2026 CVEs (page 552)
Page 552 of 668 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-0814 | Medium | 4.3 | 2026-04-08 | The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vsz_cf7_export_to_ex… |
CVE-2026-0811 | Medium | 5.4 | 2026-04-08 | The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to mis… |
CVE-2026-33756 | High | 7.5 | 2026-04-08 | Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multiple GraphQL… |
CVE-2026-33466 | High | 8.1 | 2026-04-08 | Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Rel… |
CVE-2026-33459 | Medium | 6.5 | 2026-04-08 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to… |
CVE-2026-33458 | Medium | 6.3 | 2026-04-08 | Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution pri… |
CVE-2026-32591 | Medium | 5.2 | 2026-04-08 | A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Qua… |
CVE-2026-32590 | High | 7.1 | 2026-04-08 | A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a for… |
CVE-2026-32589 | High | 7.4 | 2026-04-08 | A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with… |
CVE-2026-4837 | Medium | 6.6 | 2026-04-08 | An eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve remote code e… |
CVE-2026-4498 | High | 7.7 | 2026-04-08 | Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBA… |
CVE-2026-33461 | High | 7.7 | 2026-04-08 | Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploi… |
CVE-2026-33460 | Medium | 4.3 | 2026-04-08 | Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management… |
CVE-2026-31017 | Critical | 9.1 | 2026-04-08 | A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplie… |
CVE-2026-30080 | High | 7.5 | 2026-04-08 | OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection. Configuration has supported integrity NIA1 and NIA2. But if an UE send… |
CVE-2026-30075 | High | 7.5 | 2026-04-08 | OpenAirInterface Version 2.2.0 has a Buffer Overflow vulnerability in processing UplinkNASTransport containing Authentication Response containing a NAS PDU wit… |
CVE-2026-2377 | Medium | 6.5 | 2026-04-08 | A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift. The log export feature in these products allows an authenticated user to specify an… |
CVE-2026-33753 | Medium | 6.2 | 2026-04-08 | rfc3161-client is a Python library implementing the Time-Stamp Protocol (TSP) described in RFC 3161. Prior to 1.0.6, an Authorization Bypass vulnerability in r… |
CVE-2026-33229 | Critical | 9.8 | 2026-04-08 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.4.8 and 17.10.1, an improperly protected s… |
CVE-2026-31040 | Critical | 9.8 | 2026-04-08 | A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lead to command execution. |
CVE-2026-39865 | Medium | 5.9 | 2026-04-08 | Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a… |
CVE-2026-39410 | Medium | 4.8 | 2026-04-08 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse(… |
CVE-2026-39409 | Medium | 5.3 | 2026-04-08 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6… |
CVE-2026-39408 | High | 7.5 | 2026-04-08 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be wr… |
CVE-2026-39407 | Medium | 5.3 | 2026-04-08 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path handling inconsistency in serveStatic allows pro… |
CVE-2026-39406 | Medium | 5.3 | 2026-04-08 | @hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files… |
CVE-2026-39394 | High | 8.1 | 2026-04-08 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0… |
CVE-2026-39393 | High | 8.1 | 2026-04-08 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0… |
CVE-2026-39392 | Medium | 5.5 | 2026-04-08 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0… |
CVE-2026-39391 | Medium | 4.8 | 2026-04-08 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0… |
CVE-2026-39390 | Medium | 5.5 | 2026-04-08 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0… |
CVE-2026-39389 | Medium | 6.7 | 2026-04-08 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0… |
CVE-2026-5795 | High | 7.4 | 2026-04-08 | In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial check… |
CVE-2026-35023 | Medium | 4.3 | 2026-04-08 | Wimi Teamwork On-Premises versions prior to 8.2.0 contain an insecure direct object reference vulnerability in the preview.php endpoint where the item_id param… |
CVE-2026-31411 | Medium | 5.5 | 2026-04-08 | In the Linux kernel, the following vulnerability has been resolved: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() Reproducer available at… |
CVE-2026-2509 | Medium | 6.4 | 2026-04-08 | The Page Builder: Pagelayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget's Custom Attributes field in all versions u… |
CVE-2026-5600 | Medium | 4.3 | 2026-04-08 | A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging… |
CVE-2026-5302 | Medium | 6.3 | 2026-04-08 | CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers to read data and send commands to the service via maliciou… |
CVE-2026-5301 | High | 7.6 | 2026-04-08 | Stored XSS in log viewer in CoolerControl/coolercontrol-ui <4.0.0 allows unauthenticated attackers to take over the service via malicious JavaScript in poisone… |
CVE-2026-5300 | Medium | 5.9 | 2026-04-08 | Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows unauthenticated attackers to view and modify potentially sensitive data via HTTP r… |
CVE-2026-28261 | High | 7.8 | 2026-04-08 | Dell Elastic Cloud Storage, version 3.8.1.7 and prior, and Dell ObjectScale, versions prior to 4.1.0.3 and version 4.2.0.0, contains an Insertion of Sensitive… |
CVE-2026-27102 | Medium | 6.6 | 2026-04-08 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.1, contains an incorrect privilege assignment vulnerability. A lo… |
CVE-2026-24511 | Medium | 4.4 | 2026-04-08 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.0, contains a generation of error message containing sensitive in… |
CVE-2026-5208 | High | 8.2 | 2026-04-08 | Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands… |
CVE-2026-3396 | High | 7.5 | 2026-04-08 | WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including… |
CVE-2026-3243 | High | 8.8 | 2026-04-08 | The Advanced Members for ACF plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_crop function… |
CVE-2026-2481 | Medium | 6.4 | 2026-04-08 | The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'settings[js]' parame… |
CVE-2026-28264 | Low | 3.3 | 2026-04-08 | Dell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged… |
CVE-2026-1865 | Medium | 6.5 | 2026-04-08 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin… |
CVE-2026-1673 | Medium | 4.3 | 2026-04-08 | The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in al… |
CVE-2026-1672 | Medium | 6.5 | 2026-04-08 | The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in al… |
CVE-2026-4303 | Medium | 6.4 | 2026-04-08 | The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wsm_showDayStatsGraph' shortc… |
CVE-2026-4300 | Medium | 6.4 | 2026-04-08 | The Robo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Loading Label' setting in all versions up to, and including, 5.1.3… |
CVE-2026-4073 | Medium | 6.4 | 2026-04-08 | The pdfl.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pdflio' shortcode in all versions up to, and including, 1.0.5. This is d… |
CVE-2026-4025 | Medium | 6.4 | 2026-04-08 | The PrivateContent Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' shortcode attribute in the [pc-login-form] shortcode… |
CVE-2026-39716 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in CKThemes Flipmart flipmart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fl… |
CVE-2026-39715 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in AnyTrack AnyTrack Affiliate Link Manager anytrack-affiliate-link-manager allows Exploiting Incorrectly Configured Access… |
CVE-2026-39714 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in G5Theme G5Plus April g5plus-april allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2026-39713 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in mailercloud Mailercloud – Integrate webforms and synchronize website contacts mailercloud-integrate-webforms-synchronize… |
CVE-2026-39712 | Medium | 5.3 | 2026-04-08 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in tagDiv tagDiv Composer td-composer allows Code Injection.This is… |
CVE-2026-39711 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Retrieve Embedded Sensitive Data.This… |
CVE-2026-39710 | Medium | 5.4 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Cross Site Request Forgery.This issue affects RT-Them… |
CVE-2026-39709 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in thetechtribe The Tribal the-tech-tribe allows Retrieve Embedded Sensitive Data.This issue af… |
CVE-2026-39708 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UiCore UiCore Elements uicore-elements allows Stored XSS… |
CVE-2026-39707 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in ZealousWeb Accept PayPal Payments using Contact Form 7 contact-form-7-paypal-extension allows Exploiting Incorrectly Con… |
CVE-2026-39706 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Netro Systems Make My Trivia trivialy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-39705 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Mulika Team MIPL WC Multisite Sync mipl-wc-multisite-sync allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-39704 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing – Pro precious-metals-automated-product-pricing-pro allows Ex… |
CVE-2026-39703 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbits WPBITS Addons For Elementor Page Builder wpbits-ad… |
CVE-2026-39702 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wealcoder Animation Addons for Elementor animation-addons… |
CVE-2026-39701 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Andrew ShopWP wpshopify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopW… |
CVE-2026-39700 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in WPXPO WowOptin optin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowOptin… |
CVE-2026-39699 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in massiveshift AI Workflow Automation ai-workflow-automation-lite allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-39698 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in PublisherDesk The Publisher Desk ads.txt the-publisher-desk-ads-txt allows Exploiting Incorrectly Configured Access Cont… |
CVE-2026-39697 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in HBSS Technologies MAIO – The new AI GEO / SEO tool maio-the-new-ai-geo-seo-tool allows Exploiting Incorrectly Configured… |
CVE-2026-39696 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elfsight Elfsight WhatsApp Chat CC elfsight-whatsapp-chat… |
CVE-2026-39695 | Medium | 5.4 | 2026-04-08 | Server-Side Request Forgery (SSRF) vulnerability in podigee Podigee podigee allows Server Side Request Forgery.This issue affects Podigee: from n/a through <=… |
CVE-2026-39694 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Contr… |
CVE-2026-39693 | Medium | 5.9 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fesomia FSM Custom Featured Image Caption fsm-custom-feat… |
CVE-2026-39692 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Stored XSS.This… |
CVE-2026-39691 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in AdAstraCrypto Cryptocurrency Donation Box – Bitcoin & Crypto Donations cryptocurrency-donation-box allows Exploiting Inc… |
CVE-2026-39690 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-39689 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in eshipper eShipper Commerce eshipper-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-39688 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Glowlogix WP Frontend Profile wp-front-end-profile allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-39687 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Rapid Car Check Rapid Car Check Vehicle Data free-vehicle-data-uk allows Exploiting Incorrectly Configured Access Contro… |
CVE-2026-39686 | Medium | 5.3 | 2026-04-08 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Retrieve Embedded… |
CVE-2026-39685 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in lvaudore The Moneytizer the-moneytizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2026-39684 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in UnTheme OrganicFood organicfood allows… |
CVE-2026-39683 | Medium | 5.9 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chief Gnome Garden Gnome Package garden-gnome-package all… |
CVE-2026-39682 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Arjan Pronk linkPizza-Manager linkpizza-manager allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-39681 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Homeo homeo allows PHP Local… |
CVE-2026-39680 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in MWP Development Diet Calorie Calculator diet-calorie-calculator allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-39679 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Freeio freeio allows PHP Loc… |
CVE-2026-39678 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2026-39677 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Emphires emphires all… |
CVE-2026-39676 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-39675 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in webmuehle Court Reservation court-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-39674 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Manoj Kumar MK Google Directions google-distance-calculat… |
CVE-2026-39673 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in shrikantkale iZooto izooto-web-push allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-39672 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in shiptime ShipTime: Discounted Shipping Rates shiptime-discount-shipping allows Exploiting Incorrectly Configured Access… |