Total CVEs

143,818

Critical Severity

4,094

High Severity

14,786

Last 7 Days

1,526
Quick preset (or use dates below)
Clear Filters
📅 Showing Year: 2026 (January 1 - December 31, 2026) View All Years →
Showing 2,021 - 2,040 of 40,223 CVEs
CVE-2026-58652 HIGH - 7.5

luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-login script picker to /etc/travelmate/*.l...

Vendor: openwrt
Product: luci-app-travelmate, travelmate
Published: Jul 02, 2026
Source: NVD
CVE-2026-4772 MEDIUM - 5.4

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber ​​Defense Inc. WAF-ASP allows Stored XSS. This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117.

Published: Jul 02, 2026
Source: NVD
CVE-2026-4770 MEDIUM - 4.6

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber ​​Defense Inc. Web Application Firewall allows DOM-Based XSS. This issue affects Web Application Firewall: from v1.0.42.239 before v1.4.0.117.

Published: Jul 02, 2026
Source: NVD
CVE-2026-57766 HIGH - 8.8

Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor <= 3.5.6 versions.

Vendor: XplodedThemes
Product: WPIDE – File Manager & Code Editor
Published: Jul 02, 2026
Source: NVD
CVE-2026-57765 HIGH - 8.5

Contributor SQL Injection in WP EasyCart <= 5.9.0 versions.

Vendor: Levelfourdevelopment
Product: WP EasyCart
Published: Jul 02, 2026
Source: NVD
CVE-2026-57764 MEDIUM - 6.5

Contributor Cross Site Scripting (XSS) in Surbma | Yoast SEO Breadcrumb Shortcode <= 1.2 versions.

Vendor: Surbma
Product: Surbma | Yoast SEO Breadcrumb Shortcode
Published: Jul 02, 2026
Source: NVD
CVE-2026-57763 MEDIUM - 6.5

Contributor Cross Site Scripting (XSS) in Structured Content <= 1.7.0 versions.

Vendor: Gordon Böhme
Product: Structured Content
Published: Jul 02, 2026
Source: NVD
CVE-2026-57762 MEDIUM - 5.9

Author Cross Site Scripting (XSS) in Simple URLs <= 151 versions.

Vendor: Andrew Fiebert
Product: Simple URLs
Published: Jul 02, 2026
Source: NVD
CVE-2026-57761 HIGH - 7.1

Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions.

Vendor: BlueAstralThemes
Product: SEOWP
Published: Jul 02, 2026
Source: NVD
CVE-2026-57760 MEDIUM - 5.3

Missing Authorization vulnerability in Sendcloud Sendcloud Shipping allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sendcloud Shipping: from n/a through 1.0.29.

Vendor: Sendcloud
Product: Sendcloud Shipping
Published: Jul 02, 2026
Source: NVD
CVE-2026-57759 HIGH - 8.8

Unauthenticated Cross Site Request Forgery (CSRF) in ProfileGrid <= 5.9.9.7 versions.

Vendor: Metagauss
Product: ProfileGrid
Published: Jul 02, 2026
Source: NVD
CVE-2026-57758 HIGH - 7.1

Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce <= 1.0.8.2 versions.

Vendor: BeRocket
Product: Permalink Manager for WooCommerce
Published: Jul 02, 2026
Source: NVD
CVE-2026-57757 HIGH - 7.1

Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions.

Vendor: ploudapp
Product: pCloud WP Backup
Published: Jul 02, 2026
Source: NVD
CVE-2026-57756 HIGH - 8.5

Contributor SQL Injection in nicen-localize-image <= 1.4.9 versions.

Vendor: 友人a丶
Product: nicen-localize-image
Published: Jul 02, 2026
Source: NVD
CVE-2026-57755 MEDIUM - 6.5

Contributor Cross Site Scripting (XSS) in Mosaic Gallery &#8211; Advanced Gallery <= 1.2.0 versions.

Vendor: Misbah WP
Product: Mosaic Gallery &#8211; Advanced Gallery
Published: Jul 02, 2026
Source: NVD
CVE-2026-57754 MEDIUM - 6.5

Contributor Cross Site Scripting (XSS) in Livemesh Addons for WPBakery Page Builder <= 3.9.4 versions.

Vendor: Livemesh
Product: Livemesh Addons for WPBakery Page Builder
Published: Jul 02, 2026
Source: NVD
CVE-2026-57753 MEDIUM - 5.3

Unauthenticated Sensitive Data Exposure in Kit (formerly ConvertKit) for WooCommerce <= 2.1.5 versions.

Vendor: Nathanbarry
Product: Kit (formerly ConvertKit) for WooCommerce
Published: Jul 02, 2026
Source: NVD
CVE-2026-57752 HIGH - 8.5

Contributor SQL Injection in iNET Webkit 1.2.4 versions.

Vendor: iNET
Product: iNET Webkit
Published: Jul 02, 2026
Source: NVD
CVE-2026-57751 HIGH - 8.1

Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions.

Vendor: Heateor Support
Product: Heateor Social Login
Published: Jul 02, 2026
Source: NVD
CVE-2026-57750 MEDIUM - 5.3

Unauthenticated Broken Access Control in ez Form Calculator Premium <= 2.14.1.2 versions.

Vendor: Keksdieb
Product: ez Form Calculator Premium
Published: Jul 02, 2026
Source: NVD