Total CVEs

140,315

Critical Severity

3,712

High Severity

13,361

Last 7 Days

1,810
Quick preset (or use dates below)
Clear Filters
📅 Showing Year: 2026 (January 1 - December 31, 2026) View All Years →
Showing 261 - 280 of 36,720 CVEs
CVE-2026-57622 MEDIUM - 4.3

Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.

Vendor: Arraytics
Product: WPCafe
Published: Jun 26, 2026
Source: NVD
CVE-2026-57618 MEDIUM - 6.5

Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions.

Vendor: Themeisle
Product: Neve PRO
Published: Jun 26, 2026
Source: NVD
CVE-2026-57617 MEDIUM - 6.5

Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions.

Vendor: SeedProd LLC.
Product: SeedProd Pro
Published: Jun 26, 2026
Source: NVD
CVE-2026-57527 HIGH - 8.8

Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter....

Vendor: zaproxy
Product: zap-extensions
Published: Jun 26, 2026
Source: NVD
CVE-2026-57431 MEDIUM - 6.5

Author Cross Site Scripting (XSS) in Featured Image <= 2.1 versions.

Vendor: Mervin Praison
Product: Featured Image
Published: Jun 26, 2026
Source: NVD
CVE-2026-57430 MEDIUM - 4.3

Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.

Vendor: SEOPress Free
Product: SEOPress PRO
Published: Jun 26, 2026
Source: NVD
CVE-2026-57325 HIGH - 7.1

Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions.

Vendor: Jellywp
Product: NanoMag
Published: Jun 26, 2026
Source: NVD
CVE-2026-57324 MEDIUM - 6.5

Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.

Vendor: VillaTheme
Product: GIFT4U
Published: Jun 26, 2026
Source: NVD
CVE-2026-57323 MEDIUM - 5.8

Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.

Vendor: bPlugins
Product: Flash & HTML5 Video
Published: Jun 26, 2026
Source: NVD
CVE-2026-57322 HIGH - 7.1

Unauthenticated Cross Site Scripting (XSS) in weMail <= 2.1.2 versions.

Vendor: weDevs
Product: weMail
Published: Jun 26, 2026
Source: NVD
CVE-2026-57321 HIGH - 7.1

Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.

Vendor: icc0rz
Product: H5P
Published: Jun 26, 2026
Source: NVD
CVE-2026-57319 HIGH - 7.1

Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.

Vendor: RealMag777
Product: FOX
Published: Jun 26, 2026
Source: NVD
CVE-2026-57318 MEDIUM - 6.5

Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions.

Vendor: Gemini Labs
Product: Site Reviews
Published: Jun 26, 2026
Source: NVD
CVE-2026-57317 HIGH - 7.1

Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.

Vendor: NSquared
Product: Simply Schedule Appointments
Published: Jun 26, 2026
Source: NVD
CVE-2026-57316 MEDIUM - 6.5

Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.

Vendor: Roxnor
Product: GetGenie
Published: Jun 26, 2026
Source: NVD
CVE-2026-57315 HIGH - 8.5

Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.

Vendor: Creative Themes
Product: Blocksy Companion Pro
Published: Jun 26, 2026
Source: NVD
CVE-2026-57314 HIGH - 7.1

Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions.

Vendor: SureCart
Product: SureCart
Published: Jun 26, 2026
Source: NVD
CVE-2026-57313 MEDIUM - 6.5

Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.

Vendor: SureCart
Product: SureCart
Published: Jun 26, 2026
Source: NVD
CVE-2026-57312 HIGH - 7.1

Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions.

Vendor: wpeverest
Product: Everest Forms
Published: Jun 26, 2026
Source: NVD
CVE-2026-56773 HIGH - 8.8

Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can read table schemas, create tables, and modify or delete records across bases and tables via endpoints like GET /api/v2/tables/get and POST...

Vendor: teableio
Product: teable
Published: Jun 26, 2026
Source: NVD