2026 CVEs (page 714)
Page 714 of 725 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-21521 | High | 7.4 | 2026-01-22 | Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network. |
CVE-2026-21520 | High | 7.5 | 2026-01-22 | Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network at… |
CVE-2026-21264 | Critical | 9.3 | 2026-01-22 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unauthorized attacker to perform spoofing o… |
CVE-2026-21227 | High | 8.2 | 2026-01-22 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a… |
CVE-2026-24117 | Medium | 5.3 | 2026-01-22 | Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index… |
CVE-2026-24058 | Critical | 9.8 | 2026-01-22 | Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an att… |
CVE-2026-23988 | High | 7.3 | 2026-01-22 | Rufus is a utility that helps format and create bootable USB flash drives. Versions 4.11 and below contain a race condition (TOCTOU) in src/net.c during the cr… |
CVE-2026-23954 | High | 8.7 | 2026-01-22 | Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to launch a container with a custom image (e.g… |
CVE-2026-23953 | High | 8.7 | 2026-01-22 | Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configu… |
CVE-2026-23831 | Medium | 5.3 | 2026-01-22 | Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicali… |
CVE-2026-20912 | Critical | 9.1 | 2026-01-22 | Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be… |
CVE-2026-20904 | Medium | 6.5 | 2026-01-22 | Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other us… |
CVE-2026-20897 | Critical | 9.1 | 2026-01-22 | Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks b… |
CVE-2026-20888 | Medium | 4.3 | 2026-01-22 | Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able t… |
CVE-2026-20883 | Medium | 6.5 | 2026-01-22 | Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue t… |
CVE-2026-20800 | Medium | 6.5 | 2026-01-22 | Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository… |
CVE-2026-20750 | Critical | 9.1 | 2026-01-22 | Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modi… |
CVE-2026-20736 | High | 7.5 | 2026-01-22 | Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete… |
CVE-2026-1201 | | 2026-01-22 | An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a rem… | |
CVE-2026-0798 | Low | 3.5 | 2026-01-22 | Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private… |
CVE-2026-22281 | Low | 3.5 | 2026-01-22 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0… |
CVE-2026-22280 | Medium | 5.0 | 2026-01-22 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0… |
CVE-2026-22279 | Medium | 4.3 | 2026-01-22 | Dell PowerScale OneFS, versions prior 9.13.0.0, contains an insufficient logging vulnerability. An unauthenticated attacker with remote access could potentiall… |
CVE-2026-24390 | High | 7.5 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QantumThemes Kentha Elementor Widgets… |
CVE-2026-24389 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery all… |
CVE-2026-24388 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-24387 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator wp-quick-post-duplicator allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-24386 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in Element Invader Element Invader – Template Kits for Elementor elementinvader allows Exploiting Incorrectly Configured Ac… |
CVE-2026-24384 | Medium | 5.4 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in launchinteractive Merge + Minify + Refresh merge-minify-refresh allows Cross Site Request Forgery.This issue… |
CVE-2026-24383 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider b-slider allows DOM-Based XSS.This issu… |
CVE-2026-24381 | Medium | 5.4 | 2026-01-22 | Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods PhotoMe photome allows Server Side Request Forgery.This issue affects PhotoMe: from n/a through… |
CVE-2026-24380 | Medium | 5.3 | 2026-01-22 | Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-24379 | Medium | 6.5 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Contr… |
CVE-2026-24377 | Medium | 4.3 | 2026-01-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Retr… |
CVE-2026-24374 | Medium | 5.4 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Cross Site Reque… |
CVE-2026-24371 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-24368 | Medium | 5.3 | 2026-01-22 | Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid… |
CVE-2026-24367 | High | 8.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.T… |
CVE-2026-24366 | Medium | 5.3 | 2026-01-22 | Missing Authorization vulnerability in YITHEMES YITH WooCommerce Request A Quote yith-woocommerce-request-a-quote allows Exploiting Incorrectly Configured Acce… |
CVE-2026-24365 | Medium | 5.4 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in storeapps Stock Manager for WooCommerce woocommerce-stock-manager allows Cross Site Request Forgery.This iss… |
CVE-2026-24361 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress – Course Review learnpress-course-re… |
CVE-2026-24360 | Medium | 4.4 | 2026-01-22 | Server-Side Request Forgery (SSRF) vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Server Side Request Forgery.Thi… |
CVE-2026-24358 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2026-24357 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in Brecht WP Recipe Maker wp-recipe-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2026-24356 | Medium | 4.9 | 2026-01-22 | Missing Authorization vulnerability in Roxnor GetGenie getgenie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetG… |
CVE-2026-24355 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-func… |
CVE-2026-24354 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Shortcodes & Performance penci-shortcod… |
CVE-2026-24353 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-23978 | High | 7.5 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Softwebmedia Gyan Elements gyan-elemen… |
CVE-2026-23976 | Medium | 5.9 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery al… |
CVE-2026-23975 | High | 7.5 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo golo allows PHP Local File… |
CVE-2026-23974 | Medium | 5.3 | 2026-01-22 | Missing Authorization vulnerability in uxper Golo golo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Golo: from n/… |
CVE-2026-23764 | | 2026-01-22 | VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Au… | |
CVE-2026-23763 | | 2026-01-22 | VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a local privilege escalation vulnerability in th… | |
CVE-2026-23762 | | 2026-01-22 | VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Au… | |
CVE-2026-23761 | | 2026-01-22 | VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Au… | |
CVE-2026-22483 | Medium | 5.4 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in winkm89 teachPress teachpress allows Cross Site Request Forgery.This issue affects teachPress: from n/a thro… |
CVE-2026-22482 | Medium | 4.9 | 2026-01-22 | Server-Side Request Forgery (SSRF) vulnerability in wbolt.com IMGspider imgspider allows Server Side Request Forgery.This issue affects IMGspider: from n/a thr… |
CVE-2026-22481 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in Rasedul Haque Rumi BD Courier Order Ratio Checker bd-courier-order-ratio-checker allows Exploiting Incorrectly Configure… |
CVE-2026-22472 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-22470 | High | 7.6 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FireStorm Plugins FireStorm Professional Real Estate fs-r… |
CVE-2026-22469 | Medium | 5.3 | 2026-01-22 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in mwtemplates DeepDigital deepdigital allows Code Injection.This i… |
CVE-2026-22468 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in AbsolutePlugins Absolute Addons For Elementor absolute-addons allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2026-22466 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in Chandni Patel WP MapIt wp-mapit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2026-22464 | High | 7.5 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wphocus My auctions allegro my-auction… |
CVE-2026-22463 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Micro.company Form to Chat App form-to-chat allows Stored… |
CVE-2026-22462 | Medium | 4.3 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in richardevcom Add Polylang support for Customizer add-polylang-support-for-customizer allows Cross Site Reque… |
CVE-2026-22461 | Medium | 5.3 | 2026-01-22 | Missing Authorization vulnerability in WebAppick CTX Feed webappick-product-feed-for-woocommerce allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-22458 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in Mikado-Themes Wanderland wanderland allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-22450 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in Select-Themes Don Peppe donpeppe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2026-22447 | Medium | 5.3 | 2026-01-22 | Missing Authorization vulnerability in Select-Themes Prowess prowess allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-22445 | Medium | 5.3 | 2026-01-22 | Missing Authorization vulnerability in Proptech Plugin Apimo Connector apimo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-22430 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Verdure verdure allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-22426 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Elated-Themes Sweet Jane sweetjane allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2026-22411 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Dolcino dolcino allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-22409 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Justicia justicia allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2026-22407 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Roam roam allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-22406 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Overton overton allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-22404 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Innovio innovio allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-22402 | High | 7.5 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pavothemes Triply triply allows PHP Lo… |
CVE-2026-22401 | High | 7.5 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pavothemes Freshio freshio allows PHP… |
CVE-2026-22400 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Holmes holmes allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-22398 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fleur fleur allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-22396 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fiorello fiorello allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2026-22393 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Curly curly allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-22391 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Cocco cocco allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-22388 | Medium | 5.9 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu Owl Carousel WP owl-carousel-wp allows Stored X… |
CVE-2026-22382 | Medium | 5.4 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Cross Site Request Forg… |
CVE-2026-22360 | Medium | 4.3 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in AA-Team SearchAzon searchazon allows Cross Site Request Forgery.This issue affects SearchAzon: from n/a thro… |
CVE-2026-22359 | Medium | 4.3 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in AA-Team Wordpress Movies Bulk Importer movies importer allows Cross Site Request Forgery.This issue affects… |
CVE-2026-22358 | Medium | 5.4 | 2026-01-22 | Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Electrician - Electrical Service WordPress electrician allows Server Side Request Forgery.Thi… |
CVE-2026-22355 | High | 7.1 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in gregmolnar Simple XML Sitemap simple-xml-sitemap allows Stored XSS.This issue affects Simple XML Sitemap: fr… |
CVE-2026-22353 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in winkm89 teachPress teachpress allows Stored XSS.This issu… |
CVE-2026-22349 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in linux4me2 Menu In Post menu-in-post allows DOM-Based XSS… |
CVE-2026-22348 | Medium | 5.3 | 2026-01-22 | Missing Authorization vulnerability in Tasos Fel Civic Cookie Control civic-cookie-control-8 allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-22347 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in subhansanjaya Carousel Horizontal Posts Content Slider ca… |
CVE-2026-22278 | High | 8.1 | 2026-01-22 | Dell PowerScale OneFS versions prior to 9.13.0.0 contains an improper restriction of excessive authentication attempts vulnerability. An unauthenticated attack… |
CVE-2026-1260 | High | 7.8 | 2026-01-22 | Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure. |
CVE-2026-0535 | High | 8.1 | 2026-01-22 | A maliciously crafted HTML payload, stored in a component’s description and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in… |
CVE-2026-0534 | High | 8.1 | 2026-01-22 | A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Au… |