Skip to content
OpenAdvisories

Archive

26 June 2026

Vulnerabilities first published on this day (UTC), newest first.

← May 2026 2026 / June /26 July 2026 →
  1. 1379
  2. 2224
  3. 3153
  4. 4641
  5. 5169
  6. 639
  7. 724
  8. 8286
  9. 9721
  10. 10252
  11. 11194
  12. 12291
  13. 1322
  14. 1418
  15. 15401
  16. 16549
  17. 17397
  18. 18158
  19. 19206
  20. 2046
  21. 2172
  22. 22223
  23. 23258
  24. 24522
  25. 25472
  26. 26374
  27. 2733
  28. 2845
  29. 29246
  30. 30651
All Critical High Medium Low Exploited only Public exploit

132 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-32394

    AutoGPT: There is a DoS vulnerability in AITextSummarizerBlock

    AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.32, there is a DoS vulnerability in AITextSummarizerBlock. Malicious users can amplify their input. For example, if a malic…

    Significant-Gravitas AutoGPT
  • Medium 5.3
    CVE-2026-11779

    PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access

    An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.

    Payload CMS PayloadCMS payload npm
  • Medium 5.3
    CVE-2025-32423

    AutoGPT: There is a DoS vulnerability in ExtractTextInformationBlock

    AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.32, there is a DoS vulnerability in ExtractTextInformationBlock. Malicious users can amplify their input. For example, if a…

    Significant-Gravitas AutoGPT
  • Medium 5.4
    CVE-2026-56823

    AutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping Triggering

    AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the `POST /api/integrations/webhooks/{webhook_id}/ping` endpoint fetches the target webhook by primary key alone without veri…

    Significant-Gravitas AutoGPT
  • Medium 4.9
    CVE-2026-13434

    Virt-controller-rhel9: kubevirt: kubevirt: multus default-network annotation injection via unvalidated tenant networkname when externalnetresourceinjection is enabled

    A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineInstance with a Multus network configuration, the supplied networkName value is written verbatim into the launcher pod's v1.multus-cni.io/default-network annota…

    Red Hat Red Hat OpenShift Virtualization 4
  • Medium 5.6
    CVE-2023-20572

    An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against t…

    AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics
  • Medium 5.5
    CVE-2026-44018

    Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend

    Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An at…

    docling-project docling docling PyPI
  • Medium 6.5
    CVE-2026-9639

    Authenticated Denial of Service via Malicious Backup Tarball in LXD

    Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that …

    Canonical LXD lxd github.com/canonical/lxd Debian Go
  • Medium 5.3
    CVE-2026-57665

    WordPress GravityView plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in GravityView <= 3.0.0 versions.

    GravityKit GravityView
  • Medium 4.3
    CVE-2026-57664

    WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.1.6 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Bopo – WooCommerce Product Bundle Builder <= 1.1.6 versions.

    villatheme Bopo – WooCommerce Product Bundle Builder Web / CMS
  • Medium 5.4
    CVE-2026-57661

    WordPress WPComplete plugin <= 2.9.5.5 - Broken Access Control vulnerability

    Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.

    Nexcess WPComplete
  • Medium 5.3
    CVE-2026-57660

    WordPress Booking and Rental Manager plugin <= 2.7.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.

    MagePeople Team Booking and Rental Manager
  • Medium 4.3
    CVE-2026-57657

    WordPress Gmail SMTP plugin <= 1.2.3.19 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2.3.19 versions.

    Noor Alam Gmail SMTP
  • Medium 5.9
    CVE-2026-57656

    WordPress Hester Core plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability

    Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions.

    peregrinethemes Hester Core
  • Medium 6.5
    CVE-2026-57654

    WordPress Affiliates Manager plugin <= 2.9.49 - Broken Access Control vulnerability

    Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.

    wp.insider Affiliates Manager
  • Medium 5.3
    CVE-2026-57652

    WordPress JS Help Desk plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions.

    JoomSky JS Help Desk
  • Medium 6.5
    CVE-2026-57651

    WordPress Ghost Kit plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions.

    nK Ghost Kit
  • Medium 6.5
    CVE-2026-57650

    WordPress Magazine Blocks plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions.

    BlockArt Magazine Blocks
  • Medium 4.3
    CVE-2026-57648

    WordPress Nelio Content plugin <= 4.3.4 - Broken Access Control vulnerability

    Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.

    Nelio Software Nelio Content
  • Medium 4.3
    CVE-2026-57649

    WordPress Shoppable Images Lite plugin <= 1.3 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.

    Studio Wombat Shoppable Images Lite
  • Medium 5.4
    CVE-2026-57646

    WordPress Majestic Support plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability

    Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions.

    Majestic Support Majestic Support
  • Medium 4.3
    CVE-2026-57640

    WordPress MasterStudy LMS plugin <= 3.7.30 - Broken Access Control vulnerability

    Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.

    stylemix MasterStudy LMS
  • Medium 6.5
    CVE-2026-57641

    WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions.

    contempoinc Real Estate 7
  • Medium 6.5
    CVE-2026-57638

    WordPress Fluent Booking plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions.

    WP ManageNinja Fluent Booking
  • Medium 4.3
    CVE-2026-57637

    WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.

    Tyche Softwares Abandoned Cart Lite for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-57635

    WordPress FunnelKit Payment Gateway for Stripe WooCommerce plugin <= 1.14.0.3 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versions.

    FunnelKit FunnelKit Payment Gateway for Stripe WooCommerce Web / CMS
  • Medium 4.3
    CVE-2026-57634

    WordPress PPWP plugin <= 1.9.19 - Insecure Direct Object References (IDOR) vulnerability

    Contributor Insecure Direct Object References (IDOR) in PPWP <= 1.9.19 versions.

    WP Folio Team PPWP
  • Medium 5.3
    CVE-2026-57633

    WordPress WCBoost &#8211; Products Compare plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in WCBoost &#8211; Products Compare <= 1.1.0 versions.

    WCBoost WCBoost &#8211; Products Compare
  • Medium 5.4
    CVE-2026-57632

    WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.19.0 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.

    Omnisend Email Marketing for WooCommerce by Omnisend Web / CMS
  • Medium 5.3
    CVE-2026-57630

    WordPress Blocksy Companion Pro plugin <= 2.1.46 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.

    Creative Themes Blocksy Companion Pro
  • Medium 6.5
    CVE-2026-57629

    WordPress StatCounter plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in StatCounter <= 2.1.1 versions.

    StatCounter StatCounter
  • Medium 4.9
    CVE-2026-57627

    WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability

    Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.

    Themeum Kirki
  • Medium 4.3
    CVE-2026-57622

    WordPress WPCafe plugin <= 3.0.14 - Broken Access Control vulnerability

    Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.

    Arraytics WPCafe
  • Medium 6.5
    CVE-2026-57617

    WordPress SeedProd Pro plugin < 6.19.5 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions.

    SeedProd SeedProd Pro
  • Medium 6.5
    CVE-2026-57618

    WordPress Neve PRO theme <= 3.1.2 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions.

    themeisle Neve PRO
  • Medium 6.5
    CVE-2026-57431

    WordPress Featured Image plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability

    Author Cross Site Scripting (XSS) in Featured Image <= 2.1 versions.

    Mervin Praison Featured Image
  • Medium 4.3
    CVE-2026-57430

    WordPress SEOPress PRO plugin <= 9.1.1 - Broken Access Control vulnerability

    Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.

    SEOPress Free SEOPress PRO
  • Medium 6.5
    CVE-2026-57324

    WordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.

    villatheme GIFT4U
  • Medium 5.8
    CVE-2026-57323

    WordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.

    bPlugins Flash & HTML5 Video
  • Medium 6.5
    CVE-2026-57318

    WordPress Site Reviews plugin <= 8.0.11 - Sensitive Data Exposure vulnerability

    Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions.

    Gemini Labs Site Reviews