2026 CVE Vulnerabilities
60,364 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-39576 | HIGH | 8.1 | 0.4% | Jun 17, 2026 | Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions. |
| CVE-2026-39560 | HIGH | 8.1 | 0.3% | Jun 17, 2026 | Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions. |
| CVE-2026-39559 | HIGH | 8.1 | 0.3% | Jun 17, 2026 | Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions. |
| CVE-2026-39556 | HIGH | 8.1 | 0.3% | Jun 17, 2026 | Unauthenticated PHP Object Injection in Konsept <= 1.9 versions. |
| CVE-2026-39523 | HIGH | 8.1 | 0.3% | Jun 17, 2026 | Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions. |
| CVE-2026-39445 | HIGH | 8.1 | 0.4% | Jun 17, 2026 | Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions. |
| CVE-2026-39442 | HIGH | 8.1 | 0.3% | Jun 17, 2026 | Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions. |
| CVE-2026-10641 | HIGH | 7.1 | 0.3% | Jun 17, 2026 | Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetooth/host/classic/hfp_hf.c) cont... |
| CVE-2026-9690 | HIGH | 7.5 | 0.5% | Jun 17, 2026 | Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions. |
| CVE-2026-9570 | HIGH | 7.1 | 0.1% | Jun 17, 2026 | The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline ... |
| CVE-2026-8607 | MEDIUM | 6.4 | 0.3% | Jun 17, 2026 | The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress ... |
| CVE-2026-8494 | MEDIUM | 6.4 | 0.2% | Jun 17, 2026 | The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admi... |
| CVE-2026-8383 | MEDIUM | 5.3 | 0.2% | Jun 17, 2026 | The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `e... |
| CVE-2026-8317 | — | — | — | Jun 17, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-8089 | HIGH | 7.1 | 0.2% | Jun 17, 2026 | The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin ... |
| CVE-2026-7850 | MEDIUM | 5.9 | 0.1% | Jun 17, 2026 | The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting t... |
| CVE-2026-5667 | HIGH | 7.2 | 0.2% | Jun 17, 2026 | Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners (for Japan and outside Japan); ... |
| CVE-2026-55706 | HIGH | 8.3 | 0.2% | Jun 17, 2026 | sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values f... |
| CVE-2026-54811 | CRITICAL | 9.3 | 0.3% | Jun 17, 2026 | Unauthenticated SQL Injection in WP eMember < v10.9.4 versions. |
| CVE-2026-54807 | CRITICAL | 9.8 | 0.4% | Jun 17, 2026 | Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions. |
| CVE-2026-54806 | CRITICAL | 9.8 | 0.6% | Jun 17, 2026 | Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions. |
| CVE-2026-54805 | HIGH | 8.8 | 0.4% | Jun 17, 2026 | Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions. |
| CVE-2026-54804 | HIGH | 7.6 | 0.3% | Jun 17, 2026 | Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions. |
| CVE-2026-54803 | CRITICAL | 9.8 | 0.4% | Jun 17, 2026 | Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions. |
| CVE-2026-54802 | HIGH | 7.5 | 0.4% | Jun 17, 2026 | Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions. |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now