Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,368 results · page 19 of 108
Jun 17, 2026Listdom: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-54819 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webilia Inc. Listdom allows Blind SQL Injection. This issue affects Listdom: from n/a through 5.4.0.
- Product
- Listdom
- Affected
- up to 5.4.0
- What to do
- Affects up to 5.4.0. Update Listdom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Slimstat Analytics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-54818 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs Slimstat Analytics allows Blind SQL Injection. This issue affects Slimstat Analytics: from n/a through 5.4.11.
- Product
- Slimstat Analytics
- Affected
- up to 5.4.11
- What to do
- Affects up to 5.4.11. Update Slimstat Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Cargo Shipping Location for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-54815 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows Blind SQL Injection. This issue affects Cargo Shipping Location for WooCommerce: from n/a through 5.6.
- Product
- Cargo Shipping Location for WooCommerce
- Affected
- up to 5.6
- What to do
- Affects up to 5.6. Update Cargo Shipping Location for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026SureDash: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-54813 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force SureDash allows Blind SQL Injection. This issue affects SureDash: from n/a through 1.8.0.
- Product
- SureDash
- Affected
- up to 1.8.0
- What to do
- Affects up to 1.8.0. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026GIFT4U: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-54809 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme GIFT4U allows Blind SQL Injection. This issue affects GIFT4U: from n/a through 1.0.10.
- Product
- GIFT4U
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update GIFT4U to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026WP Travel Gutenberg Blocks: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-54808 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel Gutenberg Blocks allows Blind SQL Injection. This issue affects WP Travel Gutenberg Blocks: from n/a through 3.9.4.
- Product
- WP Travel Gutenberg Blocks
- Affected
- up to 3.9.4
- What to do
- Affects up to 3.9.4. Update WP Travel Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in Royal Elementor Addons Pro < 1.7.1041 versions.CVE-2026-40720 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Royal Elementor Addons Pro < 1.7.1041 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026JetEngine: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-49076 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows Blind SQL Injection.This issue affects JetEngine: from n/a through 3.8.9.1.
- Product
- JetEngine
- Affected
- up to 3.8.9.1
- What to do
- Affects up to 3.8.9.1. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Directorist Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-49073 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist Booking allows Blind SQL Injection. This issue affects Directorist Booking: from n/a through 3.0.3.
- Product
- Directorist Booking
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update Directorist Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.CVE-2026-42629 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions.CVE-2026-40721 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions.
- Affected
- up to 9.0.6
- What to do
- Affects up to 9.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions.CVE-2026-39597 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions.
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.CVE-2026-39529 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Contributor Arbitrary File Upload in Unlimited Elements for Elementor (Premium) <= 2.0.6 versions.CVE-2026-27041 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Contributor Arbitrary File Upload in Unlimited Elements for Elementor (Premium) <= 2.0.6 versions.
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Dell Peripheral Manager, versions from 1.5.1 to 1.7.2, contain an uncontrolled search path element vulnerability.CVE-2024-22451 · Other software · Dell · reported by security_alert@emc.comMedium 6.7
Dell Peripheral Manager, versions from 1.5.1 to 1.7.2, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious executable, leading to arbitrary code execution.
- Product
- Peripheral Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026Dell Peripheral Manager, versions prior to 1.7.3, contain an uncontrolled search path element vulnerability.CVE-2024-22447 · Other software · Dell · reported by security_alert@emc.comMedium 6.7
Dell Peripheral Manager, versions prior to 1.7.3, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious dll., leading to arbitrary code execution.
- Product
- Peripheral Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026Due to the improper neutralization of special elements used in a name parameter a low privileged remote attacker can exploit a command injection vulnerability iCVE-2026-5416 · Other software · TURCK · reported by info@cert.vde.comHigh 8.7
Due to the improper neutralization of special elements used in a name parameter a low privileged remote attacker can exploit a command injection vulnerability in the Managed Ethernet Switch, resulting in full system compromise.
- Product
- TBEN-LL-SE-M2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026The Events Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-49772 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2.
- Product
- The Events Calendar
- Affected
- up to 6.16.2
- What to do
- Affects up to 6.16.2. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.CVE-2026-9691 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions.CVE-2026-49765 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions.
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.CVE-2026-49109 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.CVE-2026-49105 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions.CVE-2026-49104 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions.
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.CVE-2026-49085 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.CVE-2026-48870 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.
- Affected
- up to 51.1.62
- What to do
- Affects up to 51.1.62. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.CVE-2026-45437 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.CVE-2026-25440 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element.CVE-2026-52721 · Other software · Red Hat · reported by Red HatMedium 5.3
Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing. This element is primarily used in debugging pipelines, limiting real-world exposure. A local attacker could trick a user into processing a specially crafted PCAP file, potentially leading to a crash or information disclosure.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jun 15, 2026Improper neutralization of formula elements in a CSV file vulnerability in MIA Technology Inc.CVE-2026-5242 · Other software · MIA Technology Inc. · reported by iletisim@usom.gov.trHigh 8.8
Improper neutralization of formula elements in a CSV file vulnerability in MIA Technology Inc. Pizzy Library allows Code Injection. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250.
- Product
- Pizzy Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method.CVE-2026-54228 · Other software · Red Hat · reported by Red HatHigh 7.8
A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.
