Skip to content
OpenAdvisories

Archive

13 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /13 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

346 results · Feed

  • Critical 9.5
    CVE-2026-22093

    Adversary-in-the-Middle (AitM) attack vulnerability in EVbee Service app

    The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communication be…

    EVbee EVbee Service
  • Critical 9.1
    CVE-2026-41041

    Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

    URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.

    Apache Software Foundation Apache Gravitino apache-gravitino PyPI
  • Medium 6.5
    CVE-2026-49876

    Apache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs

    Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs. A vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 through 1.2.1.…

    Apache Software Foundation Apache Gravitino apache-gravitino PyPI
  • High 8.8
    CVE-2026-15548

    Shibby Tomato DNS List Rendering httpd sub_407220 stack-based overflow

    A security vulnerability has been detected in Shibby Tomato up to 1.28.0000. This vulnerability affects the function sub_407220 of the file /usr/sbin/httpd of the component DNS List Rendering. The manipulation leads to stack-based buffer overflow. The attack …

    Shibby Tomato
  • Critical 9.3
    CVE-2026-59515

    WordPress AIWU plugin <= 1.5.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL Injection.This issue affects AIWU: from n/a through <= 1.5.4.

    Sergey AIWU
  • High 7.1
    CVE-2026-59516

    WordPress ICS Calendar plugin <= 12.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Room 34 Creative Services, LLC ICS Calendar ics-calendar allows Reflected XSS.This issue affects ICS Calendar: from n/a through <= 12.1.1.

    Room 34 Creative Services ICS Calendar
  • High 7.2
    CVE-2026-59521

    WordPress Real Testimonials plugin <= 3.1.15 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimonials: from n/a through <= 3.1.15.

    ShapedPlugin Real Testimonials
  • Medium 6.5
    CVE-2026-59523

    WordPress Simply Schedule Appointments plugin <= 1.6.11.11 - Broken Access Control vulnerability

    Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.11.11.

    N Squared Simply Schedule Appointments
  • Critical 9.8
    CVE-2026-59518

    WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through <= 8.8.2.

    wpWax Directorist
  • High 7.6
    CVE-2026-61955

    WordPress گرویتی فرم فارسی plugin <= 3.0.2 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hannan گرویتی فرم فارسی persian-gravity-forms allows Blind SQL Injection.This issue affects گرویتی فرم فارسی: from n/a through <= 3.0.2.

    Hannan
  • Medium 5.3
    CVE-2026-61976

    WordPress JetBlocks For Elementor plugin <= 1.5.0 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embedded Sensitive Data.This issue affects JetBlocks For Elementor: from n/a through <= 1.5.0.

    Crocoblock JetBlocks For Elementor
  • Medium 5.4
    CVE-2026-61968

    WordPress myCred plugin <= 3.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through <= 3.1.2.

    Saad Iqbal myCred
  • Medium 4.9
    CVE-2026-61970

    WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Themeisle Auto Featured Image (Auto Post Thumbnail) auto-post-thumbnail allows Server Side Request Forgery.This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through <= 5.0.4.

    themeisle Auto Featured Image (Auto Post Thumbnail)
  • Medium 5.3
    CVE-2026-61975

    WordPress JetReviews plugin <= 3.0.1 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetReviews jet-reviews allows Retrieve Embedded Sensitive Data.This issue affects JetReviews: from n/a through <= 3.0.1.

    Crocoblock JetReviews
  • Low 2.7
    CVE-2026-61971

    WordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Profile Picture: from n/a through <= 2.6…

    Cozmoslabs User Profile Picture
  • Medium 4.9
    CVE-2026-61952

    WordPress WooCommerce Bulk Edit Products – WP Sheet Editor plugin <= 1.8.21 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jose Vega WooCommerce Bulk Edit Products – WP Sheet Editor woo-bulk-edit-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Edit Products – WP Sheet Edito…

    Jose Vega WooCommerce Bulk Edit Products – WP Sheet Editor Web / CMS
  • High 7.1
    CVE-2026-61956

    WordPress ووسلام – همگام سازی ووکامرس و باسلام plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in hamsalam ووسلام &#8211; همگام سازی ووکامرس و باسلام sync-basalam allows Cross Site Request Forgery.This issue affects ووسلام &#8211; همگام سازی ووکامرس و باسلام: from n/a through <= 1.9.1.

    hamsalam ووسلام &#8211; همگام سازی ووکامرس و باسلام
  • Medium 5.3
    CVE-2026-61983

    WordPress Church Admin plugin <= 5.0.30 - Broken Access Control vulnerability

    Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.30.

    andy_moyle Church Admin
  • Medium 5.3
    CVE-2026-61985

    WordPress Car Rental Manager plugin <= 1.3.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through <= 1.3.7.

    MagePeople Team Car Rental Manager
  • Medium 5.4
    CVE-2026-61958

    WordPress License Manager for WooCommerce plugin <= 3.0.17 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects License Manager for WooCommerce: from n/a through <= 3…

    Saad Iqbal License Manager for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2026-61977

    WordPress JetSearch plugin <= 3.6.1.2 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-search allows Retrieve Embedded Sensitive Data.This issue affects JetSearch: from n/a through <= 3.6.1.2.

    Crocoblock JetSearch
  • Critical 9.8
    CVE-2026-57744

    WordPress RT-Theme 18 | Extensions plugin <= 2.5 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.

    stmcan RT-Theme 18 | Extensions
  • High 7.5
    CVE-2026-57801

    WordPress SetSail theme <= 2.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes SetSail setsail allows PHP Local File Inclusion.This issue affects SetSail: from n/a through <= 2.1.

    Select-Themes SetSail
  • High 7.5
    CVE-2026-57802

    WordPress Struktur theme < 2.7 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur allows PHP Local File Inclusion. This issue affects Struktur: from n/a before 2.7.

    Select-Themes Struktur
  • Medium 5.3
    CVE-2026-57774

    WordPress VW Food Corner theme <= 1.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vowelweb VW Food Corner vw-food-corner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Food Corner: from n/a through <= 1.1.0.

    vowelweb VW Food Corner
  • High 7.1
    CVE-2026-57741

    WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Stored XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.0.

    AcyMailing Newsletter Team AcyMailing SMTP Newsletter
  • Medium 4.3
    CVE-2026-57797

    WordPress EduMall theme <= 4.5.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemeMove EduMall edumall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EduMall: from n/a through <= 4.5.1.

    ThemeMove EduMall
  • High 8.8
    CVE-2026-57786

    WordPress WorkScout-Core plugin <= 1.7.08 - Cross Site Request Forgery (CSRF) to Broken Authentication vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows Authentication Bypass.This issue affects WorkScout-Core: from n/a through <= 1.7.08.

    purethemes WorkScout-Core
  • High 7.1
    CVE-2026-57745

    WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Reflected XSS.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.

    stmcan RT-Theme 18 | Extensions
  • High 7.5
    CVE-2026-57815

    WordPress Forminator plugin <= 1.55.0.2 - Arbitrary File Download vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Path Traversal.This issue affects Forminator: from n/a through <= 1.55.0.2.

    WPMU DEV - Your All-in-One WordPress Platform Forminator
  • Medium 6.5
    CVE-2026-57783

    WordPress Speaker plugin <= 4.1.13 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in merkulove Speaker speaker allows Stored XSS.This issue affects Speaker: from n/a through <= 4.1.13.

    merkulove Speaker
  • Critical 10.0
    CVE-2026-57811 Public exploit

    WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Remote Code Inclusion.This issue affects Realtyna Organic IDX plugin: from n/a through <= 5.2.0.

    Realtyna Realtyna Organic IDX plugin
  • High 7.5
    CVE-2026-57791

    WordPress Brook theme <= 2.9.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.

    ThemeMove Brook
  • High 8.5
    CVE-2026-57772

    WordPress WP Inventory Manager plugin <= 2.4.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Blind SQL Injection.This issue affects WP Inventory Manager: from n/a through <= 2.4.0.

    WP Inventory WP Inventory Manager
  • Medium 5.3
    CVE-2026-57776

    WordPress VW Wedding theme <= 1.3.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Wedding: from n/a through <= 1.3.7.

    vowelweb VW Wedding
  • High 7.5
    CVE-2026-57800

    WordPress Overworld theme <= 1.5 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows PHP Local File Inclusion.This issue affects Overworld: from n/a through <= 1.5.

    Edge-Themes Overworld
  • High 7.5
    CVE-2026-57795

    WordPress Kitchor theme <= 1.4.3 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Kitchor kitchor allows PHP Local File Inclusion.This issue affects Kitchor: from n/a through <= 1.4.3.

    themelexus Kitchor
  • High 8.5
    CVE-2026-57771

    WordPress GD Rating System plugin <= 3.7 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Rating System gd-rating-system allows Blind SQL Injection.This issue affects GD Rating System: from n/a through <= 3.7.

    Milan Petrovic GD Rating System
  • Medium 5.3
    CVE-2026-57782

    WordPress Universal Clocks plugin <= 1.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PressTigers Universal Clocks universal-clocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Universal Clocks: from n/a through <= 1.2.0.

    PressTigers Universal Clocks
  • High 7.6
    CVE-2026-57773

    WordPress Advanced Shipment Tracking for WooCommerce plugin <= 4.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zorem Advanced Shipment Tracking for WooCommerce woo-advanced-shipment-tracking allows Blind SQL Injection.This issue affects Advanced Shipment Tracking for …

    zorem Advanced Shipment Tracking for WooCommerce Web / CMS