2026 CVE Vulnerabilities
43,090 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-15732 | CRITICAL | 9.8 | 0.2% | Aug 6, 2026 | A Server-Side Request Forgery (SSFR) vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functiona... |
| CVE-2026-14812 | CRITICAL | 10 | 0.6% | Aug 6, 2026 | The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator ... |
| CVE-2026-11976 | CRITICAL | 10 | 0.5% | Aug 6, 2026 | The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both ... |
| CVE-2026-67261 | CRITICAL | 9.8 | 1.6% | Aug 6, 2026 | Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injecti... |
| CVE-2026-66709 | CRITICAL | 9.1 | — | Aug 6, 2026 | Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions. |
| CVE-2026-66665 | CRITICAL | 10 | — | Aug 6, 2026 | Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions. |
| CVE-2026-66662 | CRITICAL | 9.8 | — | Aug 6, 2026 | Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions. |
| CVE-2026-66447 | CRITICAL | 9.3 | — | Aug 6, 2026 | Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions. |
| CVE-2026-65581 | CRITICAL | 9.8 | — | Aug 6, 2026 | Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions. |
| CVE-2026-65579 | CRITICAL | 9.8 | — | Aug 6, 2026 | Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions. |
| CVE-2026-65578 | CRITICAL | 9.8 | — | Aug 6, 2026 | Unauthenticated PHP Object Injection in Agora <= 1.9 versions. |
| CVE-2026-65577 | CRITICAL | 9.8 | — | Aug 6, 2026 | Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions. |
| CVE-2026-65576 | CRITICAL | 9.8 | — | Aug 6, 2026 | Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions. |
| CVE-2026-65575 | CRITICAL | 9.8 | — | Aug 6, 2026 | Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions. |
| CVE-2026-65574 | CRITICAL | 9.8 | — | Aug 6, 2026 | Unauthenticated PHP Object Injection in Abogado <= 1.18 versions. |
| CVE-2026-65573 | CRITICAL | 9.8 | — | Aug 6, 2026 | Unauthenticated PHP Object Injection in Abelle <= 1.22 versions. |
| CVE-2026-65572 | CRITICAL | 9.8 | — | Aug 6, 2026 | Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions. |
| CVE-2026-65571 | CRITICAL | 9.8 | — | Aug 6, 2026 | Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions. |
| CVE-2026-65556 | CRITICAL | 9.8 | — | Aug 6, 2026 | Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions. |
| CVE-2026-65553 | CRITICAL | 10 | — | Aug 6, 2026 | Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions. |
| CVE-2026-65552 | CRITICAL | 9.8 | — | Aug 6, 2026 | Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions. |
| CVE-2026-65548 | CRITICAL | 9.9 | — | Aug 6, 2026 | Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions. |
| CVE-2026-65546 | CRITICAL | 9.3 | — | Aug 6, 2026 | Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions. |
| CVE-2026-65520 | CRITICAL | 9.3 | — | Aug 6, 2026 | Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions. |
| CVE-2026-65508 | CRITICAL | 9.3 | — | Aug 6, 2026 | Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions. |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now