2026 · High

High-severity vulnerabilities disclosed in 2026

High-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

4140 published vulnerabilities · page 39 of 42

• CVE-2026-55077HIGH 7.2

  Coder, a platform for provisioning remote development environments through Terraform, contains an authorization flaw in its password reset endpoint. An administrator with the `user-admin` role can reset the password of an owner account without providing the owner's current password—a capability that should be restricted to the owner themselves. The vulnerability is present in versions prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2. Since exploitation requires the privileged `user-admin` role, the practical risk depends on how broadly that role is distributed in your organization.

• CVE-2026-5513HIGH 7.2

  The Bookly WordPress plugin—used for managing appointments and customer bookings—has a security flaw that allows attackers to inject malicious code into websites. When a visitor accesses the affected site, the injected script runs in their browser, potentially stealing information or compromising their session. The vulnerability affects versions up to 27.2 and requires a specific feature (storing customer details in browser cookies) to be enabled, which is off by default. This means many sites are protected by default, but any installation that has explicitly enabled cookie-based customer data retention is at risk.

• CVE-2026-55477HIGH 7.2

  3X-UI, a web-based control panel for managing Xray-core proxy servers, contains a vulnerability in its database import feature that allows authenticated administrators to write arbitrary files to the server. An attacker with admin credentials can manipulate Xray configuration values during import to place malicious files on disk, potentially leading to code execution with the privileges of the Xray process—which may be root. The vulnerability affects all versions prior to 3.3.1 and is resolved in that release.

• CVE-2026-55975HIGH 7.2

  H.View IP cameras contain a vulnerability where authenticated users can inject malicious commands through the certificate generation feature. By submitting specially crafted XML input, an attacker with valid credentials can execute arbitrary commands with elevated system privileges on the camera device. This is a serious risk if an attacker gains initial authentication access or if default credentials remain unchanged.

• CVE-2026-56222HIGH 7.2

  Capgo versions before 12.128.2 have an authorization flaw that allows an administrator in one organization to gain unauthorized access to applications belonging to a different organization. When creating role bindings through the /private/role_bindings endpoint, the system fails to verify that the administrator actually owns the target application. This means an attacker with admin rights in their own organization can escalate privileges to read and modify applications they should have no access to.

• CVE-2026-56382HIGH 7.2

  Craft CMS contains a critical flaw in how it handles field layout configuration requests from admin users. When an authenticated administrator submits a field layout preview request, the application fails to properly sanitize the configuration data before processing it. This allows an attacker with admin privileges to embed malicious PHP code that executes on the server, potentially exposing sensitive data like database credentials and encryption keys. The vulnerability affects Craft CMS versions 5.5.0 through 5.9.13 and is resolved in version 5.9.14.

• CVE-2026-56414HIGH 7.2

  H.View IP cameras contain a vulnerability in their certificate upload feature that allows authenticated administrators to upload any file type to system directories reserved for security certificates. The system fails to validate what gets uploaded, enabling attackers with admin access to place malicious or corrupted files in trusted locations. These files persist even after the device reboots, potentially compromising camera functionality or enabling further attacks.

• CVE-2026-56446HIGH 7.2

  MISP contains a critical configuration flaw in its error logging system that allows site administrators to write log files to arbitrary locations on the server. Because log data can contain attacker-controlled input, a malicious administrator could place a PHP file in a web-accessible directory and inject executable code through the logging mechanism. When that file is accessed, it runs as the web server, potentially giving the attacker full control of the MISP instance and connected systems.

• CVE-2026-56447HIGH 7.2

  MISP, an open-source threat intelligence platform, contains a configuration flaw that allows authenticated site administrators to inadvertently enable arbitrary code execution. The vulnerability stems from improper validation of the Kafka_rdkafka_config setting, which accepts filesystem paths to INI files without restricting their location. An attacker with administrator privileges can point this setting to a malicious configuration file stored in a web-accessible or upload directory, then exploit rdkafka's plugin.library.paths option to load and execute arbitrary code under the MISP process user. The fix restricts this setting to approved configuration directories outside the web root and upload locations.

• CVE-2026-56808HIGH 7.2

  AVTECH Security Corporation's DGM3103SCT device contains a command injection flaw in its web management console. An attacker with valid login credentials can inject arbitrary operating system commands that execute with root-level privileges, potentially compromising the entire device and any systems it protects or manages.

• CVE-2026-57348HIGH 7.2

  Unauthenticated Server Side Request Forgery (SSRF) vulnerability exists in Paid Member Subscriptions plugin versions up to and including 3.0.4. An attacker can exploit this flaw without needing valid credentials to make the vulnerable server send requests to internal or external systems on their behalf. This could allow unauthorized access to internal services, data exfiltration, or attacks against systems the plugin server can reach.

• CVE-2026-58263HIGH 7.2

  Jodit Editor versions before 4.12.28 contain a sanitization bypass vulnerability in its HTML cleaning feature. An attacker can craft malicious HTML using MathML and style tags to hide dangerous content from the sanitizer, allowing event handlers like onload to survive in the editor's output. When this compromised output is rendered by consuming applications, the event handlers execute automatically without any user interaction, enabling unauthorized script execution (Mutation XSS).

• CVE-2026-58298HIGH 7.2

  A cross-site scripting (XSS) vulnerability in Microsoft Edge's Chromium engine allows attackers to inject malicious code into web pages viewed by users. An attacker can exploit this remotely over the network without requiring special privileges or user interaction, enabling them to spoof or impersonate content to deceive victims. The vulnerability affects the browser's input sanitization during page rendering.

