2026 CVEs (page 46)
Page 46 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-65554 | High | 7.1 | 2026-08-06 | Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions. |
CVE-2026-65553 | Critical | 10.0 | 2026-08-06 | Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions. |
CVE-2026-65552 | Critical | 9.8 | 2026-08-06 | Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions. |
CVE-2026-65549 | High | 7.2 | 2026-08-06 | Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions. |
CVE-2026-65548 | Critical | 9.9 | 2026-08-06 | Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions. |
CVE-2026-65547 | High | 8.5 | 2026-08-06 | Subscriber SQL Injection in Creative Mail <= 1.6.9 versions. |
CVE-2026-65546 | Critical | 9.3 | 2026-08-06 | Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions. |
CVE-2026-65545 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions. |
CVE-2026-65544 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions. |
CVE-2026-65543 | High | 7.5 | 2026-08-06 | Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions. |
CVE-2026-65542 | High | 8.8 | 2026-08-06 | Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions. |
CVE-2026-65541 | High | 7.3 | 2026-08-06 | Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions. |
CVE-2026-65523 | High | 7.5 | 2026-08-06 | Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions. |
CVE-2026-65520 | Critical | 9.3 | 2026-08-06 | Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions. |
CVE-2026-65517 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions. |
CVE-2026-65515 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions. |
CVE-2026-65513 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions. |
CVE-2026-65509 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions. |
CVE-2026-65508 | Critical | 9.3 | 2026-08-06 | Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions. |
CVE-2026-65507 | Critical | 9.8 | 2026-08-06 | Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions. |
CVE-2026-65504 | High | 7.5 | 2026-08-06 | Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions. |
CVE-2026-65502 | Medium | 5.3 | 2026-08-06 | Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions. |
CVE-2026-61982 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions. |
CVE-2026-61964 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions. |
CVE-2026-61963 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions. |
CVE-2026-61961 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions. |
CVE-2026-61959 | Medium | 6.5 | 2026-08-06 | Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions. |
CVE-2026-54489 | Critical | 9.1 | 2026-08-06 | Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulnerability. An unauthe… |
CVE-2026-53976 | Critical | 9.1 | 2026-08-06 | OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticate… |
CVE-2026-53975 | Critical | 9.8 | 2026-08-06 | OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending… |
CVE-2026-34502 | High | 7.5 | 2026-08-06 | Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 th… |
CVE-2026-34501 | High | 7.5 | 2026-08-06 | Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 throu… |
CVE-2026-34191 | Critical | 9.1 | 2026-08-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provid… |
CVE-2026-32548 | Medium | 5.3 | 2026-08-06 | Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions. |
CVE-2026-32469 | Medium | 5.3 | 2026-08-06 | Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions. |
CVE-2026-32327 | Critical | 9.1 | 2026-08-06 | A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the… |
CVE-2026-28180 | Medium | 5.3 | 2026-08-06 | Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions. |
CVE-2026-28179 | Medium | 5.9 | 2026-08-06 | Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions. |
CVE-2026-28178 | Medium | 6.5 | 2026-08-06 | Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions. |
CVE-2026-28177 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 versions. |
CVE-2026-28172 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions. |
CVE-2026-28169 | Medium | 5.3 | 2026-08-06 | Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions. |
CVE-2026-28146 | Medium | 6.5 | 2026-08-06 | Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions. |
CVE-2026-28143 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions. |
CVE-2026-28141 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions. |
CVE-2026-28140 | High | 7.5 | 2026-08-06 | Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions. |
CVE-2026-28139 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions. |
CVE-2026-28111 | High | 8.8 | 2026-08-06 | Contributor Privilege Escalation in Forminator <= 1.56.0 versions. |
CVE-2026-28082 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions. |
CVE-2026-28005 | Critical | 9.8 | 2026-08-06 | Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions. |
CVE-2026-25403 | Medium | 6.5 | 2026-08-06 | Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions. |
CVE-2026-19045 | Medium | 5.3 | 2026-08-06 | A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils… |
CVE-2026-19044 | Medium | 5.3 | 2026-08-06 | A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component… |
CVE-2026-15246 | Medium | 4.3 | 2026-08-06 | The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capabilit… |
CVE-2026-64993 | Medium | 6.8 | 2026-08-06 | Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerability in the collector. A remote unauthenticated attacker could poten… |
CVE-2026-5134 | Critical | 9.8 | 2026-08-06 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows… |
CVE-2026-19041 | Medium | 6.3 | 2026-08-06 | A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/co… |
CVE-2026-19040 | Medium | 6.3 | 2026-08-06 | A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a man… |
CVE-2026-18501 | Medium | 6.4 | 2026-08-06 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2026-16731 | | 2026-08-06 | OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an u… | |
CVE-2026-16316 | Medium | 4.3 | 2026-08-06 | OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values (SV) frame processing. A specially crafted SV fra… |
CVE-2026-16315 | High | 8.7 | 2026-08-06 | OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an u… |
CVE-2026-12605 | Critical | 9.6 | 2026-08-06 | In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if th… |
CVE-2026-70556 | Medium | 4.3 | 2026-08-06 | Hubzilla versions prior to 11.4 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::pos… |
CVE-2026-66733 | High | 7.5 | 2026-08-06 | Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that allows unauthenticated… |
CVE-2026-66732 | Medium | 5.9 | 2026-08-06 | Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved… |
CVE-2026-65551 | High | 7.5 | 2026-08-06 | Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdanc… |
CVE-2026-19039 | Medium | 5.3 | 2026-08-06 | A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function ssh_exec of the file sr… |
CVE-2026-19038 | Medium | 6.3 | 2026-08-06 | A security vulnerability has been detected in MonomythDevelopment la-forge-mcp 1.0.0. This issue affects the function screenshotElement of the file src/index.t… |
CVE-2026-19037 | Medium | 4.3 | 2026-08-06 | A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::update_lob of the file src/WtBtCore/MatchEngin… |
CVE-2026-19036 | High | 7.2 | 2026-08-06 | A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub_40F88C of the file /tmp/ppp/wanoptions. The manipulation of the a… |
CVE-2026-15599 | Low | 3.3 | 2026-08-06 | Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-domain-joiner allows Privilege Abuse. This issue affects… |
CVE-2026-0673 | Medium | 5.3 | 2026-08-06 | The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `elemen… |
CVE-2026-8166 | Medium | 5.4 | 2026-08-06 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing P… |
CVE-2026-68481 | High | 7.5 | 2026-08-06 | In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The sa… |
CVE-2026-68079 | Critical | 9.8 | 2026-08-06 | In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementati… |
CVE-2026-65583 | Critical | 9.1 | 2026-08-06 | Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and s… |
CVE-2026-63687 | Critical | 9.1 | 2026-08-06 | Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive paramet… |
CVE-2026-61466 | Critical | 9.1 | 2026-08-06 | In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration… |
CVE-2026-5391 | Medium | 6.4 | 2026-08-06 | The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode… |
CVE-2026-5158 | Medium | 6.4 | 2026-08-06 | The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlace… |
CVE-2026-57818 | High | 8.1 | 2026-08-06 | A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the is… |
CVE-2026-19035 | High | 7.2 | 2026-08-06 | A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function new_qoslimit_start of the file /etc/qoslimit. The manipulatio… |
CVE-2026-11983 | Medium | 5.3 | 2026-08-06 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a mis… |
CVE-2026-66909 | Critical | 9.8 | 2026-08-06 | Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any at… |
CVE-2026-65432 | High | 7.5 | 2026-08-06 | Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import… |
CVE-2026-64958 | High | 7.5 | 2026-08-06 | An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachm… |
CVE-2026-57819 | High | 7.5 | 2026-08-06 | Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default… |
CVE-2026-57817 | High | 8.1 | 2026-08-06 | The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is i… |
CVE-2026-54225 | High | 7.5 | 2026-08-06 | Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default pl… |
CVE-2026-19034 | High | 7.2 | 2026-08-06 | A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function new_qoslimit_stop of the file /tmp/qoslimittc_stop.sh… |
CVE-2026-55980 | Medium | 5.5 | 2026-08-06 | A denial-of-service vulnerability in CatchPulse could allow an attacker to conduct a stack buffer overrun attack, leading to a denial-of-service condition. |
CVE-2026-55979 | Medium | 5.2 | 2026-08-06 | An improper access control check in CatchPulse's named pipe communication interface could allow an attacker to invoke CatchPulse functions. This is limited to… |
CVE-2026-55978 | High | 8.4 | 2026-08-06 | An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel filter communicatio… |
CVE-2026-64640 | Medium | 6.5 | 2026-08-06 | Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to regi… |
CVE-2026-19022 | Medium | 6.3 | 2026-08-06 | A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initialize_repo of the file OpenHands/resolver/send_pull_request… |
CVE-2026-64604 | | 2026-08-06 | In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating… | |
CVE-2026-64603 | | 2026-08-06 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel-hid: Protect ACPI notify handler against recursion Since commit e2ffc… | |
CVE-2026-64602 | | 2026-08-06 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: spear: Initialize completion before requesting IRQ In the report from Jaeyoung… | |
CVE-2026-64601 | High | 7.8 | 2026-08-06 | In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on ea… |