Application Security Detections Published in June 2026
In June, Qualys Web Application Scanning released QIDs targeting vulnerabilities in several widely used software products and frameworks, including:
Adobe, Apache, Craft CMS, DNN, FlowiseAI, Fortinet, IBM, Ivanti, JetBrains, Joomla, Langflow, LiteLLM, Mattermost, Microsoft, Moodle, Open WebUI, OpenClaw, pgAdmin, SimpleHelp, SolarWinds, Splunk, Traefik, WordPress, jQuery
Details about the following QIDs can be found in our knowledge base. Please review reports of the scanned applications for these detections and, if any are identified, follow the steps provided in the knowledge base to ensure applications are protected against the reported vulnerabilities. Immediate resolution of these vulnerabilities as soon as they are detected should be a priority for all organizations. If not addressed, these vulnerabilities can pose security risks, such as breaches, unauthorized access, and various malicious activities.
The following table lists the QIDs released in June 2026.
| QID | Title |
| 151100 | jQuery Cross-Site Scripting (XSS) Vulnerabilities (CVE-2020-7656,CVE-2012-6708) |
| 151101 | jQuery Denial of Service (DoS) Vulnerability (CVE-2016-10707) |
| 151102 | jQuery Cross-Site Scripting (XSS) Vulnerability (CVE-2014-6071) |
| 151103 | jQuery Sensitive Information Disclosure Vulnerability (CVE-2007-2379) |
| 520186 | SolarWinds Serv-U Denial of Service (DoS) Vulnerability (CVE-2026-28318) |
| 520187 | IBM WebSphere Application Server Identity Spoofing Vulnerability (CVE-2026-8644) |
| 520188 | IBM WebSphere Application Server Remote Code Execution Vulnerability (CVE-2026-9311) |
| 520189 | IBM WebSphere Application Server Insecure Deserialization Vulnerabilities (CVE-2026-9330,CVE-2026-9319) |
| 520190 | Apache HTTP Server Use After Free Vulnerability (CVE-2026-29167) |
| 520191 | Apache HTTP Server Cross-Site Scripting (XSS) Vulnerability (CVE-2026-29170) |
| 520192 | Apache HTTP Server Buffer Overflow Vulnerability (CVE-2026-34355) |
| 520193 | Apache HTTP Server Heap Buffer Overflow Vulnerability (CVE-2026-34356) |
| 520194 | Apache HTTP Server Heap Buffer Overflow Vulnerability (CVE-2026-42536) |
| 520195 | Apache HTTP Server Out-of-Bounds Read Vulnerability (CVE-2026-43951) |
| 520196 | Apache HTTP Server Improper Privilege Management Vulnerability (CVE-2026-44119) |
| 520197 | Apache HTTP Server Buffer Over-Read Vulnerability (CVE-2026-44185) |
| 520198 | Apache HTTP Server Infinite Loop Vulnerability (CVE-2026-44186) |
| 520199 | Apache HTTP Server Buffer Underwrite Vulnerability (CVE-2026-44631) |
| 520200 | Apache HTTP Server Use After Free Vulnerability (CVE-2026-48913) |
| 520201 | Apache HTTP Server Denial Of Service Vulnerability (CVE-2026-49975) |
| 520202 | IBM WebSphere Application Server Authentication Bypass Vulnerability (CVE-2026-10845) |
| 531392 | Joomla! Core SQL Injection Vulnerability (CVE-2026-35221) |
| 531393 | Joomla! Core Multiple Security Vulnerabilities |
| 531394 | Joomla! Core Local File Inclusion (LFI) Vulnerability (CVE-2026-40383) |
| 531395 | Joomla! Core Cross-Site Scripting (XSS) Vulnerabilities (CVE-2026-25900,CVE-2026-30894,CVE-2026-48903,CVE-2026-48905) |
| 531396 | Joomla! Core Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2026-35220) |
| 531397 | Joomla! Core Improper Access Control Vulnerability (CVE-2026-48900) |
| 531398 | Joomla! Core Transport Encryption Downgrade Vulnerability (CVE-2026-48902) |
| 531401 | WordPress WPCode Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-8832) |
| 531402 | WordPress WooCommerce PayPal Payments Plugin: Missing Authorization Vulnerability (CVE-2026-9284) |
| 531403 | WordPress Unlimited Elements For Elementor Plugin: SQL Injection Vulnerability (CVE-2026-48837) |
| 531404 | WordPress MasterStudy LMS Plugin: SQL Injection Vulnerability (CVE-2026-42730) |
| 531405 | WordPress Smart Manager Plugin: Privilege Escalation Vulnerability (CVE-2026-45216) |
| 531406 | WordPress LatePoint Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-7332) |
| 531407 | WordPress MiniOrange OTP Verification Plugin: Privilege Escalation Vulnerability (CVE-2026-42731) |
| 531408 | WordPress WP Super Edit Plugin: Arbitrary File Upload Vulnerability (CVE-2021-47965) |
| 531409 | WordPress CF7 Conditional Fields Plugin: Denial of Service Vulnerability (CVE-2026-25863) |
| 531410 | WordPress LiteSpeed Cache Plugin: Cross-Site Scripting Vulnerability (CVE-2026-3375) |
| 531411 | WordPress Creative Mail Plugin: SQL Injection Vulnerability (CVE-2026-3985) |
| 531412 | WordPress Kirki Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-8073) |
| 531413 | WordPress Ditty Plugin: Missing Authorization Vulnerability (CVE-2026-9011) |
| 531414 | WordPress Auto Affiliate Links Plugin: Cross-Site Scripting Vulnerability (CVE-2026-7330) |
| 531415 | WordPress EMagicOne Store Manager Plugin: SQL Injection Vulnerability (CVE-2026-42773) |
| 531416 | WordPress Active Products Tables Plugin: SQL Injection Vulnerability (CVE-2026-42727) |
| 531417 | WordPress WebinarIgnition Plugin: SQL Injection Vulnerability (CVE-2026-40797) |
| 531418 | JetBrains TeamCity Authentication Bypass Vulnerability (CVE-2026-44413) |
| 531419 | JetBrains TeamCity Reflected XSS Vulnerability (CVE-2026-49371) |
| 531420 | JetBrains TeamCity Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-49372) |
| 531421 | JetBrains TeamCity Remote Code Execution (RCE) Vulnerability (CVE-2026-49373) |
| 531422 | JetBrains TeamCity Improper permission checks Vulnerability (CVE-2026-49374) |
| 531423 | JetBrains TeamCity Reflected XSS Vulnerability (CVE-2026-49375) |
| 531424 | JetBrains TeamCity Insufficient Username Validation Vulnerability (CVE-2026-49376) |
| 531425 | JetBrains TeamCity Sensitive Data Exposure Vulnerability (CVE-2026-49377) |
| 531426 | JetBrains TeamCity Credentials Exposure Vulnerabilities (CVE-2026-49378,CVE-2026-49379) |
| 531427 | JetBrains TeamCity Open Redirect Vulnerability (CVE-2026-49380) |
| 531428 | JetBrains TeamCity Stored Cross-Site Scripting (XSS) Vulnerability (CVE-2026-49381) |
| 531429 | WordPress Login with OTP Plugin: Authentication Bypass Vulnerability (CVE-2026-8760) |
| 531430 | WordPress Motors Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-3892) |
| 531431 | WordPress AcyMailing Plugin: Privilege Escalation Vulnerability (CVE-2026-5200) |
| 531432 | WordPress Smart Coupons For WooCommerce Coupons Plugin: Missing Authorization Vulnerability (CVE-2026-45438) |
| 531433 | WordPress YITH WooCommerce Product Add-Ons Plugin: SQL Injection Vulnerability (CVE-2026-42383) |
| 531434 | WordPress AWP Classifieds Plugin: SQL Injection Vulnerability (CVE-2026-5100) |
