2026 CVE Vulnerabilities
61,555 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-8981 | LOW | 3.5 | 0.1% | Jun 9, 2026 | The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability acros... |
| CVE-2026-5067 | CRITICAL | 9.8 | 0.6% | Jun 9, 2026 | A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sendi... |
| CVE-2026-4986 | MEDIUM | 5.3 | 0.2% | Jun 9, 2026 | The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before ... |
| CVE-2026-41539 | MEDIUM | 6.1 | 0.2% | Jun 9, 2026 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. The remot... |
| CVE-2026-11572 | HIGH | 8.8 | 1.1% | Jun 9, 2026 | Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to impro... |
| CVE-2026-9662 | HIGH | 8.1 | 0.6% | Jun 9, 2026 | The Recover Exit For WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and in... |
| CVE-2026-9185 | HIGH | 7.5 | 0.4% | Jun 9, 2026 | The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versi... |
| CVE-2026-8977 | MEDIUM | 6.4 | 0.2% | Jun 9, 2026 | The WP GDPR Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ninja_gdpr_ajax_ac... |
| CVE-2026-8940 | MEDIUM | 4.3 | 0.1% | Jun 9, 2026 | The WP Meta Sort Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu... |
| CVE-2026-8910 | MEDIUM | 6.1 | 0.1% | Jun 9, 2026 | The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu... |
| CVE-2026-8909 | MEDIUM | 4.3 | 0.1% | Jun 9, 2026 | The WpMobi plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.3.... |
| CVE-2026-8907 | MEDIUM | 6.1 | 0.1% | Jun 9, 2026 | The WP-Ultimate-Map plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1... |
| CVE-2026-8904 | MEDIUM | 4.3 | 0.1% | Jun 9, 2026 | The FastPicker, an order picker and order management system (oms) for WooCommerce on steroids plugin for WordPress is vu... |
| CVE-2026-8902 | MEDIUM | 4.3 | 0.1% | Jun 9, 2026 | The AJAX Report Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc... |
| CVE-2026-8895 | MEDIUM | 6.4 | 0.2% | Jun 9, 2026 | The kk blog card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blog-card' shortcod... |
| CVE-2026-8883 | MEDIUM | 6.4 | 0.2% | Jun 9, 2026 | The Global Body Mass Index Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gbmical... |
| CVE-2026-8882 | MEDIUM | 6.4 | 0.2% | Jun 9, 2026 | The WP ApplicantStack Jobs Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attri... |
| CVE-2026-8880 | MEDIUM | 6.4 | 0.2% | Jun 9, 2026 | The RomanCart Ecommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blclass' attribute (a... |
| CVE-2026-8841 | MEDIUM | 6.4 | 0.2% | Jun 9, 2026 | The Extra Settings for RocketChat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rocketchat'... |
| CVE-2026-8499 | MEDIUM | 5.3 | 0.3% | Jun 9, 2026 | The Helpfulcrowd Product Reviews plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in ver... |
| CVE-2026-7662 | MEDIUM | 6.4 | 0.2% | Jun 9, 2026 | The ePaperFlip Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'publicationid' attri... |
| CVE-2026-41980 | MEDIUM | 5.5 | 0.1% | Jun 9, 2026 | Permission control vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may a... |
| CVE-2026-41979 | MEDIUM | 5.5 | 0.1% | Jun 9, 2026 | Permission control vulnerability in the print module. Impact: Successful exploitation of this vulnerability may affect i... |
| CVE-2026-41978 | MEDIUM | 4.4 | 0.1% | Jun 9, 2026 | Permission control vulnerability in the clone module. Impact: Successful exploitation of this vulnerability may affect s... |
| CVE-2026-41975 | MEDIUM | 6.3 | 0.1% | Jun 9, 2026 | Permission management vulnerability in the network management module. Impact: Successful exploitation of this vulnerabil... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now