• CVE-2026-59721HIGH 7.2

  Hoppscotch, an open-source API development platform, contains a critical configuration vulnerability that allows administrators with legitimate access to inadvertently or maliciously enable arbitrary command execution on the backend server. By crafting a specially formatted SMTP URL in the infrastructure settings, an attacker with admin privileges can inject sendmail transport options that execute system commands with root privileges when the service restarts and attempts to send mail. This is a post-authentication attack requiring admin access, but the impact—root code execution on the backend—is severe.

• CVE-2026-59821HIGH 7.2

  LiteLLM is a proxy server that helps applications communicate with various large language model APIs in a standardized way. A security gap was discovered in how the product handles custom code guardrails—safety rules written in Python that can inspect or filter API requests. Before version 1.82.0-stable, administrators with permission to create or update these guardrails could upload malicious Python code that would execute directly within the LiteLLM proxy process. This execution could potentially expose sensitive secrets (like API keys or credentials) that the proxy has access to. The vulnerability requires an authenticated, privileged user to exploit, limiting the immediate attack surface, but the consequences are severe.

• CVE-2026-60091HIGH 7.2

  PraisonAI versions before 4.6.78 contain a server-side request forgery (SSRF) vulnerability in their Jobs API that allows unauthenticated attackers to make the server perform HTTP requests to internal services. The vulnerability exists because the webhook URL parameter is validated when the request arrives, but the actual connection to that URL happens later—giving attackers time to use DNS rebinding techniques to swap a benign domain for an internal IP address. This lets attackers reach services on the internal network that should be unreachable from the internet.

• CVE-2026-61343HIGH 7.2

  LibreBooking contains a path traversal vulnerability in its email template editor. When an authenticated administrator saves an email template, the application fails to validate the template name before using it to construct the file path. An attacker with admin credentials can craft a malicious template name containing path traversal sequences (like `../`) to write files outside the intended template directory. By placing a file in a web-accessible location or a directory where code is executed, the attacker can achieve remote code execution on the server.

• CVE-2026-6818HIGH 7.2

  The VikBooking Hotel Booking Engine & PMS plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts into booking pages. When hotel staff or guests later view those pages, the injected scripts execute in their browsers, potentially stealing session data, credentials, or performing actions on behalf of users. All versions up to 1.8.8 are affected.

• CVE-2026-6820HIGH 7.2

  The VikBooking Hotel Booking Engine & PMS plugin for WordPress contains a vulnerability that allows attackers to inject malicious code into hotel booking pages. Because the plugin doesn't properly clean user input from the 'email' parameter, an attacker can craft a malicious link or form that, when visited by site visitors or administrators, executes arbitrary JavaScript in their browsers. This stored attack persists on the site until removed, affecting anyone who accesses the compromised page.

• CVE-2026-7052HIGH 7.2

  HT Contact Form, a popular WordPress form builder plugin, contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 2.8.2. An unauthenticated attacker can inject malicious scripts through file upload fields that persist in the database and execute in administrators' browsers when viewing form submissions. The vulnerability requires the 'Store Submissions' setting to be enabled—a common configuration. This is a stored rather than reflected attack, making it more dangerous because the payload remains active until manually removed.

• CVE-2026-7517HIGH 7.2

  A WordPress plugin called Custom Payment Gateways for WooCommerce contains a security flaw that allows anyone on the internet to inject malicious code into checkout pages. When victims visit an affected page, the attacker's code runs in their browser, potentially stealing sensitive information or redirecting them to phishing sites. The vulnerability affects all versions through 2.1.0 and requires no special access or configuration to exploit—an attacker simply needs to submit a specially crafted request during checkout.

• CVE-2026-7537HIGH 7.2

  The MDJM Event Management plugin for WordPress contains a file upload vulnerability that allows administrators to upload and execute malicious files on a website. Because there are no checks on file types, extensions, or formats, an attacker with admin access could upload executable files and run arbitrary code on the server. This affects all versions through 1.7.8.3.

• CVE-2026-7556HIGH 7.2

  The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 7.5.49.7212. An unauthenticated attacker can inject malicious scripts into page comments that execute when users visit the affected page. However, exploitation requires two conditions: the site administrator must have enabled the 'Parse Vimeo and YouTube links' setting (which is not enabled by default), and a moderator must approve the malicious comment before it becomes visible. Once those conditions are met, the injected code runs in the browsers of everyone who views the page.

• CVE-2026-7634HIGH 7.2

  The SlimStat Analytics plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts through the User-Agent header. When an administrator has enabled the 'show_complete_user_agent_tooltip' setting, these injected scripts will execute in the browsers of users who visit affected pages. This is a stored vulnerability, meaning the malicious payload persists in the database rather than requiring a specially crafted link. All versions up to and including 5.4.11 are affected.

• CVE-2026-7829HIGH 7.2

  UltraVNC Repeater versions up to 1.8.2.2 contain a stack-based buffer overflow in the settings parser used by the web-based admin interface. When an authenticated administrator configures allow/deny rules with unusually long tokens, the application writes a null terminator past the end of its internal buffer, overwriting adjacent stack memory. An attacker with admin credentials can exploit this to execute arbitrary code on the repeater machine. While direct admin access is normally required, this risk is amplified if an organization has been exposed to the related default-credentials vulnerability (CVE-2026-7839).