| 531435 | WordPress WP Travel Plugin: SQL Injection Vulnerability (CVE-2026-45218) |
| 531437 | JetBrains YouTrack Stored Cross-Site Scripting (XSS) Vulnerability (CVE-2026-49368) |
| 531438 | JetBrains YouTrack Information Disclosure Vulnerability (CVE-2026-49369) |
| 531439 | JetBrains YouTrack Information Disclosure Vulnerability (CVE-2026-49370) |
| 531440 | JetBrains YouTrack Improper Access Control Vulnerability (CVE-2026-49385) |
| 531441 | JetBrains YouTrack Improper Access Control Vulnerability (CVE-2026-49386) |
| 531442 | WordPress Broadcast Live Video Plugin: Code Injection Vulnerability (CVE-2026-24937) |
| 531443 | WordPress CformsII Plugin: Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2026-39436) |
| 531444 | WordPress Contest Gallery Plugin: SQL Injection Vulnerability (CVE-2026-8912) |
| 531445 | WordPress Team Members Plugin: SQL Injection Vulnerability (CVE-2025-68060) |
| 531446 | WordPress AudioIgniter Music Player Plugin: Insecure Direct Object Reference Vulnerability (CVE-2026-8679) |
| 531447 | WordPress MyCryptoCheckout Plugin: Missing Authorization Vulnerability (CVE-2026-45209) |
| 531448 | WordPress HT Contact Form Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-42728) |
| 531451 | WordPress Property Hive Plugin: Cross-Site Scripting Vulnerability (CVE-2026-42729) |
| 531452 | WordPress Affiliate Toolkit Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-6169) |
| 531453 | WordPress JoomSport Plugin: SQL Injection Vulnerability (CVE-2026-6929) |
| 531454 | WordPress Expand Maker Plugin: Privilege Escalation Vulnerability (CVE-2026-7467) |
| 531455 | OpenClaw Authorization Bypass Vulnerability (CVE-2026-32905) |
| 531456 | OpenClaw Authorization Bypass Vulnerability (CVE-2026-35630) |
| 531457 | OpenClaw Improper Authentication Vulnerability (CVE-2026-8305) |
| 531458 | SolarWinds Web Help Desk Denial of Service (DoS) Vulnerability (CVE-2026-28299) |
| 531459 | Microsoft SharePoint Remote Code Execution (RCE) Vulnerability (CVE-2026-47294) |
| 531460 | Craft CMS Cross-Scope PII Disclosure Vulnerability (CVE-2026-44010) |
| 531461 | Craft CMS Information Disclosure Vulnerability (CVE-2026-44012) |
| 531462 | Craft CMS Remote Code Execution (RCE) Vulnerability (CVE-2026-44011) |
| 531463 | Open WebUI Cross-Site Scripting Vulnerability (CVE-2026-45665) |
| 531464 | Open WebUI Missing Authorization Vulnerability (CVE-2026-45350) |
| 531465 | Open WebUI Server-Side Request Forgery Vulnerability (CVE-2026-45338) |
| 531466 | Open WebUI Cross-Site Scripting Vulnerabilities (CVE-2026-45315 CVE-2026-45314) |
| 531467 | Open WebUI Cross-Site Scripting Vulnerability (CVE-2026-45303) |
| 531471 | WordPress Kirki Plugin: Privilege Escalation Vulnerability (CVE-2026-8206) |
| 531472 | WordPress ACF Extended Plugin: Privilege Escalation Vulnerability (CVE-2026-8809) |
| 531473 | WordPress Spectra Gutenberg Blocks Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-7465) |
| 531474 | WordPress Admin Columns Plugin: PHP Object Injection Vulnerability (CVE-2026-7654) |
| 531475 | WordPress Media Library Assistant Plugin: Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2026-6075) |
| 531476 | WordPress Duplicate Page and Post Plugin: SQL Injection Vulnerability (CVE-2026-49046) |
| 531477 | WordPress All-In-One Security (AIOS) Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-8438) |
| 531478 | Apache ActiveMQ Header Injection Vulnerability (CVE-2026-42253) |
| 531479 | Apache ActiveMQ Remote Code Execution (RCE) Vulnerability (CVE-2026-42588) |
| 531480 | Apache ActiveMQ Code Injection Vulnerability (CVE-2026-45505) |
| 531481 | Apache ActiveMQ Incomplete Authorization Vulnerability (CVE-2026-46605) |
| 531482 | Apache ActiveMQ Incorrect Default Permissions Vulnerability (CVE-2026-49157) |
| 531483 | Apache ActiveMQ Sensitive Information Exposure Vulnerability (CVE-2026-49270) |
| 531484 | Drupal Core SQL Injection Vulnerability (CVE-2026-9082) (Exploitation Check) |
| 531485 | Moodle SQL Injection Vulnerability (CVE-2026-7274) |
| 531486 | Moodle Remote Code Execution Vulnerability (CVE-2026-7275) |
| 531487 | Moodle Denial of Service Vulnerability (CVE-2026-7276) |
| 531488 | Moodle Cross-Site Request Forgery Vulnerability (CVE-2026-7278) |
| 531489 | WordPress WP Statistics Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-48839) |
| 531490 | WordPress Simple History Plugin: Account Takeover Vulnerability (CVE-2026-7459) |
| 531491 | WordPress LearnPress Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-48865) |
| 531492 | Adobe ColdFusion Improper Input Validation Vulnerability (CVE-2026-47930) |
| 531493 | WordPress Frontend Admin Plugin: Multiple Security Vulnerabilities (CVE-2026-6226,CVE-2026-7802) |
| 531494 | WordPress WPify Woo Plugin: Arbitrary File Upload Vulnerability (CVE-2026-42748) |
| 531495 | WordPress Gutenberg Essential Blocks Plugin: Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-10586) |
| 531496 | WordPress SlimStat Analytics Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-7634) |
| 531497 | WordPress Favicon by RealFaviconGenerator Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-42754) |
| 531498 | WordPress Appointment Booking Calendar Plugin: SQL Injection Vulnerability (CVE-2026-7797) |
| 531499 | Microsoft SharePoint Server Elevation of Privilege Vulnerability (CVE-2026-45484) |
| 531500 | Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2026-47298) |
| 531501 | Microsoft SharePoint Server Spoofing Vulnerabilities |
| 531502 | WordPress Better Messages Plugin: Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-42736) |
| 531503 | WordPress Login Recaptcha Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-2374) |
| 531504 | WordPress Booking Package Plugin: Privilege Escalation Vulnerability (CVE-2026-9851) |
| 531505 | WordPress Link Whisper Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2025-11262) |
| 531506 | WordPress WCFM Membership Plugin: Missing Authorization Vulnerability (CVE-2026-42753) |
| 531507 | WordPress WP User Manager Plugin: Local File Inclusion (LFI) Vulnerability (CVE-2026-9290) |
| 531508 | WordPress SP Client Document Manager Plugin: Missing Authorization Vulnerability (CVE-2026-10737) |
| 531509 | Apache Airflow Sensitive Data Exposure Vulnerability (CVE-2026-45192) |
| 531510 | Apache Airflow Arbitrary File Read Vulnerability (CVE-2026-40861) |
| 531511 | Apache Airflow Open Redirect Bypass Vulnerability (CVE-2026-40961) |
| 531512 | Apache Airflow Authorization Bypass Vulnerability (CVE-2026-40963) |
| 531513 | Apache Airflow Authorization Bypass Vulnerability (CVE-2026-41014) |
| 531514 | Apache Airflow JWT Cookie Replay Vulnerability (CVE-2026-41017) |