- Product
- Red Hat Enterprise Linux 7 Extended Lifecycle Support
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jun 12, 2026Hash Elements: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24618 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HashThemes Hash Elements allows Retrieve Embedded Sensitive Data. This issue affects Hash Elements: from n/a through 1.5.4.
- Product
- Hash Elements
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update Hash Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 12, 2026jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP dataCVE-2026-54133 · Other software · jmespath · reported by GitHubCritical 9.8
jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `JmesPath\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression can cause the generated cache file to contain executable attacker-controlled PHP, which is then loaded by the compiler runtime. The issue is patched in `2.9.1` and later. As a workaround, disable `JP_PHP_COMPILE` and do not use `JmesPath\CompilerRuntime` with attacker-controlled expressions. Use the default `AstRuntime` for untrusted expressions. Applications that must continue accepting untrusted JMESPath expressions before upgrading should ensure those expressions are never evaluated by the compiler runtime.
- Product
- jmespath.php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026JoomSport: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42647 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport allows Blind SQL Injection. This issue affects JoomSport: from n/a through 5.7.7.
- Product
- JoomSport
- Affected
- up to 5.7.7
- What to do
- Affects up to 5.7.7. Update JoomSport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 11, 2026Product Filter by WBW: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39494 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Injection. This issue affects Product Filter by WBW: from n/a through 3.1.2.
- Product
- Product Filter by WBW
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 11, 2026Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics TechnCVE-2026-11561 · Other software · Soagen Informatics Technologies Software and Consulting Inc. · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc. Apinizer allows Code Injection. This issue affects Apinizer: from 2026.04.0 before 2026.04.6.
- Product
- Apinizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Contact Form & Lead Form Elementor Builder: Missing AuthorizationCVE-2023-25969 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Contact Form & Lead Form Elementor Builder: from n/a through 1.8.4.
- Product
- Contact Form & Lead Form Elementor Builder
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update Contact Form & Lead Form Elementor Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 10, 2026aThemes Addons for Elementor: Stored Cross-Site ScriptingCVE-2026-8613 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title_tag' Widget Setting in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This affects the Posts Timeline widget as well as the Posts Carousel widget across its default, Banner, and Modern skins, all of which omit the whitelist validation that is correctly applied in the Posts List widget.
- Product
- aThemes Addons for Elementor
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update aThemes Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 10, 2026Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates: DOM-Based Stored Cross-Site ScriptingCVE-2025-8444 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the multiple parameters in all versions up to, and including, 4.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates
- Affected
- up to 4.2.6
- What to do
- Affects up to 4.2.6. Update Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2026Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackersCVE-2026-41694 · Other software · Spring · reported by security@vmware.comLow 3.7
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
- Product
- Spring Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary CVE-2026-47937 · Email & office · Adobe · reported by AdobeHigh 7.7
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
- Product
- Acrobat DC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Office SharePoint allows an authorized attacker CVE-2026-47634 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.3
Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker CVE-2026-42835 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.1
Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
- Product
- Microsoft Teams for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-rCVE-2026-34180 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgHigh 7.5
Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated. An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the worst case the truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly causing OpenSSL to read either less than or beyond the end of the allocated buffer. Applications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected. OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected. The FI
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in MOSK Information Technologies Ltd.CVE-2026-8025 · Other software · MOSK Information Technologies Ltd. · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in MOSK Information Technologies Ltd. CBS Platform allows SQL Injection. This issue affects CBS Platform: through 09062026. NOTE: The vendor was contacted and it was learned that the product is not supported.
- Product
- CBS Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Netcad Software Inc.CVE-2026-7486 · Other software · Netcad Software Inc. · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Netcad Software Inc. E-İmar allows SQL Injection. This issue affects E-İmar: from 2.10.1.0 before 3.0.2.
- Product
- E-İmar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages: Stored Cross-Site ScriptingCVE-2026-8677 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Widget HTML Tag Settings in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit succeeds even for users without the unfiltered_html capability because the payload (e.g., 'img src=x onerror=alert(document.domain)') contains no HTML angle brackets and therefore passes through Elementor's wp_kses_post() filter unchanged at save time.
- Product
- Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2026Product Filter Widget for Elementor: Reflected Cross-Site ScriptingCVE-2026-11603 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Product Filter Widget for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'args[filterFormArray]' Parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The endpoint is registered via wp_ajax_nopriv_ with no nonce verification or capability check, and exploitation is delivered via a CSRF-style form auto-submission to the admin-ajax.php endpoint, requiring the attacker to trick a victim into visiting an attacker-controlled page.
- Product
- Product Filter Widget for Elementor
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Product Filter Widget for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 8, 2026Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with wriCVE-2026-10544 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2026Essential Addons for Elementor – Popular Elementor Templates & Widgets: Information ExposureCVE-2026-7665 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.6.4 via the ajax_load_more function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
- Product
- Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Affected
- up to 6.6.4
- What to do
- Affects up to 6.6.4. Update Essential Addons for Elementor – Popular Elementor Templates & Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 5, 2026Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits: Stored Cross-Site ScriptingCVE-2026-9281 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension) in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unfiltered_html capability check is only enforced during Elementor control registration (UI rendering) and not during the save process, enabling Author-level users to inject the jtlma_custom_js setting directly via a crafted POST request to admin-ajax.php?action=elementor_ajax, bypassing the UI-level restriction entirely.
- Product
- Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.