Search vulnerabilities

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,822

CVE-2026-76529

Improper Protection of Alternate Path in Splunk SOAR

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76529 are related to improper protection of alternate path and are grouped under the Common Weakness Enumeration (CWE) CWE-424.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk
CVE-2026-76408

Improper Control of a Resource Through its Lifetime in Splunk SOAR

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76408 are related to improper control of a resource through its lifetime and are grouped under the Common Weakness Enumeration (CWE) CWE-664.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk
CVE-2026-76012

Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacy_render function. This is due to broken authorization on the Lightroom gallery_edit endpoint combined with mass assignment of gallery path and unrestricted file upload into a registered template directory, whose extension check uses a substring match that accepts sanitized .php_ filenames as valid templates. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to be the stored author of at least one existing NextGEN gallery, as ownership of that gallery is the sole authorization check gating the mass-assignment and upload steps.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Smub Wordpress-extensions
Products
Photo Gallery, Sliders, Proofing And Themes – Nextgen Gallery Nextgen Gallery
CVE-2026-62131

WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62016

WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62015

WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62014

WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62011

WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62010

WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62009

WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62005

WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62004

WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62003

WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-61998

WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-61997

WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-61996

WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability

Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-61992

WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-61991

WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-5461

Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata

The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter. This makes it possible for unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpmudev
Products
Forminator Forms Forminator Forms