2026 CVEs (page 424)
Page 424 of 682 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54802 | High | 7.5 | 2026-06-17 | Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions. |
CVE-2026-54196 | Medium | 6.8 | 2026-06-17 | Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation. This issue affects JetFormBuilder: from n/a through 3… |
CVE-2026-54195 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions. |
CVE-2026-54194 | Critical | 9.8 | 2026-06-17 | Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions. |
CVE-2026-54192 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions. |
CVE-2026-54189 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. |
CVE-2026-54188 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. |
CVE-2026-54187 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions. |
CVE-2026-54186 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions. |
CVE-2026-54185 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in Cornerstone < 7.8.8 versions. |
CVE-2026-54184 | High | 8.2 | 2026-06-17 | Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions. |
CVE-2026-53876 | High | 7.2 | 2026-06-17 | RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary command execution with the root privileg… |
CVE-2026-52706 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions. |
CVE-2026-52705 | Critical | 9.0 | 2026-06-17 | Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions. |
CVE-2026-52698 | High | 7.4 | 2026-06-17 | Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions. |
CVE-2026-52696 | High | 7.5 | 2026-06-17 | Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions. |
CVE-2026-50203 | Critical | 9.1 | 2026-06-17 | A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write f… |
CVE-2026-49778 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions. |
CVE-2026-49767 | Critical | 9.8 | 2026-06-17 | Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions. |
CVE-2026-49113 | High | 8.5 | 2026-06-17 | Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions. |
CVE-2026-49107 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions. |
CVE-2026-49084 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions. |
CVE-2026-49081 | High | 8.2 | 2026-06-17 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions. |
CVE-2026-49080 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions. |
CVE-2026-49079 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions. |
CVE-2026-49076 | Critical | 9.3 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows Blind SQL Injectio… |
CVE-2026-49075 | Critical | 9.8 | 2026-06-17 | Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions. |
CVE-2026-49074 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions. |
CVE-2026-49073 | High | 8.5 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist Booking allows Blind SQL Injection. Th… |
CVE-2026-49072 | Medium | 6.5 | 2026-06-17 | Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions. |
CVE-2026-49071 | Medium | 6.5 | 2026-06-17 | Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions. |
CVE-2026-49058 | Critical | 9.8 | 2026-06-17 | Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions. |
CVE-2026-49057 | High | 7.5 | 2026-06-17 | Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions. |
CVE-2026-48967 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions. |
CVE-2026-48929 | High | 7.5 | 2026-06-17 | Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMes… |
CVE-2026-48875 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions. |
CVE-2026-48869 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions. |
CVE-2026-48797 | | 2026-06-17 | Backpropagate is a Python library for fine-tuning large language models on a single GPU. In versions 1.1.0 and 1.1.1, the optional Reflex web UI exposes a trai… | |
CVE-2026-48788 | High | 8.2 | 2026-06-17 | Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-… |
CVE-2026-48783 | Medium | 4.8 | 2026-06-17 | Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscript… |
CVE-2026-48782 | Medium | 6.8 | 2026-06-17 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2, t… |
CVE-2026-48781 | Critical | 9.9 | 2026-06-17 | Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an attacker-controlled JSON blob into a sessio… |
CVE-2026-48779 | High | 7.5 | 2026-06-17 | ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to… |
CVE-2026-48745 | Critical | 9.3 | 2026-06-17 | Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and belo… |
CVE-2026-48616 | Critical | 9.3 | 2026-06-17 | Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads… |
CVE-2026-48055 | Critical | 10.0 | 2026-06-17 | Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability… |
CVE-2026-47340 | Medium | 6.5 | 2026-06-17 | Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler. This issue… |
CVE-2026-47277 | Medium | 6.5 | 2026-06-17 | Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos from files inside cloned app-store reposit… |
CVE-2026-45436 | Medium | 6.5 | 2026-06-17 | Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions. |
CVE-2026-44587 | Medium | 4.7 | 2026-06-17 | CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex… |
CVE-2026-42629 | High | 8.8 | 2026-06-17 | Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions. |
CVE-2026-42385 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions. |
CVE-2026-42380 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions. |
CVE-2026-42357 | Medium | 6.5 | 2026-06-17 | Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. This i… |
CVE-2026-41557 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions. |
CVE-2026-41280 | Medium | 4.9 | 2026-06-17 | Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache… |
CVE-2026-40783 | Critical | 9.9 | 2026-06-17 | Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions. |
CVE-2026-40768 | High | 7.3 | 2026-06-17 | Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions. |
CVE-2026-40765 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions. |
CVE-2026-40761 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions. |
CVE-2026-40760 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Behold <= 1.5 versions. |
CVE-2026-40759 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Esmée <= 1.4 versions. |
CVE-2026-40758 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions. |
CVE-2026-40755 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in TechLink <= 1.3 versions. |
CVE-2026-40754 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Roisin <= 1.4 versions. |
CVE-2026-40753 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions. |
CVE-2026-40751 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions. |
CVE-2026-40749 | Critical | 9.9 | 2026-06-17 | Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions. |
CVE-2026-40748 | Critical | 9.9 | 2026-06-17 | Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 versions. |
CVE-2026-40747 | Critical | 9.9 | 2026-06-17 | Subscriber Arbitrary File Upload in Ecommerce Zone <= 0.9.7 versions. |
CVE-2026-40746 | Critical | 9.9 | 2026-06-17 | Subscriber Arbitrary File Upload in Restaurant Zone <= 0.7.8 versions. |
CVE-2026-40739 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions. |
CVE-2026-40736 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions. |
CVE-2026-40735 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Reina <= 2.1 versions. |
CVE-2026-40731 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions. |
CVE-2026-40726 | High | 8.2 | 2026-06-17 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions. |
CVE-2026-40725 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions. |
CVE-2026-40724 | Medium | 6.5 | 2026-06-17 | CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions. |
CVE-2026-40723 | Medium | 4.3 | 2026-06-17 | Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions. |
CVE-2026-40722 | Medium | 5.5 | 2026-06-17 | Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects… |
CVE-2026-40721 | High | 7.5 | 2026-06-17 | Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions. |
CVE-2026-39598 | High | 8.0 | 2026-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell to a Web Server. This issue affects Aca… |
CVE-2026-39597 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions. |
CVE-2026-39596 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions. |
CVE-2026-39595 | Medium | 4.7 | 2026-06-17 | Author Broken Access Control in W3 Total Cache <= 2.9.1 versions. |
CVE-2026-39589 | Critical | 9.9 | 2026-06-17 | Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions. |
CVE-2026-39582 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions. |
CVE-2026-39580 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions. |
CVE-2026-39578 | Medium | 5.5 | 2026-06-17 | Unauthenticated PHP Object Injection in Valiance <= 1.2 versions. |
CVE-2026-39577 | Medium | 5.5 | 2026-06-17 | Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions. |
CVE-2026-39573 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions. |
CVE-2026-39568 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions. |
CVE-2026-39567 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions. |
CVE-2026-39558 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Malmö <= 2.2 versions. |
CVE-2026-39557 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions. |
CVE-2026-39554 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions. |
CVE-2026-39549 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions. |
CVE-2026-39548 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions. |
CVE-2026-39547 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Getaway < 1.8 versions. |
CVE-2026-39546 | High | 7.6 | 2026-06-17 | Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions. |