2026 CVEs (page 45)
Page 45 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15208 | Medium | 5.3 | 2026-08-06 | The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registra… |
CVE-2026-15152 | Medium | 5.3 | 2026-08-06 | The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account… |
CVE-2026-15149 | Medium | 5.3 | 2026-08-06 | The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking… |
CVE-2026-15147 | Medium | 5.3 | 2026-08-06 | The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate th… |
CVE-2026-14936 | Medium | 5.3 | 2026-08-06 | The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account b… |
CVE-2026-14842 | Medium | 5.3 | 2026-08-06 | The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated… |
CVE-2026-14831 | Medium | 5.3 | 2026-08-06 | The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to c… |
CVE-2026-14812 | Critical | 10.0 | 2026-08-06 | The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enabl… |
CVE-2026-14306 | Medium | 4.3 | 2026-08-06 | The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated us… |
CVE-2026-14225 | Low | 2.7 | 2026-08-06 | The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the firs… |
CVE-2026-13399 | High | 7.5 | 2026-08-06 | The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticate… |
CVE-2026-13342 | Medium | 5.3 | 2026-08-06 | The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing t… |
CVE-2026-12901 | Medium | 5.9 | 2026-08-06 | The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to f… |
CVE-2026-12584 | High | 7.5 | 2026-08-06 | The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity of incoming payment-provider notifications for… |
CVE-2026-12501 | Medium | 5.3 | 2026-08-06 | The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant acco… |
CVE-2026-11976 | Critical | 10.0 | 2026-08-06 | The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the ve… |
CVE-2026-11803 | High | 7.8 | 2026-08-06 | A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerab… |
CVE-2026-11361 | Medium | 5.9 | 2026-08-06 | The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing… |
CVE-2026-10599 | High | 7.5 | 2026-08-06 | The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked a… |
CVE-2026-10524 | High | 7.5 | 2026-08-06 | The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart throug… |
CVE-2026-68750 | High | 7.5 | 2026-08-06 | Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server… |
CVE-2026-68749 | High | 7.5 | 2026-08-06 | Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust ser… |
CVE-2026-68747 | Medium | 6.1 | 2026-08-06 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex… |
CVE-2026-66843 | Medium | 6.1 | 2026-08-06 | Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a docu… |
CVE-2026-66829 | Medium | 6.1 | 2026-08-06 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors o… |
CVE-2026-66370 | Medium | 6.1 | 2026-08-06 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to… |
CVE-2026-5423 | | 2026-08-06 | @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription… | |
CVE-2026-53985 | High | 7.5 | 2026-08-06 | Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows a… |
CVE-2026-53977 | High | 7.5 | 2026-08-06 | OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a PO… |
CVE-2026-43622 | High | 7.8 | 2026-08-06 | llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() wh… |
CVE-2026-3430 | High | 8.6 | 2026-08-06 | The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated… |
CVE-2026-19047 | Medium | 5.3 | 2026-08-06 | A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/… |
CVE-2026-19046 | Low | 3.3 | 2026-08-06 | A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown function of the file src/tools/ludusEnvir… |
CVE-2026-18427 | High | 7.5 | 2026-08-06 | @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segm… |
CVE-2026-18359 | High | 8.5 | 2026-08-06 | Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the ser… |
CVE-2026-18277 | High | 7.1 | 2026-08-06 | Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselv… |
CVE-2026-18276 | Medium | 4.3 | 2026-08-06 | Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event… |
CVE-2026-18275 | Medium | 6.5 | 2026-08-06 | Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segme… |
CVE-2026-18258 | High | 8.8 | 2026-08-06 | Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote a… |
CVE-2026-70646 | High | 7.5 | 2026-08-06 | aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body bef… |
CVE-2026-70637 | Medium | 5.9 | 2026-08-06 | LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST follow… |
CVE-2026-67261 | Critical | 9.8 | 2026-08-06 | Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI component… |
CVE-2026-66712 | High | 7.5 | 2026-08-06 | Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions. |
CVE-2026-66711 | High | 7.1 | 2026-08-06 | Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions. |
CVE-2026-66710 | High | 8.1 | 2026-08-06 | Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions. |
CVE-2026-66709 | Critical | 9.1 | 2026-08-06 | Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions. |
