2026 CVEs (page 397)
Page 397 of 450 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27332 | High | 7.1 | 2026-03-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Agrofood agrofood allows Reflected XSS.This issu… |
CVE-2026-27326 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes AC Services | HVAC, Air Co… |
CVE-2026-27098 | High | 8.1 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in axiomthemes Au Pair Agency - Babysitting & Nanny Theme au-pair-agency allows Object Injection.This issue aff… |
CVE-2026-27097 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes CasaMia | Property Rental… |
CVE-2026-24963 | High | 7.2 | 2026-03-05 | Incorrect Privilege Assignment vulnerability in ameliabooking Amelia ameliabooking allows Privilege Escalation.This issue affects Amelia: from n/a through <= 1… |
CVE-2026-24960 | Critical | 9.9 | 2026-03-05 | Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Charety charety allows Using Malicious Files.This issue affects Charety: from n/a t… |
CVE-2026-24385 | High | 7.5 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in gerritvanaaken Podlove Web Player podlove-web-player allows Object Injection.This issue affects Podlove Web… |
CVE-2026-23802 | Critical | 9.1 | 2026-03-05 | Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine ai-engine allows Using Malicious Files.This issue affects AI Engine: from… |
CVE-2026-23801 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes The Issue theissue allows P… |
CVE-2026-23799 | Medium | 6.5 | 2026-03-05 | Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor… |
CVE-2026-23798 | High | 8.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in blubrry PowerPress Podcasting powerpress allows Object Injection.This issue affects PowerPress Podcasting: f… |
CVE-2026-23767 | Critical | 9.8 | 2026-03-05 | ESC/POS, a printer control language designed by Seiko Epson Corporation, lacks mechanisms for user authentication and command authorization, does not provide c… |
CVE-2026-23546 | Medium | 6.5 | 2026-03-05 | Insertion of Sensitive Information Into Sent Data vulnerability in RadiusTheme Classified Listing classified-listing allows Retrieve Embedded Sensitive Data.Th… |
CVE-2026-22501 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in axiomthemes Mounthood mounthood allows Object Injection.This issue affects Mounthood: from n/a through <= 1… |
CVE-2026-22497 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in AncoraThemes Jardi jardi allows Object Injection.This issue affects Jardi: from n/a through <= 1.7.2. |
CVE-2026-22479 | High | 7.5 | 2026-03-05 | Missing Authorization vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2026-22478 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes FindAll findall allows P… |
CVE-2026-22477 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Felizia felizia allows PH… |
CVE-2026-22476 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Etchy etchy allows PHP L… |
CVE-2026-22475 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in axiomthemes Estate estate allows Object Injection.This issue affects Estate: from n/a through <= 1.3.4. |
CVE-2026-22474 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in ThemeREX Equestrian Centre equestrian-centre allows Object Injection.This issue affects Equestrian Centre: f… |
CVE-2026-22473 | High | 8.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in designthemes Dental Clinic dental allows Object Injection.This issue affects Dental Clinic: from n/a through… |
CVE-2026-22471 | High | 8.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in maximsecudeal Secudeal Payments for Ecommerce secudeal-payments-for-ecommerce allows Object Injection.This i… |
CVE-2026-22467 | High | 7.1 | 2026-03-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mwtemplates DeepDigital deepdigital allows Reflected XSS… |
CVE-2026-22465 | High | 7.1 | 2026-03-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeventhQueen BuddyApp buddyapp allows Reflected XSS.This… |
CVE-2026-22460 | High | 8.6 | 2026-03-05 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpWax FormGent formgent allows Path Traversal.This issue affect… |
CVE-2026-22459 | Medium | 6.5 | 2026-03-05 | Missing Authorization vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-22457 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Wanderland wanderland al… |
CVE-2026-22456 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Askka askka allows PHP L… |
CVE-2026-22455 | High | 7.1 | 2026-03-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in foreverpinetree Thebe thebe allows Reflected XSS.This iss… |
CVE-2026-22454 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in ThemeREX Solaris solaris allows Object Injection.This issue affects Solaris: from n/a through <= 2.5. |
CVE-2026-22453 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in ThemeREX Pets Club petclub allows Object Injection.This issue affects Pets Club: from n/a through <= 2.3. |
CVE-2026-22452 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Hoverex hoverex allows PHP Lo… |
CVE-2026-22451 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in AncoraThemes Handyman handyman-services allows Object Injection.This issue affects Handyman: from n/a throug… |
CVE-2026-22449 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Don Peppe donpeppe allow… |
CVE-2026-22446 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Prowess prowess allows P… |
CVE-2026-22443 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Alliance alliance allows PHP… |
CVE-2026-22442 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LaunchandSell Tribe tribe allows PHP L… |
CVE-2026-22441 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Zentrum zentrum allows P… |
CVE-2026-22440 | High | 7.1 | 2026-03-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in foreverpinetree Thecs thecs allows Reflected XSS.This iss… |
CVE-2026-22439 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Green Planet green-planet… |
CVE-2026-22438 | High | 7.1 | 2026-03-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in foreverpinetree TheBi thebi allows Reflected XSS.This iss… |
CVE-2026-22437 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Playa playa allows PHP Lo… |
CVE-2026-22436 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Helvig helvig allows PHP… |
CVE-2026-22435 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes ElectroServ electroserv a… |
CVE-2026-22434 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Crown Art crown-art allow… |
CVE-2026-22433 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes CloudMe cloudme allows PH… |
