2026 CVEs (page 379)
Page 379 of 686 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54798 | Medium | 6.5 | 2026-07-09 | A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affec… |
CVE-2026-60095 | Medium | 6.5 | 2026-07-09 | Vinchin Backup & Recovery through 9.0.0.86562 contains a stack buffer overflow vulnerability in the ModuleHandShake function of the agentlink_server service th… |
CVE-2026-60094 | Medium | 6.5 | 2026-07-09 | Vinchin Backup & Recovery through 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause process crash… |
CVE-2026-4256 | High | 8.2 | 2026-07-09 | Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in PEAKUP Technology Inc. PassGate allows LDAP Injection. T… |
CVE-2026-15186 | Medium | 6.3 | 2026-07-09 | A vulnerability was identified in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /returnApply/create of the component Portal Endpoin… |
CVE-2026-15185 | Low | 3.3 | 2026-07-09 | A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsub_read_idx of the file /src/media_tools/vobsub.c of the component MP4Box. Exec… |
CVE-2026-14261 | Critical | 9.1 | 2026-07-09 | A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution via reinstallation through the /setup/ folder, enabling at… |
CVE-2026-12879 | | 2026-07-09 | An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated… | |
CVE-2026-12593 | | 2026-07-09 | The implementation of an internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) forgot to ensure an HTTP request for creating an AP… | |
CVE-2026-12116 | Critical | 9.8 | 2026-07-09 | A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP interpre… |
CVE-2026-15184 | Low | 3.3 | 2026-07-09 | A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function dwg_next_entity of the file src/dwg.c of the component DWG File Ha… |
CVE-2026-9253 | High | 7.2 | 2026-07-09 | The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customerInfos' parameter… |
CVE-2026-15182 | Medium | 5.3 | 2026-07-09 | A vulnerability has been found in GNU LibreDWG up to 0.13.4. The affected element is the function dwg_bmp of the file src/dwg.c of the component BMP Image Hand… |
CVE-2026-9240 | Medium | 4.3 | 2026-07-09 | The Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi… |
CVE-2026-9237 | Medium | 4.3 | 2026-07-09 | The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includin… |
CVE-2026-9235 | Medium | 4.3 | 2026-07-09 | The DHL eCommerce (Benelux) for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check… |
CVE-2026-9028 | Medium | 5.3 | 2026-07-09 | The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.4. This is due t… |
CVE-2026-9027 | Medium | 5.3 | 2026-07-09 | The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Payment Bypass via Improper Verification of Cryptographic Signature in all vers… |
CVE-2026-9021 | Medium | 5.3 | 2026-07-09 | The Easy Invoice plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.19. This is due to the plugin registering th… |
CVE-2026-59692 | High | 7.5 | 2026-07-09 | A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed… |
CVE-2026-59691 | High | 7.1 | 2026-07-09 | A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp frame… |
CVE-2026-58307 | Medium | 6.1 | 2026-07-09 | Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation. This issue affects Esc… |
CVE-2026-58306 | Medium | 6.1 | 2026-07-09 | Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before ef525f337fafddecde77a3c4… |
CVE-2026-58305 | Medium | 6.1 | 2026-07-09 | Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Es… |
CVE-2026-58304 | Medium | 6.1 | 2026-07-09 | Out-of-bounds read, Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before 779f6bedf58… |
CVE-2026-58303 | Medium | 6.1 | 2026-07-09 | Stack-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before b30b63fc63b403907d8137d… |
CVE-2026-56291 | Critical | 9.8 | 2026-07-09 | Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauth… |
CVE-2026-56289 | Medium | 5.5 | 2026-07-09 | GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single block of changes in diff) line offsets in unified-diff input. A… |
CVE-2026-56288 | Medium | 5.5 | 2026-07-09 | GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file… |
CVE-2026-50644 | | 2026-07-09 | SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all rights can inject SQL commands into the audi… | |
CVE-2026-4298 | Medium | 4.3 | 2026-07-09 | The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 4.9. This is due to the dsgvo_reset… |
CVE-2026-4275 | High | 8.8 | 2026-07-09 | The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu… |
