2026 CVE Vulnerabilities
58,117 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-54430 | MEDIUM | 5.1 | — | Jul 2, 2026 | liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verif... |
| CVE-2026-9834 | HIGH | 7.2 | 2.7% | Jul 2, 2026 | The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Com... |
| CVE-2026-9188 | MEDIUM | 5.3 | 0.5% | Jul 2, 2026 | The Appointment Bookings for Zoom GoogleMeet and more – Wappointment plugin for WordPress is vulnerable to Insecure Dire... |
| CVE-2026-9145 | MEDIUM | 6.5 | 0.4% | Jul 2, 2026 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via ... |
| CVE-2026-8482 | MEDIUM | 4.3 | 0.2% | Jul 2, 2026 | A vulnerability was discovered on StormShield Network Security 4.3.0 to 4.3.41 (included), 4.8.0 to 4.8.15 (included) , ... |
| CVE-2026-8441 | HIGH | 7.5 | 0.4% | Jul 2, 2026 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp... |
| CVE-2026-14336 | HIGH | 8.2 | 0.3% | Jul 2, 2026 | PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.o... |
| CVE-2026-14029 | MEDIUM | 6.5 | 0.4% | Jul 2, 2026 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection ... |
| CVE-2026-13459 | MEDIUM | 5.3 | 0.6% | Jul 2, 2026 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versi... |
| CVE-2026-13369 | HIGH | 7.5 | 0.5% | Jul 2, 2026 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function... |
| CVE-2026-13252 | MEDIUM | 6.4 | 0.3% | Jul 2, 2026 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is... |
| CVE-2026-13251 | HIGH | 7.5 | 0.8% | Jul 2, 2026 | The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.4 vi... |
| CVE-2026-12657 | MEDIUM | 5.3 | 0.7% | Jul 2, 2026 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direc... |
| CVE-2026-12472 | MEDIUM | 5.3 | 0.5% | Jul 2, 2026 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypa... |
| CVE-2026-12134 | MEDIUM | 4.3 | 0.4% | Jul 2, 2026 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to authorization b... |
| CVE-2026-12122 | MEDIUM | 5.3 | 0.5% | Jul 2, 2026 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Informat... |
| CVE-2026-11896 | MEDIUM | 5.3 | 0.5% | Jul 2, 2026 | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all... |
| CVE-2026-10104 | MEDIUM | 4.4 | 0.3% | Jul 2, 2026 | The Product Video Gallery for Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom_t... |
| CVE-2026-9563 | HIGH | 7.5 | 0.4% | Jul 2, 2026 | In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default max... |
| CVE-2026-8147 | HIGH | 8.1 | 0.3% | Jul 2, 2026 | In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper author... |
| CVE-2026-33592 | HIGH | 7.5 | 0.4% | Jul 2, 2026 | An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The ser... |
| CVE-2026-5821 | HIGH | 8.1 | 0.4% | Jul 2, 2026 | The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4.... |
| CVE-2026-5348 | MEDIUM | 5.3 | 0.3% | Jul 2, 2026 | The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Di... |
| CVE-2026-14249 | HIGH | 7.5 | 0.3% | Jul 2, 2026 | The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the... |
| CVE-2026-13704 | MEDIUM | 6.4 | 0.2% | Jul 2, 2026 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting ... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now