• CVE-2026-8141HIGH 7.2

  The Ajax Load More – Filters WordPress plugin contains a stored cross-site scripting (XSS) flaw that allows unauthenticated attackers to inject malicious scripts into web pages. The vulnerability exists in how the plugin processes the 'taxonomy_include_children' parameter without properly sanitizing or escaping user input. Once injected, the malicious script executes automatically whenever anyone visits the affected page, potentially compromising visitor accounts, stealing credentials, or spreading malware. All versions up to and including 3.4.1 are vulnerable.

• CVE-2026-8438HIGH 7.2

  The All-In-One Security (AIOS) WordPress plugin contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 5.4.7. An unauthenticated attacker can inject malicious JavaScript into debug logs by crafting specially designed REST API requests. When site administrators view the debug logs page, the injected script executes in their browser, potentially allowing the attacker to steal session credentials, execute unauthorized actions, or compromise the entire WordPress site. The vulnerability requires two specific plugin features to be enabled: the 'Disable REST API for non-logged in users' setting and debug logging.

• CVE-2026-8848HIGH 7.2

  The Popup Maker plugin for WordPress—a tool used to create popup forms for lead capture and conversions—contains a flaw that allows editors and higher-privileged users to bypass normal approval processes and force installation of malicious plugins. An attacker with editor-level access can install any plugin they choose from a URL they control, ultimately gaining full control over the WordPress site. This attack only works if the site has a valid Popup Maker Pro license but hasn't yet installed the Pro version of the plugin.

• CVE-2026-8901HIGH 7.2

  A WordPress plugin called 'Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More' contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.0.15. Attackers can inject malicious scripts through form submissions. The injected code executes when a form submission fails to reach the CRM API and an administrator later views the error details in the WordPress admin dashboard. This affects any WordPress site using the vulnerable plugin versions without requiring the attacker to be logged in.

• CVE-2026-9109HIGH 7.2

  A WordPress plugin called GPTranslate that handles website translations contains a security flaw allowing unauthenticated attackers to inject malicious code into web pages. The vulnerability exists because the plugin doesn't properly validate input when storing translations via its REST API. When visitors access an affected page, any injected code executes in their browsers. The plugin compounds this by exposing a deterministic API key in plain text on every page, making it trivial for attackers to craft malicious payloads without authentication.

• CVE-2026-9148HIGH 7.2

  The Comments – wpDiscuz plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 7.6.56. Attackers can inject malicious scripts through the guest commenter 'Website' field, which are then stored and executed whenever anyone views the affected page. Because no authentication is required and the attack happens at the network level, this poses a significant risk to any WordPress site running the vulnerable plugin.

• CVE-2026-9253HIGH 7.2

  The WP Cost Estimation & Payment Forms Builder plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts into form pages. Because the vulnerability is stored, any user who visits an affected page will have the injected script execute in their browser, potentially compromising their session, stealing data, or redirecting them to malicious sites. The flaw affects all versions up to and including 10.5.97.

• CVE-2026-9640HIGH 7.2

  A vulnerability in LXD allows authenticated project operators to escalate their privileges to root on the host system by bypassing security policies designed to restrict multi-tenant environments. An attacker with operator-level access in a restricted project can craft a malicious instance backup, import it, and restore its snapshot in a way that applies restricted configuration settings that would normally be blocked. Once the instance restarts with these unauthorized settings, the operator gains full root access to the underlying host. This affects LXD versions 6.0 through 6.8, 5.21.0 through 5.21.4, and 5.0.0 through 5.0.6.

• CVE-2026-9643HIGH 7.2

  The WP Meta SEO plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts into the plugin's database. When a user visits a non-existent page, the plugin captures the URL and stores it without proper sanitization. Later, when a WordPress administrator views the plugin's 404 & Redirects management page, the injected script executes in their browser with administrative privileges. This affects all versions up to and including 4.5.18.

• CVE-2026-9717HIGH 7.2

  CVE-2026-9717 is a command injection flaw in Schneider Electric PowerLogic P7 that allows a privileged user with network access to execute arbitrary system commands with elevated privileges. An authenticated administrator or high-privilege account can craft specially crafted input to bypass command filtering and run unauthorized code, potentially compromising the entire device. The vulnerability requires existing authentication but no user interaction—an attacker with valid credentials can exploit it remotely.

• CVE-2026-9777HIGH 7.2

  ATEN Unizon contains a directory traversal vulnerability in its restoreDB functionality that allows authenticated users to bypass normal file access restrictions and execute arbitrary code with SYSTEM-level privileges. An attacker with valid credentials can craft a malicious file path that traverses the directory structure, allowing them to place and execute code outside of intended boundaries. This is a post-authentication attack, meaning the attacker must already have login access to the system.

• CVE-2026-9778HIGH 7.2

  A directory traversal vulnerability in ATEN Unizon's ImportDeviceList function allows authenticated attackers to execute arbitrary code with SYSTEM-level privileges. The vulnerability stems from insufficient validation of file paths before they are used in file operations, enabling an attacker to traverse the directory structure and load malicious code. While authentication is required to exploit this flaw, the ability to escalate from an authenticated user to SYSTEM-level code execution represents a significant post-authentication privilege escalation risk.

• CVE-2026-9779HIGH 7.2

  ATEN Unizon contains a vulnerability in its file update mechanism that fails to properly verify digital signatures on cryptographic operations. An authenticated attacker can exploit this flaw to execute arbitrary code with SYSTEM-level privileges on affected systems. While authentication is required, the ability to run code as SYSTEM makes this a high-severity issue for organizations relying on Unizon for secure file operations.