CVE-2026-14372 | High | 7.1 | 2026-07-09 | The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion du… |
CVE-2026-13441 | High | 7.2 | 2026-07-09 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_event_type_background_col… |
CVE-2026-12590 | Low | 3.7 | 2026-07-09 | Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an un… |
CVE-2026-12428 | Medium | 6.5 | 2026-07-09 | The Blocks for ACF Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_all_values() function… |
CVE-2026-5955 | Critical | 9.8 | 2026-07-09 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Inrove Software and Internet Services BiEticaret allows S… |
CVE-2026-5793 | Medium | 6.1 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Inrove Software and Internet Services BiEticaret allows R… |
CVE-2026-56460 | Medium | 6.5 | 2026-07-09 | HCL DevOps Deploy / HCL Launch could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attack… |
CVE-2026-56459 | Medium | 6.2 | 2026-07-09 | HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure. The application stores potentially sensitive information in log files that… |
CVE-2026-56458 | Medium | 5.4 | 2026-07-09 | HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as… |
CVE-2026-2342 | Critical | 9.3 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OceanicSoft Informatics Systems Ltd. ValeApp allows Store… |
CVE-2026-1989 | High | 7.5 | 2026-07-09 | Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. PAVO Pay allows Exploitation of Trusted Identifiers… |
CVE-2026-1365 | Medium | 6.5 | 2026-07-09 | Insertion of sensitive information into sent data vulnerability in Sayax Energy Technologies Inc. OSOS allows Authentication Bypass. This issue affects OSOS… |
CVE-2026-15158 | Critical | 9.8 | 2026-07-09 | The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.1.46 via the save_attachments functio… |
CVE-2026-12433 | Medium | 4.3 | 2026-07-09 | The Hydra Booking – Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and inc… |
CVE-2026-8996 | Medium | 6.5 | 2026-07-09 | The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.22.26 vi… |
CVE-2026-8848 | High | 7.2 | 2026-07-09 | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to authorization bypass i… |
CVE-2026-7558 | Medium | 5.3 | 2026-07-09 | The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to unauthorized access in all versions up to and including 4… |
CVE-2026-6910 | Medium | 6.4 | 2026-07-09 | The Bookero.pl – system rezerwacji online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookero_products` shortcode's `hide_produc… |
CVE-2026-59269 | Low | 3.8 | 2026-07-09 | A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following… |
CVE-2026-57111 | High | 7.5 | 2026-07-09 | Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters.CORSFilter) in Apache Helix through 2.0.0 on… |
CVE-2026-4653 | Medium | 6.4 | 2026-07-09 | The Block, Suspend, Report for BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter in versions up to and incl… |
CVE-2026-33390 | High | 8.1 | 2026-07-09 | An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authentica… |
CVE-2026-31985 | High | 8.1 | 2026-07-09 | When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration disabled TLS certificate verification, and n… |
CVE-2026-31984 | High | 7.5 | 2026-07-09 | A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on inp… |
CVE-2026-31983 | Medium | 5.3 | 2026-07-09 | A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. An unauthenticated attacker can send a request to the SSH keys… |
CVE-2026-31982 | High | 7.1 | 2026-07-09 | An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection paramete… |
CVE-2026-31981 | Medium | 5.9 | 2026-07-09 | A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restricti… |
CVE-2026-15000 | High | 7.2 | 2026-07-09 | The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mailchimp Merge Field Values in all versions up… |
CVE-2026-14343 | Medium | 6.4 | 2026-07-09 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes in all versions… |
CVE-2026-14342 | Medium | 4.9 | 2026-07-09 | The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to time-based SQL Injection via the 'cont… |
CVE-2026-14245 | Critical | 9.8 | 2026-07-09 | The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeo… |
CVE-2026-13771 | Medium | 6.4 | 2026-07-09 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'color' Shortcode Attribute in all versions up to, a… |
CVE-2026-13450 | Medium | 5.3 | 2026-07-09 | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Insecure Direct Object Re… |
CVE-2026-13334 | Medium | 6.1 | 2026-07-09 | The Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'stag' parameter in all versions up to, and including, 2.3.4 due… |