| 531515 | Apache Airflow Authorization Bypass Vulnerability (CVE-2026-41084) |
| 531516 | Apache Airflow Server-Side Template Injection Vulnerability (CVE-2026-42252) |
| 531517 | Apache Airflow Sensitive Information Disclosure Vulnerability (CVE-2026-42358) |
| 531518 | Apache Airflow Insecure Deserialization Vulnerability (CVE-2026-42359) |
| 531519 | Apache Airflow Sensitive Information Disclosure Vulnerability (CVE-2026-42360) |
| 531520 | Apache Airflow Insecure Deserialization Vulnerability (CVE-2026-45360) |
| 531521 | Apache Airflow Authorization Bypass Vulnerability (CVE-2026-45426) |
| 531522 | Apache Airflow Authorization Bypass Vulnerability (CVE-2026-46764) |
| 531523 | Apache Airflow Insufficient Session Expiration Vulnerability (CVE-2026-48726) |
| 531524 | Ivanti Sentry OS Command Injection Vulnerability (CVE-2026-10520) |
| 531525 | Ivanti Sentry Authentication Bypass Vulnerability (CVE-2026-10523) |
| 531526 | Mattermost Multiple Security Vulnerabilities (CVE-2026-6961,CVE-2026-7387) |
| 531527 | Mattermost Multiple Security Vulnerabilities (CVE-2026-4858,CVE-2026-5740) |
| 531528 | Mattermost Terminal Escape Injection Vulnerability (CVE-2026-3108) |
| 531529 | OpenClaw Race Condition Vulnerability (CVE-2026-53838) |
| 531530 | OpenClaw Authorization Bypass Vulnerability (CVE-2026-53834) |
| 531531 | OpenClaw Authorization Bypass Vulnerability (CVE-2026-53833) |
| 531532 | OpenClaw Arbitrary File Read Vulnerability (CVE-2026-53831) |
| 531533 | LiteLLM Command Injection Vulnerability (CVE-2026-42271) |
| 531534 | Ivanti Endpoint Manager Mobile (EPMM) OS Command Injection Vulnerability (CVE-2026-10727) |
| 531535 | Microsoft SharePoint Server Path Traversal Vulnerability (CVE-2026-45454) |
| 531536 | Microsoft SharePoint Server Spoofing Vulnerability (CVE-2026-47634) |
| 531537 | SimpleHelp OIDC Authentication Bypass Vulnerability (CVE-2026-48558) |
| 531538 | Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-25089) |
| 531539 | Mattermost Sensitive Information Exposure Vulnerabilities (CVE-2026-6346,CVE-2026-6347) |
| 531540 | Mattermost Denial of Service (DoS) Vulnerability (CVE-2026-24458) |
| 531541 | WordPress VikBooking Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-42737) |
| 531542 | WordPress Affiliate Super Assistent Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-42759) |
| 531543 | WordPress GutenBee Plugin: Arbitrary File Upload Vulnerability (CVE-2026-9227) |
| 531544 | WordPress Login with Phone Number Plugin: Authentication Bypass Vulnerability (CVE-2026-3655) |
| 531545 | LiteLLM Authentication Bypass via Host Header Injection (CVE-2026-49468) |
| 531546 | WordPress Easy Form Builder Plugin: SQL Injection Vulnerability (CVE-2026-42747) |
| 531547 | WordPress Comments Plus Plugin: Authentication Bypass Vulnerability (CVE-2026-42749) |
| 531548 | WordPress Clover Online Orders Plugin: Multiple Security Vulnerabilities (CVE-2026-42738,CVE-2026-42745,CVE-2026-42746) |
| 531549 | WordPress Content Visibility for Divi Builder Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-1829) |
| 531550 | WordPress WebinarIgnition Plugin: Multiple Security Vulnerabilities (CVE-2026-42757,CVE-2026-42758) |
| 531551 | Traefik HTTP/3 QUIC mTLS Bypass via Exact SNI Lookup Vulnerability (CVE-2026-53622) |
| 531552 | Traefik SNICheck Wildcard TLSOptions mTLS Bypass Vulnerability (CVE-2026-48491) |
| 531553 | WordPress Tainacan Plugin: SQL Injection Vulnerability (CVE-2026-42740) |
| 531554 | WordPress Advanced IP Blocker Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-42739) |
| 531555 | WordPress Hippoo Mobile App Plugin: Authentication Bypass Vulnerability (CVE-2026-10580) |
| 531556 | WordPress CleanTalk Spam Protect Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-8071) |
| 531557 | WordPress The Events Calendar Plugin: SQL Injection Vulnerability (CVE-2026-49772) |
| 531558 | WordPress LatePoint Plugin: Privilege Escalation Vulnerability (CVE-2026-8176) |
| 531559 | WordPress Contest Gallery Plugin: Privilege Escalation Vulnerability (CVE-2026-12165) |
| 531560 | OpenClaw Allowlist Bypass Vulnerability (CVE-2026-53861) |
| 531561 | OpenClaw Allowlist Bypass Vulnerability (CVE-2026-53866) |
| 531562 | OpenClaw Arbitrary Command Execution Vulnerability (CVE-2026-53865) |
| 531563 | Langflow Unauthenticated Remote Code Execution Vulnerability (CVE-2026-48519) |
| 531564 | Langflow Monitor API IDOR Missing Ownership Enforcement Vulnerability (CVE-2026-33760) |
| 531565 | Langflow Knowledge Bases API Path Traversal Vulnerability (CVE-2026-42867) |
| 531566 | Langflow Unauthenticated Shareable Playground Arbitrary File Read Vulnerability (CVE-2026-48520) |
| 531567 | FlowiseAI Mass Assignment Vulnerability (CVE-2026-42861) |
| 531568 | FlowiseAI Mass Assignment Vulnerability (CVE-2026-42862) |
| 531569 | FlowiseAI Mass Assignment Vulnerability (CVE-2026-42863) |
| 531570 | FlowiseAI Authentication Bypass Vulnerability (CVE-2026-46440) |
| 531571 | FlowiseAI Mass Assignment Vulnerability (CVE-2026-46441) |
| 531572 | FlowiseAI Authentication Bypass Vulnerability (CVE-2026-46442) |
| 531573 | FlowiseAI Credential Filtering Bypass Vulnerability (CVE-2026-46443) |
| 531574 | FlowiseAI Authentication Bypass Vulnerability (CVE-2026-46444) |
| 531575 | FlowiseAI Mass-Assignment Vulnerability (CVE-2026-46475) |
| 531576 | FlowiseAI Mass Assignment Vulnerability (CVE-2026-46476) |
| 531577 | FlowiseAI Mass-Assignment Vulnerability (CVE-2026-46477) |
| 531578 | FlowiseAI Mass Assignment Vulnerability (CVE-2026-46478) |
| 531579 | FlowiseAI Mass-Assignment Vulnerability (CVE-2026-46479) |
| 531580 | FlowiseAI Mass-Assignment Vulnerability (CVE-2026-46480) |
| 531581 | WordPress UpdraftPlus Plugin: Authentication Bypass Vulnerability (CVE-2026-10795) |
| 531582 | WordPress eCommerce Product Catalog Plugin: SQL Injection Vulnerability (CVE-2026-52693) |
| 531583 | WordPress E2Pdf Plugin: Privilege Escalation Vulnerability (CVE-2026-12407) |
| 531584 | WordPress Bookly Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-5513) |
| 531585 | WordPress SEO Redirection Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-52702) |
| 531586 | WordPress WPZOOM Portfolio Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-49069) |
| 531587 | WordPress CF7 to Webhook Plugin: Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-11395) |
| 531588 | WordPress Gravity SMTP Plugin: Sensitive Information Exposure Vulnerability (CVE-2026-4020) |
| 531589 | WordPress WP Maps Plugin: Local File Inclusion (LFI) Vulnerability (CVE-2026-6381) |
| 531590 | WordPress Masteriyo LMS Plugin: Privilege Escalation Vulnerability (CVE-2026-49111) |
