2026 CVEs (page 515)
Page 515 of 672 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-7691 | Medium | 6.3 | 2026-05-03 | A security vulnerability has been detected in Wavlink WL-WN570HA1 R70HA1 V1410_221110. Impacted is the function set_sys_cmd of the file /cgi-bin/adm.cgi. Such… |
CVE-2026-7690 | Medium | 6.3 | 2026-05-03 | A weakness has been identified in Wavlink WL-WN570HA1 R70HA1 V1410_221110. This issue affects the function set_sys_adm of the file /cgi-bin/adm.cgi. This manip… |
CVE-2026-7689 | Low | 3.7 | 2026-05-03 | A security flaw has been discovered in Dolibarr ERP CRM up to 23.0.2. This vulnerability affects the function dol_verifyHash in the library htdocs/core/lib/sec… |
CVE-2026-7688 | Medium | 5.0 | 2026-05-03 | A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. This affects the function _checkValForAPI of the file htdocs/expedition/class/expedition.class… |
CVE-2026-7687 | Medium | 6.3 | 2026-05-03 | A vulnerability was determined in langflow-ai langflow up to 1.8.4. Affected by this issue is the function CodeParser.parse_callable_details of the file src/lf… |
CVE-2026-7686 | Medium | 5.3 | 2026-05-03 | A vulnerability was found in eyeo Adblock Plus up to 4.36.2 on Chrome. Affected by this vulnerability is the function postMessage of the file premium.preload.j… |
CVE-2026-7685 | High | 8.8 | 2026-05-03 | A vulnerability was detected in Edimax BR-6208AC up to 1.02. Affected is an unknown function of the file /goform/setWAN. Performing a manipulation of the argum… |
CVE-2026-7684 | High | 8.8 | 2026-05-03 | A security vulnerability has been detected in Edimax BR-6428nC up to 1.16. This impacts an unknown function of the file /goform/setWAN. Such manipulation of th… |
CVE-2026-7683 | Medium | 6.3 | 2026-05-03 | A weakness has been identified in Edimax BR-6428nC up to 1.16. This affects an unknown function of the file /goform/setWAN of the component Web Interface. This… |
CVE-2026-7682 | Medium | 6.3 | 2026-05-03 | A security flaw has been discovered in Edimax BR-6208AC 1.02. The impacted element is the function setWAN of the file /goform/setWAN of the component L2TP Mode… |
CVE-2026-5337 | Medium | 6.5 | 2026-05-03 | During the analysis, it was identified that authenticated attackers with Subscriber-level access or higher are able to perform an Insecure Direct Object Refere… |
CVE-2026-7681 | Medium | 6.5 | 2026-05-03 | A security vulnerability has been detected in jsbroks COCO Annotator up to 0.11.1. Affected by this vulnerability is an unknown functionality of the file backe… |
CVE-2026-7680 | Medium | 4.3 | 2026-05-03 | A weakness has been identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file backend/webserver/api/datasets.py of the com… |
CVE-2026-5063 | High | 7.2 | 2026-05-03 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via POST parameter key names in the submi… |
CVE-2026-7679 | High | 7.3 | 2026-05-03 | A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This impacts the function getAccessToken of the file yudao-module-system-biz/src/main/… |
CVE-2026-7678 | Medium | 6.3 | 2026-05-03 | A vulnerability was identified in YunaiV yudao-cloud up to 2026.01. This affects the function getDataBySQL of the file yudao-module-report-biz/src/main/java/io… |
CVE-2026-7677 | Low | 3.5 | 2026-05-03 | A vulnerability was determined in kerwincui FastBee up to 1.2.1. The impacted element is the function Add of the file springboot/fastbee-admin/src/main/java/co… |
CVE-2026-7676 | Medium | 4.3 | 2026-05-03 | A vulnerability was found in kerwincui FastBee up to 1.2.1. The affected element is the function ToolController.download of the file springboot/fastbee-open-ap… |
CVE-2026-7675 | High | 8.8 | 2026-05-03 | A vulnerability has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. Impacted is the function start_lan of the file /apply.cgi. The manipula… |
CVE-2026-7674 | High | 8.8 | 2026-05-03 | A flaw has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. This issue affects the function start_single_service of the component Web Manage… |
CVE-2026-7673 | Medium | 4.7 | 2026-05-03 | A vulnerability was detected in crmeb_java up to 1.3.4. This vulnerability affects unknown code of the file crmeb/crmeb-service/src/main/java/com/zbkj/service/… |
