2026 CVEs (page 86)

Page 86 of 448 — CVEs published in 2026, newest first, with CVSS severity and publication dates.

All CVEs published in 2026 — newest first (page 86 of 448)
CVESeverityScorePublishedSummary
CVE-2026-65913Medium6.12026-07-23DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array…
CVE-2026-65912Medium6.12026-07-23DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeChe…
CVE-2026-65911Medium6.12026-07-23In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) ac…
CVE-2026-65904Medium4.72026-07-23DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's co…
CVE-2026-65903Medium6.12026-07-23DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions…
CVE-2026-65902Medium6.12026-07-23DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the upon…
CVE-2026-65901Medium6.12026-07-23DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attacke…
CVE-2026-65900Medium6.12026-07-23DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PL…
CVE-2026-65899Medium6.12026-07-23DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundar…
CVE-2026-65898High7.22026-07-23DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently…
CVE-2026-65690High8.82026-07-23Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authen…
CVE-2026-65689Critical9.82026-07-23Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauth…
CVE-2026-65688Critical9.82026-07-23Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature that allows unauthen…
CVE-2026-65687Critical9.82026-07-23Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthent…
CVE-2026-16735Medium5.32026-07-23A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of…
CVE-2026-16733Medium5.32026-07-23A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the co…
CVE-2026-14257High7.52026-07-23brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (d…
CVE-2026-65908High8.62026-07-23In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open
CVE-2026-65907Critical9.12026-07-23In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
CVE-2026-65906High8.82026-07-23In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible
CVE-2026-150372026-07-23Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrus…
CVE-2026-65897High8.82026-07-23Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to…
CVE-2026-65896High7.12026-07-23Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. Pa…
CVE-2026-65895High8.52026-07-23Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.co…
CVE-2026-65608High8.82026-07-23Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives…
CVE-2026-65607Medium6.52026-07-23SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unl…
CVE-2026-65606Critical9.62026-07-23SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name tha…
CVE-2026-65605Critical9.62026-07-23SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as H…
CVE-2026-65550Medium5.92026-07-23Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.
CVE-2026-65540High7.12026-07-23Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.
CVE-2026-65539High7.12026-07-23Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.
CVE-2026-65538Medium5.92026-07-23Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.
CVE-2026-65537Medium4.32026-07-23Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.
CVE-2026-65536Medium6.52026-07-23Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.
CVE-2026-65535Medium4.32026-07-23Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions.
CVE-2026-65534Medium5.92026-07-23Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.
CVE-2026-65533Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.
CVE-2026-65532High7.62026-07-23Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.
CVE-2026-65531Medium4.82026-07-23Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.
CVE-2026-65530Medium4.32026-07-23Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.
CVE-2026-65529Medium5.32026-07-23Unauthenticated Broken Access Control in Graphina <= 3.1.12 versions.
CVE-2026-65528Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.
CVE-2026-65527Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.
CVE-2026-65526High8.52026-07-23Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection. This is…
CVE-2026-65525Medium5.32026-07-23Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.
CVE-2026-65524Medium4.32026-07-23Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.
CVE-2026-65522Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
CVE-2026-65521Medium5.32026-07-23Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.
CVE-2026-65519Medium6.52026-07-23Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.
CVE-2026-65518Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.
CVE-2026-65516High7.22026-07-23Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.
CVE-2026-65514Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.
CVE-2026-65512Medium5.42026-07-23Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This iss…
CVE-2026-65511High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
CVE-2026-65510High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.
CVE-2026-65506Medium5.32026-07-23Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.
CVE-2026-65505Medium5.32026-07-23Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
CVE-2026-65503Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
CVE-2026-65501Medium5.32026-07-23Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.
CVE-2026-65500High7.52026-07-23Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
CVE-2026-65499Medium6.52026-07-23Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.
CVE-2026-65498Medium5.32026-07-23Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions.
CVE-2026-65497High7.22026-07-23Administrator PHP Object Injection in Complianz <= 7.5.0 versions.
CVE-2026-65496Medium4.42026-07-23Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions.
CVE-2026-65495High7.52026-07-23Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions.
CVE-2026-65494High7.12026-07-23Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.
CVE-2026-65493High7.52026-07-23Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.
CVE-2026-65492High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in Dokan Pro <= 5.0.0 versions.
CVE-2026-65491Medium4.32026-07-23Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.
CVE-2026-65490Medium5.32026-07-23Unauthenticated Sensitive Data Exposure in Create by Mediavine <= 2.5.3 versions.
CVE-2026-65489Medium5.32026-07-23Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor <= 1.6.2 versions.
CVE-2026-65488High7.12026-07-23Unauthenticated Cross Site Request Forgery (CSRF) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.
CVE-2026-65487Medium5.32026-07-23Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.
CVE-2026-65486Medium5.32026-07-23Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.
CVE-2026-65485Medium5.32026-07-23Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.
CVE-2026-65484Medium6.32026-07-23Contributor Broken Access Control in Style Kits <= 2.6.5 versions.
CVE-2026-65483Medium5.92026-07-23Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.
CVE-2026-65482Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.
CVE-2026-65481High7.52026-07-23Contributor Local File Inclusion in Vino <= 1.9 versions.
CVE-2026-65480Medium6.52026-07-23Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affe…
CVE-2026-65479Medium5.42026-07-23Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.
CVE-2026-65478Medium5.42026-07-23Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.
CVE-2026-65477High7.52026-07-23Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.
CVE-2026-65476Medium5.32026-07-23Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.
CVE-2026-65475Medium6.52026-07-23Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This is…
CVE-2026-65474Medium5.32026-07-23Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.
CVE-2026-65473Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.
CVE-2026-65472Medium5.32026-07-23Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.
CVE-2026-65471Critical9.62026-07-23Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.
CVE-2026-65470Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.
CVE-2026-65469Medium5.32026-07-23Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.
CVE-2026-65468Medium5.32026-07-23Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.
CVE-2026-65467Medium4.92026-07-23Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.
CVE-2026-65466Medium4.92026-07-23Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.
CVE-2026-65465Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.
CVE-2026-65464Medium5.42026-07-23Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.
CVE-2026-65463Medium5.42026-07-23Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.
CVE-2026-65462High7.62026-07-23Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.
CVE-2026-65461Critical9.12026-07-23Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.
CVE-2026-65460Medium4.32026-07-23Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.