2026 CVEs (page 408)
Page 408 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-26063 | | 2026-02-19 | CediPay is a crypto-to-fiat app for the Ghanaian market. A vulnerability in CediPay prior to version 1.2.3 allows attackers to bypass input validation in the t… | |
CVE-2026-27475 | High | 8.1 | 2026-02-19 | SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An at… |
CVE-2026-27474 | Medium | 6.1 | 2026-02-19 | SPIP before 4.4.9 allows Cross-Site Scripting (XSS) in the private area, complementing an incomplete fix from SPIP 4.4.8. The echappe_anti_xss() function was n… |
CVE-2026-27473 | Medium | 6.4 | 2026-02-19 | SPIP before 4.4.9 allows Stored Cross-Site Scripting (XSS) via syndicated sites in the private area. The #URL_SYNDIC output is not properly sanitized on the pr… |
CVE-2026-27472 | Medium | 4.3 | 2026-02-19 | SPIP before 4.4.9 allows Blind Server-Side Request Forgery (SSRF) via syndicated sites in the private area. When editing a syndicated site, the application doe… |
CVE-2026-26059 | Medium | 5.4 | 2026-02-19 | ChurchCRM is an open-source church management system. In versions prior to 6.8.2, it was possible for an authenticated user with permission to edit groups to s… |
CVE-2026-26057 | Medium | 6.5 | 2026-02-19 | Skill Scanner is a security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. A vulnerability in the A… |
CVE-2026-23621 | Medium | 4.3 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain an arbitrary directory existence enumeration vulnerability in the ListServer.IsPathExist() web method expo… |
CVE-2026-2817 | Medium | 4.4 | 2026-02-19 | Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On sh… |
CVE-2026-2409 | | 2026-02-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delinea Cloud Suite allows Argument Injection.This issue… | |
CVE-2026-2243 | Medium | 5.1 | 2026-02-19 | A flaw was found in QEMU. A specially crafted VMDK image could trigger an out-of-bounds read vulnerability, potentially leading to a 12-byte leak of sensitive… |
CVE-2026-26339 | Critical | 9.8 | 2026-02-19 | Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through the argument injection vulnerability, which ex… |
CVE-2026-26338 | Critical | 9.8 | 2026-02-19 | Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve server-side request forgery (SSRF) through the document processing functiona… |
CVE-2026-26337 | High | 8.2 | 2026-02-19 | Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve both arbitrary file read and server-side request forgery through the absolut… |
CVE-2026-23620 | Medium | 4.3 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain an arbitrary file existence enumeration vulnerability in the ListServer.IsDBExist() web method exposed at… |
CVE-2026-23619 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Local Domains settings page. An authenticated user can… |
CVE-2026-23618 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Spam Keyword Checking (Subject) conditions interface. A… |
CVE-2026-23617 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Spam Keyword Checking (Body) conditions interface. An a… |
CVE-2026-23616 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Anti-Spoofing configuration page. An authenticated user… |
CVE-2026-23615 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Sender Policy Framework Email Exceptions interface. An… |
CVE-2026-23614 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Sender Policy Framework IP Exceptions interface. An aut… |
CVE-2026-23613 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the URI DNS Blocklist configuration page. An authenticated… |
CVE-2026-23612 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the IP DNS Blocklist configuration page. An authenticated u… |
CVE-2026-23611 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the IP Blocklist management page. An authenticated user can… |
CVE-2026-23610 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the POP2Exchange configuration endpoint. An authenticated u… |
CVE-2026-23609 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Perimeter SMTP Servers configuration page. An authentic… |
CVE-2026-23608 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Mail Monitoring rule creation endpoint. An authenticate… |
CVE-2026-23607 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Anti-Spam Whitelist management interface. An authentica… |
CVE-2026-23606 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Advanced Content Filtering rule creation workflow. An a… |
CVE-2026-23605 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Attachment Filtering rule creation workflow. An authent… |
CVE-2026-23604 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Keyword Filtering rule creation workflow. An authentica… |
CVE-2026-2232 | High | 7.5 | 2026-02-19 | The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versio… |
