Application Security Detections Published in August 2026
Table of Contents
In August, Qualys Web Application Scanning released QIDs targeting vulnerabilities in several widely used software products and frameworks, including:
Lodash, RequireJS, Nginx, IBM WebSphere Application Server, cPanel and WHM, OpenSSL, Microsoft SharePoint, Apache Kylin, Progress MOVEit Automation, Apache Tomcat, Apache ActiveMQ, FlowiseAI, Zimbra, MLflow, Splunk Enterprise, pfSense, HashiCorp Vault, BentoML, Grafana, Atlassian Confluence, Atlassian Bamboo, Check Point SmartConsole, pgAdmin, XWiki, Langflow, Adobe ColdFusion, WordPress, Drupal, Zohocorp ManageEngine ADAudit Plus, Craft CMS, Joomla!, Oracle WebLogic Server, Grav API Plugin, Apache Superset, Apache Jena Fuseki, Apache JSPWiki, Cacti, Apache Airflow, JetBrains YouTrack, Apache Camel
Details about the following QIDs can be found in our knowledge base. Please review reports of the scanned applications for these detections and, if any are identified, follow the steps provided in the knowledge base to ensure applications are protected against the reported vulnerabilities. Immediate resolution of these vulnerabilities as soon as they are detected should be a priority for all organizations. If not addressed, these vulnerabilities can pose security risks, such as breaches, unauthorized access, and various malicious activities.QID
| QID | Title |
| 151109 | Lodash Prototype Pollution Vulnerability (CVE-2025-13465) |
| 151110 | RequireJS Prototype Pollution Vulnerability (CVE-2024-38999) |
| 520228 | EOL/Obsolete Software: Nginx 0.X Detected |
| 520229 | EOL/Obsolete Software: Nginx 1.X Detected |
| 520230 | IBM WebSphere Application Server Multiple Security Vulnerabilities |
| 520231 | cPanel and WHM Privilege Escalation Vulnerability (CVE-2026-58048) |
| 520232 | IBM WebSphere Application Server Remote Code Execution Vulnerability (CVE-2026-11536) |
| 520235 | OpenSSL Denial of Service (DoS) Vulnerability (CVE-2026-14457) |
| 520236 | OpenSSL QUIC Double Free Denial of Service (DoS) Vulnerability (CVE-2026-18798) |
| 520239 | OpenSSL Format String Denial of Service Vulnerability (CVE-2026-63073) |
| 520240 | OpenSSL Denial of Service (DoS) Vulnerability (CVE-2026-63074) |
| 520241 | OpenSSL QUIC Memory Exhaustion Denial of Service (DoS) Vulnerability (CVE-2026-63075) |
| 520242 | OpenSSL CMP Null Pointer Dereference Denial of Service (DoS) Vulnerability (CVE-2026-63076) |
| 531925 | Microsoft SharePoint Cross-Site Scripting (XSS) Vulnerability (CVE-2026-62826) |
| 531926 | Apache Kylin SQL Injection Vulnerability (CVE-2026-62390) |
| 531927 | Apache Kylin OS Command Injection Vulnerability (CVE-2026-62392) |
| 531938 | Progress MOVEit Automation Authentication Bypass Vulnerability (CVE-2026-4670) |
| 531939 | Progress MOVEit Automation Improper Input Validation Vulnerability (CVE-2026-5174) |
| 531964 | Apache Tomcat Uncontrolled Resource Consumption Vulnerability (CVE-2026-66299) |
| 531965 | Apache ActiveMQ Improper Input Validation Vulnerability (CVE-2026-59878) |
| 531966 | Apache ActiveMQ Improper Authorization Vulnerability (CVE-2026-61487) |
| 532004 | FlowiseAI Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-69250) |
| 532005 | FlowiseAI Remote Code Execution (RCE) Vulnerability (CVE-2026-69251) |
| 532006 | FlowiseAI Missing Authorization Vulnerability (CVE-2026-69252) |
| 532007 | FlowiseAI Sandbox Escape Vulnerability (CVE-2026-69253) |
| 532026 | FlowiseAI Sandbox Escape Vulnerability (CVE-2026-69254) |
| 532027 | FlowiseAI Remote Code Execution Vulnerability (CVE-2026-69255) |
| 532028 | FlowiseAI Remote Code Execution Vulnerability (CVE-2026-69256) |
| 532029 | FlowiseAI Server-Side Request Forgery Vulnerability (CVE-2026-69257) |
| 532030 | FlowiseAI Property Injection Vulnerability (CVE-2026-69258) |
| 532031 | FlowiseAI Remote Code Execution Vulnerability (CVE-2026-69259) |
| 532032 | FlowiseAI Incorrect Authorization Vulnerability (CVE-2026-69262) |
| 532033 | FlowiseAI Remote Code Execution Vulnerability (CVE-2026-69263) |
| 532034 | FlowiseAI Remote Code Execution Vulnerability (CVE-2026-69264) |
| 532035 | FlowiseAI Remote Code Execution Vulnerability (CVE-2026-70470) |
| 532036 | FlowiseAI Improper Authorization Vulnerability (CVE-2026-70471) |
| 532037 | FlowiseAI Insecure Direct Object Reference Vulnerability (CVE-2026-70472) |
| 532038 | FlowiseAI Information Disclosure Vulnerability (CVE-2026-70473) |
| 532039 | FlowiseAI OAuth2 Credential Metadata Leak Vulnerability (CVE-2026-70474) |
| 532040 | FlowiseAI Missing Authorization Vulnerability (CVE-2026-70475) |
| 532041 | FlowiseAI Broken Access Control Vulnerability (CVE-2026-70476) |
| 532042 | FlowiseAI Remote Code Execution Vulnerability (CVE-2026-70477) |
| 532043 | FlowiseAI Missing Authentication Vulnerability (CVE-2026-70478) |
