2026 CVE Vulnerabilities
64,775 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-21822 | MEDIUM | 6.3 | — | Sep 18, 2026 | HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handl... |
| CVE-2026-13635 | MEDIUM | 5.3 | — | Sep 18, 2026 | An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-... |
| CVE-2026-13623 | MEDIUM | 4.8 | — | Sep 18, 2026 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Sy... |
| CVE-2026-93493 | MEDIUM | 5.9 | — | Sep 18, 2026 | A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by prov... |
| CVE-2026-92622 | MEDIUM | 6.4 | — | Sep 18, 2026 | The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightbox_class' Shortcode... |
| CVE-2026-92554 | MEDIUM | 6.1 | 0.3% | Sep 18, 2026 | The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflecte... |
| CVE-2026-92249 | MEDIUM | 6.1 | 0.3% | Sep 18, 2026 | The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter i... |
| CVE-2026-90981 | MEDIUM | 6.1 | — | Sep 18, 2026 | The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting... |
| CVE-2026-85652 | MEDIUM | 6.5 | — | Sep 18, 2026 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injectio... |
| CVE-2026-75961 | MEDIUM | 4.9 | 0.4% | Sep 18, 2026 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the ... |
| CVE-2026-17607 | MEDIUM | 6.5 | — | Sep 18, 2026 | The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the ... |
| CVE-2026-17586 | MEDIUM | 6.4 | — | Sep 18, 2026 | The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnit_cta_img... |
| CVE-2026-16777 | MEDIUM | 4.9 | — | Sep 18, 2026 | The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to... |
| CVE-2026-15004 | MEDIUM | 5.4 | 0.2% | Sep 18, 2026 | The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
| CVE-2026-14472 | MEDIUM | 6.4 | — | Sep 18, 2026 | The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubio/copyright Block Co... |
| CVE-2026-13471 | MEDIUM | 4.3 | — | Sep 18, 2026 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direc... |
| CVE-2026-12739 | MEDIUM | 4.3 | 0.3% | Sep 18, 2026 | The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypas... |
| CVE-2026-11757 | MEDIUM | 6.1 | — | Sep 18, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in KA Informatics Tec... |
| CVE-2026-92714 | MEDIUM | 6.5 | — | Sep 18, 2026 | The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and inclu... |
| CVE-2026-92561 | MEDIUM | 6.1 | — | Sep 18, 2026 | The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in... |
| CVE-2026-91707 | MEDIUM | 5.3 | — | Sep 18, 2026 | The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.... |
| CVE-2026-90977 | MEDIUM | 5.3 | — | Sep 18, 2026 | The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is e... |
| CVE-2026-90976 | MEDIUM | 5.3 | — | Sep 18, 2026 | The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an acco... |
| CVE-2026-89330 | MEDIUM | 6.1 | — | Sep 18, 2026 | The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for ... |
| CVE-2026-89278 | MEDIUM | 5.3 | — | Sep 18, 2026 | The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is v... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now