• CVE-2026-9834HIGH 7.2

  A critical flaw exists in the WP Database Backup plugin for WordPress (versions up to 7.11) that allows administrators to inadvertently—or an attacker with admin access to intentionally—inject operating system commands during backup operations. The vulnerability stems from the plugin failing to properly escape user input in one specific backup parameter (the database table exclusion list), while escaping all other parameters correctly. This inconsistency creates an opening for shell command injection. When a backup is triggered, any malicious commands embedded in that parameter will execute with the privileges of the web server.

• CVE-2026-9851HIGH 7.2

  The Booking Package plugin for WordPress contains a critical flaw that allows authenticated editors and higher-privileged users to seize control of any WordPress account, including administrator accounts. An attacker with editor-level access can bypass security checks in the plugin's user management functionality to change email addresses and passwords of other users without proper authorization. This effectively enables complete site takeover.

• CVE-2016-20063HIGH 7.1

  Single Personal Message version 1.0.3 contains a SQL injection flaw that allows authenticated users to inject malicious database commands through the message parameter. An attacker with user credentials can craft specially-designed messages to execute arbitrary SQL queries, potentially extracting sensitive data such as user credentials and site configuration details from the underlying database.

• CVE-2017-20264HIGH 7.1

  Joomla! Component Sponsor Wall version 8.0 contains a critical weakness that allows attackers to inject malicious SQL commands without logging in. By crafting a specially designed web request, an attacker can trick the component into executing unauthorized database queries, potentially exposing usernames, passwords, and other sensitive configuration data. The vulnerability requires user interaction (clicking a malicious link), but no authentication is needed to attempt the attack.

• CVE-2017-20265HIGH 7.1

  A SQL injection flaw in Joomla! Component Flip Wall version 8.0 allows unauthenticated attackers to inject malicious database commands through a web parameter. By crafting a specially formatted web request, an attacker can query the underlying database directly—potentially exposing user credentials, configuration data, or other sensitive information. The attack requires no authentication and can be triggered simply by clicking a malicious link or visiting a compromised page.

• CVE-2018-25392HIGH 7.1

  MaxOn ERP Software versions 8.x through 9.x contain a SQL injection flaw that lets authenticated users inject malicious SQL commands through specific parameters in the activity logging function. An attacker with valid credentials can craft POST requests to extract sensitive database information such as version numbers and database names. While exploitation requires authentication, the impact—unauthorized access to database structure and sensitive data—represents a meaningful security risk for organizations running these versions.

• CVE-2018-25410HIGH 7.1

  SIM-PKH version 2.4.1 contains a SQL injection flaw in its admin media management interface. An authenticated attacker can craft malicious requests to the /admin/media.php endpoint that inject SQL code, allowing them to extract sensitive database information such as usernames, database names, and version details. The vulnerability requires valid login credentials but poses a meaningful risk to data confidentiality within affected deployments.

• CVE-2018-25429HIGH 7.1

  Paroiciel version 11.20 contains an SQL injection vulnerability in the zpro.php endpoint that allows authenticated users to execute arbitrary database queries by manipulating the zProIdPro parameter. An attacker with valid credentials can craft malicious SQL statements to extract sensitive information from the database, including usernames, database names, and version details. This is a post-authentication attack that does not require user interaction.

• CVE-2018-25430HIGH 7.1

  Paroiciel version 11.20 contains a SQL injection flaw in its egeq.php endpoint. Authenticated users can craft malicious requests that embed SQL commands into the eGeqIdEquipe parameter, allowing them to query the underlying database directly. This bypasses normal access controls and could expose sensitive information such as database version details and other stored data. The vulnerability requires valid login credentials, so it represents an insider threat or compromised-account scenario.

• CVE-2018-25431HIGH 7.1

  No-Cms 1.0 contains a SQL injection flaw in its privilege management export feature. An authenticated user can craft a specially formatted request to extract sensitive data from the application's database by injecting malicious SQL commands into the order_by parameter. The vulnerability requires valid credentials but poses significant risk to data confidentiality.

• CVE-2019-25746HIGH 7.1

  WordPress administrators using the Sliced Invoices plugin version 3.8.2 face a SQL injection risk. An authenticated attacker—someone with valid WordPress login credentials—can craft malicious requests to the plugin's admin interface to read or alter database contents. While this requires existing access to WordPress, the vulnerability poses meaningful risk to organizations managing invoices through this plugin, especially in multi-user environments or where account credentials may be compromised.

• CVE-2019-25749HIGH 7.1

  Joomla J-CruisePortal version 6.0.4 is vulnerable to SQL injection through the guest_adult parameter. An authenticated attacker can craft malicious SQL code within this field and send it via POST requests to the cruises endpoint, allowing them to directly query or manipulate the application's database. This is a moderately severe risk that requires user authentication to exploit but can lead to exposure of sensitive customer and operational data.

• CVE-2019-25757HIGH 7.1

  Joomla vWishlist version 1.0.1 contains a SQL injection flaw that allows authenticated users to run arbitrary database commands. An attacker with valid login credentials can craft malicious SQL code within specific request parameters to extract sensitive database information such as version numbers and database names. This vulnerability requires authentication, which limits exposure to internal or compromised accounts.

• CVE-2019-25759HIGH 7.1

  Joomla! Component vBizz version 1.0.7 contains a SQL injection flaw in its employee management interface. An authenticated user can craft specially-formatted requests to the payid parameter that trick the application into executing unintended database commands. This allows attackers with valid login credentials to extract sensitive information from the underlying database, including version details and table names—a serious reconnaissance and data exfiltration risk for organizations running this component.