| 532062 | FlowiseAI Authentication Bypass Vulnerability (CVE-2026-70636) |
| 532063 | FlowiseAI Insecure Direct Object Reference Vulnerability (CVE-2026-67622) |
| 532185 | Zimbra Remote Code Execution (RCE) Vulnerability (CVE-2026-73570) |
| 532186 | Zimbra Cross-Site Scripting (XSS) Vulnerability (CVE-2026-73572) |
| 532187 | Zimbra Authorization Bypass Vulnerability (CVE-2026-73571) |
| 532188 | Zimbra Path Traversal Vulnerability (CVE-2026-73573) |
| 532189 | Zimbra Local File Inclusion Vulnerability (CVE-2026-73574) |
| 532190 | Zimbra Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2026-73575) |
| 532191 | Zimbra Weak Cryptographic Key Generation Vulnerability (CVE-2026-73576) |
| 532212 | MLflow Server-Side Request Forgery Vulnerability (CVE-2026-64849) |
| 532213 | MLflow Improper Authorization Vulnerability (CVE-2026-69148) |
| 532214 | MLflow Improper Authorization Vulnerability (CVE-2026-69146) |
| 532226 | Splunk Enterprise Improper Access Control Vulnerability (CVE-2026-76312) |
| 532227 | Splunk Enterprise Improper Access Control Vulnerabilities (CVE-2026-76310,CVE-2026-76311) |
| 532228 | Splunk Enterprise Improper Access Control Vulnerabilities (CVE-2026-76336,CVE-2026-76263) |
| 532229 | Splunk Enterprise Privilege Escalation Vulnerability (CVE-2026-76253) |
| 532230 | Splunk Enterprise Improper Privilege Management Vulnerability (CVE-2026-76259) |
| 532231 | Splunk Enterprise Improper Privilege Management Vulnerability (CVE-2026-76350) |
| 532235 | Splunk Enterprise Remote Code Execution Vulnerabilities |
| 532236 | Splunk Enterprise Remote Code Execution Vulnerability (CVE-2026-76345) |
| 532237 | Splunk Enterprise Code Injection Vulnerability (CVE-2026-76315) |
| 532238 | Splunk Enterprise SPL Injection Vulnerabilities |
| 532239 | Splunk Enterprise SPL Injection Vulnerability (CVE-2026-76316) |
| 532240 | Splunk Enterprise SPL Injection Vulnerability (CVE-2026-76328) |
| 532241 | Splunk Enterprise SPL Injection Vulnerability (CVE-2026-76349) |
| 532242 | Splunk Enterprise Path Traversal Vulnerabilities |
| 532252 | Splunk Enterprise Improper Authentication Vulnerability (CVE-2026-76338) |
| 532254 | Splunk Enterprise Sensitive Information Disclosure Vulnerabilities (CVE-2026-76262,CVE-2026-76355) |
| 532255 | Splunk Enterprise Cross-Site Scripting Vulnerabilities (CVE-2026-76325,CVE-2026-76333,CVE-2026-76318,CVE-2026-76324,CVE-2026-76326,CVE-2026-76346) |
| 532256 | Splunk Enterprise Use of Hard-coded Cryptographic Key Vulnerability (CVE-2026-76258) |
| 532257 | Splunk Enterprise Incorrect Permission Assignment Vulnerability (CVE-2026-76260) |
| 532258 | Splunk Enterprise SQL Injection Vulnerability (CVE-2026-76343) |
| 532259 | Splunk Enterprise Server-Side Request Forgery Vulnerabilities (CVE-2026-76351,CVE-2026-76347) |
| 532278 | pfSense Cross-Site Scripting (XSS) Vulnerability (CVE-2026-67189) |
| 532316 | HashiCorp Vault Authorization Bypass Vulnerability (CVE-2026-5006) |
| 532317 | BentoML Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-78205) |
| 532327 | Grafana Cross-Site Scripting Vulnerability (CVE-2026-17033) |
| 520233 | Atlassian Confluence Stored Cross-Site Scripting (XSS) Vulnerability (CVE-2026-21580) |
| 520234 | Atlassian Bamboo Improper Authorization Vulnerability (CVE-2026-21584) |
| 531982 | Check Point SmartConsole Authentication Bypass Vulnerability (CVE-2026-16232) |
| 532009 | pgAdmin SQL Injection Vulnerability (CVE-2026-17346) |
| 532010 | pgAdmin Shell Command Injection Vulnerability (CVE-2026-17347) |
| 532011 | pgAdmin Missing Authentication Decorator Routes Vulnerability (CVE-2026-17348) |
| 532012 | pgAdmin Credential Theft Vulnerability (CVE-2026-17349) |
| 532013 | pgAdmin Tool Permission Enforcement Bypass Vulnerability (CVE-2026-17350) |
| 532014 | pgAdmin Remote Code Execution (RCE) Vulnerability (CVE-2026-17351) |
| 532015 | pgAdmin Command Injection via Query Validation Bypass Vulnerability (CVE-2026-17566) |
| 532044 | XWiki Path Traversal Vulnerability (CVE-2026-48047) |
| 532045 | Langflow Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-9081) |
| 532046 | Langflow Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-7657) |
| 532052 | XWiki Password Hash Information Disclosure Vulnerability (CVE-2026-48048) |
| 532054 | Langflow Remote Code Execution (RCE) Vulnerability (CVE-2026-9198) |
| 532089 | Microsoft SharePoint Cross-Site Scripting (XSS) Vulnerability (CVE-2026-57105) |
| 532090 | Microsoft SharePoint Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-58639) |
| 532091 | Microsoft SharePoint Authentication Bypass Privilege Escalation Vulnerability (CVE-2026-62827) |
| 532092 | Microsoft SharePoint Cross-Site Scripting (XSS) Vulnerability (CVE-2026-62829) |
| 532093 | Microsoft SharePoint Path Traversal Information Disclosure Vulnerability (CVE-2026-62837) |
