CVEs we hold for The

Records whose assigning authority named The as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-9832Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature…themehigh Payment Gateway of Stripe for WooCommerce

CVE-2026-97670Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}'…themefusion Avada (Fusion) Builder

CVE-2026-97471Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via…themefusion Avada (Fusion) Builder

CVE-2026-97470Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html…themefic Tourfic – AI Powered Travel Booking, Hotel Booking…

CVE-2026-97399One-byte overread in strncasecmp on Power8The GNU C Library glibc

CVE-2026-97340Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting…ThemeFusion Avada | Website Builder For WordPress &…

CVE-2026-97305WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerabilityThemeisle AI Chatbot for WordPress – Hyve Lite

CVE-2026-97302WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerabilityThemeisle MPG

CVE-2026-97236WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerabilityThemeREX Addons

CVE-2026-97235WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerabilityThemeREX Addons

CVE-2026-96879"Checked by" label in page history should not be shown if the underlying review log entry is suppressed"The Wikimedia Foundation Mediawiki - FlaggedRevs extension

CVE-2026-96878Cargo Exhibit field alias allows stored XSSThe Wikimedia Foundation Mediawiki - Cargo extension

CVE-2026-96877Reflected XSS through Cargo Drilldown full-text searchThe Wikimedia Foundation Mediawiki - Cargo extension

CVE-2026-96876Anonymous reflected XSS in CargoExport invalid-alias errorsThe Wikimedia Foundation Mediawiki - Cargo extension

CVE-2026-96875Reflected XSS in Cargo Drilldown hierarchy filtersThe Wikimedia Foundation Mediawiki - Cargo extension

CVE-2026-96874Stored XSS in Cargo Drilldown tab namesThe Wikimedia Foundation Mediawiki - Cargo extension

CVE-2026-96873Reflected XSS in CirrusSearch debug explain outputThe Wikimedia Foundation Mediawiki - CirrusSearch Extension

CVE-2026-96872WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositionsThe Wikimedia Foundation Mediawiki - WikiLambda Extension

CVE-2026-96833WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerabilityThemefic Ultimate Addons for Contact Form 7

CVE-2026-96831WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerabilitythemifyme Themify Builder

CVE-2026-96334WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerabilityThemeGrill User Registration

CVE-2026-95864Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameterthemifyme Themify Builder

CVE-2026-95830theRealSain Pixtream post_upload.php unrestricted uploadtheRealSain Pixtream

CVE-2026-95818AT_SECURE program buffer overflow via $ORIGIN processingThe GNU C Library glibc

CVE-2026-95586WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerabilityThemefic Ultimate Addons for Contact Form 7

CVE-2026-94453IKEv2 Use-After-Free bug when using IKE-over-TCPThe Libreswan Project libreswan

CVE-2026-94183Address bar spoofing risk in affected Android versions of Arc SearchThe Browser Company of New York Arc Search

CVE-2026-94181Address Bar Spoof Risk; Missing Fullscreen Notification via Select ElementThe Browser Company of New York Arc

CVE-2026-94169WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerabilityTheme-one The Grid

CVE-2026-94161WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeGoods Grand Restaurant

CVE-2026-94160WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeStek Extras for LabtechCO Theme

CVE-2026-94063WordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeREX Education Center

CVE-2026-93944WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerabilityThemeREX Group Camelia

CVE-2026-93943WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerabilityThemeREX Group Convex

CVE-2026-93942WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerabilityThemeREX Group Dwell

CVE-2026-93941WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerabilityThemeREX Group Edema

CVE-2026-93940WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerabilityThemeREX Group Greeny

CVE-2026-93938WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerabilityThemeREX Group Hogwords

CVE-2026-93937WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerabilityThemeREX Group Hygia

CVE-2026-93936WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerabilityThemeREX Group IPharm

CVE-2026-93935WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerabilityThemeREX Group Let's Play

CVE-2026-93934WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerabilityThemeREX Group Partiso

CVE-2026-93933WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerabilityThemeREX Group Rosalinda

CVE-2026-93932WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerabilityThemeREX Group Smart Casa

CVE-2026-93931WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerabilityThemeREX Group Smash

CVE-2026-93930WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerabilityThemeREX Group Tantra

CVE-2026-93929WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerabilityThemeREX Group Travesia

CVE-2026-93681Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameterthemeum Tutor LMS – eLearning and online course solution

CVE-2026-92715Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and…themeum Tutor LMS – eLearning and online course solution

CVE-2026-92627Heap Use-After-Free in H5T__conv_f_fThe HDF Group HDF5

CVE-2026-92465WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerabilityThemeum WP Mega Menu