• CVE-2019-25761HIGH 7.1

  JoomCRM version 1.1.1, a Joomla component used for customer relationship management, contains a flaw that allows logged-in users to run unauthorized database commands. An attacker with valid credentials can manipulate a specific web request parameter to inject SQL code, potentially reading sensitive data from your database such as table structures and stored information. This is a high-severity issue because it requires authentication but grants significant read access to confidential data.

• CVE-2022-26758HIGH 7.1

  CVE-2022-26758 is a memory corruption vulnerability in macOS that allows a malicious application running on the same system to alter memory regions shared between processes. An attacker with local access and the ability to execute code would be able to read sensitive data or modify system behavior by corrupting this shared memory. Apple resolved this through improved state management in macOS Monterey 12.4.

• CVE-2023-33999HIGH 7.1

  WP Mail Log, a WordPress plugin, contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by site administrators and users. This vulnerability is exploitable through the DOM (Document Object Model) without requiring authentication, meaning an attacker can craft a malicious link or embed code on an external site to trigger the attack when a victim visits. The vulnerability affects all versions of WP Mail Log from its initial release through version 1.0.2.

• CVE-2025-15654HIGH 7.1

  CVE-2025-15654 is a reflected cross-site scripting (XSS) vulnerability in Fox-themes Prague versions 2.2.8 and earlier. An attacker can craft a malicious URL containing unsanitized input that, when visited by a user, executes arbitrary JavaScript in their browser within the context of the vulnerable application. This allows the attacker to steal session cookies, perform actions on behalf of the victim, or redirect them to phishing sites—all without modifying the application itself.

• CVE-2025-31013HIGH 7.1

  Themify Folo contains a reflected cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious JavaScript into a web page viewed by other users. An attacker crafts a malicious link and tricks a user into clicking it; when the victim visits the link, the injected code executes in their browser with their permissions. This can lead to session hijacking, credential theft, or malware distribution. The vulnerability affects all versions of Themify Folo through version 1.9.6.

• CVE-2025-52612HIGH 7.1

  HCL iControl contains a vulnerability that combines CSV injection with reflected cross-site scripting (XSS) in its export function. An authenticated attacker can craft malicious input that, when a user interacts with exported CSV content or follows a specially crafted link, executes arbitrary JavaScript in the victim's browser session. The vulnerability stems from inadequate input validation and sanitization, allowing attackers to inject both CSV formulas and script payloads.

• CVE-2025-52759HIGH 7.1

  A reflected cross-site scripting (XSS) vulnerability exists in the UnboundStudio Accordion FAQ plugin affecting versions up to 2.2.1. An attacker can craft a malicious link that, when clicked by a user, executes arbitrary JavaScript in the victim's browser within the context of the affected site. This allows theft of session cookies, credential harvesting, malware injection, or other client-side attacks. The vulnerability requires user interaction—specifically clicking a malicious link—but has no authentication barrier, making it a straightforward social engineering vector.

• CVE-2025-67448HIGH 7.1

  A stored cross-site scripting (XSS) vulnerability exists in the SMS module of Neterbit NW-431F routers running firmware version 20241014-IR03 and earlier. An attacker can craft a malicious SMS message and send it to a router user; when that user views the message, the embedded script executes in their browser. This allows attackers to steal session tokens, redirect users, inject fake content, or perform actions on behalf of the victim—all without the victim realizing they've been compromised through what appears to be a routine SMS.

• CVE-2025-68872HIGH 7.1

  A security flaw in Eli's WordCents adSense Widget with Analytics (version 1.3.03.27 and earlier) allows attackers to inject malicious scripts into web pages without requiring authentication. When a user visits an affected page, the injected code executes in their browser, potentially stealing session cookies, redirecting them to phishing sites, or capturing form input. The vulnerability stems from insufficient validation of user-supplied input before displaying it on the page.

• CVE-2025-69151HIGH 7.1

  Grand Car Rental versions 3.7 and earlier contain an unauthenticated Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the application without needing credentials. When a user visits a crafted link or page, the injected script executes in their browser, potentially stealing session tokens, redirecting them to phishing sites, or performing actions on their behalf. The vulnerability does not require authentication, making it accessible to any attacker who can trick a user into clicking a malicious link.

• CVE-2025-69152HIGH 7.1

  A cross-site scripting (XSS) vulnerability exists in Artale | Wedding Photography WordPress plugin version 2.2.2 and earlier. The flaw allows an attacker to inject malicious scripts into web pages viewed by site visitors without requiring authentication. When a victim visits a compromised page, the injected script executes in their browser, potentially stealing session cookies, redirecting users, or performing actions on their behalf. The vulnerability is considered high-severity because it can spread site-wide impact to multiple visitors and affects the site's integrity and confidentiality.

• CVE-2025-69154HIGH 7.1

  A flaw in the SpaLab Beauty Salon WordPress Theme (version 6.7 and earlier) allows attackers to inject malicious scripts into web pages viewed by site visitors, without needing to log in first. When a user visits an affected page, the injected code runs in their browser under the site's context, potentially stealing session cookies, defacing content, or redirecting visitors to malicious sites. The vulnerability is rated HIGH severity because it affects unauthenticated attackers and impacts the confidentiality, integrity, and availability of user interactions.

