Skip to content
OpenAdvisories

Archive

10 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /10 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

172 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-15285

    The Plus Addons for Elementor <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes

    The Plus Addons for Elementor plugin for WordPress was vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the Button widget's `custom_attributes` setting in versions up to and including 6.4.11. The `render` function in `modules/widgets…

    posimyththemes The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Web / CMS
  • Medium 5.3
    CVE-2026-15302

    ARMember <= 4.0.27 - Directory Traversal via X-FILENAME

    The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files (e.g., CSS) to dir…

    Repute InfoSystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Web / CMS
  • Medium 4.4
    CVE-2026-15283

    WPvivid Backup for MainWP <= 0.9.33 - Authenticated (Admin+) Stored Cross-Site Scripting

    The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticate…

    wpvividplugins WPvivid Backup for MainWP Web / CMS
  • Medium 5.4
    CVE-2026-15331

    zhayujie CowAgent Skill Installation service.py _add_package path traversal

    A vulnerability was identified in zhayujie CowAgent up to 2.1.0. The affected element is the function _add_url/_add_package of the file agent/skills/service.py of the component Skill Installation Handler. The manipulation of the argument Name leads to path tr…

    zhayujie CowAgent
  • Medium 5.4
    CVE-2026-11818

    WPCafe <= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST API

    The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.14. This is due to the plugin not properly verifying that a user is authorized to pe…

    Arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System Web / CMS
  • Medium 6.1
    CVE-2026-11392

    WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters

    The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' and 'check_out_date' parameters in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This make…

    ThimPress WP Hotel Booking Web / CMS
  • Medium 4.3
    CVE-2026-15329

    zhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosure

    A vulnerability was found in zhayujie CowAgent up to 2.1.0. This issue affects the function BrowserTool._do_navigate of the file agent/tools/browser/browser_tool.py of the component Browser Tool. Performing a manipulation results in information disclosure. Th…

    zhayujie CowAgent
  • Medium 5.4
    CVE-2026-5069

    Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'

    The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscription_id' parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This …

    WP ManageNinja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Web / CMS
  • Medium 5.4
    CVE-2026-15320

    Sipeed PicoClaw pico.go rt.ReloadConfig authorization

    A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. This vulnerability affects the function rt.ReloadConfig of the file pkg/channels/pico/pico.go. Performing a manipulation of the argument message.send results in missing authorization. It is possible…

    Sipeed PicoClaw
  • Medium 6.3
    CVE-2026-15318

    Sipeed PicoClaw MQTT Channel mqtt.go authorization

    A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channels/mqtt/mqtt.go of the component MQTT Channel Handler. This manipulation of the argument client_id causes incorrect autho…

    Sipeed PicoClaw
  • Medium 6.3
    CVE-2026-15317

    Sipeed PicoClaw Guarded Web Fetch Flow web.go WebFetchTool.Execute server-side request forgery

    A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. Affected by this vulnerability is the function WebFetchTool.Execute of the file pkg/tools/integration/web.go of the component Guarded Web Fetch Flow. The manipulation results in server-side r…

    Sipeed PicoClaw
  • Medium 5.5
    CVE-2026-44918

    OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.

    OpenStack Ironic ironic ironic Debian Ubuntu