CVE-2026-9018Easy Elements for Elementor – Addons & Website Templates <= 1.4.5 - Unauthenticated Privilege Escalation via…themewant Easy Elements for Elementor – Addons & Website…

CVE-2026-8976RSS Aggregator by Feedzy <= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation…themeisle RSS Aggregator by Feedzy – Feed to Post…

CVE-2026-89333Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via…themeum Tutor LMS – eLearning and online course solution

CVE-2026-89092Stack overflow in nscd due to unbounded alloca useThe GNU C Library glibc

CVE-2026-89089OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)The OpenNMS Group Horizon

CVE-2026-89081Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parametersthemeum Tutor LMS – eLearning and online course solution

CVE-2026-89054OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changesThe OpenNMS Group Horizon

CVE-2026-89023ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST APIThemeAtelier Domain For Sale

CVE-2026-88963Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameterthemeum Tutor LMS – eLearning and online course solution

CVE-2026-88944Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id'…themeum Tutor LMS – eLearning and online course solution

CVE-2026-8713Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Valuethemefusion Avada (Fusion) Builder

CVE-2026-8689Visualizer: Tables and Charts Manager for WordPress <= 3.11.14 - Missing Authorization to Authenticated (Subscriber+)…themeisle Visualizer: Tables and Charts Manager for…

CVE-2026-86805AT_SECURE programs may load attacker-controlled code via $ORIGINThe GNU C Library glibc

CVE-2026-8674Assertion failure in the DNS stub resolver with a long search domainThe GNU C Library glibc

CVE-2026-86709The Pressengine <= 1.0 - Unauthenticated Authentication BypassUnknown The Pressengine

CVE-2026-86435commonmark 1.5.0 before 2.8.4 Denial of Service via Footnotethephpleague commonmark

CVE-2026-86434commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collisionthephpleague commonmark

CVE-2026-86433commonmark 1.5.0 before 2.8.4 Denial of Service via Attributesthephpleague commonmark

CVE-2026-86432commonmark 2.0.0 before 2.8.4 Denial of Service via XMLthephpleague commonmark

CVE-2026-86431commonmark before 2.9.1 XSS via AttributesExtension form feed bypassthephpleague commonmark

CVE-2026-86430league/commonmark before 2.9.1 Denial of Service via parsingthephpleague commonmark

CVE-2026-86429commonmark before 2.9.1 Denial of Service via SmartPunct and Attributesthephpleague commonmark

CVE-2026-86428commonmark 1.5.0 before 2.10.0 Denial of Service via Attributesthephpleague commonmark

CVE-2026-85691MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/urlThe-Vibe-Company megaparse

CVE-2026-85455MOOS core-moos through 10.4.0 MOOSDB Out-of-Bounds Read via Short Packetthemoos core-moos

CVE-2026-85454MOOS core-moos through 10.4.0 Off-by-One Buffer Overflow in Serial Telegram Handlingthemoos core-moos

CVE-2026-85453MOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross-Site Scriptingthemoos core-moos

CVE-2026-85452MOOS ui-moos through 50b9c6c uMS Buffer Overflow via Long MOOS Identifiersthemoos ui-moos

CVE-2026-85451MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrasethemoos core-moos

CVE-2026-85450MOOS core-moos through 10.4.0 MOOSDB HTTP Server Resource Exhaustionthemoos core-moos

CVE-2026-85443MOOS core-moos through 10.4.0 MOOSDB Accept Loop Denial of Servicethemoos core-moos

CVE-2026-85442MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet Allocationthemoos core-moos

CVE-2026-85441MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Negative Serialized String Lengththemoos core-moos

CVE-2026-85440MOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet Lengththemoos core-moos

CVE-2026-85436MOOS essential-moos through 10.0.1 pMOOSBridge Heap Corruption via Negative UDP Lengththemoos essential-moos

CVE-2026-85433MOOS essential-moos through 10.0.1 pShare Unauthorized Runtime Route Reconfigurationthemoos essential-moos

CVE-2026-85432MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identitythemoos core-moos

CVE-2026-85431MOOS essential-moos through 10.0.1 pMOOSBridge Unauthenticated UDP Packet Injectionthemoos essential-moos

CVE-2026-85430MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram Republishingthemoos essential-moos

CVE-2026-85428MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Writethemoos core-moos

CVE-2026-85427MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSION_FILEthemoos essential-moos

CVE-2026-85424MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEARthemoos core-moos

CVE-2026-85198MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Paththemeisle MPG – Multiple Page Generator, Bulk Landing Pages…

CVE-2026-84925Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' ParameterThemeFusion Avada | Website Builder For WordPress &…

CVE-2026-84745The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST APIUnknown The Events Calendar

CVE-2026-84743The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via…Unknown The Events Calendar