• CVE-2025-69155HIGH 7.1

  The Fitness Zone WordPress theme up to version 5.7 contains an unauthenticated cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by site visitors. Because no authentication is required, any attacker can craft a malicious request to inject JavaScript code. When users visit an affected page, the injected script executes in their browser, potentially stealing session cookies, redirecting users to malicious sites, or defacing content. This is particularly concerning for WordPress sites using this theme for fitness businesses, gyms, or health-related services that may handle client data or payments.

• CVE-2025-69156HIGH 7.1

  An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in the Kids Zone – Children WordPress theme affecting version 5.4 and earlier. This flaw allows attackers to inject malicious scripts into the website without authentication, potentially compromising visitor sessions, stealing sensitive data, or redirecting users to phishing pages. The vulnerability requires user interaction (such as clicking a malicious link) to trigger the attack, but poses significant risk because anyone visiting an affected website could be targeted.

• CVE-2026-0281HIGH 7.1

  An unauthenticated attacker can trick a legitimate user into clicking a malicious link that allows the attacker to steal their web session token for the Palo Alto Networks firewall management interface. This token grants access to sensitive firewall configuration and monitoring capabilities. The attack requires both network access to the management interface and social engineering to get a user to click the link, but once successful, the attacker can impersonate that user without needing their password.

• CVE-2026-10546HIGH 7.1

  IBM Langflow OSS versions 1.0.0 through 1.9.3 contain a Server-Side Request Forgery (SSRF) vulnerability in the URL component. An attacker with login credentials can exploit a timing weakness in how the system validates URLs to make the application fetch resources from unintended internal or external locations. The vulnerability leverages DNS rebinding, a technique where a domain name's IP address changes between the validation check and actual use, allowing bypass of security controls.

• CVE-2026-10641HIGH 7.1

  A vulnerability in Zephyr's Bluetooth Classic implementation allows a remote device to crash or corrupt memory on systems running vulnerable builds. When a Zephyr device establishes a Bluetooth connection using the Hands-Free Profile, it expects responses from the remote device that follow a defined format. An attacker controlling or spoofing the remote device can send a malformed response with an unusually long list of indicators, bypassing safety checks and writing data into unintended memory locations. This memory corruption can disable Bluetooth functionality and potentially affect system stability. The vulnerability requires the attacker to be within Bluetooth range and does not require user interaction to trigger.

• CVE-2026-10651HIGH 7.1

  A Bluetooth protocol parser in Zephyr has a boundary-checking flaw that allows a remote device to read one byte past the allocated buffer. When a specially crafted SDP (Service Discovery Protocol) record arrives, the parser validates only that three bytes are present, then immediately tries to read a fourth byte without proper bounds checking. The over-read itself is limited and not exploitable for data theft, but it can crash the device if that fourth byte sits at a memory boundary or trigger a debug assertion. This affects devices running Zephyr 4.3.0 and 4.4.0 and requires no authentication—any paired or nearby Bluetooth peer can send the malicious record.

• CVE-2026-10658HIGH 7.1

  A buffer handling flaw in Zephyr's Bluetooth ISO receive path allows an attacker with access to an established Bluetooth connection to read and write memory beyond buffer boundaries. When processing incoming ISO data packets, the code fails to validate that the packet contains enough bytes before extracting header information. An attacker on a compromised or adjacent Bluetooth device can craft malicious packets to cause out-of-bounds reads that corrupt data structures, and in multi-packet scenarios, trigger out-of-bounds writes that overwrite critical memory regions. The vulnerability affects Zephyr versions 2.6.0 through 4.4.0 when Bluetooth ISO receive functionality is enabled (typically for LE Audio applications).

• CVE-2026-10840HIGH 7.1

  OpenShift Pipelines operator contains a privilege escalation vulnerability stemming from overly permissive role-based access control (RBAC). The tekton-scheduler-rolebinding automatically grants any authenticated user write access to Kueue and cert-manager custom resources. This means that anyone with cluster login credentials—including low-privilege service accounts or developers without special permissions—can interfere with workload scheduling, tamper with certificate management, and potentially overwrite critical TLS secrets used by ingress controllers. The vulnerability is particularly dangerous in multi-tenant clusters where separation of duties is expected.

• CVE-2026-11269HIGH 7.1

  Google Chrome versions prior to 149.0.7827.53 contain a vulnerability in how the browser handles extensions that allows an attacker positioned on the same network as a user to execute arbitrary code within Chrome's sandbox. The attacker must craft a malicious extension and the user must interact with it (such as installing or clicking something), making this a moderate-complexity attack. While Chromium rated this as low severity internally, the CVSS assessment reflects the potential for complete compromise of the sandboxed process.

• CVE-2026-11422HIGH 7.1

  Markdown Preview Enhanced, a popular VS Code extension that renders Markdown with enhanced visualization features, contains a critical flaw in how it processes WaveDrom diagrams. An attacker can craft a malicious Markdown file containing specially crafted WaveDrom code that, when previewed in VS Code, executes arbitrary JavaScript with the privileges of the extension. This JavaScript can then read files from your computer and write new files to your filesystem, potentially installing malware or stealing sensitive data. The vulnerability affects version 0.8.x when used with crossnote engine 0.9.28.

• CVE-2026-11546HIGH 7.1

  IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7 contain a server-side request forgery (SSRF) vulnerability that becomes exploitable when the adminCenter-1.0 feature is enabled. An authenticated attacker can abuse this flaw to make the vulnerable server perform unintended requests to internal or external systems, potentially compromising confidentiality and service availability. The vulnerability requires valid credentials to exploit, limiting the immediate blast radius but remaining a serious concern for organizations running affected Liberty versions with admin center enabled.

