2026 CVEs (page 59)
Page 59 of 662 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18317 | Medium | 4.3 | 2026-09-18 | The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up… |
CVE-2026-17576 | Medium | 6.5 | 2026-09-18 | The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments action in versions up to, and including, 1.13.9. This is due to… |
CVE-2026-12106 | Medium | 6.4 | 2026-09-18 | The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadIm… |
CVE-2026-93485 | High | 7.1 | 2026-09-18 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS. This is… |
CVE-2026-90984 | Medium | 5.8 | 2026-09-18 | The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted… |
CVE-2026-90978 | High | 7.1 | 2026-09-18 | The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capa… |
CVE-2026-89008 | Low | 2.7 | 2026-09-18 | The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions… |
CVE-2026-89007 | Low | 2.7 | 2026-09-18 | The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, a… |
CVE-2026-88993 | Medium | 6.8 | 2026-09-18 | The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing us… |
CVE-2026-88844 | Low | 2.7 | 2026-09-18 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-stu… |
CVE-2026-88825 | High | 8.8 | 2026-09-18 | The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitr… |
CVE-2026-88798 | Medium | 5.3 | 2026-09-18 | The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own… |
CVE-2026-87966 | Medium | 5.3 | 2026-09-18 | The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpo… |
CVE-2026-87965 | Medium | 4.8 | 2026-09-18 | The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation ac… |
CVE-2026-87775 | High | 8.6 | 2026-09-18 | The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action ava… |
CVE-2026-87774 | High | 8.6 | 2026-09-18 | The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action ava… |
CVE-2026-87771 | High | 8.6 | 2026-09-18 | The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions availab… |
CVE-2026-87770 | High | 8.6 | 2026-09-18 | The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action a… |
CVE-2026-87767 | High | 8.6 | 2026-09-18 | The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX… |
CVE-2026-85350 | Medium | 5.3 | 2026-09-18 | The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campai… |
CVE-2026-85127 | High | 8.8 | 2026-09-18 | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live ch… |
CVE-2026-85123 | Medium | 5.3 | 2026-09-18 | The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form t… |
CVE-2026-85122 | High | 8.8 | 2026-09-18 | The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form t… |
CVE-2026-85009 | Medium | 6.5 | 2026-09-18 | The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, al… |
CVE-2026-84904 | Low | 3.8 | 2026-09-18 | The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gatin… |
CVE-2026-84903 | Low | 2.7 | 2026-09-18 | The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of… |
CVE-2026-84902 | Medium | 6.8 | 2026-09-18 | The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page… |
CVE-2026-84738 | Critical | 9.1 | 2026-09-18 | The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-priv… |
CVE-2026-81810 | High | 7.2 | 2026-09-18 | The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on… |
CVE-2026-81340 | Low | 3.8 | 2026-09-18 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through it… |
CVE-2026-18912 | High | 7.7 | 2026-09-18 | ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to exe… |
CVE-2026-18911 | High | 7.5 | 2026-09-18 | ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without prope… |
CVE-2026-17086 | High | 8.8 | 2026-09-18 | The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inc… |
CVE-2026-93468 | High | 7.5 | 2026-09-18 | The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit Relative Path Traversal to read arbitrar… |
CVE-2026-93467 | Critical | 9.8 | 2026-09-18 | The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by send… |
CVE-2026-93371 | High | 8.3 | 2026-09-18 | A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/int… |
CVE-2026-92991 | Medium | 5.4 | 2026-09-18 | The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output e… |
CVE-2026-15650 | Medium | 6.4 | 2026-09-18 | The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointer_menu_item' Block… |
CVE-2026-14855 | Medium | 6.4 | 2026-09-18 | The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css[left]' parameter in all versions up to, and including, 1.5.1 du… |
CVE-2026-93456 | High | 8.2 | 2026-09-18 | django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify… |
CVE-2026-93455 | Medium | 6.5 | 2026-09-18 | django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and… |
CVE-2026-93331 | High | 7.3 | 2026-09-18 | A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_parse_ttxt of the file src/ietf/rtp_depacketizer.c of the comp… |
CVE-2026-93314 | Medium | 6.3 | 2026-09-18 | A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing… |
CVE-2026-93313 | Medium | 6.3 | 2026-09-18 | A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc… |
CVE-2026-82985 | Medium | 6.5 | 2026-09-18 | The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rathe… |
CVE-2026-82982 | Medium | 4.3 | 2026-09-18 | The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting… |
CVE-2026-82980 | Medium | 6.3 | 2026-09-18 | Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absol… |
CVE-2026-77170 | Medium | 4.3 | 2026-09-18 | The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has p… |
CVE-2026-77169 | Medium | 6.5 | 2026-09-18 | A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators… |
CVE-2026-77164 | Medium | 6.2 | 2026-09-18 | Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allo… |
CVE-2026-68493 | Low | 3.1 | 2026-09-18 | After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of. |
CVE-2026-93312 | Medium | 4.3 | 2026-09-18 | A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes… |
CVE-2026-93311 | Medium | 4.3 | 2026-09-18 | A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc o… |
CVE-2026-93310 | Medium | 5.3 | 2026-09-18 | A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation leads to allocatio… |
CVE-2026-79954 | | 2026-09-18 | NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association use… | |
CVE-2026-93454 | Medium | 5.4 | 2026-09-18 | Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-t… |
CVE-2026-93453 | High | 8.3 | 2026-09-18 | SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect re… |
CVE-2026-93452 | High | 7.5 | 2026-09-18 | snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination bu… |
CVE-2026-93451 | Medium | 6.5 | 2026-09-18 | snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompre… |
CVE-2026-93450 | High | 7.5 | 2026-09-18 | go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no de… |
CVE-2026-93309 | Medium | 4.3 | 2026-09-18 | A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a… |
CVE-2026-93308 | Medium | 4.3 | 2026-09-18 | A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing… |
CVE-2026-85887 | High | 7.7 | 2026-09-18 | Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network. |
CVE-2026-85878 | Critical | 9.9 | 2026-09-18 | Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network. |
CVE-2026-83946 | High | 8.2 | 2026-09-18 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a… |
CVE-2026-69843 | Critical | 10.0 | 2026-09-18 | Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-62874 | Critical | 10.0 | 2026-09-18 | Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-2585 | Medium | 6.4 | 2026-09-18 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ parameter in all versions up to, and includ… |
CVE-2026-18441 | Medium | 4.3 | 2026-09-18 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all… |
CVE-2026-93436 | High | 7.5 | 2026-09-17 | vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attacke… |
CVE-2026-93435 | High | 7.5 | 2026-09-17 | redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client pro… |
CVE-2026-87886 | High | 7.8 | 2026-09-17 | Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1… |
CVE-2026-87701 | Critical | 9.6 | 2026-09-17 | Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate… |
CVE-2026-85917 | High | 7.5 | 2026-09-17 | Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-85889 | Critical | 10.0 | 2026-09-17 | Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-85885 | Critical | 9.9 | 2026-09-17 | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a… |
CVE-2026-83944 | Critical | 10.0 | 2026-09-17 | Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-78501 | High | 7.4 | 2026-09-17 | Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to… |
CVE-2026-77903 | Critical | 9.0 | 2026-09-17 | Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-70200 | Critical | 10.0 | 2026-09-17 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a… |
CVE-2026-70009 | Critical | 9.3 | 2026-09-17 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a networ… |
CVE-2026-69865 | Critical | 10.0 | 2026-09-17 | Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-69399 | Critical | 10.0 | 2026-09-17 | Azure Arc Elevation of Privilege Vulnerability |
CVE-2026-68791 | High | 8.6 | 2026-09-17 | Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network. |
CVE-2026-55946 | Medium | 6.1 | 2026-09-17 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose informatio… |
CVE-2026-93426 | High | 8.5 | 2026-09-17 | SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject… |
CVE-2026-93307 | Medium | 4.3 | 2026-09-17 | A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argumen… |
CVE-2026-86688 | | 2026-09-17 | Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browser to hold an authen… | |
CVE-2026-76949 | | 2026-09-17 | Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who can plant a remember-me cookie in a victim's browser… | |
CVE-2026-73639 | Critical | 9.1 | 2026-09-17 | Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8. … |
CVE-2026-73638 | Medium | 6.2 | 2026-09-17 | Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd. tiff_load_ifd() validates an IFD… |
CVE-2026-54767 | Critical | 9.1 | 2026-09-17 | WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletar_socios.php exposes an unauthenticated GET endpoin… |
CVE-2026-54734 | Critical | 10.0 | 2026-09-17 | Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request UR… |
CVE-2026-54671 | High | 8.8 | 2026-09-17 | WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and veri… |
CVE-2026-54670 | Critical | 9.1 | 2026-09-17 | WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts… |
CVE-2026-54648 | Medium | 6.5 | 2026-09-17 | CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CC_PERM_READ access and d… |
CVE-2026-54647 | High | 7.2 | 2026-09-17 | CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_ex… |
CVE-2026-54646 | High | 7.2 | 2026-09-17 | CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER… |
CVE-2026-54645 | Medium | 4.8 | 2026-09-17 | CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, description_short, and spec_copy rich-t… |
CVE-2026-54644 | Medium | 6.1 | 2026-09-17 | CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in erro… |