2026 CVEs (page 72)
Page 72 of 447 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12927 | | 2026-07-29 | CWE-787 Out-of-bounds write vulnerability exists that could cause loss of data or potentially risk arbitrary code execution when a malicious CGF file is import… | |
CVE-2026-0667 | | 2026-07-29 | CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidenti… | |
CVE-2026-14270 | High | 8.8 | 2026-07-29 | The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Upload in all versi… |
CVE-2026-8791 | Medium | 6.4 | 2026-07-29 | The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up to, and incl… |
CVE-2026-7436 | Medium | 6.4 | 2026-07-29 | The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcbm_best_seller`… |
CVE-2026-6089 | Medium | 4.9 | 2026-07-29 | The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'sticky_s_media' parameter in imported JSON files in all versions up to, a… |
CVE-2026-65883 | Critical | 9.8 | 2026-07-29 | Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection i… |
CVE-2026-5060 | Medium | 6.5 | 2026-07-29 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2026-56390 | | 2026-07-29 | GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted witho… | |
CVE-2026-56389 | | 2026-07-29 | GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A… | |
CVE-2026-50642 | | 2026-07-29 | diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while a… | |
CVE-2026-4604 | Medium | 5.3 | 2026-07-29 | The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `kr_mr_store_s… |
CVE-2026-18220 | High | 7.8 | 2026-07-29 | An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend (bfd/elf32-dlx.c) in GNU binutils. The dlx_rtype_to_howto() function maps E… |
CVE-2026-16655 | High | 7.2 | 2026-07-29 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi… |
CVE-2026-16597 | High | 7.2 | 2026-07-29 | The GTM4WP – A Google Tag Manager (GTM) plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Billing Fields i… |
CVE-2026-14900 | Critical | 9.8 | 2026-07-29 | The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php funct… |
CVE-2026-14488 | Critical | 9.1 | 2026-07-29 | The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the MB Frontend Submission extension in ve… |
CVE-2026-12895 | | 2026-07-29 | SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation us… | |
CVE-2026-65100 | Medium | 4.8 | 2026-07-29 | Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder o… |
CVE-2026-59243 | Critical | 9.8 | 2026-07-29 | The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned… |
CVE-2026-58189 | High | 7.5 | 2026-07-29 | Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic Server… |
CVE-2026-58188 | High | 8.2 | 2026-07-29 | Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8… |
CVE-2026-58187 | Low | 3.7 | 2026-07-29 | The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic… |
CVE-2026-58186 | High | 7.5 | 2026-07-29 | The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from… |
CVE-2026-58185 | Medium | 5.9 | 2026-07-29 | The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14… |
CVE-2026-58184 | High | 8.2 | 2026-07-29 | The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Tr… |
CVE-2026-58183 | Medium | 5.9 | 2026-07-29 | The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8… |
CVE-2026-58182 | High | 8.6 | 2026-07-29 | The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8… |
CVE-2026-58181 | High | 7.5 | 2026-07-29 | The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0… |
CVE-2026-58180 | High | 7.5 | 2026-07-29 | The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1… |
CVE-2026-58179 | High | 8.1 | 2026-07-29 | The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Server: from 8.0.0 th… |
CVE-2026-58178 | High | 7.5 | 2026-07-29 | The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 throug… |
CVE-2026-58177 | High | 8.1 | 2026-07-29 | The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from… |
CVE-2026-58175 | High | 7.5 | 2026-07-29 | Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9… |
CVE-2026-58164 | High | 7.5 | 2026-07-29 | Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Server: from… |
CVE-2026-58163 | High | 7.5 | 2026-07-29 | Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0… |
CVE-2026-58162 | Critical | 10.0 | 2026-07-29 | The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0… |
CVE-2026-58161 | High | 7.5 | 2026-07-29 | Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 t… |
CVE-2026-58160 | Medium | 6.5 | 2026-07-29 | Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9… |
CVE-2026-58159 | High | 8.2 | 2026-07-29 | Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 thr… |
CVE-2026-58158 | Medium | 5.9 | 2026-07-29 | Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 throug… |
CVE-2026-58157 | High | 8.7 | 2026-07-29 | Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This issue affects Apache Traffic Server: fro… |
CVE-2026-50622 | High | 8.8 | 2026-07-29 | Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, rega… |
CVE-2026-23904 | High | 7.3 | 2026-07-29 | Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to t… |
CVE-2026-18207 | Medium | 6.5 | 2026-07-29 | A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique i… |
CVE-2026-18201 | Medium | 5.5 | 2026-07-29 | Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permis… |
CVE-2026-9720 | Medium | 4.3 | 2026-07-29 | The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is du… |
CVE-2026-65325 | Medium | 4.8 | 2026-07-29 | Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affect… |
CVE-2026-65324 | High | 7.5 | 2026-07-29 | Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affe… |
CVE-2026-64557 | High | 8.8 | 2026-07-29 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_con… |
CVE-2026-64556 | High | 7.8 | 2026-07-29 | In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes… |
CVE-2026-58156 | Medium | 4.9 | 2026-07-29 | Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 t… |
CVE-2026-58155 | Critical | 9.3 | 2026-07-29 | Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Serv… |
CVE-2026-58154 | High | 8.9 | 2026-07-29 | Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 t… |
CVE-2026-58153 | High | 8.3 | 2026-07-29 | Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Ap… |
CVE-2026-58152 | Medium | 5.9 | 2026-07-29 | Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through… |
CVE-2026-58151 | High | 7.5 | 2026-07-29 | Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server: fr… |
CVE-2026-13425 | High | 7.2 | 2026-07-29 | The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6… |
CVE-2026-11973 | Medium | 4.9 | 2026-07-29 | The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8… |
CVE-2026-58150 | Critical | 10.0 | 2026-07-29 | Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: fr… |
CVE-2026-57834 | Critical | 10.0 | 2026-07-29 | Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0… |
CVE-2026-41920 | Critical | 9.3 | 2026-07-29 | Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1… |
CVE-2026-35226 | Medium | 6.5 | 2026-07-29 | An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFIN… |
CVE-2026-33930 | Medium | 5.9 | 2026-07-29 | Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overfl… |
CVE-2026-33267 | Critical | 10.0 | 2026-07-29 | Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10… |
CVE-2026-24033 | High | 7.2 | 2026-07-29 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server. This issue affects Apache Traffic Ser… |
CVE-2026-22068 | High | 8.2 | 2026-07-29 | Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X th… |
CVE-2026-18197 | | 2026-07-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS). This iss… | |
CVE-2026-18192 | Medium | 6.5 | 2026-07-29 | VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to downl… |
CVE-2026-18191 | Critical | 9.8 | 2026-07-29 | VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to… |
CVE-2026-63242 | Medium | 4.3 | 2026-07-29 | A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint… |
CVE-2026-63241 | Low | 3.1 | 2026-07-29 | An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user withou… |
CVE-2026-63240 | Medium | 4.3 | 2026-07-29 | An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without … |
CVE-2026-63239 | Medium | 5.4 | 2026-07-29 | A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive d… |
CVE-2026-63238 | Medium | 6.5 | 2026-07-29 | An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supply… |
CVE-2026-63237 | Medium | 4.8 | 2026-07-29 | A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time pas… |
CVE-2026-63236 | Low | 3.7 | 2026-07-29 | An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson st… |
CVE-2026-63235 | Low | 3.7 | 2026-07-29 | An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email add… |
CVE-2026-63234 | Critical | 9.9 | 2026-07-29 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint… |
CVE-2026-63233 | Critical | 9.9 | 2026-07-29 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpo… |
CVE-2026-63232 | Critical | 9.9 | 2026-07-29 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoi… |
CVE-2026-63231 | High | 8.1 | 2026-07-29 | A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs u… |
CVE-2026-63230 | Critical | 9.1 | 2026-07-29 | A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including… |
CVE-2026-63229 | Critical | 9.1 | 2026-07-29 | A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endp… |
CVE-2026-63228 | Low | 2.6 | 2026-07-29 | An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an image file via the feed… |
CVE-2026-63227 | Critical | 9.9 | 2026-07-29 | An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to… |
CVE-2026-14300 | High | 8.1 | 2026-07-29 | The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optiona… |
CVE-2026-14234 | High | 7.1 | 2026-07-29 | The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick… |
CVE-2026-14224 | Medium | 5.4 | 2026-07-29 | The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current u… |
CVE-2026-13692 | Medium | 5.3 | 2026-07-29 | The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthent… |
CVE-2026-13690 | High | 7.4 | 2026-07-29 | The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who al… |
CVE-2026-13605 | Medium | 6.8 | 2026-07-29 | The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM… |
CVE-2026-13423 | Critical | 9.8 | 2026-07-29 | The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an… |
CVE-2026-11974 | High | 8.6 | 2026-07-29 | The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX action… |
CVE-2026-11351 | Medium | 5.3 | 2026-07-29 | The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated user… |
CVE-2026-18072 | Critical | 9.8 | 2026-07-29 | The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded B… |
CVE-2026-5626 | Medium | 4.3 | 2026-07-29 | The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_all_data() function in all… |
CVE-2026-15344 | Medium | 4.9 | 2026-07-29 | The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002… |
CVE-2026-12476 | High | 7.2 | 2026-07-29 | The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file… |
CVE-2026-17166 | Medium | 4.3 | 2026-07-29 | The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass… |