• CVE-2026-13601HIGH 7.1

  Yelp, a GNOME help viewer, contains a flaw in how it handles security policies that allow malicious applications running in a Flatpak sandbox to access files they shouldn't. By crafting specially formatted help content containing untrusted stylesheets embedded in SVG documents, an attacker can trick Yelp into reading arbitrary files from the host system and sending that data back over the internet. This bypasses Flatpak's sandbox protections, potentially exposing sensitive user data.

• CVE-2026-13705HIGH 7.1

  Imager, a Perl image processing library, contains a memory safety flaw in its SGI image format parser. When processing specially crafted SGI files, the code miscalculates how many bytes to read from memory, causing it to read beyond the allocated buffer. This occurs only with 16-bit color SGI images and happens early enough in parsing that a malicious image can crash any application using Imager to open untrusted image files. The vulnerability requires user interaction (opening a file) but affects both local and remote scenarios where images are processed.

• CVE-2026-14372HIGH 7.1

  Bit Form, a widely-deployed WordPress form builder plugin, contains a critical flaw that lets anyone with a basic subscriber account delete arbitrary files from a website's server. The vulnerability stems from weak validation of file paths in the deletion function, meaning an attacker can target sensitive files like wp-config.php. Removing the right file can grant an attacker complete control of the site. The issue affects all versions up to 3.1.1.

• CVE-2026-20258HIGH 7.1

  A stored cross-site scripting (XSS) vulnerability in Splunk Enterprise and Splunk Cloud Platform allows a low-privileged user without admin or power roles to inject malicious JavaScript into a classic dashboard HTML panel. When another user views that dashboard, the attacker's code executes in their browser with their privileges. The attack requires social engineering—the attacker must trick the victim into triggering a request—meaning it cannot be exploited automatically but relies on user interaction.

• CVE-2026-20779HIGH 7.1

  Gitea, a popular self-hosted Git service, contains a flaw in its two-factor authentication (2FA) system that allows attackers to reuse the same time-based one-time password (TOTP) code multiple times. Instead of invalidating a code after first use, the vulnerability permits a valid code to work across different authentication sessions and through multiple access methods. An attacker who obtains a valid TOTP code—through phishing, shoulder surfing, or other means—can leverage it repeatedly before it naturally expires, effectively bypassing the single-use guarantee that 2FA is designed to enforce. This affects Gitea versions 1.5.0 through 1.26.2.

• CVE-2026-21032HIGH 7.1

  Samsung Assistant versions before 9.3.14 contain a flaw in how they expose certain application components. A person with local access to an Android device can exploit this misconfiguration to run arbitrary scripts with elevated privileges, potentially gaining unauthorized control over the device or sensitive functions.

• CVE-2026-21033HIGH 7.1

  Samsung Assistant versions before 9.3.14 contain a flaw in how it exports Android application components, specifically in the ExpressHomeWidgetReceiver. A local attacker with standard user privileges can exploit this misconfiguration to execute arbitrary code or scripts on a device. The vulnerability requires local access but no special interaction from the user, making it a practical concern for devices where untrusted applications may be installed.

• CVE-2026-21037HIGH 7.1

  Samsung Members versions before 5.8.01.5 contain a flaw that fails to properly check what input users provide. A local attacker—someone already with access to the device—can exploit this to redirect the app to any URL and launch other features or apps while pretending to be Samsung Members, which runs with elevated privileges on the device.

• CVE-2026-21383HIGH 7.1

  A cryptographic flaw in Qualcomm wireless and networking firmware allows attackers with local access to compromise the confidentiality and integrity of encrypted communications. The issue stems from reusing the same initialization vector (IV) across multiple AES-GCM encryption operations—a practice that fundamentally breaks the security guarantees of GCM mode. An attacker can exploit this weakness to decrypt previously captured traffic or forge encrypted messages, potentially gaining unauthorized access to sensitive data or system communications.

• CVE-2026-23970HIGH 7.1

  Contact Form 7 version 3.2.8 and earlier contain an unauthenticated Cross-Site Scripting vulnerability in the form redirection functionality. An attacker can inject malicious JavaScript into a redirect parameter, and when a victim visits or completes the form, the script executes in their browser. This doesn't require the attacker to be authenticated or logged in, making it a low-friction attack vector.

• CVE-2026-24090HIGH 7.1

  A cryptographic weakness in how Qualcomm processors handle partition table entries during boot allows a local attacker with standard user privileges to modify the boot process without authorization. This could enable an attacker to alter how a device loads its operating system or firmware, potentially leading to installation of malicious code or bypass of security controls. The vulnerability requires direct access to the device and cannot be exploited remotely.

• CVE-2026-24349HIGH 7.1

  A vulnerability in Siemens SIMATIC WinCC Unified PC Runtime allows an attacker with local access to extract sensitive cryptographic material from the Certificate Manager component. The issue stems from inadequate protection of key material stored on disk or in memory, potentially exposing certificates and private keys that protect SCADA/HMI communications. While exploitation requires local system access, the impact is significant because certificate compromise can enable downstream attacks on industrial control systems and their communications.

• CVE-2026-27402HIGH 7.1

  A stored cross-site scripting (XSS) vulnerability exists in Kids Life | Children School WordPress plugin versions 5.2 and earlier. An attacker can inject malicious scripts without authentication, which are then executed in the browsers of site administrators and other users who view the affected content. This allows attackers to steal sessions, redirect users, or perform actions on behalf of legitimate users.