CVE-2026-84742The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST APIUnknown The Events Calendar

CVE-2026-84741The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST APIUnknown The Events Calendar

CVE-2026-84740The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' ParameterUnknown The Events Calendar

CVE-2026-84151The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List WideningUnknown The Post Grid

CVE-2026-8369Improper Input Validation in OpenThread NAT64 TranslatorThe OpenThread Authors OpenThread

CVE-2026-8358Heap buffer overflow in spreadsheet tracked-changes importThe Document Foundation LibreOffice

CVE-2026-8357Heap buffer overflow in Calc formula compilationThe Document Foundation LibreOffice

CVE-2026-8356Stack buffer overflow in PPT presentation importThe Document Foundation LibreOffice

CVE-2026-82901Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Fieldthemefic Ultra Addons for Contact Form 7

CVE-2026-8206Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'themeum Kirki – Freeform Page Builder, Website Builder &…

CVE-2026-81797WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerabilityThemeRex Buzz Stone | Magazine & Viral Blog WordPress Theme

CVE-2026-81785WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerabilityThemekraft BuddyForms

CVE-2026-81778WordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityThe4 Kalles Addons

CVE-2026-8167Reflected XSS in theWP's News Theme V8THEWP Digital Solutions News Theme V8

CVE-2026-81583Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege EscalationUnknown Theme My Login

CVE-2026-81534Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template'…ThemeHigh Email Customizer for WooCommerce (Pro)

CVE-2026-8096Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via…themeum Kirki – Freeform Page Builder, Website Builder &…

CVE-2026-8073Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIPthemeum Kirki – Freeform Page Builder, Website Builder &…

CVE-2026-80489EUC_JISX0213 decoding may hang on crafted inputThe GNU C Library glibc

CVE-2026-78535WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerabilityThemeRex Photolia

CVE-2026-78531WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerabilityThemeREX Jacqueline

CVE-2026-78529WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerabilityThemeREX Alliance

CVE-2026-78290WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerabilityThemeGrill Magazine Blocks

CVE-2026-78175Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Executionthemeum Tutor LMS – eLearning and online course solution

CVE-2026-78172Themify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scriptingthemifyme Themify – WooCommerce Product Filter

CVE-2026-77366obsidian-tc tokens can access arbitrary configured vaultsThe-40-Thieves obsidian-tc

CVE-2026-77364obsidian-tc fail-open default ACL exposes Obsidian control-directory secretsThe-40-Thieves obsidian-tc

CVE-2026-77363obsidian-tc Streamable HTTP transport permits cross-origin loopback vault accessThe-40-Thieves obsidian-tc

CVE-2026-77362obsidian-tc bridge tools expose data outside the read ACLThe-40-Thieves obsidian-tc

CVE-2026-77361obsidian-tc symlink path mismatch bypasses read ACL restrictionsThe-40-Thieves obsidian-tc

CVE-2026-77207Null Pointer Dereference in PKCS#7 bundle with no certificatesThe Libreswan Project libreswan

CVE-2026-77206IKEv2 pre-authentication Null Pointer Dereference in EAP codeThe Libreswan Project libreswan

CVE-2026-77205Denial of Service via sending bogus X.509 certificatesThe Libreswan Project libreswan

CVE-2026-77117SHIFT_JISX0213 decoding may hang on crafted inputThe GNU C Library glibc

CVE-2026-75027Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via…themifyme Themify Builder

CVE-2026-74018WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerabilitythemagnifico52 Warehouse Cargo

CVE-2026-74016WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerabilitythemagnifico52 Smart Cleaning

CVE-2026-73389WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerabilityThe4 Kalles Addons

CVE-2026-73347WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerabilityThemetechMount TrueBooker

CVE-2026-7330Auto Affiliate Links <= 6.8.8 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameterthedark Auto Affiliate Links

CVE-2026-73189WordPress WP Crowdfunding plugin < 2.2.1 - Insecure Direct Object References (IDOR) vulnerabilityThemeum WP Crowdfunding

CVE-2026-73181WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerabilityThemeComplete Extra Product Options & Add-Ons for…

CVE-2026-7284Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_registerthemewant Easy Elements for Elementor – Addons & Website…

CVE-2026-71488league/commonmark: Quadratic-time denial of service when parsing crafted Markdownthephpleague commonmark

CVE-2026-71478league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytesthephpleague commonmark

CVE-2026-71231IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookiethebradleysanders IOTSmartHome

CVE-2026-70378imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panictheotherphil imagecli

CVE-2026-70377imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Servicetheotherphil imagecli

CVE-2026-6965Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via…themeum Tutor LMS – eLearning and online course solution