| 532094 | Microsoft SharePoint Insufficiently Protected Credentials Vulnerability (CVE-2026-62839) |
| 532095 | Microsoft SharePoint Input Validation Spoofing Vulnerability (CVE-2026-62917) |
| 532096 | Microsoft SharePoint Authorization Bypass Vulnerability (CVE-2026-63512) |
| 532097 | Microsoft SharePoint Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2026-63514) |
| 532098 | Microsoft SharePoint Untrusted Data Deserialization Spoofing Vulnerability (CVE-2026-63516) |
| 532099 | Microsoft SharePoint Input Validation Remote Code Execution (RCE) Vulnerability (CVE-2026-63520) |
| 532100 | Microsoft SharePoint Cross-Site Scripting (XSS) Vulnerability (CVE-2026-64897) |
| 532101 | Microsoft SharePoint Cross-Site Scripting (XSS) Vulnerability (CVE-2026-64900) |
| 532102 | Microsoft SharePoint Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2026-64901) |
| 532103 | Microsoft SharePoint Cross-Site Scripting (XSS) Vulnerability (CVE-2026-64902) |
| 532104 | Microsoft SharePoint Cross-Site Scripting (XSS) Vulnerability (CVE-2026-64916) |
| 532105 | Microsoft SharePoint Missing Authentication for Critical Function Vulnerability (CVE-2026-64921) |
| 532106 | Microsoft SharePoint Cross-Site Scripting (XSS) Vulnerability (CVE-2026-64922) |
| 532107 | Microsoft SharePoint Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2026-65658) |
| 532108 | Microsoft SharePoint Code Injection Vulnerability (CVE-2026-65660) |
| 532109 | Microsoft SharePoint Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2026-65663) |
| 532110 | Microsoft SharePoint Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2026-65665) |
| 532111 | Microsoft SharePoint Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2026-66805) |
| 532112 | Microsoft SharePoint Untrusted Data Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2026-66808) |
| 532113 | Microsoft SharePoint Cross-Site Scripting (XSS) Vulnerability (CVE-2026-70306) |
| 532114 | Microsoft SharePoint Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2026-70321) |
| 532115 | Microsoft SharePoint Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-70324) |
| 532116 | Microsoft SharePoint Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-70326) |
| 532117 | Microsoft SharePoint Cross-Site Scripting (XSS) Vulnerability (CVE-2026-70355) |
| 532147 | Adobe ColdFusion Command Injection Vulnerability (CVE-2026-48362) |
| 532148 | Adobe ColdFusion Denial of Service (DoS) Vulnerability (CVE-2026-48375) |
| 532149 | Adobe ColdFusion Denial of Service (DoS) Vulnerability (CVE-2026-48384) |
| 532150 | Adobe ColdFusion OS Command Injection Vulnerability (CVE-2026-48385) |
| 532151 | Adobe ColdFusion Memory Disclosure Vulnerability (CVE-2026-48386) |
| 532152 | Adobe ColdFusion Heap-based Buffer Overflow Remote Code Execution (RCE) Vulnerability (CVE-2026-48440) |
| 532153 | Adobe ColdFusion Remote Code Execution (RCE) Vulnerability (CVE-2026-71387) |
| 532154 | Adobe ColdFusion Eval injection Vulnerability (CVE-2026-48273) |
| 532155 | Adobe ColdFusion Denial of Service (DoS) Vulnerability (CVE-2026-71384) |
| 532156 | Adobe ColdFusion Arbitrary Code Execution Vulnerability (CVE-2026-71386) |
| 532157 | Adobe ColdFusion Privilege Escalation Vulnerability (CVE-2026-21273) |
| 532167 | Adobe ColdFusion Incorrect Authorization Vulnerability (CVE-2026-71385) |
| 532168 | Adobe ColdFusion Hard-coded Cryptographic Key Vulnerability (CVE-2026-34635) |
| 532169 | Adobe ColdFusion Improper Input Validation Vulnerability (CVE-2026-21279) |
| 532170 | Adobe ColdFusion Privilege Escalation Vulnerability (CVE-2026-25652) |
| 532171 | Adobe ColdFusion Incorrect Authorization Vulnerability (CVE-2026-71383) |
| 532172 | Adobe ColdFusion Improper Encoding Vulnerability (CVE-2026-48376) |
| 532192 | WordPress Forminator Forms Plugin: Arbitrary File Upload Vulnerability (CVE-2026-15748) |
| 532200 | Ivanti Endpoint Manager (EPM) Out-of-Bounds Read Vulnerability (CVE-2026-18125) |
| 532201 | Ivanti Endpoint Manager (EPM) External Control of Filename Vulnerability (CVE-2026-18127) |
| 532202 | Ivanti Endpoint Manager (EPM) Sensitive Information Exposure Vulnerability (CVE-2026-18129) |
| 532216 | Langflow Missing Registration Endpoint Authentication Vulnerability (CVE-2026-19875) |
| 532279 | Apache CloudStack OS Command Injection in NAS Backup Vulnerability (CVE-2026-47359) |
| 532280 | Apache CloudStack Server-Side Request Forgery (SSRF) and Remote Code Execution Vulnerability (CVE-2026-50112) |
| 532281 | Apache CloudStack Missing Authorization Cross Tenant Access Vulnerability (CVE-2026-50222) |
| 532282 | Apache CloudStack Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-59085) |
| 532283 | Apache CloudStack OAuth Provider Information Disclosure Vulnerability (CVE-2026-59655) |
