2026 CVEs (page 391)
Page 391 of 685 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54430 | | 2026-07-02 | liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads both signer and kid from the… | |
CVE-2026-9834 | High | 7.2 | 2026-07-02 | The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all versions up to an… |
CVE-2026-9188 | Medium | 5.3 | 2026-07-02 | The Appointment Bookings for Zoom GoogleMeet and more – Wappointment plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up… |
CVE-2026-9145 | Medium | 6.5 | 2026-07-02 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via the create_entry_el() function in versi… |
CVE-2026-8482 | Medium | 4.3 | 2026-07-02 | A vulnerability was discovered on StormShield Network Security 4.3.0 to 4.3.41 (included), 4.8.0 to 4.8.15 (included) , 5.0.0 to 5.0.5 (included) There is a p… |
CVE-2026-8441 | High | 7.5 | 2026-07-02 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action in versions… |
CVE-2026-14336 | High | 8.2 | 2026-07-02 | PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py… |
CVE-2026-14029 | Medium | 6.5 | 2026-07-02 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'select' parameter in all versi… |
CVE-2026-13459 | Medium | 5.3 | 2026-07-02 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This i… |
CVE-2026-13369 | High | 7.5 | 2026-07-02 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, and including, 3.3… |
CVE-2026-13252 | Medium | 6.4 | 2026-07-02 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2026-13251 | High | 7.5 | 2026-07-02 | The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.4 via the 's' parameter. This makes it poss… |
CVE-2026-12657 | Medium | 5.3 | 2026-07-02 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up t… |
CVE-2026-12472 | Medium | 5.3 | 2026-07-02 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-12134 | Medium | 4.3 | 2026-07-02 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includ… |
CVE-2026-12122 | Medium | 5.3 | 2026-07-02 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and… |
CVE-2026-11896 | Medium | 5.3 | 2026-07-02 | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14… |
CVE-2026-10104 | Medium | 4.4 | 2026-07-02 | The Product Video Gallery for Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom_thumbnail Parameter in all versions up t… |
CVE-2026-9563 | High | 7.5 | 2026-07-02 | In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consum… |
CVE-2026-8147 | High | 8.1 | 2026-07-02 | In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any aut… |
CVE-2026-33592 | High | 7.5 | 2026-07-02 | An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FindServersRequest is… |
CVE-2026-5821 | High | 8.1 | 2026-07-02 | The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path valid… |
CVE-2026-5348 | Medium | 5.3 | 2026-07-02 | The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to… |
CVE-2026-14249 | High | 7.5 | 2026-07-02 | The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is d… |
CVE-2026-13704 | Medium | 6.4 | 2026-07-02 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sequoia[introduction][image]'… |
CVE-2026-13357 | Medium | 4.9 | 2026-07-02 | The Houzez Property Feed plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.46 due to in… |
CVE-2026-11965 | Medium | 6.5 | 2026-07-02 | The User Registration & Membership WordPress plugin before 5.2.0 does not enforce payment completion before activating a paid membership subscription, allowin… |
CVE-2026-11781 | Low | 2.7 | 2026-07-02 | The Adminify WordPress plugin before 4.2.10 does not perform per-user read-capability checks on the results returned by one of its administration search featu… |
CVE-2026-11600 | Medium | 4.3 | 2026-07-02 | The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization c… |
CVE-2026-11592 | Medium | 4.3 | 2026-07-02 | The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization… |
CVE-2026-11578 | Low | 2.7 | 2026-07-02 | The Fluent Forms WordPress plugin before 6.2.5 does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authori… |
CVE-2026-10089 | Medium | 6.4 | 2026-07-02 | The Insert Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post custom field keys (meta key names) in all versions up to, and inclu… |
CVE-2026-10077 | Medium | 6.8 | 2026-07-02 | The yootheme WordPress theme before 5.0.35 does not prevent its bundled front-end framework from treating certain HTML attributes, which are permitted by wp_ks… |
CVE-2026-57278 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57277 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57276 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57275 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57274 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57273 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57272 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57271 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57270 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57269 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57268 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57267 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57266 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57265 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57264 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-13132 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-13131 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-13125 | High | 8.8 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-55794 | | 2026-07-02 | Craft CMS is a content management system (CMS). In versions 5.9.0 and above prior to 5.10.0, control panel users with the ability to edit entries can execute u… | |
CVE-2026-55792 | | 2026-07-02 | Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl(… | |
