2026 CVEs (page 65)
Page 65 of 446 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14592 | Medium | 6.1 | 2026-07-30 | The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and… |
CVE-2026-14318 | Medium | 6.8 | 2026-07-30 | The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the… |
CVE-2026-14310 | Medium | 5.4 | 2026-07-30 | The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing… |
CVE-2026-14305 | Medium | 5.3 | 2026-07-30 | The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify l… |
CVE-2026-14239 | High | 7.1 | 2026-07-30 | The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not esc… |
CVE-2026-14231 | Medium | 4.3 | 2026-07-30 | The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is l… |
CVE-2026-14226 | Medium | 4.3 | 2026-07-30 | The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it… |
CVE-2026-14223 | Medium | 4.3 | 2026-07-30 | The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subsc… |
CVE-2026-14222 | Low | 3.8 | 2026-07-30 | The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users… |
CVE-2026-14221 | Low | 3.8 | 2026-07-30 | The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce… |
CVE-2026-14207 | Medium | 6.1 | 2026-07-30 | The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing us… |
CVE-2026-14188 | Low | 2.7 | 2026-07-30 | The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowin… |
CVE-2026-13395 | High | 8.6 | 2026-07-30 | The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauth… |
CVE-2026-13345 | Medium | 5.3 | 2026-07-30 | The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce prod… |
CVE-2026-13344 | Medium | 4.8 | 2026-07-30 | The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it… |
CVE-2026-13330 | Medium | 6.1 | 2026-07-30 | The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types… |
CVE-2026-13178 | High | 7.5 | 2026-07-30 | The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated… |
CVE-2026-13145 | Medium | 4.3 | 2026-07-30 | The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowin… |
CVE-2026-13143 | Medium | 5.3 | 2026-07-30 | The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a book… |
CVE-2026-12687 | High | 7.5 | 2026-07-30 | The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allow… |
CVE-2026-12500 | High | 7.5 | 2026-07-30 | The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin bef… |
CVE-2026-11881 | Medium | 6.1 | 2026-07-30 | The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline… |
CVE-2026-11870 | Medium | 5.4 | 2026-07-30 | The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-… |
CVE-2026-11867 | Medium | 6.5 | 2026-07-30 | The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion op… |
CVE-2026-11782 | Medium | 5.9 | 2026-07-30 | The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is… |
CVE-2026-67248 | High | 8.8 | 2026-07-30 | A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly v… |
CVE-2026-67247 | Medium | 6.5 | 2026-07-30 | A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently… |
CVE-2026-67246 | Medium | 6.5 | 2026-07-30 | A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is not suffic… |
CVE-2026-67245 | High | 8.1 | 2026-07-30 | A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occurs because user-controlled certificate name input is not sufficie… |
CVE-2026-1360 | High | 7.5 | 2026-07-30 | The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unse… |
CVE-2026-16610 | Critical | 9.8 | 2026-07-30 | The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recur… |
CVE-2026-14356 | High | 8.8 | 2026-07-30 | The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not proper… |
CVE-2026-67244 | High | 7.2 | 2026-07-30 | A format string vulnerability was found in the Notification OAuth settings of ADM. The vulnerability occurs because user-controlled notification configuration… |
CVE-2026-48449 | Critical | 10.0 | 2026-07-30 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curren… |
CVE-2026-48448 | High | 8.6 | 2026-07-30 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could le… |
CVE-2026-1982 | Medium | 5.3 | 2026-07-30 | The Persian Elementor (المنتور فارسی) plugin for WordPress is vulnerable to Price Manipulation in all versions up to, and including, 2.8.1. This is due to the… |
CVE-2026-18188 | High | 8.1 | 2026-07-30 | A format string vulnerability was found in the Rsync Backup on the ADM. The vulnerability occurs because user-controlled rsync backup configuration or log data… |
CVE-2026-18187 | High | 8.1 | 2026-07-30 | A format string vulnerability was found in the Internal Backup on the ADM. The vulnerability occurs because user-controlled task input may be included in an er… |
CVE-2026-18186 | High | 8.1 | 2026-07-30 | A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be… |
CVE-2026-16092 | Medium | 6.5 | 2026-07-30 | The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'meta_key' Custom Field via 'Save and Duplicate' Action in all ve… |
CVE-2026-16727 | | 2026-07-30 | Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to execute arbitrary code… | |
CVE-2026-15929 | | 2026-07-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in LG Electronics SmartShare allows SQL Injection. This iss… | |
CVE-2026-59952 | | 2026-07-30 | Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten() helper when validation issues contain attacker-c… | |
CVE-2026-18019 | Medium | 4.3 | 2026-07-30 | Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-18018 | Medium | 4.0 | 2026-07-30 | Inappropriate implementation in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform UI spoofing via a malicious file… |
CVE-2026-18017 | High | 8.8 | 2026-07-30 | Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
CVE-2026-18016 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted… |
