2026 CVEs (page 475)
Page 475 of 679 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-45840 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: cap upcall PID array size and pre-size vport replies The vport netlink reply… |
CVE-2026-45839 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() CO-RE accessor strin… |
CVE-2026-45838 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: bpf: fix end-of-list detection in cgroup_storage_get_next_key() list_next_entry() never r… |
CVE-2026-45837 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in arena_vm_close on fork arena_vm_open() only bumps vml->mmap_co… |
CVE-2026-42762 | High | 7.1 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking… |
CVE-2026-42761 | Critical | 9.3 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-… |
CVE-2026-42760 | High | 7.5 | 2026-05-27 | Authentication Bypass Using an Alternate Path or Channel vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Password Recover… |
CVE-2026-42759 | High | 7.1 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timo Affiliate Super Assistent amazonsimpleadmin allows S… |
CVE-2026-42758 | Critical | 9.8 | 2026-05-27 | Incorrect Privilege Assignment vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Privilege Escalation.This issue affects Webina… |
CVE-2026-42757 | Critical | 9.9 | 2026-05-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allow… |
CVE-2026-42756 | Critical | 9.9 | 2026-05-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ludwig You QuickWebP – Compress / Optimize Images & C… |
CVE-2026-42755 | Critical | 9.3 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 TableOn posts-table-filterable allows Blind SQ… |
CVE-2026-42754 | High | 7.1 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phbernard Favicon favicon-by-realfavicongenerator allows… |
CVE-2026-42753 | High | 7.3 | 2026-05-27 | Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2026-42751 | Medium | 6.5 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Manager booking-manager allows Stored X… |
CVE-2026-42750 | Medium | 6.5 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nexcess WPComplete wpcomplete allows Stored XSS.This issu… |
CVE-2026-42749 | High | 7.1 | 2026-05-27 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeisle Disable Comments for Any Post Types (Remove comments) comments-plus allows… |
CVE-2026-42748 | Critical | 9.9 | 2026-05-27 | Unrestricted Upload of File with Dangerous Type vulnerability in WPify WPify Woo Czech wpify-woo allows Upload a Web Shell to a Web Server.This issue affects W… |
CVE-2026-42747 | Critical | 9.3 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows… |
CVE-2026-42746 | High | 7.3 | 2026-05-27 | Insertion of Sensitive Information Into Sent Data vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Retrieve Embedded Sensitiv… |
CVE-2026-42745 | High | 7.3 | 2026-05-27 | Authentication Bypass Using an Alternate Path or Channel vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Authentication Bypa… |
CVE-2026-42744 | Medium | 6.5 | 2026-05-27 | Improper Validation of Specified Quantity in Input vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded allows Manipulating Hidden Fields.This… |
CVE-2026-42740 | Critical | 9.3 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.Thi… |
CVE-2026-42739 | High | 7.1 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IniLerm Advanced IP Blocker advanced-ip-blocker allows DO… |
CVE-2026-42738 | High | 7.1 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZAYTECH Smart Online Order for Clover clover-online-order… |
CVE-2026-42737 | High | 8.6 | 2026-05-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allow… |
CVE-2026-42736 | High | 7.5 | 2026-05-27 | Authorization Bypass Through User-Controlled Key vulnerability in wordplus BP Better Messages bp-better-messages allows Exploiting Incorrectly Configured Acces… |
CVE-2026-42735 | High | 8.2 | 2026-05-27 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Password Recovery Exp… |
CVE-2026-42734 | High | 7.1 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.Th… |
CVE-2026-42733 | High | 7.1 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 WPCS currency-switcher allows DOM-Based XSS.Th… |
CVE-2026-42732 | Medium | 6.5 | 2026-05-27 | Improper Validation of Specified Quantity in Input vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded allows Input Data Manipulation.This is… |
CVE-2026-42731 | Critical | 9.8 | 2026-05-27 | Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affec… |
CVE-2026-42730 | High | 8.5 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-managem… |
CVE-2026-42729 | High | 7.1 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows DOM-Based… |
CVE-2026-42728 | High | 7.1 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows Stored… |
CVE-2026-42727 | Critical | 9.3 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-… |
CVE-2026-42726 | Medium | 6.5 | 2026-05-27 | Missing Authorization vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Exploiting Incorrectly Configured Access Con… |
CVE-2026-42725 | Medium | 6.5 | 2026-05-27 | Authorization Bypass Through User-Controlled Key vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Exploi… |
CVE-2026-3349 | Medium | 6.1 | 2026-05-27 | The MinhNhut Link Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter on the redirect page in all versions up… |
CVE-2026-3348 | Medium | 4.4 | 2026-05-27 | The MinhNhut Link Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings (Description, Title, and other fields) in… |
CVE-2026-3012 | High | 8.0 | 2026-05-27 | A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate… |
CVE-2026-2288 | Medium | 4.8 | 2026-05-27 | The myLinksDump plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_title' parameter in all versions up to, and including, 1.6 due… |
CVE-2026-2280 | Medium | 4.8 | 2026-05-27 | The rexCrawler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.15 due to insuffi… |
CVE-2026-8054 | | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/audi… | |
CVE-2026-49002 | Critical | 9.1 | 2026-05-27 | Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access system data beyond t… |
CVE-2026-48968 | Medium | 6.5 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider allows DOM-Based XSS. This issue af… |
CVE-2026-48877 | Medium | 6.5 | 2026-05-27 | Insertion of Sensitive Information Into Sent Data vulnerability in Tom GenerateBlocks allows Retrieve Embedded Sensitive Data. This issue affects GenerateBloc… |
CVE-2026-40852 | High | 7.2 | 2026-05-27 | A highly authenticated attacker can alter the config generator injecting a payload into future created configurations. The device is not correctly checking thi… |
CVE-2026-40851 | High | 8.4 | 2026-05-27 | A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick leading to code execution. This can result in a t… |
CVE-2026-40850 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountData function due to improper neutralization of… |
CVE-2026-40849 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the user_alarmprofile view due to improper neutralization of sp… |
CVE-2026-40848 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the tag view due to improper neutralization of special elements… |
CVE-2026-40847 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system_tag view due to improper neutralization of special e… |
CVE-2026-40846 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system view due to improper neutralization of special eleme… |
CVE-2026-40845 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the devices_configuration view due to improper neutralization o… |
CVE-2026-40844 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dashboard view due to improper neutralization of special el… |
CVE-2026-40843 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the alarming view due to improper neutralization of special ele… |
CVE-2026-40842 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getWidgetTags function due to improper neutralization of sp… |
CVE-2026-40841 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectTags function due to improper neutralization of s… |
CVE-2026-40840 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the VerifyCreateLicences function due to improper neutralizatio… |
CVE-2026-40839 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getComponentScalings function due to improper neutralizatio… |
CVE-2026-40838 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDeviceScalings function due to improper neutralization o… |
CVE-2026-40837 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectScalings function due to improper neutralization… |
CVE-2026-40836 | High | 7.1 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the inmessage model due to improper neutralization of special e… |
CVE-2026-40835 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the saveObjectFromData function due to improper neutralization… |
CVE-2026-40834 | High | 7.1 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash_layout.php files saveDashboardLayout function due to i… |
CVE-2026-40833 | High | 7.1 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash.php files saveDashboardLayout function due to improper… |
CVE-2026-40832 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDevicegroups function due to improper neutralization of… |
CVE-2026-40831 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the Easy View due to improper neutralization of special element… |
CVE-2026-40830 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the admin.mbnetj.php files UpdateParam function due to improper… |
CVE-2026-40829 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the view.html.php files UpdateParam function due to improper ne… |
CVE-2026-40828 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DeleteSysLogEntry function due to improper neutralization o… |
CVE-2026-40827 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _RemoveRequest function due to improper neutralization of s… |
CVE-2026-2237 | Medium | 6.2 | 2026-05-27 | A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local… |
CVE-2026-8942 | Medium | 4.3 | 2026-05-27 | The MetaMagic SEO Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or… |
CVE-2026-8906 | Medium | 6.1 | 2026-05-27 | The WP Promoter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect… |
CVE-2026-8832 | High | 8.8 | 2026-05-27 | The WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager plugin for WordPress is vulnerable to Remote Code Execution in versions… |
CVE-2026-8143 | High | 7.2 | 2026-05-27 | The HBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hb_country_iso', 'hb_usa_state_iso', and 'hb_canada_province_iso' paramete… |
CVE-2026-8042 | Medium | 6.4 | 2026-05-27 | The Github Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repo' shortcode attribute in the 'github' shortcode in all vers… |
CVE-2026-7618 | Medium | 4.9 | 2026-05-27 | The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versio… |
CVE-2026-6169 | High | 7.2 | 2026-05-27 | The affiliate-toolkit plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 3.8.5. This is due to the plugin using… |
CVE-2026-49001 | Medium | 5.3 | 2026-05-27 | Cross-site request forgery (CSRF) vulnerabilities allow attackers to exploit a user's authenticated session to forge cross-site requests, inducing the executio… |
CVE-2026-41704 | Medium | 5.0 | 2026-05-27 | AgentClient#handle_method (lines 264-303) processes every NATS reply. It calls inject_compile_log (line 273) on every response, which reads response['value']['… |
CVE-2026-41009 | Medium | 5.8 | 2026-05-27 | When the director sends a long-running request (e.g. compile_package), the agent's reply JSON is consumed by AgentClient. inject_compile_log (line 332-339) rea… |
CVE-2026-40826 | Medium | 4.9 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dsgvo_contracts view due to improper neutralization of spec… |
CVE-2026-40825 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view devices parameter due to improper neutra… |
CVE-2026-40824 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view userid parameter due to improper neutral… |
CVE-2026-40823 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of s… |
CVE-2026-40822 | Medium | 4.9 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of s… |
CVE-2026-40821 | Medium | 4.9 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountByID function due to improper neutralization of s… |
CVE-2026-40819 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the sync_data24 task due to improper neutralization of special… |
CVE-2026-40818 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _mb24confi_getDevice function due to improper neutralizati… |
CVE-2026-40817 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAlarmProfiles function due to improper neutralization o… |
CVE-2026-40816 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the mb24alarm.php files _mb24confi_getTagAlarm function due to… |
CVE-2026-40815 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _mb24api_getUserAccount function due to improper neutraliz… |
CVE-2026-40814 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dataapi.php files _mb24confi_getTagAlarm function due to i… |
CVE-2026-40813 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions tagid parameter due to improper ne… |
CVE-2026-40812 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions sn parameter due to improper neutr… |
CVE-2026-40811 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the ssoabstractservice due to improper neutralization of speci… |
CVE-2026-40810 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the userinfo endpoint due to improper neutralization of specia… |