CVE-2026-66708 | High | 8.2 | 2026-08-06 | Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions. |
CVE-2026-66707 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions. |
CVE-2026-66706 | Medium | 5.9 | 2026-08-06 | Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions. |
CVE-2026-66705 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions. |
CVE-2026-66703 | Medium | 6.5 | 2026-08-06 | Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions. |
CVE-2026-66702 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions. |
CVE-2026-66701 | Medium | 5.3 | 2026-08-06 | Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions. |
CVE-2026-66699 | Medium | 5.3 | 2026-08-06 | Custom role Broken Access Control in Dokan <= 5.0.10 versions. |
CVE-2026-66696 | Medium | 4.3 | 2026-08-06 | Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions. |
CVE-2026-66695 | Medium | 6.5 | 2026-08-06 | Unauthenticated Path Traversal in W3 Total Cache <= 2.10.2 versions. |
CVE-2026-66694 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions. |
CVE-2026-66692 | Medium | 4.3 | 2026-08-06 | Customer Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions. |
CVE-2026-66690 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions. |
CVE-2026-66688 | Medium | 6.5 | 2026-08-06 | Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions. |
CVE-2026-66686 | Medium | 6.5 | 2026-08-06 | Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions. |
CVE-2026-66685 | Medium | 5.3 | 2026-08-06 | Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions. |
CVE-2026-66684 | Medium | 5.3 | 2026-08-06 | Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions. |
CVE-2026-66683 | Medium | 5.3 | 2026-08-06 | Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions. |
CVE-2026-66681 | Medium | 4.3 | 2026-08-06 | Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions. |
CVE-2026-66678 | Medium | 4.3 | 2026-08-06 | Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions. |
CVE-2026-66665 | Critical | 10.0 | 2026-08-06 | Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions. |
CVE-2026-66664 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions. |
CVE-2026-66663 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions. |
CVE-2026-66662 | Critical | 9.8 | 2026-08-06 | Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions. |
CVE-2026-66470 | High | 7.1 | 2026-08-06 | Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions. |
CVE-2026-66457 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Events Manager <= 7.4.1 versions. |
CVE-2026-66452 | Medium | 6.5 | 2026-08-06 | Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions. |
CVE-2026-66451 | Medium | 6.5 | 2026-08-06 | Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions. |
CVE-2026-66447 | Critical | 9.3 | 2026-08-06 | Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions. |
CVE-2026-66440 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions. |
CVE-2026-66439 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions. |
CVE-2026-66425 | Medium | 6.5 | 2026-08-06 | Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions. |
CVE-2026-65581 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions. |
CVE-2026-65579 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions. |
CVE-2026-65578 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Agora <= 1.9 versions. |
CVE-2026-65577 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions. |
CVE-2026-65576 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions. |
CVE-2026-65575 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions. |
CVE-2026-65574 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Abogado <= 1.18 versions. |
CVE-2026-65573 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Abelle <= 1.22 versions. |
CVE-2026-65572 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions. |
CVE-2026-65571 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions. |
CVE-2026-65570 | High | 8.1 | 2026-08-06 | Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions. |
CVE-2026-65569 | High | 8.5 | 2026-08-06 | Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions. |
CVE-2026-65565 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions. |
CVE-2026-65560 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions. |
CVE-2026-65559 | High | 7.2 | 2026-08-06 | Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions. |
CVE-2026-65556 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions. |
CVE-2026-65554 | High | 7.1 | 2026-08-06 | Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions. |
CVE-2026-65553 | Critical | 10.0 | 2026-08-06 | Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions. |
CVE-2026-65552 | Critical | 9.8 | 2026-08-06 | Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions. |
CVE-2026-65549 | High | 7.2 | 2026-08-06 | Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions. |
CVE-2026-65548 | Critical | 9.9 | 2026-08-06 | Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions. |
CVE-2026-65547 | High | 8.5 | 2026-08-06 | Subscriber SQL Injection in Creative Mail <= 1.6.9 versions. |