CVE-2026-26336 | High | 7.5 | 2026-02-19 | Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, th… |
CVE-2026-26030 | Critical | 9.9 | 2026-02-19 | Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemo… |
CVE-2026-26016 | High | 8.1 | 2026-02-19 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization check in… |
CVE-2026-25998 | High | 7.5 | 2026-02-19 | strongMan is a management interface for strongSwan, an OpenSource IPsec-based VPN. When storing credentials in the database (private keys, EAP secrets), strong… |
CVE-2026-24834 | Critical | 9.3 | 2026-02-19 | Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions… |
CVE-2026-1581 | High | 7.5 | 2026-02-19 | The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'wpfob' parameter in all versions up to, and including, 2.4.14 due to i… |
CVE-2026-2274 | | 2026-02-19 | A SSRF and Arbitrary File Read vulnerability in AppSheet Core in Google AppSheet prior to 2025-11-23 allows an authenticated remote attacker to read sensitive… | |
CVE-2026-26345 | Medium | 5.4 | 2026-02-19 | SPIP before 4.4.8 contains a stored cross-site scripting (XSS) vulnerability in the public area triggered in certain edge-case usage patterns. The echapper_htm… |
CVE-2026-26223 | Medium | 6.1 | 2026-02-19 | SPIP before 4.4.8 allows cross-site scripting (XSS) in the private area via malicious iframe tags. The application does not properly sandbox or escape iframe c… |
CVE-2026-25940 | High | 8.1 | 2026-02-19 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of the Acroform module allows users to inject arbitra… |
CVE-2026-25766 | Medium | 5.3 | 2026-02-19 | Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s `middleware.Static` using the default filesystem allows path traversal via backs… |
CVE-2026-25739 | Medium | 5.4 | 2026-02-19 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to cro… |
CVE-2026-25738 | Medium | 4.3 | 2026-02-19 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to ser… |
CVE-2026-25755 | High | 8.1 | 2026-02-19 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PD… |
CVE-2026-25535 | High | 7.5 | 2026-02-19 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `addImage` method results in denial of service. If… |
CVE-2026-25527 | Medium | 5.3 | 2026-02-19 | changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` route accepts `group="… |
CVE-2026-2718 | Medium | 6.4 | 2026-02-19 | The Dealia – Request a Quote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Gutenberg block attributes in all versions up to, and includ… |
CVE-2026-2716 | Medium | 4.4 | 2026-02-19 | The Client Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Testimonial Heading' setting in all versions up to, an… |
CVE-2026-22268 | Medium | 6.3 | 2026-02-19 | Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote ac… |
CVE-2026-22267 | High | 8.1 | 2026-02-19 | Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote ac… |
CVE-2026-22266 | Medium | 4.7 | 2026-02-19 | Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel vulnerability in the REST A… |
CVE-2026-1461 | Medium | 6.5 | 2026-02-19 | The Simple Membership plugin for WordPress is vulnerable to Improper Handling of Missing Values in all versions up to, and including, 4.7.0 via the Stripe webh… |
CVE-2026-1219 | Medium | 5.3 | 2026-02-19 | The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to… |
CVE-2026-2736 | Medium | 6.1 | 2026-02-19 | Reflected Cross-site Scripting (XSS) in Alkacon's OpenCms v18.0, which allows an attacker to execute JavaScript code in the victim's browser by sending the vic… |
CVE-2026-2735 | Medium | 5.4 | 2026-02-19 | Stored Cross-Site Scripting (XSS) in Alkacon's OpenCms v18.0, which occurs when user input is not properly validated when sending a POST request to ‘/blog/new-… |
CVE-2026-27094 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoDaddy CoBlocks coblocks allows Stored XSS.This issue af… |
CVE-2026-27092 | Medium | 6.5 | 2026-02-19 | Missing Authorization vulnerability in Greg Winiarski WPAdverts wpadverts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2026-27090 | Medium | 4.3 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in WP Moose Kenta Companion kenta-companion allows Cross Site Request Forgery.This issue affects Kenta Companio… |
CVE-2026-27074 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vaakash Shortcoder shortcoder allows Stored XSS.This issu… |
CVE-2026-27069 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad soledad allows DOM-Based XSS.This iss… |
CVE-2026-27059 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Recipe penci-recipe allows DOM-Based XS… |
CVE-2026-27058 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Podcast penci-podcast allows DOM-Based… |
CVE-2026-27057 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Filter Everything penci-filter-everythi… |
