2026 CVEs (page 425)
Page 425 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-24667 | Medium | 5.0 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, failure to invalidate active user sessi… |
CVE-2026-24666 | Medium | 6.5 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Cross-Site Request Forgery (CSRF) vul… |
CVE-2026-24665 | High | 8.7 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a stored Cross-Site Scripting (XSS) vul… |
CVE-2026-24664 | Medium | 5.3 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a username enumeration vulnerability al… |
CVE-2026-22228 | Medium | 4.9 | 2026-02-03 | An authenticated user with high privileges may trigger a denial‑of‑service condition in TP-Link Archer BE230 v1.2 by restoring a crafted configuration file con… |
CVE-2026-22220 | Medium | 4.5 | 2026-02-03 | A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to cause the device’s web… |
CVE-2026-1568 | Critical | 9.6 | 2026-02-03 | Rapid7 InsightVM versions before 8.34.0 contain a signature verification issue on the Assertion Consumer Service (ACS) cloud endpoint that could allow an attac… |
CVE-2026-24762 | High | 7.5 | 2026-02-03 | RustFS is a distributed object storage system built in Rust. From versions alpha.13 to alpha.81, RustFS logs sensitive credential material (access key, secret… |
CVE-2026-23795 | Medium | 4.9 | 2026-02-03 | Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Ke… |
CVE-2026-23794 | Medium | 6.8 | 2026-02-03 | Reflected XSS in Apache Syncope's Enduser Login page. An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduse… |
CVE-2026-21862 | High | 7.5 | 2026-02-03 | RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: get_condition_values trusts cl… |
CVE-2026-25036 | Medium | 6.5 | 2026-02-03 | Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-25028 | Medium | 5.4 | 2026-02-03 | Missing Authorization vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Exploiting Incorrectly Co… |
CVE-2026-25027 | High | 7.5 | 2026-02-03 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Unicamp unicamp allows PHP L… |
CVE-2026-25024 | Medium | 5.4 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Cross Site Request Forgery.This issue affects Thir… |
CVE-2026-25023 | Medium | 5.3 | 2026-02-03 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in mdedev Run Contests, Raffles, and Giveaways with ContestsWP contest… |
CVE-2026-25022 | High | 8.5 | 2026-02-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system… |
CVE-2026-25021 | Medium | 5.4 | 2026-02-03 | Missing Authorization vulnerability in Mizan Themes Mizan Demo Importer mizan-demo-importer allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-25020 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in WP connect WP Sync for Notion wp-sync-for-notion allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-25019 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-25016 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Nelio Software Nelio Popups nelio-popups allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-25015 | Medium | 4.3 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1… |
CVE-2026-25014 | Medium | 4.3 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in themelooks Enter Addons enteraddons allows Cross Site Request Forgery.This issue affects Enter Addons: from… |
CVE-2026-25012 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in gfazioli WP Bannerize Pro wp-bannerize-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-25011 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured A… |
CVE-2026-25010 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in ILLID Share This Image share-this-image allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-24998 | Medium | 5.3 | 2026-02-03 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hustle wordpress-popu… |
CVE-2026-24997 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in Wired Impact Wired Impact Volunteer Management wired-impact-volunteer-management allows Exploiting Incorrectly Configure… |
CVE-2026-24996 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in wpelemento WPElemento Importer wpelemento-importer allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-24995 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-24994 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-24992 | Medium | 5.3 | 2026-02-03 | Insertion of Sensitive Information Into Sent Data vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-s… |
CVE-2026-24991 | Medium | 5.3 | 2026-02-03 | Authorization Bypass Through User-Controlled Key vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Exploiting Incorrectly Configured Acc… |
CVE-2026-24990 | Medium | 5.4 | 2026-02-03 | Missing Authorization vulnerability in Fahad Mahmood WP Docs wp-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-24988 | Medium | 6.5 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Hogg The Events Calendar Shortcode & Block the-even… |
CVE-2026-24986 | Medium | 5.4 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in wp.insider Simple Membership WP user Import simple-membership-wp-user-import allows Cross Site Request Forge… |
CVE-2026-24985 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in approveme WP Forms Signature Contract Add-On wp-forms-signature-contract-add-on allows Exploiting Incorrectly Configured… |
CVE-2026-24984 | Medium | 6.5 | 2026-02-03 | Missing Authorization vulnerability in Brecht Visual Link Preview visual-link-preview allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2026-24982 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-24967 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in ameliabooking Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2026-24966 | Medium | 4.3 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in Copyscape Copyscape Premium copyscape-premium allows Cross Site Request Forgery.This issue affects Copyscape… |
CVE-2026-24965 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Exploiting Incorrectly Configured Acc… |
CVE-2026-24962 | Medium | 4.3 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Sigmize sigmize allows Cross Site Request Forgery.This issue affects Sigmize: from n/a thro… |
CVE-2026-24961 | Medium | 5.4 | 2026-02-03 | Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Server Side Request Forgery.This issue affects Grand Blog: from n/a… |
CVE-2026-24958 | Medium | 6.5 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows… |
CVE-2026-24957 | Medium | 6.5 | 2026-02-03 | Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-24954 | High | 8.8 | 2026-02-03 | Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a thro… |
CVE-2026-24952 | Medium | 6.5 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple… |
CVE-2026-24951 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCr… |
CVE-2026-24947 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Contr… |
CVE-2026-24945 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured… |
CVE-2026-24942 | Medium | 4.3 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in magepeopleteam WpEvently mage-eventpress allows Cross Site Request Forgery.This issue affects WpEvently: fro… |
CVE-2026-24940 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Themefic Travelfic Toolkit travelfic-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-24939 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-24938 | Medium | 5.9 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Better Search better-search allows Stored XSS.This i… |
CVE-2026-1814 | | 2026-02-03 | Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. Wh… | |
CVE-2026-1312 | Medium | 5.4 | 2026-02-03 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases con… |
CVE-2026-1287 | Medium | 5.4 | 2026-02-03 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via con… |
CVE-2026-1285 | High | 7.5 | 2026-02-03 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (w… |
CVE-2026-1207 | Medium | 5.4 | 2026-02-03 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows r… |
CVE-2026-1664 | | 2026-02-03 | Summary An Insecure Direct Object Reference has been found to exist in `createHeaderBasedEmailResolver()` function within the Cloudflare Agents SDK. The issue… | |
CVE-2026-1432 | | 2026-02-03 | SQL injection vulnerability in the Buroweb platform version 2505.0.12, specifically in the 'tablon' component. This vulnerability is present in several paramet… | |
CVE-2026-1730 | High | 8.8 | 2026-02-03 | The OS DataHub Maps plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'OS_DataHub_Maps_Admin::add_file_… |
CVE-2026-1592 | Medium | 6.3 | 2026-02-03 | Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user input is embedded int… |
CVE-2026-1591 | Medium | 6.3 | 2026-02-03 | Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the u… |
CVE-2026-1375 | High | 8.1 | 2026-02-03 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and… |
CVE-2026-1371 | Medium | 5.3 | 2026-02-03 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2026-24465 | Critical | 9.8 | 2026-02-03 | Stack-based buffer overflow vulnerability exists in ELECOM wireless LAN access point devices. A crafted packet may lead to arbitrary code execution. |
CVE-2026-24449 | Medium | 4.6 | 2026-02-03 | For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information. |
CVE-2026-22550 | High | 8.8 | 2026-02-03 | OS command injection vulnerability exists in ELECOM wireless LAN products. A crafted request from a logged-in user may lead to an arbitrary OS command executio… |
CVE-2026-20704 | Medium | 4.3 | 2026-02-03 | Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, u… |
CVE-2026-1447 | Medium | 5.4 | 2026-02-03 | The Mail Mint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.19.2. This is due to missing nonce valid… |
CVE-2026-1210 | Medium | 6.4 | 2026-02-03 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_elementor_data' meta field in all versions up to, an… |
CVE-2026-1065 | High | 7.2 | 2026-02-03 | The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plu… |
CVE-2026-1058 | High | 7.1 | 2026-02-03 | The Form Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via hidden field values in all versions up to, and including, 1.15.35. This is… |
CVE-2026-0617 | High | 7.2 | 2026-02-03 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer profile… |
CVE-2026-24694 | High | 7.8 | 2026-02-03 | The installer for Roland Cloud Manager ver.3.1.19 and prior insecurely loads Dynamic Link Libraries (DLLs), which could allow an attacker to execute arbitrary… |
CVE-2026-0950 | Medium | 5.3 | 2026-02-03 | The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and inc… |
CVE-2026-24936 | Critical | 9.8 | 2026-02-03 | When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowin… |
CVE-2026-1788 | | 2026-02-03 | : Out-of-bounds Write vulnerability in Xquic Project Xquic Server xquic on Linux (QUIC protocol implementation, packet processing module modules) allows : Buff… | |
CVE-2026-0909 | Medium | 5.3 | 2026-02-03 | The WP ULike plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.8.3.1. This is due to the `wp_ulike… |
CVE-2026-0383 | High | 7.8 | 2026-02-03 | A vulnerability in Brocade Fabric OS could allow an authenticated, local attacker with privileges to access the Bash shell to access insecurely stored file con… |
CVE-2026-24935 | Medium | 5.6 | 2026-02-03 | A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While subsequent access to device services r… |
CVE-2026-24934 | Low | 3.7 | 2026-02-03 | The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the device's WAN IP addres… |
CVE-2026-24933 | Medium | 5.9 | 2026-02-03 | The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the server. An improper certificates validation vulner… |
CVE-2026-24932 | Medium | 5.9 | 2026-02-03 | The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certificate. Although the connection uses HTTPS, an improp… |
CVE-2026-25228 | Medium | 5.0 | 2026-02-02 | Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationDa… |
CVE-2026-25222 | High | 7.5 | 2026-02-02 | PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, a timing attack vulnerability in the sign-in process allows unauthentica… |
CVE-2026-25221 | High | 8.1 | 2026-02-02 | PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vu… |
CVE-2026-25144 | Medium | 5.3 | 2026-02-02 | Talishar is a fan-made Flesh and Blood project. A Stored XSS exists in the chat in-game system. The playerID parameter in SubmitChat.php and is saved without s… |
CVE-2026-25142 | Critical | 10.0 | 2026-02-02 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obtain prototypes, whi… |
CVE-2026-25137 | Critical | 9.1 | 2026-02-02 | The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database m… |
CVE-2026-25134 | High | 8.8 | 2026-02-02 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes an… |
CVE-2026-25060 | High | 8.1 | 2026-02-02 | OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The T… |
CVE-2026-25059 | High | 8.8 | 2026-02-02 | OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in… |
CVE-2026-24763 | High | 8.8 | 2026-02-02 | OpenClaw (formerly Clawdbot) is a personal AI assistant you run on your own devices. Prior to 2026.1.29, a command injection vulnerability existed in OpenClaw… |
CVE-2026-24737 | High | 8.1 | 2026-02-02 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitra… |
CVE-2026-24471 | | 2026-02-02 | continuwuity is a Matrix homeserver written in Rust. This vulnerability allows an attacker with a malicious remote server to cause the local server to sign an… | |
CVE-2026-24133 | Medium | 6.5 | 2026-02-02 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addImage method results in denial of service. If g… |
CVE-2026-24051 | High | 7.0 | 2026-02-02 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Searc… |