CVE-2026-18015 | Critical | 9.6 | 2026-07-30 | Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a cra… |
CVE-2026-18014 | Medium | 6.5 | 2026-07-30 | Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via… |
CVE-2026-18013 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2026-18012 | High | 8.8 | 2026-07-30 | Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (… |
CVE-2026-18011 | Low | 2.4 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive informat… |
CVE-2026-18010 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffi… |
CVE-2026-18009 | Medium | 4.3 | 2026-07-30 | Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious… |
CVE-2026-18008 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic… |
CVE-2026-18007 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Input in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML pa… |
CVE-2026-18006 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perfo… |
CVE-2026-18005 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from proces… |
CVE-2026-18004 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cr… |
CVE-2026-18003 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2026-18002 | Critical | 9.6 | 2026-07-30 | Insufficient validation of untrusted input in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer pr… |
CVE-2026-18001 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from proces… |
CVE-2026-18000 | Low | 3.1 | 2026-07-30 | Insufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-17999 | Medium | 6.5 | 2026-07-30 | Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chro… |
CVE-2026-17998 | Medium | 4.3 | 2026-07-30 | Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perfor… |
CVE-2026-17997 | Low | 3.1 | 2026-07-30 | Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cr… |
CVE-2026-17996 | Medium | 6.2 | 2026-07-30 | Inappropriate implementation in Browser in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictions via a malicio… |
CVE-2026-17995 | High | 8.1 | 2026-07-30 | Out of bounds read in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (… |
CVE-2026-17994 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Media in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a craf… |
CVE-2026-17993 | High | 7.0 | 2026-07-30 | Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium sec… |
CVE-2026-17992 | Medium | 6.5 | 2026-07-30 | Uninitialized Use in Skia in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process… |
CVE-2026-17991 | Critical | 9.6 | 2026-07-30 | Insufficient validation of untrusted input in AI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-17990 | Critical | 9.6 | 2026-07-30 | Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-17989 | High | 8.8 | 2026-07-30 | Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chr… |
CVE-2026-17988 | Medium | 6.5 | 2026-07-30 | Insufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-17987 | Critical | 9.6 | 2026-07-30 | Insufficient validation of untrusted input in Notifications in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer… |
CVE-2026-17986 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypa… |
CVE-2026-17985 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation via a crafted HTML page. (… |
CVE-2026-17984 | Low | 3.3 | 2026-07-30 | Inappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTM… |
CVE-2026-17983 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Global Media Controls in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2026-17982 | Medium | 4.3 | 2026-07-30 | Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted… |
CVE-2026-17981 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chr… |
CVE-2026-17980 | Low | 3.1 | 2026-07-30 | Inappropriate implementation in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI g… |
CVE-2026-17979 | High | 7.5 | 2026-07-30 | Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium secu… |
CVE-2026-17978 | Medium | 5.3 | 2026-07-30 | Side-channel information leakage in WebCodecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information fro… |
CVE-2026-17977 | Medium | 4.3 | 2026-07-30 | Policy bypass in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security se… |
CVE-2026-17976 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-17975 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in IME in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from p… |
CVE-2026-17974 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictions via a crafted HT… |
CVE-2026-17973 | Medium | 5.5 | 2026-07-30 | Inappropriate implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from… |
CVE-2026-17972 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2026-17971 | High | 8.8 | 2026-07-30 | Inappropriate implementation in Frame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform out of bounds memory access via… |
CVE-2026-17970 | Medium | 4.3 | 2026-07-30 | Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to perform… |
CVE-2026-17969 | High | 8.8 | 2026-07-30 | Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr… |
CVE-2026-17968 | Medium | 6.5 | 2026-07-30 | Uninitialized Use in WebXR in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from proces… |
CVE-2026-17967 | High | 8.8 | 2026-07-30 | Use after free in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2026-17966 | Medium | 6.2 | 2026-07-30 | Inappropriate implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from… |
CVE-2026-17965 | Medium | 4.3 | 2026-07-30 | Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page… |
CVE-2026-17964 | Medium | 4.3 | 2026-07-30 | Incorrect security UI in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (C… |
CVE-2026-17963 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |