | 2026-07-13 | Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. The application exposes an endp… | |
CVE-2026-61498 | Critical | 9.8 | 2026-07-13 | Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint that allows remote unauthenticat… |
CVE-2026-60121 | Critical | 9.8 | 2026-07-13 | Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execut… |
CVE-2026-40553 | High | 7.5 | 2026-07-13 | Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() routine). This issue could be used to crash the program and… |
CVE-2026-40469 | Critical | 9.1 | 2026-07-13 | Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata… |
CVE-2026-40468 | Critical | 9.1 | 2026-07-13 | Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and… |
CVE-2026-40467 | High | 7.5 | 2026-07-13 | Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in ver… |
CVE-2026-15584 | High | 7.5 | 2026-07-13 | A privilege escalation vulnerability was found in the incluster-checks tool for OpenShift. The tool creates privileged debug pods with host filesystem access i… |
CVE-2026-15559 | Medium | 6.3 | 2026-07-13 | A vulnerability was detected in CodeAstro Simple Online Leave Management System 1.0. This affects an unknown part of the file /SimpleOnlineLeave/admin/accept.p… |
CVE-2026-62147 | Medium | 6.5 | 2026-07-13 | The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, al… |
CVE-2026-15558 | Medium | 6.3 | 2026-07-13 | A security vulnerability has been detected in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the… |
CVE-2026-12257 | | 2026-07-13 | Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/index.cfm/_api/json/… | |
CVE-2026-9824 | Medium | 4.3 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to check the manage_shared_channels permission in the /share-channel autocompl… |
CVE-2026-9820 | Low | 3.8 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams endpoint, which allows a user with the Use… |
CVE-2026-6541 | Medium | 4.3 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which al… |
CVE-2026-4765 | | 2026-07-13 | Self Cross-Site Scripting (Self-XSS) vulnerability in the RD Station Conversas chat feature. The vulnerability lies in the ‘name’ parameter of the initialisati… | |
CVE-2026-14934 | | 2026-07-13 | A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between… | |
CVE-2026-61985 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-61983 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-61977 | Medium | 5.3 | 2026-07-13 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-search allows Retrieve Embedded Sensitive… |
CVE-2026-61976 | Medium | 5.3 | 2026-07-13 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embed… |
CVE-2026-61975 | Medium | 5.3 | 2026-07-13 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetReviews jet-reviews allows Retrieve Embedded Sensitiv… |
CVE-2026-61971 | Low | 2.7 | 2026-07-13 | Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Config… |
CVE-2026-61970 | Medium | 4.9 | 2026-07-13 | Server-Side Request Forgery (SSRF) vulnerability in Themeisle Auto Featured Image (Auto Post Thumbnail) auto-post-thumbnail allows Server Side Request Forgery… |
CVE-2026-61968 | Medium | 5.4 | 2026-07-13 | Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCr… |
CVE-2026-61958 | Medium | 5.4 | 2026-07-13 | Missing Authorization vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Exploiting Incorrectly Configured Acce… |
CVE-2026-61956 | High | 7.1 | 2026-07-13 | Cross-Site Request Forgery (CSRF) vulnerability in hamsalam ووسلام – همگام سازی ووکامرس و باسلام sync-basalam allows Cross Site Request Forgery.This issu… |
CVE-2026-61955 | High | 7.6 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hannan گرویتی فرم فارسی persian-gravity-forms allows Blin… |
CVE-2026-61952 | Medium | 4.9 | 2026-07-13 | Missing Authorization vulnerability in Jose Vega WooCommerce Bulk Edit Products – WP Sheet Editor woo-bulk-edit-products allows Exploiting Incorrectly Configur… |
CVE-2026-59523 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Contr… |
CVE-2026-59521 | High | 7.2 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimon… |
CVE-2026-59518 | Critical | 9.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through <= 8… |
CVE-2026-59516 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Room 34 Creative Services, LLC ICS Calendar ics-calendar… |
CVE-2026-59515 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL… |
CVE-2026-57816 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Funnel Builder by FunnelKit funnel-builder allo… |
CVE-2026-57815 | High | 7.5 | 2026-07-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator formin… |
CVE-2026-57814 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator… |
CVE-2026-57813 | Critical | 9.8 | 2026-07-13 | Incorrect Privilege Assignment vulnerability in properfraction MailOptin mailoptin allows Privilege Escalation.This issue affects MailOptin: from n/a through <… |
CVE-2026-57812 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Contr… |
CVE-2026-57811 | Critical | 10.0 | 2026-07-13 | Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Remote… |
CVE-2026-57810 | High | 8.5 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare al… |
CVE-2026-57805 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Tonda tonda allows PHP L… |