CVE-2026-22432 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Woopy woopy allows PHP Lo… |
CVE-2026-22431 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Wabi-Sabi wabi-sabi allow… |
CVE-2026-22429 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Verdure verdure allows P… |
CVE-2026-22428 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Tooth Fairy tooth-fairy a… |
CVE-2026-22427 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes GoTravel gotravel allows… |
CVE-2026-22425 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Sweet Jane sweetjane all… |
CVE-2026-22424 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Shaha shaha allows PHP Lo… |
CVE-2026-22423 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes SetSail setsail allows P… |
CVE-2026-22421 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Quantum quantum allows PH… |
CVE-2026-22420 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Horizon horizon allows PH… |
CVE-2026-22419 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Honor honor allows PHP Lo… |
CVE-2026-22418 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Great Lotus great-lotus a… |
CVE-2026-22417 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a thr… |
CVE-2026-22416 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes FixTeam fixteam allows PH… |
CVE-2026-22415 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes The Mounty the-mounty all… |
CVE-2026-22414 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Marra marra allows PHP L… |
CVE-2026-22413 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Malgré malgre allows PHP… |
CVE-2026-22412 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Eona eona allows PHP Loc… |
CVE-2026-22410 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dolcino dolcino allows P… |
CVE-2026-22408 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Justicia justicia allows… |
CVE-2026-22405 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Overton overton allows P… |
CVE-2026-22403 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Innovio innovio allows P… |
CVE-2026-22399 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Holmes holmes allows PHP… |
CVE-2026-22397 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Fleur fleur allows PHP L… |
CVE-2026-22395 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Fiorello fiorello allows… |
CVE-2026-22394 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Evently evently allows P… |
CVE-2026-22392 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Cortex cortex allows PHP… |
CVE-2026-22390 | Critical | 9.9 | 2026-03-05 | Improper Control of Generation of Code ('Code Injection') vulnerability in Builderall Builderall Builder for WordPress builderall-cheetah-for-wp allows Code In… |
CVE-2026-22389 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Cocco cocco allows PHP L… |
CVE-2026-22387 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Aviana aviana allows PHP… |
CVE-2026-22385 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in don-themes Wolmart wolmart allows PHP… |
CVE-2026-3523 | Medium | 4.9 | 2026-03-05 | The Apocalypse Meow plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 22.1.0. This is due to a… |
CVE-2026-3034 | Medium | 6.4 | 2026-03-05 | The OoohBoi Steroids for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _ob_spacerat_link, _ob_bbad_link, and _ob_teleport… |
CVE-2026-2899 | Medium | 6.5 | 2026-03-05 | The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.17. This is due to the `… |
CVE-2026-2365 | High | 7.2 | 2026-03-05 | The Fluent Forms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fluentform_step_form_save_data` AJAX action in all versions up… |
CVE-2026-29127 | High | 7.8 | 2026-03-05 | The IDC SFX2100 Satellite Receiver sets overly permissive file system permissions on the monitor user's home directory. The directory is configured with permis… |
CVE-2026-26034 | High | 7.8 | 2026-03-05 | UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Incorrect Default Permissions (CWE-276) vulnerability that allows an attacker to e… |
CVE-2026-26033 | Medium | 6.7 | 2026-03-05 | UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Unquoted Search Path or Element (CWE-428) vulnerability, which allows a user with… |
CVE-2026-3381 | Critical | 9.8 | 2026-03-05 | Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib. Compress::Raw::Zlib includes a copy of the zlib library. Compre… |
CVE-2026-3257 | Critical | 9.8 | 2026-03-05 | UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library. UnQLite for Perl embeds the UnQLite library. Version 0.06… |
CVE-2026-29126 | High | 7.8 | 2026-03-05 | Incorrect permission assignment (world-writable file) in /etc/udhcpc/default.script in International Data Casting (IDC) SFX2100 Satellite Receiver allows a loc… |
CVE-2026-29125 | Medium | 4.7 | 2026-03-05 | IDC SFX2100 Satalite Recievers set the `/etc/resolv.conf` file to be world-writable by any local user, allowing DNS resolver tampering that can redirect networ… |
CVE-2026-29124 | High | 7.8 | 2026-03-05 | Multiple SUID root-owned binaries are found in /home/monitor/terminal, /home/monitor/kore-terminal, /home/monitor/IDE-DPack/terminal-dpack, and /home/monitor/I… |
CVE-2026-29123 | High | 7.8 | 2026-03-05 | A SUID root-owned binary in /home/xd/terminal/XDTerminal in International Data Casting (IDC) SFX2100 on Linux allows a local actor to potentially preform local… |
CVE-2026-29122 | Medium | 5.5 | 2026-03-05 | International Data Casting (IDC) SFX2100 satellite receiver comes with the `/bin/date` utility installed with the setuid bit set. This configuration grants ele… |
CVE-2026-29121 | High | 7.8 | 2026-03-05 | International Data Casting (IDC) SFX2100 satellite receiver comes with the `/sbin/ip` utility installed with the setuid bit set. This configuration grants elev… |
CVE-2026-2836 | High | 8.1 | 2026-03-05 | A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction. The issue occurs because the default HTTP… |
CVE-2026-2835 | Critical | 9.1 | 2026-03-05 | An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to impro… |
CVE-2026-2833 | Critical | 9.1 | 2026-03-05 | An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a Pingora proxy reads… |
CVE-2026-22052 | Medium | 4.3 | 2026-03-05 | ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticate… |
CVE-2026-2297 | | 2026-03-04 | The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.op… | |
CVE-2026-29086 | Medium | 5.4 | 2026-03-04 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicol… |
CVE-2026-29085 | Medium | 6.5 | 2026-03-04 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using streamSSE() in Streaming Helper, the… |