CVE-2026-40561 | Medium | 5.3 | 2026-05-03 | Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starlet incorrectly prioritizes "Content-Length" over "Tr… |
CVE-2026-7672 | Medium | 6.3 | 2026-05-03 | A security vulnerability has been detected in youlaitech youlai-boot up to 2.21.1. This affects the function getUserList of the file src/main/java/com/youlai/b… |
CVE-2026-7671 | Low | 3.7 | 2026-05-03 | A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. The impacted element is an unknown function of the file /TwoFactor. S… |
CVE-2026-7670 | High | 7.3 | 2026-05-02 | A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSummarize/UserSel.aspx. This manipulation of… |
CVE-2026-7669 | Medium | 5.6 | 2026-05-02 | A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_util… |
CVE-2026-7668 | High | 7.3 | 2026-05-02 | A vulnerability was identified in MikroTik RouterOS 6.49.8. This vulnerability affects the function ASN1_STRING_data in the library nova/lib/www/scep.p of the… |
CVE-2026-7653 | Medium | 6.3 | 2026-05-02 | A security flaw has been discovered in r-huijts mcp-server-rijksmuseum up to 1.0.4. Affected is the function open_image_in_browser of the file src/index.ts of… |
CVE-2026-7645 | Medium | 6.5 | 2026-05-02 | A vulnerability was found in ruvnet sublinear-time-solver 1.5.0. Affected by this vulnerability is the function export_state of the file src/consciousness-expl… |
CVE-2026-7644 | High | 7.3 | 2026-05-02 | A vulnerability has been found in ChatGPTNextWeb NextChat up to 2.16.1. Affected is the function addMcpServer of the file app/mcp/actions.ts. The manipulation… |
CVE-2026-7643 | Medium | 4.3 | 2026-05-02 | A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of the component API Endpoint. Executing a… |
CVE-2026-7642 | Medium | 6.3 | 2026-05-02 | A vulnerability was detected in pskill9 website-downloader up to 0.1.0. This affects the function download_website of the file src/index.ts of the component MC… |
CVE-2026-7633 | Medium | 6.5 | 2026-05-02 | A vulnerability was identified in Totolink N300RH 6.1c.1353_B20190305. This impacts the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. Such manipu… |
CVE-2026-7632 | High | 7.3 | 2026-05-02 | A vulnerability was determined in code-projects Online Hospital Management System 1.0. This affects an unknown function of the file /viewappointment.php. This… |
CVE-2026-7631 | Medium | 5.4 | 2026-05-02 | A vulnerability was found in code-projects Online Hospital Management System 1.0. The impacted element is an unknown function of the component Registration Han… |
CVE-2026-7630 | High | 7.3 | 2026-05-02 | A vulnerability has been found in innocommerce InnoShop up to 0.7.8. The affected element is the function InstallServiceProvider::boot of the file innopacks/in… |
CVE-2026-7629 | Medium | 6.3 | 2026-05-02 | A flaw has been found in kleneway awesome-cursor-mpc-server up to 2.0.1. Impacted is the function runCodeReviewTool of the file src/tools/codeReview.ts of the… |
CVE-2026-3504 | Medium | 5.3 | 2026-05-02 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to… |
CVE-2026-2554 | High | 8.1 | 2026-05-02 | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object R… |
CVE-2026-0703 | Medium | 6.4 | 2026-05-02 | The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xlwcty_current_date' sho… |
CVE-2026-7628 | Medium | 6.3 | 2026-05-02 | A vulnerability was detected in crazyrabbitLTC mcp-code-review-server up to 0.1.0. This issue affects the function executeRepomix of the file src/repomix.ts of… |
CVE-2026-6817 | Medium | 5.8 | 2026-05-02 | The Quiz Maker by AYS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rate_reason' parameter in all versions up to, and including, 6… |
CVE-2026-6525 | Medium | 5.5 | 2026-05-02 | IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.4 |
CVE-2026-6320 | High | 7.5 | 2026-05-02 | The Salon Booking System – Free Version plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 10.30.25. This is due to th… |
CVE-2026-4790 | Medium | 5.4 | 2026-05-02 | The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_svg… |
CVE-2026-4100 | High | 7.1 | 2026-05-02 | The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and disruption of Stripe webhook configuration in all versions up to… |
CVE-2026-4062 | High | 7.5 | 2026-05-02 | The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'object_ids' and 'exclude_object_ids' parameters in all versions up to, a… |
CVE-2026-4061 | High | 7.5 | 2026-05-02 | The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'map_post_type' parameter in all versions up to, and including, 1.13.18… |
CVE-2026-4060 | High | 7.5 | 2026-05-02 | The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.18. This is d… |
CVE-2026-7627 | Medium | 6.3 | 2026-05-02 | A security vulnerability has been detected in 8nite metatrader-4-mcp 1.0.0. This vulnerability affects the function CallToolRequestSchema of the file src/index… |
CVE-2026-7612 | Medium | 4.7 | 2026-05-02 | A vulnerability was determined in itsourcecode Courier Management System 1.0. Affected is an unknown function of the file /edit_user.php. Executing a manipulat… |
CVE-2026-7611 | Low | 3.7 | 2026-05-02 | A vulnerability was found in TRENDnet TEW-821DAP up to 1.12B01. This impacts the function platform_do_upgrade_cameo_dev of the file cameo_dev.sh of the compone… |
CVE-2026-7610 | Low | 3.7 | 2026-05-02 | A vulnerability has been found in TRENDnet TEW-821DAP 1.12B01. This affects an unknown function of the file /www/cgi/ssi of the component Firmware Update. Such… |
CVE-2026-7609 | Medium | 6.3 | 2026-05-02 | A flaw has been found in TRENDnet TEW-821DAP up to 1.12B01. The impacted element is the function tools_diagnostic of the file /tmp/diagnostic of the component… |
CVE-2026-7491 | High | 8.1 | 2026-05-02 | School App developed by Zyosoft has an Insecure Direct Object Reference vulnerability, allowing authenticated remote attackers to modify a specific parameter t… |
CVE-2026-7490 | High | 7.2 | 2026-05-02 | CTMS and CPAS developed by Sunnet has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, t… |
CVE-2026-7489 | High | 8.8 | 2026-05-02 | CTMS developed by Sunnet has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read, modify, and delet… |
CVE-2026-5077 | Medium | 5.4 | 2026-05-02 | The Total theme for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.2.1 due to insufficient output e… |
CVE-2026-7608 | Medium | 5.5 | 2026-05-02 | A vulnerability was detected in TRENDnet TEW-821DAP up to 1.12B01. The affected element is the function tools_diagnostic. The manipulation results in os comman… |
CVE-2026-5324 | High | 7.2 | 2026-05-02 | The Brizy – Page Builder plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to, and including, 2.8.11 This is… |
CVE-2026-4024 | Medium | 5.3 | 2026-05-02 | The Royal Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `wpr_update_for… |
CVE-2026-7649 | High | 7.5 | 2026-05-02 | The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to time-based blind SQL Inj… |
CVE-2026-7607 | High | 8.8 | 2026-05-02 | A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the function auto_update_firmware of the component Firmware Udpate. The… |
CVE-2026-7606 | Low | 3.7 | 2026-05-02 | A weakness has been identified in TRENDnet TEW-821DAP 1.12B01. This issue affects the function find_hwid/new_gui_update_firmware of the component Firmware Upda… |
CVE-2026-6457 | Medium | 6.5 | 2026-05-02 | The Geo Mashup plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geo_mashup_null_fields' parameter in all versions up to, and inclu… |
CVE-2026-6449 | Medium | 5.3 | 2026-05-02 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 2… |
CVE-2026-6229 | High | 7.2 | 2026-05-02 | The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insuffi… |
CVE-2026-4650 | Medium | 5.3 | 2026-05-02 | The FundPress – WordPress Donation Plugin for WordPress is vulnerable to authorization bypass in versions up to and including 2.0.8. This is due to missing aut… |
CVE-2026-2052 | High | 8.8 | 2026-05-02 | The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all… |
CVE-2026-7605 | Medium | 6.3 | 2026-05-02 | A security flaw has been discovered in JeecgBoot up to 3.9.1. This vulnerability affects the function CommonController.uploadImgByHttp/HttpFileToMultipartFileU… |
CVE-2026-43058 | Medium | 5.5 | 2026-05-02 | In the Linux kernel, the following vulnerability has been resolved: media: vidtv: fix pass-by-value structs causing MSAN warnings vidtv_ts_null_write_into()… |
CVE-2026-7647 | High | 8.1 | 2026-05-02 | The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's… |
CVE-2026-7049 | High | 7.2 | 2026-05-02 | The PixelYourSite Pro – Your smart PIXEL (TAG) Manager plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including… |
CVE-2026-6916 | Medium | 6.4 | 2026-05-02 | The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-6812 | Medium | 4.4 | 2026-05-02 | The Ona theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.26 via the ona_activate_child_theme. This make… |
CVE-2026-6447 | Medium | 4.4 | 2026-05-02 | The Call for Price for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4… |
CVE-2026-5113 | High | 7.2 | 2026-05-02 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Consent field hidden inputs in versions up to and including 2.10.0. Thi… |
CVE-2026-5112 | High | 7.2 | 2026-05-02 | The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insu… |
CVE-2026-5111 | High | 7.2 | 2026-05-02 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input v… |
CVE-2026-5110 | High | 7.2 | 2026-05-02 | The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insu… |
CVE-2026-5109 | High | 7.2 | 2026-05-02 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient validat… |
CVE-2026-7641 | High | 8.8 | 2026-05-02 | The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the `save_ex… |
CVE-2026-7604 | Medium | 6.3 | 2026-05-02 | A vulnerability was identified in JeecgBoot up to 3.9.1. This affects the function OpenApiController.add/OpenApiController.call of the file OpenApiController.j… |
CVE-2026-7603 | Medium | 6.3 | 2026-05-02 | A vulnerability was determined in JeecgBoot up to 3.9.1. Affected by this issue is the function checkPathTraversalBatch of the file FileDownloadUtils.jav of th… |
CVE-2026-7458 | Critical | 9.8 | 2026-05-02 | The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to t… |
CVE-2026-6963 | High | 8.8 | 2026-05-02 | The WP Mail Gateway plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wmg_save_provider_config AJAX action in… |
CVE-2026-6446 | Medium | 5.4 | 2026-05-02 | The My Social Feeds – Social Feeds Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 1.0.4 via… |
CVE-2026-4882 | Critical | 9.8 | 2026-05-02 | The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAF_AJAX::metho… |
CVE-2026-4658 | Medium | 6.4 | 2026-05-02 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the className… |
CVE-2026-7638 | Medium | 5.3 | 2026-05-02 | The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to… |
CVE-2026-7602 | Medium | 6.3 | 2026-05-02 | A vulnerability was found in JeecgBoot up to 3.9.1. Affected by this vulnerability is an unknown functionality of the file /sys/fillRule/edit of the component… |
CVE-2026-7209 | Medium | 6.4 | 2026-05-02 | The Simple Link Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `qcopd-directory` shortcode in all versions up to… |
CVE-2026-6378 | Medium | 6.4 | 2026-05-02 | The Maxi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `/wp-json/maxi-blocks/v1.0/style-card` REST API endpoint in all versi… |
CVE-2026-7601 | Medium | 4.3 | 2026-05-02 | A vulnerability has been found in Open5GS up to 2.7.6. Affected is an unknown function of the file src/amf/gmm-handler.c of the component AMF. The manipulation… |
CVE-2026-43824 | High | 7.7 | 2026-05-02 | In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data. |
CVE-2026-7600 | Medium | 6.3 | 2026-05-02 | A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2. This impacts the function yii_command_help/yii_execute_command of the file src/index.ts of the compone… |
CVE-2026-7599 | Medium | 6.3 | 2026-05-01 | A vulnerability was detected in Dayoooun hwpx-mcp 0.2.0. This affects the function save_document/export_to_text/export_to_html of the file mcp-server/src/index… |
CVE-2026-7598 | High | 7.3 | 2026-05-01 | A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such man… |
CVE-2026-7597 | Medium | 6.3 | 2026-05-01 | A vulnerability was found in mem0ai mem0 up to 1.0.11. This affects the function pickle.load/pickle.dump of the file mem0/vector_stores/faiss.py. Performing a… |
CVE-2026-7596 | Medium | 4.3 | 2026-05-01 | A vulnerability has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this issue is the function data.get of the file .claude/skills/… |