• CVE-2026-27426HIGH 7.1

  An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in Automotive Car Dealership Business software versions 13.3.3 and earlier. Because no authentication is required, an attacker can craft a malicious link or embed script code that, when visited by a dealership customer or employee, executes in their browser with access to their session and sensitive data. This affects the confidentiality, integrity, and availability of user interactions with the platform.

• CVE-2026-28740HIGH 7.1

  Gitea, a popular self-hosted Git service, contains an authorization bypass vulnerability in how it handles Git Large File Storage (LFS) objects. An authenticated user who has general repository access but is explicitly restricted from viewing code can bypass those restrictions to access private LFS objects stored in that repository. The issue affects Gitea versions 1.26.2 and earlier. An attacker with basic repository access could exploit this to read sensitive files stored via LFS without proper authorization checks.

• CVE-2026-31942HIGH 7.1

  LibreChat versions up to 0.7.6 contain a critical flaw in how API keys are managed. Any authenticated user can manipulate API key settings for other users by injecting parameters into requests, allowing them to replace legitimate API keys (from providers like OpenAI, Anthropic, or Azure) with their own or invalid ones. This means an attacker could intercept conversations through attacker-controlled API endpoints or disable a victim's service entirely.

• CVE-2026-31982HIGH 7.1

  A flaw in the SAML single sign-on mechanism allows an unauthenticated attacker to redirect users to a malicious website during the authentication process. By poisoning the cached redirection target, an attacker can trick multiple users into entering their credentials on a fake login page or disrupt their ability to authenticate altogether. The vulnerability requires user interaction—specifically, the user must initiate the SAML sign-on flow—but no prior authentication is needed to set up the attack.

• CVE-2026-33560HIGH 7.1

  The DMP-5000 file service and related Daktronics display products contain a critical flaw in their file upload mechanism. Authenticated users can upload any type of file—including executable programs and scripts—without restriction. The system fails to validate file types, inspect content, or enforce any filtering, allowing attackers with valid credentials to place malicious binaries directly onto the server where they can potentially be executed.

• CVE-2026-34194HIGH 7.1

  CVE-2026-34194 is a memory management flaw in GPU-accelerated software that allows a non-privileged user to trigger incorrect memory references through improper GPU system calls. When the software performs mathematical operations across GPU buffers of different sizes, it can incorrectly access memory locations outside its intended scope. This can corrupt data or crash the application, but does not enable privilege escalation or data theft. The vulnerability requires local system access and is triggered through the application itself—not remotely.

• CVE-2026-34902HIGH 7.1

  WooCommerce Product Table Lite, a popular WordPress plugin for displaying product catalogs in table format, contains an unauthenticated cross-site scripting (XSS) vulnerability in versions 4.6.3 and earlier. An attacker can inject malicious JavaScript code that executes in the browsers of site visitors without needing to log in or have special permissions. This allows attackers to steal session cookies, redirect users to phishing pages, capture form data, or deface content—all while appearing to come from your trusted website.

• CVE-2026-35066HIGH 7.1

  Dell PowerFlex Manager versions before 5.1.0.1 contain an access control flaw that allows low-privileged remote attackers to cause denial of service. The vulnerability stems from improper enforcement of access restrictions, enabling an authenticated attacker to disrupt availability of the management platform without requiring elevated permissions or user interaction.

• CVE-2026-35210HIGH 7.1

  OpenCTI, an open-source threat intelligence platform, contains an authorization bypass flaw in versions before 7.260326.0. Users with standard knowledge update permissions can manipulate how the system treats sensitive intelligence by sending a specially crafted HTTP header. This allows them to weaken confidence levels on threat data, strip off security markings like TLP:RED that restrict distribution, and alter relationships between threat actors, malware, and indicators—even though they should not have permission to do so. The vulnerability requires an authenticated account but no additional interaction, making it a direct privilege escalation risk for organizations relying on OpenCTI to maintain the integrity and confidentiality of their threat intelligence.

• CVE-2026-36176HIGH 7.1

  GNCC GP5 version 7.1.76 leaks Backblaze B2 cloud storage upload credentials to the device's serial console in plaintext. An attacker with physical access to the hardware can monitor the UART interface and capture active, pre-signed upload URLs intended for file transfers. Once captured, these URLs can be used to upload or manipulate files in the connected B2 storage bucket without authorization. The vulnerability requires proximity to the device but poses significant risk to organizations using this gateway in sensitive environments.

• CVE-2026-36606HIGH 7.1

  Mercusys AC12G (EU) V1 routers running firmware version AC12G(EU)_V1_200909 store backup files that are encrypted with a hardcoded, publicly discoverable key using weak encryption. Anyone who obtains a backup file—whether through direct device access, cloud storage misconfiguration, or phishing—can decrypt it and extract sensitive credentials including the admin password, WiFi pre-shared key, and DDNS login information. This is a local attack that depends on an attacker first gaining access to the backup file itself.

• CVE-2026-3840HIGH 7.1

  A path traversal vulnerability in Kedro 1.2.0 allows an authenticated local attacker to break out of the intended dataset directory structure by injecting specially crafted version strings. The flaw exists in how the data pipeline tool constructs file paths when versioning datasets, enabling unauthorized access to files outside the expected scope. This can be exploited both programmatically and via the command-line interface, potentially allowing attackers to read sensitive files or inject malicious data into shared environments.