2026 CVEs (page 409)
Page 409 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-25394 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in sparklewpthemes Fitness FSE fitness-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-25393 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in sparklewpthemes Hello FSE hello-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-25392 | Medium | 4.7 | 2026-02-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in KaizenCoders Update URLs – Quick and Easy way to search old links and replace them with ne… |
CVE-2026-25391 | Medium | 5.4 | 2026-02-19 | Missing Authorization vulnerability in WP Grids WP Wand ai-content-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2026-25389 | Medium | 5.3 | 2026-02-19 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Re… |
CVE-2026-25388 | Medium | 5.4 | 2026-02-19 | Missing Authorization vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-25387 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in Elementor Image Optimizer by Elementor image-optimization allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-25386 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in Elementor Ally pojo-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2026-25385 | Medium | 5.5 | 2026-02-19 | Server-Side Request Forgery (SSRF) vulnerability in KaizenCoders URL Shortify url-shortify allows Server Side Request Forgery.This issue affects URL Shortify… |
CVE-2026-25384 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2026-25378 | High | 7.6 | 2026-02-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows B… |
CVE-2026-25375 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Acc… |
CVE-2026-25374 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in raratheme Spa and Salon spa-and-salon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-25372 | Medium | 6.5 | 2026-02-19 | Missing Authorization vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2026-25370 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2026-25368 | Medium | 6.5 | 2026-02-19 | Missing Authorization vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-25367 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in NooTheme CitiLights noo-citilights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2026-25364 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2026-25363 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in FooPlugins FooGallery foogallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2026-25362 | Medium | 5.9 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FooPlugins FooGallery foogallery allows Stored XSS.This i… |
CVE-2026-25348 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in alttextai Download Alt Text AI alttext-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-25343 | Medium | 5.9 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS wp-sms allows DOM-Based XSS.This issue… |
CVE-2026-25338 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Exploiting Incorrectly Configu… |
CVE-2026-25337 | Medium | 5.4 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in wpcoachify Coachify coachify allows Cross Site Request Forgery.This issue affects Coachify: from n/a through… |
CVE-2026-25336 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in wpcoachify Coachify coachify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-25335 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection allows Exploiting Incorrectly… |
CVE-2026-25333 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in peregrinethemes Shopwell shopwell allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2026-25332 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in Fahad Mahmood Endless Posts Navigation endless-posts-navigation allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-25331 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows DO… |
CVE-2026-25330 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in PublishPress PublishPress Authors publishpress-authors allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-25329 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2026-25326 | High | 7.5 | 2026-02-19 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cmsmasters CMSMasters Content Composer… |
CVE-2026-25325 | Medium | 5.3 | 2026-02-19 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress buddypress-med… |
CVE-2026-25324 | Medium | 5.3 | 2026-02-19 | Authorization Bypass Through User-Controlled Key vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Con… |
CVE-2026-25323 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in MiKa OSM osm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OSM: from n/a th… |
CVE-2026-25322 | Medium | 5.4 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in PublishPress PublishPress Revisions revisionary allows Cross Site Request Forgery.This issue affects Publish… |
CVE-2026-25321 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in PSM Plugins SupportCandy supportcandy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-25320 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in Cool Plugins Elementor Contact Form DB sb-elementor-contact-form-db allows Exploiting Incorrectly Configured Access Cont… |
CVE-2026-25319 | Medium | 4.3 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in wpzita Zita Elementor Site Library zita-site-library allows Cross Site Request Forgery.This issue affects Zi… |
CVE-2026-25318 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in Wisernotify team WiserReview Product Reviews for WooCommerce wiser-review allows Exploiting Incorrectly Configured Acces… |
CVE-2026-25316 | High | 7.2 | 2026-02-19 | Deserialization of Untrusted Data vulnerability in Brainstorm Force CartFlows cartflows allows Object Injection.This issue affects CartFlows: from n/a through… |
CVE-2026-25315 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in hcaptcha hCaptcha for WP hcaptcha-for-forms-and-more allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-25314 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in WP Messiah TOP Table Of Contents top-table-of-contents allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-25313 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in Shahjahan Jewel FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-25311 | Medium | 5.4 | 2026-02-19 | Missing Authorization vulnerability in 10up Autoshare for Twitter autoshare-for-twitter allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-25310 | Medium | 4.9 | 2026-02-19 | Server-Side Request Forgery (SSRF) vulnerability in Alobaidi Extend Link extend-link allows Server Side Request Forgery.This issue affects Extend Link: from n/… |
CVE-2026-25308 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in wp.insider Simple Membership simple-membership allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2026-25307 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.Th… |
CVE-2026-25305 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows DOM-Based XSS.This issue affe… |
CVE-2026-25008 | Medium | 4.3 | 2026-02-19 | Insertion of Sensitive Information Into Sent Data vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2026-25006 | Medium | 5.3 | 2026-02-19 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XS… |
CVE-2026-25005 | Medium | 5.3 | 2026-02-19 | Authorization Bypass Through User-Controlled Key vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Exploiting Incorrectly Configu… |
CVE-2026-25004 | Medium | 5.9 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Business Directory cm-business-… |
CVE-2026-25003 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in madalin.ungureanu Client Portal client-portal allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-25000 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in Kraft Plugins Wheel of Life wheel-of-life allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-24999 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in Alma Alma alma-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2026-24392 | Medium | 5.9 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nabil Lemsieh HurryTimer hurrytimer allows Stored XSS.Thi… |
CVE-2026-24375 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in WP Swings Ultimate Gift Cards For WooCommerce woo-gift-cards-lite allows Exploiting Incorrectly Configured Access Contro… |
CVE-2026-23805 | High | 7.6 | 2026-02-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yoren Chang Media Search Enhanced media-search-enhanced a… |
CVE-2026-23804 | Medium | 5.4 | 2026-02-19 | Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2026-23803 | Medium | 6.4 | 2026-02-19 | Server-Side Request Forgery (SSRF) vulnerability in Burhan Nasir Smart Auto Upload Images smart-auto-upload-images allows Server Side Request Forgery.This issu… |
CVE-2026-23549 | Critical | 9.8 | 2026-02-19 | Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a thro… |
CVE-2026-23548 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in Designinvento DirectoryPress directorypress allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-23547 | High | 7.1 | 2026-02-19 | Missing Authorization vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows Exploiting Incorrectly Configured Access Contr… |
CVE-2026-23545 | Medium | 6.5 | 2026-02-19 | Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-23544 | High | 8.8 | 2026-02-19 | Deserialization of Untrusted Data vulnerability in codetipi Valenti valenti allows Object Injection.This issue affects Valenti: from n/a through <= 5.6.3.5. |
CVE-2026-23543 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured… |
CVE-2026-23542 | Critical | 9.8 | 2026-02-19 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: fro… |
CVE-2026-23541 | High | 7.5 | 2026-02-19 | Missing Authorization vulnerability in WPFunnels Mail Mint mail-mint allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mail Mi… |
CVE-2026-22422 | Medium | 5.3 | 2026-02-19 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in wpeverest Everest Forms everest-forms allows Code Injection.This… |
CVE-2026-22333 | High | 7.2 | 2026-02-19 | Deserialization of Untrusted Data vulnerability in YITHEMES YITH WooCommerce Compare yith-woocommerce-compare allows Object Injection.This issue affects YITH W… |
CVE-2026-22269 | Medium | 4.7 | 2026-02-19 | Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel vulnerability in the REST A… |
CVE-2026-2733 | Low | 3.8 | 2026-02-19 | A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been adm… |
CVE-2026-2711 | Medium | 5.6 | 2026-02-19 | A vulnerability has been found in zhutoutoutousan worldquant-miner up to 1.0.9. The impacted element is an unknown function of the file worldquant-miner-master… |
CVE-2026-2731 | | 2026-02-19 | Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allows unauthenticated attackers to execute… | |
CVE-2026-2709 | Low | 3.5 | 2026-02-19 | A flaw has been found in busy up to 2.5.5. The affected element is an unknown function of the file source-code/busy-master/src/server/app.js of the component C… |
CVE-2026-2706 | Medium | 6.3 | 2026-02-19 | A flaw has been found in code-projects Patient Record Management System 1.0. This affects an unknown function of the file /fecalysis_not.php. This manipulation… |
CVE-2026-2705 | Medium | 4.3 | 2026-02-19 | A vulnerability was detected in Open Babel up to 3.1.1. The impacted element is the function OBAtom::SetFormalCharge in the library include/openbabel/atom.h of… |
CVE-2026-2704 | Medium | 4.3 | 2026-02-19 | A security vulnerability has been detected in Open Babel up to 3.1.1. The affected element is the function OpenBabel::transform3d::DescribeAsString of the file… |
CVE-2026-2703 | Low | 3.3 | 2026-02-19 | A weakness has been identified in xlnt-community xlnt up to 1.6.1. Impacted is the function xlnt::detail::decode_base64 of the file source/detail/cryptography/… |
CVE-2026-2702 | Low | 3.1 | 2026-02-19 | A security flaw has been discovered in Beetel 777VR1 up to 01.00.09. This issue affects some unknown processing of the component WPA2 PSK. Performing a manipul… |
CVE-2026-2693 | Medium | 4.3 | 2026-02-19 | A vulnerability was determined in CoCoTeaNet CyreneAdmin up to 1.3.0. This vulnerability affects unknown code of the file /api/system/dashboard/getCount of the… |
CVE-2026-2692 | Medium | 4.3 | 2026-02-19 | A vulnerability was found in CoCoTeaNet CyreneAdmin up to 1.3.0. This affects an unknown part of the file /api/system/user/getAvatar of the component Image Han… |
CVE-2026-2691 | High | 7.3 | 2026-02-19 | A vulnerability has been found in itsourcecode Event Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/manage_regi… |
CVE-2026-2690 | High | 7.3 | 2026-02-19 | A flaw has been found in itsourcecode Event Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?actio… |
CVE-2026-2689 | High | 7.3 | 2026-02-19 | A vulnerability was detected in itsourcecode Event Management System 1.0. Affected is an unknown function of the file /admin/manage_booking.php. The manipulati… |
CVE-2026-2681 | Medium | 5.3 | 2026-02-19 | A flaw was found in the blst cryptographic library. This out-of-bounds stack write vulnerability, specifically in the blst_sha256_bcopy assembly routine, occur… |
CVE-2026-2504 | Medium | 4.3 | 2026-02-19 | The Dealia – Request a quote plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on multiple AJAX handlers… |
CVE-2026-2502 | Medium | 6.1 | 2026-02-19 | The xmlrpc attacks blocker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0, via the 'X-Forwarded-For' H… |
CVE-2026-2284 | Medium | 5.4 | 2026-02-19 | The News Element Elementor Blog Magazine plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.8. This is due t… |
CVE-2026-2282 | Medium | 4.4 | 2026-02-19 | The Slidorion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insuffici… |
CVE-2026-25474 | High | 7.5 | 2026-02-19 | OpenClaw is a personal AI assistant. In versions 2026.1.30 and below, if channels.telegram.webhookSecret is not set when in Telegram webhook mode, OpenClaw may… |
CVE-2026-25242 | Critical | 9.8 | 2026-02-19 | Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigni… |
CVE-2026-25232 | High | 8.8 | 2026-02-19 | Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator… |
CVE-2026-25229 | Medium | 6.5 | 2026-02-19 | Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with writ… |
CVE-2026-25120 | Low | 2.7 | 2026-02-19 | Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongs to the repository… |
CVE-2026-24764 | Low | 3.7 | 2026-02-19 | OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. In versions 2026.2.2 and below, when the Slack integration is enabled… |
CVE-2026-1994 | Critical | 9.8 | 2026-02-19 | The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the p… |
CVE-2026-1646 | Medium | 6.4 | 2026-02-19 | The Advance Block Extend plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TitleColor block attribute in the Latest Posts Gutenberg blo… |
CVE-2026-1455 | Medium | 4.3 | 2026-02-19 | The Whatsiplus Scheduled Notification for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1… |