Search
450 CVEs · published 2026-07-27 to 2026-07-27
CVEs (450)
Showing 1–25 of 450
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-17500 | MEDIUM | 5.3 | 2026-07-27 | A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function _visit_pattern of the file common/json-schema-to-grammar.cpp. The manipulation… | |
| CVE-2026-17501 | MEDIUM | 5.3 | 2026-07-27 | A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-S… | |
| CVE-2026-15928 | NONE | — | 2026-07-27 | XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component. | |
| CVE-2025-15662 | HIGH | Patched | 8.6 | 2026-07-27 | The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not … |
| CVE-2026-10082 | MEDIUM | Patched | 6.1 | 2026-07-27 | The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor ro… |
| CVE-2026-12255 | HIGH | Patched | 8.1 | 2026-07-27 | The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disa… |
| CVE-2026-12394 | CRITICAL | Patched | 9.8 | 2026-07-27 | The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an… |
| CVE-2026-12493 | HIGH | Patched | 7.5 | 2026-07-27 | The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooComm… |
| CVE-2026-12982 | MEDIUM | Patched | 6.1 | 2026-07-27 | The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX act… |
| CVE-2026-13152 | HIGH | Patched | 8.1 | 2026-07-27 | The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities met… |
| CVE-2026-13332 | CRITICAL | Patched | 9.1 | 2026-07-27 | The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthentic… |
| CVE-2026-13390 | MEDIUM | Patched | 5.3 | 2026-07-27 | The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity ch… |
| CVE-2026-13400 | MEDIUM | Patched | 6.1 | 2026-07-27 | Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ord… |
| CVE-2026-13597 | CRITICAL | 9.1 | 2026-07-27 | The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated log… | |
| CVE-2026-13714 | CRITICAL | Patched | 9.8 | 2026-07-27 | The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated onl… |
| CVE-2026-13726 | HIGH | Patched | 7.1 | 2026-07-27 | The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Ref… |
| CVE-2026-14189 | LOW | Patched | 3.8 | 2026-07-27 | The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator ac… |
| CVE-2026-14190 | MEDIUM | Patched | 6.1 | 2026-07-27 | The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before … |
| CVE-2026-14203 | MEDIUM | Patched | 4.8 | 2026-07-27 | The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users wi… |
| CVE-2026-14235 | HIGH | Patched | 7.5 | 2026-07-27 | The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-liv… |
| CVE-2026-14236 | MEDIUM | Patched | 4.7 | 2026-07-27 | The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Str… |
| CVE-2026-14289 | CRITICAL | Patched | 9.0 | 2026-07-27 | The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a crypto… |
| CVE-2026-14568 | MEDIUM | Patched | 6.5 | 2026-07-27 | The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify… |
| CVE-2026-14820 | MEDIUM | Patched | 5.3 | 2026-07-27 | The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functi… |
| CVE-2026-14827 | MEDIUM | Patched | 6.8 | 2026-07-27 | The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allo… |