| 532284 | Apache CloudStack Cleartext Storage of Sensitive Information Vulnerability (CVE-2026-59657) |
| 532285 | Apache CloudStack LDAP Configuration Information Disclosure Vulnerability (CVE-2026-59780) |
| 532286 | Apache CloudStack Two-Factor Authentication Bypass Vulnerability (CVE-2026-59799) |
| 532287 | Apache CloudStack OAuth2 Sensitive Information Exposure Vulnerability (CVE-2026-61397) |
| 532288 | Apache CloudStack Improper Output Encoding Cross-Site Scripting Vulnerability (CVE-2026-61398) |
| 532289 | Apache CloudStack Cross-Site Scripting Vulnerability (CVE-2026-61399) |
| 532290 | Apache CloudStack Command Injection in Diagnostics APIs Vulnerability (CVE-2026-61400) |
| 532291 | Apache CloudStack Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-61422) |
| 532292 | Apache CloudStack Cross-Tenant Access Control Bypass Vulnerability (CVE-2026-62440) |
| 532293 | Apache CloudStack Webhook Information Disclosure Vulnerability (CVE-2026-65613) |
| 532294 | Apache CloudStack Missing Authorization in Host Tags Listing Vulnerability (CVE-2026-66721) |
| 532295 | Apache CloudStack Domain Admin Cross-Domain Authorization Bypass Vulnerability (CVE-2026-66722) |
| 532296 | Apache CloudStack Insecure Direct Object Reference Vulnerability (CVE-2026-66797) |
| 532297 | Apache CloudStack SAML Certificate Validation Authentication Bypass Vulnerability (CVE-2026-68745) |
| 532298 | Apache CloudStack Resource Leak Denial of Service (DoS) Vulnerability (CVE-2026-59654) |
| 532305 | Apache Tomcat TOCTOU Race Condition Vulnerability (CVE-2026-65183) |
| 532306 | Apache Tomcat Improper Input Validation Vulnerability (CVE-2026-65637) |
| 532307 | Apache Tomcat DIGEST Authentication Replay Attack Vulnerability (CVE-2026-65905) |
| 532308 | Apache Tomcat Off-by-one Error in Rewrite Processing Vulnerability (CVE-2026-65927) |
| 532309 | Apache Tomcat Security Role Reference Authorization Bypass Vulnerability (CVE-2026-66422) |
| 532310 | Apache Tomcat FORM Authentication Authorization Bypass Vulnerability (CVE-2026-68525) |
| 532311 | Apache Tomcat Client Certificate Authentication Bypass Vulnerability (CVE-2026-68569) |
| 532312 | Apache Tomcat HTTP/2 Resource Consumption Denial of Service (DoS) Vulnerability (CVE-2026-68763) |
| 532313 | Apache Tomcat WebSocket Session Persistence After HTTP Session End Vulnerability (CVE-2026-73180) |
| 532314 | Apache Tomcat Security Constraint Bypass Vulnerability (CVE-2026-65182) |
| 531983 | Apache Superset Dashboard Permission Bypass Vulnerability (CVE-2026-23981) |
| 531984 | Apache Superset SQL Parser Regular Expression Denial of Service Vulnerability (CVE-2026-23985) |
| 531998 | Apache Jena Fuseki Path Traversal Vulnerability (CVE-2026-61372) |
| 531999 | Apache JSPWiki Debug Messages Information Disclosure Vulnerability (CVE-2026-28811) |
| 532000 | Apache JSPWiki UserManager Authentication Bypass Vulnerability (CVE-2026-28812) |
| 532001 | Apache JSPWiki JSON Hijacking Leading to Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2026-28813) |
| 532002 | Apache JSPWiki Authentication Bypass Information Disclosure Vulnerability (CVE-2026-28814) |
| 532003 | Apache JSPWiki Markdown Parser Cross-Site Scripting (XSS) Vulnerability (CVE-2026-48910) |
| 532053 | Cacti SQL Injection Vulnerability (CVE-2026-71287) |
| 532067 | Langflow Command Injection in MCP Configuration Vulnerability (CVE-2026-17623) |
| 532068 | Langflow Docker Volume Mount Path Traversal Vulnerability (CVE-2026-17626) |
| 532069 | Langflow Configuration Parameter Remote Code Execution (RCE) Vulnerability (CVE-2026-17630) |
| 532070 | Langflow Path Traversal File Access Vulnerability (CVE-2026-7646) |
| 532071 | Langflow Model Context Protocol Authentication Bypass Vulnerability (CVE-2026-8446) |
| 532072 | Langflow Localhost Restriction Bypass Vulnerability (CVE-2026-9077) |
| 532073 | Langflow Environment Variable Information Disclosure Vulnerability (CVE-2026-10128) |
| 532074 | Langflow Command Injection Vulnerability (CVE-2026-17625) |
| 532075 | Langflow Improper Access Control in API Endpoint Vulnerability (CVE-2026-10547) |
| 532076 | Langflow Module Import Remote Code Execution (RCE) Vulnerability (CVE-2026-17624) |
| 532077 | Langflow Python Code Execution via AST Bypass Vulnerability (CVE-2026-17632) |
| 532078 | Langflow Code Injection Vulnerability (CVE-2026-17633) |
| 532079 | Langflow Username Path Traversal Vulnerability (CVE-2026-7658) |
| 532080 | Langflow Path Traversal Vulnerability (CVE-2026-7869) |
| 532081 | Langflow Unauthenticated Remote Code Execution (RCE) Vulnerability (CVE-2026-8182) |
| 532082 | Langflow Path Traversal Vulnerability (CVE-2026-8183) |
| 532083 | Langflow Weak Cryptographic Key Generation Vulnerability (CVE-2026-8470) |
| 532084 | Langflow Remote Code Execution (RCE) Vulnerability (CVE-2026-8478) |
