2026 CVE Vulnerabilities
43,990 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-54819 | CRITICAL | 9.3 | 0.2% | Jun 17, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webilia Inc. Listd... |
| CVE-2026-54815 | CRITICAL | 9.3 | 0.2% | Jun 17, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shi... |
| CVE-2026-54809 | CRITICAL | 9.3 | 0.2% | Jun 17, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme GIFT4U ... |
| CVE-2026-54808 | CRITICAL | 9.3 | 0.3% | Jun 17, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Trave... |
| CVE-2026-49268 | CRITICAL | 9.1 | 0.5% | Jun 17, 2026 | A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm c... |
| CVE-2026-49108 | CRITICAL | 9.8 | 0.3% | Jun 17, 2026 | Unauthenticated PHP Object Injection in Moderno < 1.43 versions. |
| CVE-2026-54811 | CRITICAL | 9.3 | 0.3% | Jun 17, 2026 | Unauthenticated SQL Injection in WP eMember < v10.9.4 versions. |
| CVE-2026-54807 | CRITICAL | 9.8 | 0.4% | Jun 17, 2026 | Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions. |
| CVE-2026-54806 | CRITICAL | 9.8 | 0.6% | Jun 17, 2026 | Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions. |
| CVE-2026-54803 | CRITICAL | 9.8 | 0.4% | Jun 17, 2026 | Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions. |
| CVE-2026-54194 | CRITICAL | 9.8 | 0.4% | Jun 17, 2026 | Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions. |
| CVE-2026-54187 | CRITICAL | 9.3 | 0.3% | Jun 17, 2026 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions. |
| CVE-2026-54186 | CRITICAL | 9.3 | 0.3% | Jun 17, 2026 | Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions. |
| CVE-2026-52706 | CRITICAL | 9.8 | 0.5% | Jun 17, 2026 | Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions. |
| CVE-2026-52705 | CRITICAL | 9 | 0.3% | Jun 17, 2026 | Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions. |
| CVE-2026-50203 | CRITICAL | 9.1 | 0.6% | Jun 17, 2026 | A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or... |
| CVE-2026-49767 | CRITICAL | 9.8 | 0.5% | Jun 17, 2026 | Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions. |
| CVE-2026-49107 | CRITICAL | 9.8 | 0.4% | Jun 17, 2026 | Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions. |
| CVE-2026-49084 | CRITICAL | 9.3 | 0.3% | Jun 17, 2026 | Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions. |
| CVE-2026-49080 | CRITICAL | 9.3 | 0.2% | Jun 17, 2026 | Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions. |
| CVE-2026-49079 | CRITICAL | 9.3 | 0.3% | Jun 17, 2026 | Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions. |
| CVE-2026-49076 | CRITICAL | 9.3 | 0.4% | Jun 17, 2026 | Unauthenticated SQL Injection in JetEngine <= 3.8.9.1 versions. |
| CVE-2026-49075 | CRITICAL | 9.8 | 0.4% | Jun 17, 2026 | Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions. |
| CVE-2026-49058 | CRITICAL | 9.8 | 0.3% | Jun 17, 2026 | Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions. |
| CVE-2026-48875 | CRITICAL | 9.3 | 0.4% | Jun 17, 2026 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions. |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now