CVE-2026-13253 | Medium | 6.4 | 2026-07-09 | The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-sea… |
CVE-2026-13080 | Medium | 6.6 | 2026-07-09 | The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up t… |
CVE-2026-13011 | Medium | 6.5 | 2026-07-09 | The ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support plugin for WordPress is vulnerable to generic SQL Injection via the '… |
CVE-2026-12418 | Medium | 5.3 | 2026-07-09 | The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct O… |
CVE-2026-12406 | Medium | 5.3 | 2026-07-09 | The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to authorization byp… |
CVE-2026-12170 | Medium | 6.4 | 2026-07-09 | The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-11359 | Medium | 4.3 | 2026-07-09 | The Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin for WordPress is vulnerable to unauthorized plugin installation… |
CVE-2026-47840 | High | 7.5 | 2026-07-09 | A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP… |
CVE-2026-47831 | High | 7.5 | 2026-07-09 | Use of a cryptographically weak random number generator in the GenerateRandomPassword function in bosh-windows-stemcell-builder allows a remote attacker to bru… |
CVE-2026-47830 | High | 8.8 | 2026-07-09 | Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privilege authenticated users to overwrite C:\bos… |
CVE-2026-47829 | High | 7.8 | 2026-07-09 | Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned ssh process when an operator run… |
CVE-2026-47828 | High | 8.8 | 2026-07-09 | During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without v… |
CVE-2026-47826 | Critical | 9.1 | 2026-07-09 | The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive information. Affected… |
CVE-2026-12517 | Medium | 5.3 | 2026-07-09 | The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated site-info endpo… |
CVE-2026-12516 | Medium | 5.3 | 2026-07-09 | The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated media-proxying… |
CVE-2026-12270 | Medium | 6.5 | 2026-07-09 | The Everest Forms WordPress plugin before 3.5.0 does not correctly restrict access to several REST API endpoints belonging to its onboarding assistant: the ca… |
CVE-2026-11875 | Medium | 5.3 | 2026-07-09 | The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sign or verify its guest-session cookie, allowing unauthenticated attacker… |
CVE-2026-11869 | Medium | 5.3 | 2026-07-09 | The WP DSGVO Tools (GDPR) WordPress plugin before 3.1.40 does not perform an authorization check on the immediate-processing path of its data subject access re… |
CVE-2026-11571 | High | 7.5 | 2026-07-09 | The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing and leaves them pu… |
CVE-2026-5523 | High | 8.8 | 2026-07-09 | The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.1.8. This is due to the update_user() fun… |
CVE-2026-41857 | High | 7.8 | 2026-07-09 | A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh ssh (or bosh scp/bosh l… |
CVE-2026-15138 | Medium | 6.3 | 2026-07-09 | A security vulnerability has been detected in tumf mcp-text-editor up to 1.0.2. This issue affects the function _validate_file_path of the file mcp_text_editor… |
CVE-2026-47646 | Critical | 9.3 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform… |
CVE-2026-15137 | High | 7.3 | 2026-07-09 | A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability affects unknown code of the file \inc\classes\View.php. Thi… |
CVE-2026-15135 | High | 7.3 | 2026-07-09 | A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an unknown part of the file /edit_food_items.php. The manipulat… |
CVE-2026-15134 | High | 7.3 | 2026-07-09 | A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /… |
CVE-2026-59723 | High | 8.8 | 2026-07-08 | Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard… |
CVE-2026-54784 | High | 7.4 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation… |
CVE-2026-54783 | High | 7.4 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security endorsing and suppo… |
CVE-2026-54782 | Critical | 10.0 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token val… |
CVE-2026-54781 | High | 7.4 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token validation does not… |
CVE-2026-54780 | Low | 3.7 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, the CoreWCF WS-Security 1.0 receive pip… |
CVE-2026-54779 | Medium | 5.9 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token replay protection is… |
CVE-2026-54778 | Medium | 6.2 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF UnixDomainSocket POSIX peer ide… |