● Live advisory feed

Security Advisory Fusion for CSIRTs, SOCs & Defenders

Security advisories from 24 sources — CISA, CERT-EU, NCSC-UK, BSI, CERT-FR, NCSC-NL, JPCERT/CC, JVN, HKCERT, the Canadian Cyber Centre, NVD, GitHub, Microsoft, Cisco, Fortinet, Palo Alto Networks and more — normalized, translated to English and flagged against the CISA KEV catalog. One global feed for CSIRTs, SOCs and defenders.

Daily Briefings IntelFusions

Advisories tracked

9,194

Known exploited

1,706

Sources online

Last sync

3M AGO

3,814 records · page 40 / 77

CVE-2026-57426: Unauthenticated Cross Site Scripting (XSS) in Modula - PRO <= 2.10.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Modula - PRO <= 2.10.8 versions.

highCVSS 7.1CVE-2026-57426 nvd2026-07-02

CVE-2026-57366: Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.1 versions.

Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.1 versions.

highCVSS 7.1CVE-2026-57366 nvd2026-07-02

CVE-2026-57362: Unauthenticated Cross Site Scripting (XSS) in ChatBot <= 8.3.2 versions.

Unauthenticated Cross Site Scripting (XSS) in ChatBot <= 8.3.2 versions.

highCVSS 7.1CVE-2026-57362 nvd2026-07-02

CVE-2026-57361: Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.

Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.

highCVSS 7.1CVE-2026-57361 nvd2026-07-02

CVE-2026-57360: Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.

Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.

highCVSS 7.1CVE-2026-57360 nvd2026-07-02

CVE-2026-57359: Unauthenticated Cross Site Scripting (XSS) in ReviewX <= 2.3.10 versions.

Unauthenticated Cross Site Scripting (XSS) in ReviewX <= 2.3.10 versions.

highCVSS 7.1CVE-2026-57359 nvd2026-07-02

CVE-2026-57358: Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3.9 versions.

highCVSS 7.1CVE-2026-57358 nvd2026-07-02

CVE-2026-57357: Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions.

highCVSS 7.1CVE-2026-57357 nvd2026-07-02

CVE-2026-57356: Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions.

Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions.

highCVSS 7.1CVE-2026-57356 nvd2026-07-02

CVE-2026-57355: Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions.

Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions.

mediumCVSS 6.5CVE-2026-57355 nvd2026-07-02

CVE-2026-57354: Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions.

Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions.

mediumCVSS 6.5CVE-2026-57354 nvd2026-07-02

CVE-2026-57353: Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions.

Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions.

mediumCVSS 6.5CVE-2026-57353 nvd2026-07-02

CVE-2026-57352: Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions.

Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions.

mediumCVSS 4.8CVE-2026-57352 nvd2026-07-02

CVE-2026-57351: Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions.

Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions.

highCVSS 7.1CVE-2026-57351 nvd2026-07-02

CVE-2026-57350: Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions.

highCVSS 7.1CVE-2026-57350 nvd2026-07-02

CVE-2026-57349: Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions.

Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions.

highCVSS 7.1CVE-2026-57349 nvd2026-07-02

CVE-2026-57348: Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions.

Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions.

highCVSS 7.2CVE-2026-57348 nvd2026-07-02

CVE-2026-57347: Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions.

Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions.

mediumCVSS 6.5CVE-2026-57347 nvd2026-07-02

CVE-2026-57345: Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 versions.

highCVSS 7.1CVE-2026-57345 nvd2026-07-02

CVE-2026-57344: Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions.

highCVSS 7.1CVE-2026-57344 nvd2026-07-02

CVE-2026-57343: Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions.

highCVSS 7.1CVE-2026-57343 nvd2026-07-02

CVE-2026-57342: Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions.

Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions.

mediumCVSS 6.5CVE-2026-57342 nvd2026-07-02

CVE-2026-56037: Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. This issue affects Themify Popup: from n/a through 1.4.3.

Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. This issue affects Themify Popup: from n/a through 1.4.3.

highCVSS 8.8CVE-2026-56037 nvd2026-07-02

CVE-2026-49779: Customer Path Traversal in Tax Exempt for WooCommerce <= 1.9.3 versions.

Customer Path Traversal in Tax Exempt for WooCommerce <= 1.9.3 versions.

mediumCVSS 6.5CVE-2026-49779 nvd2026-07-02

CVE-2026-42382: Unauthenticated Local File Inclusion in Audrey <= 1.5 versions.

Unauthenticated Local File Inclusion in Audrey <= 1.5 versions.

highCVSS 8.1CVE-2026-42382 nvd2026-07-02

CVE-2026-39448: Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions.

Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions.

highCVSS 7.5CVE-2026-39448 nvd2026-07-02

CVE-2026-27436: Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.

Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.

criticalCVSS 9.1CVE-2026-27436 nvd2026-07-02

CVE-2026-27433: Unauthenticated Broken Access Control in Motors <= 5.6.80 versions.

Unauthenticated Broken Access Control in Motors <= 5.6.80 versions.

mediumCVSS 6.5CVE-2026-27433 nvd2026-07-02

CVE-2026-27430: Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions.

Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions.

highCVSS 7.1CVE-2026-27430 nvd2026-07-02

CVE-2026-27426: Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions.

highCVSS 7.1CVE-2026-27426 nvd2026-07-02

CVE-2026-27425: Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions.

highCVSS 7.1CVE-2026-27425 nvd2026-07-02

CVE-2026-27419: Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions.

Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions.

criticalCVSS 9.9CVE-2026-27419 nvd2026-07-02

CVE-2026-27414: Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions.

Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions.

highCVSS 8.8CVE-2026-27414 nvd2026-07-02

CVE-2026-27412: Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.

Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.

highCVSS 8.1CVE-2026-27412 nvd2026-07-02

CVE-2026-27408: Unauthenticated Cross Site Scripting (XSS) in NativeChurch <= 4.8.8.2 versions.

Unauthenticated Cross Site Scripting (XSS) in NativeChurch <= 4.8.8.2 versions.

highCVSS 7.1CVE-2026-27408 nvd2026-07-02

CVE-2026-27404: Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.

Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.

highCVSS 7.1CVE-2026-27404 nvd2026-07-02

CVE-2026-27402: Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.

highCVSS 7.1CVE-2026-27402 nvd2026-07-02

CVE-2026-27060: Contributor PHP Object Injection in ARMember Premium <= 7.0 versions.

Contributor PHP Object Injection in ARMember Premium <= 7.0 versions.

highCVSS 8.8CVE-2026-27060 nvd2026-07-02

CVE-2026-14449: u5CMS through v12.8.8 is vulnerable to reflected XSS via the ‘thanks’ parameter in multiple form components

u5CMS through v12.8.8 is vulnerable to reflected XSS via the ‘thanks’ parameter in multiple form components

unknownCVE-2026-14449 nvd2026-07-02

CVE-2026-11946: An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for

An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. An attacker can declare an arbitrarily large string (up to ~4.09 GB via the UInt32 length fi…

highCVSS 7.5CVE-2026-11946 nvd2026-07-02