CVE-2026-27056 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in StellarWP iThemes Sync ithemes-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-27055 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in PenciDesign Penci AI SmartContent Creator penci-ai allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-27052 | High | 7.5 | 2026-02-19 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in villatheme Sales Countdown Timer for W… |
CVE-2026-27050 | Medium | 5.4 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress RealPress realpress allows Cross Site Request Forgery.This issue affects RealPress: from n/a throu… |
CVE-2026-27042 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in WPDeveloper NotificationX notificationx allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-26362 | High | 8.1 | 2026-02-19 | Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentiall… |
CVE-2026-26361 | Medium | 6.5 | 2026-02-19 | Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access c… |
CVE-2026-26360 | High | 8.1 | 2026-02-19 | Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access c… |
CVE-2026-26359 | High | 8.8 | 2026-02-19 | Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access c… |
CVE-2026-26358 | High | 8.8 | 2026-02-19 | Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially… |
CVE-2026-25473 | Medium | 5.4 | 2026-02-19 | Missing Authorization vulnerability in AA-Team WZone woozone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WZone… |
CVE-2026-25472 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows Stored X… |
CVE-2026-25463 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpEstate Wpresidence Core wpresidence-core allows Stored… |
CVE-2026-25459 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in uixthemes Sober sober allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sober… |
CVE-2026-25453 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mdempfle Advanced iFrame advanced-iframe allows DOM-Based… |
CVE-2026-25451 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Sto… |
CVE-2026-25441 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in varunvairavanlc LeadConnector leadconnector allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-25432 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows Stored XSS.This… |
CVE-2026-25428 | Medium | 4.4 | 2026-02-19 | Server-Side Request Forgery (SSRF) vulnerability in totalsoft TS Poll poll-wp allows Server Side Request Forgery.This issue affects TS Poll: from n/a through <… |
CVE-2026-25423 | Low | 3.8 | 2026-02-19 | Missing Authorization vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite allows Exploiting Incorrectly Configured Access Control S… |
CVE-2026-25422 | Medium | 5.4 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in Themes4WP Popularis Extra popularis-extra allows Cross Site Request Forgery.This issue affects Popularis Ext… |
CVE-2026-25420 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in MailerLite MailerLite official-mailerlite-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-25419 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-25418 | High | 7.6 | 2026-02-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bit Apps Bit Form bit-form allows SQL Injection.This issu… |
CVE-2026-25416 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-25415 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2026-25411 | Medium | 4.3 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in themastercut Revision Manager TMC revision-manager-tmc allows Cross Site Request Forgery.This issue affects… |
CVE-2026-25410 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in tstephenson WP-CORS wp-cors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects W… |
CVE-2026-25409 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in crgeary JAMstack Deployments wp-jamstack-deployments allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-25408 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in PluginRx Broken Link Notifier broken-link-notifier allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-25407 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in cookiebot Cookiebot cookiebot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-25404 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in Automattic WP Job Manager wp-job-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-25402 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in echoplugins Knowledge Base for Documentation, FAQs with AI Assistance echo-knowledge-base allows Exploiting Incorrectly… |
CVE-2026-25399 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in CryoutCreations Serious Slider cryout-serious-slider allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-25395 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in ikreatethemes Business Roy business-roy allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |