2026 CVE Vulnerabilities
44,067 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-48836 | CRITICAL | 10 | 0.6% | Jun 15, 2026 | Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions. |
| CVE-2026-45439 | CRITICAL | 9.3 | 0.3% | Jun 15, 2026 | Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions. |
| CVE-2026-42665 | CRITICAL | 9.3 | 0.3% | Jun 15, 2026 | Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions. |
| CVE-2026-42639 | CRITICAL | 9.3 | 0.3% | Jun 15, 2026 | Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions. |
| CVE-2026-42386 | CRITICAL | 9.3 | 0.3% | Jun 15, 2026 | Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions. |
| CVE-2026-42381 | CRITICAL | 9.3 | 0.3% | Jun 15, 2026 | Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions. |
| CVE-2026-40798 | CRITICAL | 9.3 | 0.3% | Jun 15, 2026 | Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions. |
| CVE-2026-40772 | CRITICAL | 10 | 0.3% | Jun 15, 2026 | Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions. |
| CVE-2026-40771 | CRITICAL | 9.3 | 0.3% | Jun 15, 2026 | Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions. |
| CVE-2026-39591 | CRITICAL | 9.9 | 0.5% | Jun 15, 2026 | Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions. |
| CVE-2026-39583 | CRITICAL | 9.8 | 0.4% | Jun 15, 2026 | Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions. |
| CVE-2026-39530 | CRITICAL | 9.3 | 0.3% | Jun 15, 2026 | Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions. |
| CVE-2026-39519 | CRITICAL | 9.3 | 0.3% | Jun 15, 2026 | Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions. |
| CVE-2026-39512 | CRITICAL | 9.3 | 0.3% | Jun 15, 2026 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions. |
| CVE-2026-39511 | CRITICAL | 9.3 | 0.3% | Jun 15, 2026 | Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions. |
| CVE-2026-39502 | CRITICAL | 9.3 | 0.3% | Jun 15, 2026 | Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions. |
| CVE-2026-39493 | CRITICAL | 9.3 | 0.4% | Jun 15, 2026 | Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions. |
| CVE-2026-39492 | CRITICAL | 9.3 | 0.4% | Jun 15, 2026 | Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions. |
| CVE-2026-39465 | CRITICAL | 9.1 | 0.7% | Jun 15, 2026 | Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions. |
| CVE-2026-39441 | CRITICAL | 9.3 | 0.3% | Jun 15, 2026 | Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions. |
| CVE-2026-34901 | CRITICAL | 9.8 | 0.3% | Jun 15, 2026 | Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions. |
| CVE-2026-27053 | CRITICAL | 9.8 | 0.4% | Jun 15, 2026 | Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions. |
| CVE-2026-50890 | CRITICAL | 9.8 | 0.3% | Jun 15, 2026 | Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /sto... |
| CVE-2026-50887 | CRITICAL | 9.1 | 0.3% | Jun 15, 2026 | A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attac... |
| CVE-2026-50886 | CRITICAL | 9.1 | 0.3% | Jun 15, 2026 | Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan inte... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now