CVE-2026-57804 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for… |
CVE-2026-57803 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur Core allows PHP… |
CVE-2026-57802 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur allows PHP Loca… |
CVE-2026-57801 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes SetSail setsail allows P… |
CVE-2026-57800 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows… |
CVE-2026-57799 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Nuss nuss allows PHP Local File… |
CVE-2026-57798 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SaurabhSharma NewsPlus Shortcodes news… |
CVE-2026-57797 | Medium | 4.3 | 2026-07-13 | Missing Authorization vulnerability in ThemeMove EduMall edumall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Edu… |
CVE-2026-57796 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VLThemes Leedo leedo allows PHP Local… |
CVE-2026-57795 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Kitchor kitchor allows PHP… |
CVE-2026-57794 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo Framework golo-framework al… |
CVE-2026-57793 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Flow flow allows PHP Loc… |
CVE-2026-57792 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local… |
CVE-2026-57791 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local… |
CVE-2026-57790 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Loc… |
CVE-2026-57789 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Aqua aqua allows PHP Local F… |
CVE-2026-57788 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Aalto aalto allows PHP Loc… |
CVE-2026-57787 | High | 8.5 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeWS CWS SVGicons cws-svgicons allows Blind SQL Inj… |
CVE-2026-57786 | High | 8.8 | 2026-07-13 | Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows Authentication Bypass.This issue affects WorkScout-Core: fro… |
CVE-2026-57783 | Medium | 6.5 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in merkulove Speaker speaker allows Stored XSS.This issue af… |
CVE-2026-57782 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in PressTigers Universal Clocks universal-clocks allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-57781 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in Sovlix MeetingHub meetinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-57780 | Medium | 6.5 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Envision Envision Page Builder envision-page-build… |
CVE-2026-57779 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in themebeez Fascinate fascinate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-57778 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access C… |
CVE-2026-57776 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2026-57774 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in vowelweb VW Food Corner vw-food-corner allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2026-57773 | High | 7.6 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zorem Advanced Shipment Tracking for WooCommerce woo-adva… |
CVE-2026-57772 | High | 8.5 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager al… |
CVE-2026-57771 | High | 8.5 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Rating System gd-rating-system allows B… |
CVE-2026-57770 | Critical | 9.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography… |
CVE-2026-57768 | High | 8.2 | 2026-07-13 | Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register houzez-login-register allows Privilege Escalation.This issue affects Houzez Lo… |
CVE-2026-57745 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Re… |
CVE-2026-57744 | Critical | 9.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affects RT-Theme 18 | Ext… |
CVE-2026-57743 | High | 8.1 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 | Extensions rt18-e… |
CVE-2026-57741 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acy… |
CVE-2026-57740 | High | 7.1 | 2026-07-13 | Missing Authorization vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-57739 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acy… |
CVE-2026-57738 | Critical | 9.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through <= 1.13.0. |
CVE-2026-57734 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Reflected XSS.T… |
CVE-2026-57733 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Cloud Library td-cloud-library allows DOM-B… |
CVE-2026-57732 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows DOM-B… |
CVE-2026-57729 | High | 7.5 | 2026-07-13 | Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects F… |
CVE-2026-57728 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UX-themes Flatsome flatsome allows Reflected XSS.This iss… |
CVE-2026-57727 | High | 7.5 | 2026-07-13 | Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: fr… |
CVE-2026-57726 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue… |
CVE-2026-57725 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issue affects… |
CVE-2026-57724 | Critical | 9.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12. |
CVE-2026-57719 | Critical | 10.0 | 2026-07-13 | Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pro aimogen-pro allows Using Malicious Files.This issue affects Aimogen… |