| 531591 | WordPress Newsletters Plugin: SQL Injection Vulnerability (CVE-2026-3018) |
| 531592 | WordPress FV Flowplayer Video Player Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-7556) |
| 531593 | DNN CMS Detected |
| 531594 | Splunk Enterprise Missing Authentication Vulnerability (CVE-2026-20253) |
| 531595 | Splunk Enterprise/Cloud Platform Server-Side Request Forgery Vulnerability (CVE-2026-20252) |
| 531596 | Splunk Enterprise/Cloud Platform Insecure Deserialization Vulnerability (CVE-2026-20251) |
| 531597 | Splunk Enterprise/Cloud Platform Cross-Site Scripting Vulnerability (CVE-2026-20258) |
| 531598 | pgAdmin SQL Injection (SQLi) Vulnerability (CVE-2026-12044) |
| 531599 | pgAdmin Read-only transaction bypass Vulnerability (CVE-2026-12045) |
| 531600 | pgAdmin Missing Authentication Vulnerability (CVE-2026-12046) |
| 531601 | pgAdmin HTML Injection Vulnerability (CVE-2026-12047) |
| 531602 | pgAdmin Stored Cross-Site Scripting (XSS) Vulnerability (CVE-2026-12048) |
| 531603 | pgAdmin Open Redirect Vulnerability (CVE-2026-12049) |
| 531604 | pgAdmin SQL Injection (SQLi) Vulnerability (CVE-2026-12050) |
| 531605 | WordPress Ajax Load More Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-6495) |
| 531606 | WordPress Email Encoder Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-5776) |
| 531607 | WordPress Events Calendar for GeoDirectory Plugin: Privilege Escalation Vulnerability (CVE-2026-11616) |
| 531608 | WordPress WPC Product Options Plugin: Arbitrary File Download Vulnerability (CVE-2026-49061) |
| 531609 | WordPress Listdom Plugin: Privilege Escalation Vulnerability (CVE-2026-49063) |
| 531610 | WordPress Advanced 301 and 302 Redirect Plugin: SQL Injection Vulnerability (CVE-2026-49067) |
| 531611 | WordPress CF Images Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-9860) |
| 531612 | WordPress WP Ticket Plugin: SQL Injection Vulnerability (CVE-2026-9848) |
| 531613 | WordPress Woo Product Slider Pro Plugin: Supply Chain Backdoor Vulnerability (CVE-2026-49777) |
| 531614 | WordPress JetEngine Plugin: PHP Object Injection Vulnerability (CVE-2026-52706) |
| 531615 | WordPress JetEngine Plugin: SQL injection Vulnerability (CVE-2026-12360) |
| 531616 | WordPress JetEngine Plugin: SQL injection Vulnerability (CVE-2026-49084) |
| 531617 | WordPress JetEngine Plugin: Multiple Security Vulnerabilities (CVE-2026-49074,CVE-2026-49075,CVE-2026-49076) |
| 531618 | WordPress WP Scraper Plugin: Arbitrary File Upload Vulnerability (CVE-2025-69129) |
| 531619 | WordPress BetterDocs Pro Plugin: Local File Inclusion (LFI) Vulnerability (CVE-2026-7515) |
| 531620 | WordPress Doctreat Core Plugin: Privilege Escalation Vulnerability (CVE-2025-6254) |
| 531621 | WordPress LoginPress Pro Plugin: Privilege Escalation Vulnerability (CVE-2026-49058) |
| 531628 | WordPress WP Directory Kit Plugin: SQL Injection Vulnerability (CVE-2026-42672) |
| 531629 | WordPress ARMember Plugin: Account Takeover Vulnerability (CVE-2026-5076) |
| 531630 | WordPress Gravity Forms Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-48866) |
| 531631 | WordPress AI Copilot Plugin: Privilege Escalation Vulnerability (CVE-2026-48879) |
| 531632 | WordPress WP Maps Pro Plugin: Privilege Escalation Vulnerability (CVE-2026-8732) |
Qualys Notification: Application Security Detections Published in June 2026