2026 CVE Vulnerabilities
61,161 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-54192 | HIGH | 7.1 | 0.2% | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions. |
| CVE-2026-54189 | HIGH | 7.1 | 0.1% | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. |
| CVE-2026-54188 | HIGH | 7.1 | 0.1% | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. |
| CVE-2026-54187 | CRITICAL | 9.3 | 0.3% | Jun 17, 2026 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions. |
| CVE-2026-54186 | CRITICAL | 9.3 | 0.3% | Jun 17, 2026 | Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions. |
| CVE-2026-54185 | HIGH | 8.5 | 0.3% | Jun 17, 2026 | Subscriber SQL Injection in Cornerstone < 7.8.8 versions. |
| CVE-2026-54184 | HIGH | 8.2 | 0.3% | Jun 17, 2026 | Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions. |
| CVE-2026-53876 | HIGH | 8.6 | 1.8% | Jun 17, 2026 | RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary c... |
| CVE-2026-52706 | CRITICAL | 9.8 | 0.5% | Jun 17, 2026 | Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions. |
| CVE-2026-52705 | CRITICAL | 9 | 0.3% | Jun 17, 2026 | Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions. |
| CVE-2026-52698 | HIGH | 7.4 | 0.2% | Jun 17, 2026 | Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2... |
| CVE-2026-52696 | HIGH | 7.5 | 0.2% | Jun 17, 2026 | Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions. |
| CVE-2026-50203 | CRITICAL | 9.1 | 0.6% | Jun 17, 2026 | A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or... |
| CVE-2026-49778 | HIGH | 7.1 | 0.2% | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions. |
| CVE-2026-49767 | CRITICAL | 9.8 | 0.5% | Jun 17, 2026 | Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions. |
| CVE-2026-49113 | HIGH | 8.5 | 0.4% | Jun 17, 2026 | Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions. |
| CVE-2026-49107 | CRITICAL | 9.8 | 0.4% | Jun 17, 2026 | Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions. |
| CVE-2026-49084 | CRITICAL | 9.3 | 0.3% | Jun 17, 2026 | Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions. |
| CVE-2026-49081 | HIGH | 8.2 | 0.3% | Jun 17, 2026 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions. |
| CVE-2026-49080 | CRITICAL | 9.3 | 0.2% | Jun 17, 2026 | Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions. |
| CVE-2026-49079 | CRITICAL | 9.3 | 0.3% | Jun 17, 2026 | Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions. |
| CVE-2026-49076 | CRITICAL | 9.3 | 0.4% | Jun 17, 2026 | Unauthenticated SQL Injection in JetEngine <= 3.8.9.1 versions. |
| CVE-2026-49075 | CRITICAL | 9.8 | 0.4% | Jun 17, 2026 | Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions. |
| CVE-2026-49074 | HIGH | 7.1 | 0.2% | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions. |
| CVE-2026-49073 | HIGH | 8.5 | 0.2% | Jun 17, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist ... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now