2026 CVE Vulnerabilities
44,056 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-15331 | MEDIUM | 5.4 | 0.4% | Jul 10, 2026 | A vulnerability was identified in zhayujie CowAgent up to 2.1.0. The affected element is the function _add_url/_add_pack... |
| CVE-2026-15302 | MEDIUM | 5.3 | 0.5% | Jul 10, 2026 | The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via ... |
| CVE-2026-15301 | MEDIUM | 6.4 | 0.2% | Jul 10, 2026 | The BuddyHolis TableSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder’ param... |
| CVE-2026-15299 | MEDIUM | 6.4 | 0.2% | Jul 10, 2026 | The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'weather_st... |
| CVE-2026-15297 | MEDIUM | 6.1 | 0.3% | Jul 10, 2026 | The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) plugin for WordPress is vulnerab... |
| CVE-2026-15296 | MEDIUM | 6.4 | 0.3% | Jul 10, 2026 | The affiliate-toolkit – WP Affiliate Plugin with Amazon plugin for WordPress is vulnerable to Stored Cross-Site Scriptin... |
| CVE-2026-15292 | MEDIUM | 6.4 | 0.2% | Jul 10, 2026 | The Sudoku Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background' parameter in... |
| CVE-2026-15289 | MEDIUM | 5.9 | 0.3% | Jul 10, 2026 | The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to time-based SQL Injection via the ... |
| CVE-2026-15287 | MEDIUM | 6.5 | 0.3% | Jul 10, 2026 | The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based SQL Injection via the... |
| CVE-2026-15286 | MEDIUM | 4.3 | 0.3% | Jul 10, 2026 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to unauthorized po... |
| CVE-2026-15285 | MEDIUM | 6.4 | 0.3% | Jul 10, 2026 | The Plus Addons for Elementor plugin for WordPress was vulnerable to Authenticated (Contributor+) Stored Cross-Site Scri... |
| CVE-2026-15284 | MEDIUM | 6.4 | 0.3% | Jul 10, 2026 | The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_page_id' p... |
| CVE-2026-15283 | MEDIUM | 4.4 | 0.2% | Jul 10, 2026 | The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in al... |
| CVE-2026-5069 | MEDIUM | 5.4 | 0.2% | Jul 10, 2026 | The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscription_id' parameter in ve... |
| CVE-2026-44918 | MEDIUM | 5.5 | 0.4% | Jul 10, 2026 | OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization. |
| CVE-2026-15329 | MEDIUM | 4.3 | 0.2% | Jul 10, 2026 | A vulnerability was found in zhayujie CowAgent up to 2.1.0. This issue affects the function BrowserTool._do_navigate of ... |
| CVE-2026-11818 | MEDIUM | 5.4 | 0.3% | Jul 10, 2026 | The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authoriz... |
| CVE-2026-11392 | MEDIUM | 6.1 | 0.3% | Jul 10, 2026 | The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' and 'c... |
| CVE-2026-15320 | MEDIUM | 5.4 | 0.2% | Jul 10, 2026 | A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. This vulnerability affects the function rt.ReloadConfig of ... |
| CVE-2026-15318 | MEDIUM | 6.3 | 0.2% | Jul 10, 2026 | A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of t... |
| CVE-2026-15317 | MEDIUM | 6.3 | 0.2% | Jul 10, 2026 | A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. Affected by this vulnerability is the function WebFe... |
| CVE-2026-59857 | MEDIUM | 5.5 | 0.1% | Jul 9, 2026 | Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in s... |
| CVE-2026-59854 | MEDIUM | 4.9 | 0.3% | Jul 9, 2026 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, POST /api/file/globalCopyFiles accepts at... |
| CVE-2026-59853 | MEDIUM | 6.5 | 0.2% | Jul 9, 2026 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint ret... |
| CVE-2026-59831 | MEDIUM | 4.4 | 0.2% | Jul 9, 2026 | GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace ... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now