| 532085 | Langflow Session Identifier Authorization Bypass Vulnerability (CVE-2026-9130) |
| 532086 | Langflow LLM Generated Code Execution Vulnerability (CVE-2026-9196) |
| 532087 | Langflow Truncated Hash Validation Bypass Vulnerability (CVE-2026-9201) |
| 532088 | Langflow Weak Cryptographic Key Derivation Vulnerability (CVE-2026-9205) |
| 532135 | Apache Airflow Secrets Masker Bypass in Nested Collections Vulnerability (CVE-2026-54183) |
| 532136 | Apache Airflow Deserialization Remote Code Execution Vulnerability (CVE-2026-58076) |
| 532137 | Apache Airflow XCom Deserialization Arbitrary Class Instantiation Vulnerability (CVE-2026-59242) |
| 532138 | Apache Airflow Secret Masking Bypass Vulnerability (CVE-2026-59244) |
| 532139 | Apache Airflow Team-Scoped Configuration Secrets Exposure Vulnerability (CVE-2026-65017) |
| 532140 | Apache Airflow Unsafe Deserialization Remote Code Execution Vulnerability (CVE-2026-67260) |
| 532141 | Apache Airflow Arbitrary Module Import via Deserialization Vulnerability (CVE-2026-67587) |
| 532142 | Apache Airflow Team Scope Authorization Bypass Vulnerability (CVE-2026-68076) |
| 532143 | Apache Airflow Authorization Bypass Through Parameter Parsing Mismatch Vulnerability (CVE-2026-68968) |
| 532144 | Apache Airflow Audit Log Secret Exposure Vulnerability (CVE-2026-68969) |
| 532145 | Apache Airflow Variable Secret Exposure in Logs Vulnerability (CVE-2026-68970) |
| 532146 | Apache Airflow Team-Based Authorization Bypass Vulnerability (CVE-2026-68971) |
| 532181 | JetBrains YouTrack Missing Authorization in Mailbox Endpoint Vulnerability (CVE-2026-75044) |
| 532182 | JetBrains YouTrack Unauthenticated Database Backup Download Vulnerability (CVE-2026-75045) |
| 532183 | JetBrains YouTrack User Enumeration via Search Endpoint Vulnerability (CVE-2026-75046) |
| 532184 | JetBrains YouTrack Decompression Bomb Denial of Service (DoS) Vulnerability (CVE-2026-75047) |
| 532203 | JetBrains YouTrack Stored Cross-Site Scripting (XSS) Vulnerability (CVE-2026-75048) |
| 532204 | JetBrains YouTrack Insecure Direct Object Reference Vulnerability (CVE-2026-75049) |
| 532205 | JetBrains YouTrack Denial of Service (DoS) Vulnerability (CVE-2026-75050) |
| 532206 | JetBrains YouTrack Unauthorized Project Transfer Vulnerability (CVE-2026-75051) |
| 532215 | Langflow Brute Force Authentication Attack Vulnerability (CVE-2026-19297) |
| 532270 | Apache Camel MIME Header Injection Control Flow Manipulation Vulnerability (CVE-2026-59230) |
| 532271 | Apache Camel Path Traversal in Azure Storage Datalake Component Vulnerability (CVE-2026-60093) |
| 532272 | Apache Camel Header Injection Enabling Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-63621) |
| 532273 | Apache Camel Path Traversal in Azure Storage Blob Component Vulnerability (CVE-2026-66906) |
| 532274 | Apache Camel Path Traversal in Google Storage Component Vulnerability (CVE-2026-66907) |
| 532275 | Apache Camel JWT Authentication Bypass Vulnerability (CVE-2026-66908) |
| 532276 | Apache Camel WebSocket Message Routing Hijack Vulnerability (CVE-2026-71300) |
| 532277 | Apache Camel Header Filter Strategy Bypass Vulnerability (CVE-2026-78329) |
| 532299 | Grav API Plugin Authentication Bypass Vulnerability (CVE-2026-72822) |
| 532300 | Grav API Plugin Missing Authorization Vulnerability (CVE-2026-72824) |
| 532301 | Grav API Plugin Scope Bypass via createApiKey Vulnerability (CVE-2026-72826) |
| 532302 | Grav API Plugin API-key scope-cap Bypass Vulnerability (CVE-2026-72829) |
| 532303 | Grav API Plugin ConfigController Scope Bypass Vulnerability (CVE-2026-72830) |
| 532118 | WordPress InstaWP Connect Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-13457) |
| 532158 | WordPress AI Engine Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-65545) |
| 532199 | WordPress Query Wrangler Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-14498) |
| 532217 | WordPress Site Reviews Plugin: Cross Site Scripting (XSS) Vulnerability (CVE-2026-73382) |
| 532218 | WordPress OttoKit Plugin: Server Side Request Forgery (SSRF) Vulnerability (CVE-2026-32553) |
| 532232 | WordPress FundEngine Plugin: PHP Object Injection Vulnerability (CVE-2026-73993) |
| 532233 | WordPress Easy Elementor Addons Plugin: Cross-Site Request Forgery (CSRF) (CVE-2026-28164) |
| 154187 | WordPress Core Cross Site Scripting (XSS) Vulnerability (CVE-2026-64638) |
| 154188 | WordPress Core Remote Code Execution (RCE) Vulnerability (CVE-2026-65640) |
| 154189 | Drupal Core Multiple Security Vulnerabilities (CVE-2026-15916,CVE-2026-55805) |
| 154190 | Drupal Core Cross-Site Scripting (XSS) Vulnerability (CVE-2026-15917) |
| 520227 | Zohocorp ManageEngine ADAudit Plus Remote Code Execution (RCE) Vulnerability (CVE-2026-6516) |
| 531956 | WordPress Advanced Responsive Video Embedder Plugin: Authentication Bypass Vulnerability (CVE-2026-18072) |
| 531960 | WordPress SMS Alert Plugin: Authentication Bypass Vulnerability (CVE-2026-15014) |
| 531968 | WordPress Bookly Plugin: SQL Injection Vulnerability (CVE-2026-14516) |
| 531973 | WordPress LoginPress Pro Plugin: Authentication Bypass Vulnerabilities |
| 531985 | WordPress WooCommerce Social Login Plugin: Authentication Bypass Vulnerability (CVE-2026-8457) |
| 531988 | WordPress Meta Box AIO Plugin: Missing Authorization Vulnerability (CVE-2026-14488) |
| 532049 | WordPress WP Events Manager Plugin: Improper Authentication Vulnerability (CVE-2026-14205) |
| 532123 | WordPress Formidable Digital Signatures Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-16230) |
| 532125 | Craft CMS Remote Code Execution (RCE) Vulnerability (CVE-2026-72778) |
| 532126 | Craft CMS Authentication Bypass Vulnerability (CVE-2026-72780) |
| 532127 | Craft CMS Remote Code Execution (RCE) Vulnerability (CVE-2026-72781) |
| 532128 | Craft CMS Information Disclosure Vulnerability (CVE-2026-72782) |
| 532129 | Craft CMS Path Traversal Vulnerability (CVE-2026-72783) |
| 532130 | Craft CMS Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-72784) |
| 532131 | Craft CMS Arbitrary File Read Vulnerability (CVE-2026-72779) |
| 532132 | Craft CMS Authorization Bypass Vulnerability (CVE-2026-72785) |
| 532133 | Craft CMS Improper Authorization Vulnerability (CVE-2026-72786) |
| 532134 | Craft CMS Cross-Site Scripting (XSS) Vulnerability (CVE-2026-72787) |
| 532207 | Joomla! Core Response Header Injection Vulnerability (CVE-2026-71572) |
| 532208 | Joomla! Core Multiple Security Vulnerabilities (CVE-2026-71573,CVE-2026-72531) |
| 532209 | Joomla! Core Multiple Security Vulnerabilities |
| 532210 | Joomla! Core Multiple Security Vulnerabilities (CVE-2026-73336,CVE-2026-73372) |
| 532211 | Joomla! Core Unrestricted SHTML File Upload Vulnerability (CVE-2026-73373) |
| 532219 | WordPress Templately Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-66667) |
| 532220 | WordPress Essential Real Estate Plugin: PHP Object Injection Vulnerability (CVE-2026-32465) |
| 532221 | WordPress FundEngine Plugin: PHP Object Injection Vulnerability (CVE-2026-32470) |
| 532222 | WordPress W3 Total Cache Plugin: Path Traversal Vulnerability (CVE-2026-18051) |
| 532223 | WordPress Broken Link Checker Plugin: Code Injection Vulnerability (CVE-2026-18937) |
| 532224 | WordPress Theme Test Drive Plugin: Local File Inclusion (LFI) Vulnerability (CVE-2026-32464) |
| 532225 | WordPress JetEngine Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-66613) |
| 532243 | WordPress Advanced File Manager Plugin: Missing Authorization Vulnerability (CVE-2026-11565) |
| 532244 | WordPress TranslatePress Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-75981) |
| 532245 | WordPress WP Statistics Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-15780) |
| 532246 | WordPress Eventin Plugin: Missing Authorization Vulnerabilities (CVE-2026-13169,CVE-2026-13174) |
| 532247 | WordPress Booking Calendar Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-14334) |
| 532248 | WordPress SAML Single Sign On Plugin: Account Takeover Vulnerability (CVE-2026-19842) |
| 532249 | WordPress Events Made Easy Plugin: Local File Inclusion (LFI) Vulnerability (CVE-2026-75963) |
| 532250 | WordPress JSON Options Plugin: Improper Privilege Management Vulnerability (CVE-2026-75860) |
| 532251 | WordPress WPForms Pro Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-18409) |
| 532264 | WordPress ManageWP Worker Plugin: Authentication Bypass Vulnerability (CVE-2026-18052) |
| 532265 | WordPress Forminator Forms Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-19221) |
| 532266 | WordPress AI Engine Plugin: Account Takeover Vulnerability (CVE-2026-75796) |
| 532267 | WordPress WPeMatico Plugin: Privilege Escalation Vulnerability (CVE-2026-19883) |
| 532268 | WordPress Drag and Drop Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-18781) |
| 532269 | WordPress Password Protect Pages Plugin: PHP Object Injection Vulnerability (CVE-2026-0551) |
| 532304 | Oracle WebLogic Server Multiple Vulnerabilities (CSPU-AUG2026) |
| 532318 | Craft CMS Authenticated Remote Code Execution (RCE) Vulnerability (CVE-2026-78416) |
| 532319 | WordPress Ultimate Social Media Icons Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-66623) |
| 532320 | WordPress Events Made Easy Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-28162) |
| 532321 | WordPress Forminator Forms Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-18323) |
| 532322 | WordPress Forminator Forms Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-18328) |
| 532323 | WordPress ShopEngine Plugin: Privilege Escalation Vulnerability (CVE-2026-75971) |
| 532324 | WordPress Digits Plugin: Privilege Escalation Vulnerability (CVE-2026-28165) |
| 532329 | WordPress WP Fastest Cache Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-19760) |
| 532330 | WordPress TranslatePress Plugin: Sensitive Information Exposure Vulnerability (CVE-2026-19632) |
| 532331 | WordPress Mang Board WP Plugin: Privilege Escalation Vulnerability (CVE-2026-75977) |
| 532332 | WordPress Formidable Forms Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-18331) |
| 532333 | WordPress WooCommerce Lottery Plugin: SQL Injection Vulnerability (CVE-2026-18884) |
| 532334 | WordPress Classified Listing Plugin: Authentication Bypass Vulnerability (CVE-2026-15985) |
| 532335 | WordPress LiteSpeed Cache Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-18978) |
| 532336 | WordPress TranslatePress Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-76053) |
| 532337 | WordPress Forminator Forms Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-18324) |
| 532338 | WordPress Optimole Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-77365) |
| 532339 | WordPress Customer Reviews for WooCommerce Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-6176) |
| 532340 | WordPress WpForo Forum Plugin: SQL Injection Vulnerability (CVE-2026-5097) |
| 532341 | WordPress Amelia Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-6286) |
| 532342 | WordPress WPMU DEV Dashboard Plugin: Authentication Bypass Vulnerability (CVE-2026-76581) |
| 531957 | WordPress Buddypress Media Plugin: SQL Injection Vulnerabilities (CVE-2026-59549,CVE-2026-59551) |
| 531958 | WordPress GamiPress Plugin: SQL Injection Vulnerability (CVE-2026-59538) |
| 531959 | WordPress AWP Classifieds Plugin: SQL Injection Vulnerability (CVE-2026-59550) |
| 531961 | WordPress MapSVG Plugin: SQL Injection Vulnerability (CVE-2026-59527) |
| 531962 | WordPress Wholesale for WooCommerce Plugin: Privilege Escalation Vulnerability (CVE-2026-12144) |
| 531963 | WordPress Easy Digital Downloads Plugin: Arbitrary File Upload Vulnerability (CVE-2026-12476) |
| 531967 | WordPress Payment Plugins for Stripe WooCommerce Plugin: Missing Authorization Vulnerability (CVE-2026-59530) |
| 531969 | WordPress Uncanny Automator Plugin: Missing Authorization Vulnerability (CVE-2026-15025) |
| 531970 | WordPress Better Messages Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-16585) |
| 531971 | WordPress Best Woocommerce Feed Plugin: Cross-Site Scripting Vulnerability (CVE-2026-59553) |
| 531972 | WordPress Fluent Forms Pro Plugin: PHP Object Injection Vulnerability (CVE-2026-15962) |
| 531974 | WordPress AI Engine Plugin: Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2026-15988) |
| 531975 | WordPress Kali Forms Plugin: Remote Code Execution Vulnerability (CVE-2026-16144) |
| 531976 | WordPress NEX-Forms Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-15450) |
| 531977 | WordPress Subscriptions for WooCommerce Plugin: Multiple Security Vulnerabilities (CVE-2026-15414,CVE-2026-15397) |
| 531978 | WordPress Pronamic Pay Plugin: Privilege Escalation Vulnerability (CVE-2026-16635) |
| 531979 | WordPress Realtyna Organic IDX Plugin: Arbitrary File Upload Vulnerability (CVE-2026-14483) |
| 531980 | WordPress Realtyna Organic IDX Plugin: Arbitrary File Upload Vulnerability (CVE-2026-16236) |
| 531981 | WordPress FormGent Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-3141) |
| 531986 | WordPress Admin Site Enhancements Pro Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-16610) |
| 531987 | WordPress Cost Calculator Builder Pro Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-14900) |
| 531989 | WordPress Fluent Forms Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-16655) |
| 531990 | WordPress Bookly Plugin: SQL Injection Vulnerability (CVE-2026-13395) |
| 531991 | WordPress BuddyPress Plugin: PHP Object Injection Vulnerability (CVE-2026-1360) |
| 531992 | WordPress GTM4WP Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-16597) |
| 531993 | WordPress Redux Framework Plugin: Privilege Escalation Vulnerability (CVE-2026-12525) |
| 531994 | WordPress Unlimited Elements For Elementor Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-10081) |
| 531995 | WordPress Kirki Plugin: Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-13147) |
| 531996 | WordPress AI Engine Plugin: Arbitrary File Write Vulnerability (CVE-2026-12511) |
| 531997 | WordPress Booster for WooCommerce Plugin: Arbitrary File Upload Vulnerability (CVE-2026-56027) |
| 532008 | WordPress Admin and Site Enhancements Plugin: Missing Authorization Vulnerability (CVE-2026-12083) |
| 532016 | WordPress Multiple Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-3220) |
| 532017 | WordPress Multiple Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-6382) |
| 532018 | WordPress Rank Math SEO Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-66702) |
| 532019 | WordPress Meta for WooCommerce Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-66707) |
| 532020 | WordPress Creative Mail Plugin: SQL Injection Vulnerability (CVE-2026-65547) |
| 532021 | WordPress TranslatePress Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-18510) |
| 532022 | WordPress Dokan Lite Plugin: Privilege Escalation Vulnerability (CVE-2026-8761) |
| 532023 | WordPress Appointment Booking Calendar Plugin: Multiple Security Vulnerabilities (CVE-2026-65508,CVE-2026-65513) |
| 532024 | WordPress Smart Popup by Supsystic Plugin: Privilege Escalation Vulnerability (CVE-2026-18322) |
| 532025 | WordPress File Manager Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-15991) |
| 532047 | WordPress AI Copilot Plugin: Privilege Escalation Vulnerability (CVE-2026-14526) |
| 532048 | WordPress TrueBooker Plugin: Multiple Security Vulnerabilities (CVE-2026-14364,CVE-2026-14365) |
| 532050 | WordPress Ajax Search Lite Plugin: PHP Object Injection Vulnerability (CVE-2026-16258) |
| 532051 | WordPress MStore API Plugin: Payment Bypass Vulnerability (CVE-2026-16038) |
| 532055 | WordPress File Manager Plugin: Sensitive Data Exposure Vulnerabilities (CVE-2026-17541,CVE-2026-17542) |
| 532056 | WordPress Bricksforge Plugin: Arbitrary Password Reset Vulnerability (CVE-2026-18030) |
| 532057 | WordPress ProSolution WP Client Plugin: SQL Injection Vulnerability (CVE-2026-19053) |
| 532058 | WordPress HT Contact Form Plugin: Sensitive Data Exposure Vulnerability (CVE-2026-14206) |
| 532059 | WordPress Salon Booking System Plugin: Information Disclosure Vulnerability (CVE-2026-17022) |
| 532060 | WordPress Login and Register Forms Plugin: Information Disclosure Vulnerability (CVE-2026-18470) |
| 532061 | WordPress Contact Form to Any API Plugin: Sensitive File Disclosure Vulnerability (CVE-2026-18946) |
| 532119 | WordPress GeoDirectory Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-19091) |
| 532120 | WordPress Frontend Admin Plugin: Arbitrary Password Reset Vulnerability (CVE-2026-15606) |
| 532121 | WordPress AcyMailing Plugin: Missing Authorization Vulnerability (CVE-2026-15426) |
| 532122 | WordPress VentraConnect Social Login Plugin: Authentication Bypass Vulnerability (CVE-2026-18961) |
| 532124 | WordPress CheckView Plugin: Improper Authentication Vulnerability (CVE-2026-18786) |
| 532159 | WordPress Salon Booking System Plugin: Broken Authentication Vulnerability (CVE-2026-66453) |
| 532160 | WordPress Fluent Forms Plugin: Cross-Site Scripting Vulnerability (CVE-2026-18146) |
| 532161 | WordPress W3 Total Cache Plugin: Cross-Site Scripting Vulnerability (CVE-2026-18109) |
| 532162 | WordPress WPJAM Basic Plugin: SQL Injection Vulnerability (CVE-2026-61966) |
| 532163 | WordPress Events Manager Plugin: Multiple Security Vulnerabilities (CVE-2026-18366,CVE-2026-18057) |
| 532164 | WordPress Form Maker Plugin: SQL Injection Vulnerability (CVE-2026-16977) |
| 532165 | WordPress Wallet for WooCommerce Plugin: Improper Access Control Vulnerability (CVE-2026-16538) |
| 532166 | WordPress Eventin Plugin: Missing Authorization Vulnerability (CVE-2026-13171) |
| 532173 | WordPress Essential Addons for Elementor Plugin: Improper Privilege Management Vulnerability (CVE-2026-18039) |
| 532174 | WordPress User Profile Builder Plugin: Authentication Bypass Vulnerability (CVE-2026-15826) |
| 532175 | WordPress Pods Plugin: Privilege Escalation Vulnerability (CVE-2026-19598) |
| 532176 | WordPress Royal Elementor Addons Plugin: Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-17123) |
| 532177 | WordPress Templately Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-18438) |
| 532178 | WordPress Link Library Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-18855) |
| 532179 | WordPress Frontend Admin Plugin: Privilege Escalation Vulnerability (CVE-2026-18432) |
| 532180 | WordPress Podlove Podcast Publisher Plugin: PHP Object Injection Vulnerability (CVE-2026-16099) |
| 532193 | WordPress WPAdverts Plugin: Missing Authorization Vulnerability (CVE-2026-11801) |
| 532194 | WordPress Solace Extra Plugin: Missing Authorization Vulnerability (CVE-2026-18316) |
| 532195 | WordPress Paymob for WooCommerce Plugin: SQL Injection Vulnerability (CVE-2026-15205) |
| 532196 | WordPress Bookly Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-13424) |
| 532197 | WordPress Gallery by BestWebSoft Plugin: SQL Injection Vulnerability (CVE-2026-2497) |
| 532198 | WordPress Wishlist Member X Plugin: Account Takeover Vulnerability (CVE-2026-12949) |
What’s Next
Leverage the QID list to guide your remediation efforts and strengthen your risk posture.
Looking for more context or remediation tips? See Qualys KnowledgeBase for detailed analysis, actionable guidance, and expert-backed support.