CVE-2026-6791Potential stack-based buffer clash during tilde expansion in wordexpThe GNU C Library glibc

CVE-2026-66652WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerabilityThemeGoods Grand Tour

CVE-2026-66650WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerabilityTheme-Rex FreightCo

CVE-2026-6663GWD Connect <= 2.9 - Unauthenticated Limited Code Execution via update_agentthewebsitesupply GWD Conex

CVE-2026-66629WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerabilityThemeum Kirki

CVE-2026-66612WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerabilitythembay Aora

CVE-2026-66610WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerabilitythembay Urna

CVE-2026-66607WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerabilityThemeHunk Advance Product Search

CVE-2026-66606WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityThemeGrill SmartSMTP

CVE-2026-66586WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerabilityThemewinter WP Cafe Pro

CVE-2026-66564WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerabilityThemeREX ShiftCV

CVE-2026-66563WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerabilityThemeREX Windsor

CVE-2026-66483WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerabilityThemeREX Education Center

CVE-2026-66471WordPress Accordion plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerabilityThemepoints Accordion

CVE-2026-66437WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerabilityThemeisle Feedzy

CVE-2026-65573WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerabilityThemeREX Abelle

CVE-2026-65563WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerabilityThemeIsle

CVE-2026-6554infinte loop in libpcap before 1.10.7The Tcpdump Group libpcap

CVE-2026-65537WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control…Themeisle Cyr to Lat reloaded – transliteration of links…

CVE-2026-65531WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerabilityThemeum Qubely

CVE-2026-65526WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerabilityThemeisle Visualizer

CVE-2026-65524WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerabilityThemeFusion Avada Custom Branding

CVE-2026-65487WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerabilityThemeGoods Photography

CVE-2026-65439WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerabilityThemefic Ultimate Addons for Contact Form 7

CVE-2026-65436WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerabilityThemeum Kirki

CVE-2026-65433WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Broken Access Control…themewant RT Mega Menu – Mega Menu Builder for Elementor…

CVE-2026-63279Out of bounds read in PICT image importThe Document Foundation LibreOffice

CVE-2026-63278Package URLs can be used to exfiltrate arbitrary INI file values and environment variablesThe Document Foundation LibreOffice

CVE-2026-63277RCE via calcext:data-mappings, sql provider and jdbc connectorThe Document Foundation LibreOffice

CVE-2026-63276Stack buffer overflow in CFF to Type 1 font conversionThe Document Foundation LibreOffice

CVE-2026-63275Stack buffer overflow in CFF font hint handlingThe Document Foundation LibreOffice

CVE-2026-63274Heap buffer overflow in PDF import stream handlingThe Document Foundation LibreOffice

CVE-2026-63273Heap buffer overflow in PDF import encryption handlingThe Document Foundation LibreOffice

CVE-2026-63272Heap buffer overflow in WMF text record importThe Document Foundation LibreOffice

CVE-2026-63270Environment/ini-file leaksThe Document Foundation LibreOffice

CVE-2026-63269LFI and GET SSRF via GStreamer and HLS playlistsThe Document Foundation LibreOffice

CVE-2026-63268LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db hrefThe Document Foundation LibreOffice

CVE-2026-63267LFI and GET SSRF via calcext:data-mappings and csv providerThe Document Foundation LibreOffice

CVE-2026-63266Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionalityThe Document Foundation LibreOffice

CVE-2026-63099TheHive 4.1.24 Broken Object Level Authorization via Attachment Download EndpointsTheHive-Project TheHive

CVE-2026-63098TheHive 4.1.24 Unauthenticated Information Disclosure via /api/status EndpointTheHive-Project TheHive

CVE-2026-6279Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics'…themefusion Avada (Fusion) Builder

CVE-2026-6244division by zero in libpcap before 1.10.7The Tcpdump Group libpcap

CVE-2026-6238Buffer overread in ns_printrrf with corrupted RDATA fieldThe GNU C Library glibc

CVE-2026-62125WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerabilityThemeREX Asia Garden

CVE-2026-62124WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerabilityThemeREX N7 | Golf Club Sports & Events

CVE-2026-62123WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerabilityThemeREX Invetex

CVE-2026-62120WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerabilityThemeREX Law Office

CVE-2026-62105WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerabilityThemeREX Addons

CVE-2026-62090WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerabilityThemeREX WineShop

CVE-2026-62087WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerabilityThemeREX Equadio

CVE-2026-62086WordPress Juno theme <= 2.25 - PHP Object Injection vulnerabilityThemeREX Juno

CVE-2026-62076WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerabilityThe4 Kalles

CVE-2026-62074WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerabilityThemeREX Ozeum

200 records, read from the index as it stood on 18 Oct 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.