Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 1003 of 1013.
- CVE-2026-100525 OpenClaw diagnostics-prometheus before 2026.9.3 Authentication Bypass
- CVE-2026-100524 Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager
- CVE-2026-100523 Cotonti through 1.0.0 Open Redirect via message.php redirect parameter
- CVE-2026-100522 Cotonti through 1.0.0 Reflected XSS via message.php lng parameter
- CVE-2026-100521 Cotonti through 1.0.0 Reflected XSS via search highlight parameter
- CVE-2026-100520 Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint
- CVE-2026-10052 Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpoints
- CVE-2026-100518 WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability
- CVE-2026-100517 WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-100515 WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-100514 WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-100513 Cross-site scripting in CF7 Views – Complete Entry Management for Contact Form 7
- CVE-2026-100512 WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability
- CVE-2026-100511 WordPress VK Google Job Posting Manager plugin <= 1.3.1 - PHP Object Injection vulnerability
- CVE-2026-100510 WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-10051 Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections
- CVE-2026-100509 WordPress RepairBuddy plugin <= 4.1225 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-100508 WordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerability
- CVE-2026-100507 WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-100506 WordPress WP Spell Check plugin <= 12.1 - PHP Object Injection vulnerability
- CVE-2026-100505 Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager
- CVE-2026-100504 Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128
- CVE-2026-100503 Ghidra through 12.1.4 Heap Use-After-Free in Decompiler
- CVE-2026-100502 Flame through 2.4.0 Admin Token Insufficient Session Expiration
- CVE-2026-100501 Flame through 2.4.0 Brute-Force Attack via Login Endpoint
- CVE-2026-10050 Digest authentication lossy encoding
- CVE-2026-1005 Integer underflow leads to out-of-bounds access in sniffer AES-GCM/CCM/ARIA-GCM decrypt path
- CVE-2026-10047 Out-of-bounds write in Napoca real-mode hook handler via guest-controlled SS:SP (VA-13905)
- CVE-2026-10046 Out-of-bounds write in Napoca BIOS INT 0x15 E820 memory map handler (VA-13905)
- CVE-2026-10045 CVE-2026-10045
- CVE-2026-10044 ai-goofish-monitor Unauthenticated Arbitrary File Read via GET /api/prompts/
- CVE-2026-10043 MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2026-100420 Information disclosure vulnerability in the cloud-client daemon of Deco BE63
- CVE-2026-10042 manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model
- CVE-2026-100419 gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink
- CVE-2026-100418 Flame through 2.4.0 Information Exposure via GET /api/config
- CVE-2026-100417 RustDesk before 1.5.0 One-Way File Transfer Bypass
- CVE-2026-100413 SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments
- CVE-2026-10041 Missing authorization in WCFM – Frontend Manager for WooCommerce
- CVE-2026-100409 OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
- CVE-2026-100406 dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`
- CVE-2026-100404 Zulip: Guests can read new messages in non-subscribed public channels
- CVE-2026-1004 Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure
- CVE-2026-100394 Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant
- CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)
- CVE-2026-100391 MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation
- CVE-2026-100390 Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6
- CVE-2026-10039 Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter
- CVE-2026-100389 GestSup before 3.2.62 Remote Code Execution via IMAP Attachment
- CVE-2026-100388 RustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard Messages
- CVE-2026-100387 pgPointcloud through 1.2.5 heap out-of-bounds read via WKB deserialization
- CVE-2026-100383 Stored i18n XSS in WikiLambda's VisualEditor integration
- CVE-2026-100382 Unauthenticated remote code execution through wikitext in ExternalData
- CVE-2026-100381 UploadWizard Flickr collection and set titles allow DOM XSS
- CVE-2026-100380 Reflected XSS in Wikibase Special:SetLabel language validation
- CVE-2026-10038 Missing authorization in Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
- CVE-2026-100379 Cross-request disclosure of CentralAuth cookies in Wikipedia Android App
- CVE-2026-100378 Missing permission check in the Translate sandbox doRemind action
- CVE-2026-100377 Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract
- CVE-2026-100376 TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix
- CVE-2026-100373 OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass
- CVE-2026-100372 ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.php
- CVE-2026-100371 Missing authorization in InvoicePlane
- CVE-2026-100370 Cross-site scripting in dom-sanitizer
- CVE-2026-10037 Sandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal
- CVE-2026-100369 CliInvoke: Argument Injection in Extensibility Runner Factory
- CVE-2026-100368 CliInvoke.Specializations: Command injection in PowerShell and Cmd shell wrappers
- CVE-2026-10036 SpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing
- CVE-2026-100354 kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash
- CVE-2026-100353 kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
- CVE-2026-100352 kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
- CVE-2026-100351 kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
- CVE-2026-100350 kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
- CVE-2026-10035 Turnkey bbPress by WeaverTheme <= 1.7.1 - Authenticated (Administrator+) PHP Object Injection
- CVE-2026-100349 kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
- CVE-2026-100348 kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)
- CVE-2026-100347 kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path
- CVE-2026-10034 Missing authorization in WP DSGVO Tools (GDPR)
- CVE-2026-10033 Missing authorization in EventON Action User
- CVE-2026-10032 Arbitrary JavaScript Execution via openUrl in @a2ui/web_core
- CVE-2026-100316 Cross-site scripting in European VAT Compliance Assistant for WooCommerce
- CVE-2026-100315 mathurvishal CloudClassroom-PHP-Project mydetailsfaculty.php sql injection
- CVE-2026-100314 mathurvishal CloudClassroom-PHP-Project updatedetailsfromstudent.php sql injection
- CVE-2026-100313 mathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting
- CVE-2026-100312 mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection
- CVE-2026-100311 mathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scripting
- CVE-2026-100310 GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX
- CVE-2026-10031 SFTPGo < 2.7.4 Permission Bypass via Symbolic Link Creation
- CVE-2026-100308 GluonTS arbitrary command execution during model deserialization
- CVE-2026-100306 TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement
- CVE-2026-100305 TDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission Endpoint
- CVE-2026-100304 TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check
- CVE-2026-100303 TDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints
- CVE-2026-10030 IBM MQ Console is vulnerable to privilege escalation
- CVE-2026-1003 Missing authorization in GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools
- CVE-2026-100299 Use of Weak Credentials in Anjvision YSSD-RTMP-H5
- CVE-2026-100298 Insufficiently Protected Credentials in Anjvision YSSD-RTMP-H5
- CVE-2026-100297 Server-Side request forgery (SSRF) in Anjvision YSSD-RTMP-H5
- CVE-2026-100296 Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5
- CVE-2026-100295 Active debug code in Anjvision YSSD-RTMP-H5