CVE-2026-55791 | | 2026-07-02 | Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Serv… | |
CVE-2026-50280 | | 2026-07-02 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 and above prior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates th… | |
CVE-2026-50279 | | 2026-07-02 | Craft CMS is a content management system (CMS). IN versions 5.0.0-RC1 and above prior to 5.9.21, theEntriesController::actionSaveEntry() performs entry-edit pe… | |
CVE-2026-55790 | | 2026-07-01 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can… | |
CVE-2026-50284 | | 2026-07-01 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsController::actionDeleteFolder() o… | |
CVE-2026-50283 | | 2026-07-01 | Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in the AssetsCo… | |
CVE-2026-14440 | Medium | 6.8 | 2026-07-01 | Description: To issue and renew TLS certificates on behalf of customers, Cloudflare's Universal SSL feature automatically manages the CAA RRset for the cus… |
CVE-2026-14439 | | 2026-07-01 | A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365. The service accepts a sequence of post-cl… | |
CVE-2026-14432 | High | 8.8 | 2026-07-01 | Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chr… |
CVE-2026-14431 | High | 8.8 | 2026-07-01 | Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chr… |
CVE-2026-14430 | High | 8.8 | 2026-07-01 | Integer overflow in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
CVE-2026-14429 | High | 8.3 | 2026-07-01 | Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-14428 | High | 8.3 | 2026-07-01 | Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.46 allowed a remote attacker who had compromised the rendere… |
CVE-2026-14427 | High | 8.3 | 2026-07-01 | Heap buffer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-14426 | High | 7.5 | 2026-07-01 | Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitr… |
CVE-2026-14425 | Critical | 9.6 | 2026-07-01 | Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chr… |
CVE-2026-14424 | Critical | 9.6 | 2026-07-01 | Use after free in Dawn in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page… |
CVE-2026-14423 | Critical | 9.6 | 2026-07-01 | Type Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chro… |
CVE-2026-14422 | High | 8.8 | 2026-07-01 | Out of bounds read and write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform out of bounds memory access via a… |
CVE-2026-14421 | Medium | 6.5 | 2026-07-01 | Uninitialized Use in Dawn in Google Chrome on ChromeOS prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from proces… |
CVE-2026-14420 | Critical | 9.6 | 2026-07-01 | Out of bounds read and write in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HT… |
CVE-2026-14419 | Critical | 9.6 | 2026-07-01 | Use after free in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chro… |
CVE-2026-14418 | Medium | 4.3 | 2026-07-01 | Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-14417 | Critical | 9.6 | 2026-07-01 | Use after free in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chro… |
CVE-2026-14416 | Critical | 9.6 | 2026-07-01 | Out of bounds read in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (… |
CVE-2026-14415 | High | 8.8 | 2026-07-01 | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2026-14414 | Medium | 5.3 | 2026-07-01 | Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-14413 | High | 8.3 | 2026-07-01 | Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-14412 | High | 8.3 | 2026-07-01 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-14411 | Critical | 9.6 | 2026-07-01 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape v… |
CVE-2026-14410 | Medium | 4.3 | 2026-07-01 | Inappropriate implementation in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to perform UI s… |
CVE-2026-14409 | High | 7.5 | 2026-07-01 | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2026-14408 | Medium | 6.5 | 2026-07-01 | Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory via… |
CVE-2026-14407 | High | 8.8 | 2026-07-01 | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H… |
CVE-2026-14406 | Medium | 5.9 | 2026-07-01 | Out of bounds read in V8 in Google Chrome prior to 150.0.7871.46 allowed an attacker who convinced a user to install a malicious extension to obtain potentiall… |
CVE-2026-14405 | Critical | 9.6 | 2026-07-01 | Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-14404 | Medium | 6.5 | 2026-07-01 | Inappropriate implementation in PDFium in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI spoofing via a crafted PDF file. (Chromi… |
CVE-2026-14403 | High | 8.8 | 2026-07-01 | Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chr… |
CVE-2026-14402 | Medium | 6.5 | 2026-07-01 | Uninitialized Use in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from proces… |
CVE-2026-14401 | High | 8.3 | 2026-07-01 | Insufficient validation of untrusted input in ANGLE in Google Chrome on Android prior to 150.0.7871.46 allowed a remote attacker who had compromised the render… |
CVE-2026-14400 | High | 8.3 | 2026-07-01 | Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-14399 | Medium | 6.5 | 2026-07-01 | Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory via… |
CVE-2026-14398 | Critical | 9.6 | 2026-07-01 | Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chr… |
CVE-2026-14397 | Critical | 9.6 | 2026-07-01 | Out of bounds write in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
CVE-2026-14396 | Medium | 6.5 | 2026-07-01 | Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secu… |
CVE-2026-14395 | High | 8.8 | 2026-07-01 | Out of bounds write in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-14394 | High | 8.8 | 2026-07-01 | Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |