2026 CVEs (page 62)
Page 62 of 446 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15048 | High | 7.5 | 2026-07-31 | The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve cha… |
CVE-2026-14931 | Medium | 6.5 | 2026-07-31 | The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check… |
CVE-2026-14930 | High | 7.5 | 2026-07-31 | The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unaut… |
CVE-2026-14929 | Medium | 4.3 | 2026-07-31 | The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber… |
CVE-2026-14928 | Medium | 6.5 | 2026-07-31 | The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated sea… |
CVE-2026-14927 | Low | 3.7 | 2026-07-31 | The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order docu… |
CVE-2026-14922 | Medium | 6.1 | 2026-07-31 | WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encod… |
CVE-2026-14921 | Medium | 6.1 | 2026-07-31 | The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(), |
CVE-2026-14919 | Critical | 9.8 | 2026-07-31 | The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is sat… |
CVE-2026-14862 | Low | 3.7 | 2026-07-31 | The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downloads, allowing unauthenticated users who… |
CVE-2026-14849 | Low | 3.7 | 2026-07-31 | The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in th… |
CVE-2026-14847 | Medium | 4.3 | 2026-07-31 | The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowi… |
CVE-2026-14845 | Medium | 6.1 | 2026-07-31 | The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outp… |
CVE-2026-14843 | Medium | 5.3 | 2026-07-31 | The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthentica… |
CVE-2026-14834 | Medium | 6.5 | 2026-07-31 | The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the sit… |
CVE-2026-14833 | Medium | 6.8 | 2026-07-31 | The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox captio… |
CVE-2026-14830 | High | 7.5 | 2026-07-31 | The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated ord… |
CVE-2026-14554 | Medium | 6.5 | 2026-07-31 | The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with ad… |
CVE-2026-14483 | Critical | 9.8 | 2026-07-31 | The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via t… |
CVE-2026-14333 | High | 7.5 | 2026-07-31 | The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access… |
CVE-2026-14319 | High | 7.5 | 2026-07-31 | The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthent… |
CVE-2026-14317 | Medium | 5.3 | 2026-07-31 | The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part f… |
CVE-2026-13609 | High | 8.8 | 2026-07-31 | The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML… |
CVE-2026-13393 | Low | 3.5 | 2026-07-31 | The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outpu… |
CVE-2026-13392 | High | 7.2 | 2026-07-31 | The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities… |
CVE-2026-12721 | High | 8.6 | 2026-07-31 | The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing una… |
CVE-2026-12720 | High | 7.5 | 2026-07-31 | The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, l… |
CVE-2026-12697 | Medium | 5.4 | 2026-07-31 | The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowi… |
CVE-2026-12695 | High | 8.1 | 2026-07-31 | The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifyin… |
CVE-2026-12376 | Medium | 4.3 | 2026-07-31 | The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber… |
CVE-2026-12251 | High | 8.1 | 2026-07-31 | The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration for… |
CVE-2026-63223 | Critical | 9.8 | 2026-07-31 | CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client file… |
CVE-2026-63222 | High | 7.5 | 2026-07-31 | CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without… |
CVE-2026-63221 | Critical | 9.4 | 2026-07-31 | CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into gene… |
CVE-2026-56673 | High | 7.5 | 2026-07-31 | ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folder_paths.get_annotated_filepath and exists_ann… |
CVE-2026-56672 | High | 8.2 | 2026-07-31 | ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} served user-controlled HTML and SVG files with extension-d… |
CVE-2026-56671 | High | 7.5 | 2026-07-31 | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, get_model_preview in app/model_manager.py joins an unr… |
CVE-2026-56670 | High | 8.2 | 2026-07-31 | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpoint served uploaded SVG files inline be… |
CVE-2026-63220 | Medium | 4.8 | 2026-07-31 | CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-Forwarded-Proto and Front-End-Https header… |
CVE-2026-62323 | Medium | 6.3 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token… |
CVE-2026-55502 | High | 7.1 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though Get… |
CVE-2026-55499 | Medium | 4.3 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the ow… |
CVE-2026-55497 | Medium | 6.5 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but… |
CVE-2026-55496 | Medium | 4.3 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predic… |
CVE-2026-55495 | Medium | 4.3 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT_RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a… |
CVE-2026-43833 | Medium | 5.3 | 2026-07-31 | Full details and mitigation steps are currently restricted and will be published at a later date. |
CVE-2026-43832 | High | 7.5 | 2026-07-31 | Full details and mitigation steps are currently restricted and will be published at a later date. |
CVE-2026-43831 | High | 7.5 | 2026-07-31 | Full details and mitigation steps are currently restricted and will be published at a later date. |
CVE-2026-43830 | Critical | 9.8 | 2026-07-31 | Full details and mitigation steps are currently restricted and will be published at a later date. |
CVE-2026-43829 | High | 7.5 | 2026-07-31 | Full details and mitigation steps are currently restricted and will be published at a later date. |
CVE-2026-18157 | High | 7.8 | 2026-07-31 | A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in… |
CVE-2026-14541 | High | 7.5 | 2026-07-31 | An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google… |
CVE-2026-14540 | Medium | 6.1 | 2026-07-31 | A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. Wh… |
CVE-2026-14539 | High | 7.5 | 2026-07-31 | An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauth… |
CVE-2026-14538 | High | 7.7 | 2026-07-31 | An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1… |
CVE-2026-14537 | Critical | 9.8 | 2026-07-31 | Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to… |
CVE-2026-58039 | Low | 3.3 | 2026-07-31 | A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidenti… |
CVE-2026-66720 | Medium | 6.5 | 2026-07-30 | The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicast messages… |
CVE-2026-66421 | Critical | 9.3 | 2026-07-30 | OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the adm… |
CVE-2026-66420 | High | 8.8 | 2026-07-30 | MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticat… |
CVE-2026-66369 | Medium | 6.5 | 2026-07-30 | The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus… |
CVE-2026-66364 | Medium | 6.5 | 2026-07-30 | The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When… |
CVE-2026-66360 | High | 7.5 | 2026-07-30 | The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of… |
CVE-2026-66349 | Medium | 6.5 | 2026-07-30 | The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER… |
CVE-2026-65423 | High | 8.8 | 2026-07-30 | An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write. |
CVE-2026-65421 | Medium | 6.5 | 2026-07-30 | The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validated, causing a read… |
CVE-2026-63550 | Medium | 6.5 | 2026-07-30 | The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded eleme… |
CVE-2026-63362 | Medium | 5.9 | 2026-07-30 | An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted U… |
CVE-2026-63035 | High | 8.1 | 2026-07-30 | A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denial of service or pot… |
CVE-2026-63033 | Medium | 6.5 | 2026-07-30 | A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one b… |
CVE-2026-61893 | Medium | 6.5 | 2026-07-30 | A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of… |
CVE-2026-56758 | Medium | 6.5 | 2026-07-30 | The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, a… |
CVE-2026-10031 | Medium | 4.2 | 2026-07-30 | SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbol… |
CVE-2026-68563 | Medium | 5.5 | 2026-07-30 | A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is… |
CVE-2026-68562 | Medium | 6.2 | 2026-07-30 | A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When… |
CVE-2026-64816 | Medium | 6.5 | 2026-07-30 | RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lut… |
CVE-2026-63559 | High | 7.5 | 2026-07-30 | An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds heap memory, potenti… |
CVE-2026-62845 | Medium | 4.7 | 2026-07-30 | Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolati… |
CVE-2026-62246 | High | 8.5 | 2026-07-30 | Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd… |
CVE-2026-5846 | Medium | 5.7 | 2026-07-30 | The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and en… |
CVE-2026-38709 | Critical | 9.8 | 2026-07-30 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discover… |
CVE-2026-18064 | High | 7.5 | 2026-07-30 | An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reach… |
CVE-2026-12562 | High | 8.8 | 2026-07-30 | The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded sys… |
CVE-2026-68503 | Critical | 9.8 | 2026-07-30 | LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn… |
CVE-2026-68502 | Critical | 9.8 | 2026-07-30 | LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket… |
CVE-2026-68501 | Medium | 6.5 | 2026-07-30 | Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank… |
CVE-2026-68500 | High | 7.5 | 2026-07-30 | Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/upda… |
CVE-2026-68499 | Medium | 6.2 | 2026-07-30 | re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 patter… |
CVE-2026-66803 | Critical | 10.0 | 2026-07-30 | Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network. |
CVE-2026-66418 | Critical | 9.3 | 2026-07-30 | OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script… |
CVE-2026-61526 | Medium | 6.1 | 2026-07-30 | AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the er… |
CVE-2026-55777 | | 2026-07-30 | GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to 1.11, the parse_ios()… | |
CVE-2026-55768 | | 2026-07-30 | GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the buil… | |
CVE-2026-54715 | | 2026-07-30 | GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. In version 1.10.2, parse_browse… | |
CVE-2026-52539 | Critical | 9.1 | 2026-07-30 | Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environment variable is not set, the application falls back to the de… |
CVE-2026-35847 | Critical | 9.8 | 2026-07-30 | An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file |
CVE-2026-67594 | Critical | 9.8 | 2026-07-30 | Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploi… |
CVE-2026-67550 | Medium | 5.7 | 2026-07-30 | re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject b… |
CVE-2026-67530 | Medium | 6.4 | 2026-07-30 | WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhook action in src/lib/automations/engine.ts and its validatio… |
CVE-2026-67529 | Medium | 4.3 | 2026-07-30 | OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workP… |