Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 1008 of 1013.
- CVE-2026-0752 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-0751 Cross-site scripting in Payment Page | Payment Form for Stripe
- CVE-2026-0750 Payment bypass in Commerce Paybox
- CVE-2026-0749 Cross-Site Scripting Vulnerability in Drupal Form Builder Module
- CVE-2026-0748 Access bypass in Drupal 7 i18n_node translation UI
- CVE-2026-0747 Information disclosure in Remote Desktop Manager
- CVE-2026-0746 AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery
- CVE-2026-0745 Server-side request forgery in User Language Switch
- CVE-2026-0743 WP Content Permission <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ohmem-message' Parameter
- CVE-2026-0742 Cross-site scripting in Smart Appointment & Booking
- CVE-2026-0741 Cross-site scripting in Electric Studio Download Counter
- CVE-2026-0740 Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
- CVE-2026-0739 WMF Mobile Redirector <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters
- CVE-2026-0738 Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode
- CVE-2026-0737 Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode
- CVE-2026-0736 Cross-site scripting in Chatbot for WordPress by Collect.chat ⚡️
- CVE-2026-0735 Cross-site scripting in User Language Switch
- CVE-2026-0734 WP Allowed Hosts <= 1.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'allowed-hosts' Parameter
- CVE-2026-0733 PHPGurukul Online Course Registration System manage-students.php sql injection
- CVE-2026-0732 D-Link DI-8200G upgrade_filter.asp command injection
- CVE-2026-0731 TOTOLINK WA1200 HTTP Request cstecgi.cgi null pointer dereference
- CVE-2026-0730 PHPGurukul Staff Leave Management System SVG File adminviews.py UPDATE_STAFF cross site scripting
- CVE-2026-0729 code-projects Intern Membership Management System add_activity.php sql injection
- CVE-2026-0728 code-projects Intern Membership Management System delete_admin.php sql injection
- CVE-2026-0727 Missing authorization in Accordion and Accordion Slider
- CVE-2026-0726 Deserialization in Nexter Extension – Security, Performance, Code Snippets & Site Toolkit
- CVE-2026-0725 Cross-site scripting in Integrate Dynamics 365 CRM
- CVE-2026-0724 Cross-site scripting in WPlyr Media Block
- CVE-2026-0723 Unchecked Return Value in GitLab
- CVE-2026-0722 Shield Security <= 21.0.8 - Cross-Site Request Forgery to SQL Injection
- CVE-2026-0719 Libsoup: signed to unsigned conversion error leading to stack-based buffer overflow in libsoup ntlm authentication
- CVE-2026-0718 Missing authorization in Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX
- CVE-2026-0717 LottieFiles – Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information Exposure
- CVE-2026-0716 Libsoup: out-of-bounds read in libsoup websocket frame processing
- CVE-2026-0715 Information disclosure in UC-1200A Series
- CVE-2026-0714 Information disclosure in UC-1200A Series
- CVE-2026-0711 Command injection in DX3300-T0 firmware
- CVE-2026-0710 Sipp/sipp: sipp: denial of service and potential arbitrary code execution vulnerability
- CVE-2026-0709 Command injection in DS-3WAP521-SI
- CVE-2026-0708 Libucl: libucl: denial of service via embedded null byte in ucl input
- CVE-2026-0707 Keycloak: keycloak authorization header parsing leading to potential security control bypass
- CVE-2026-0705 Privilege escalation in Acronis Cloud Manager
- CVE-2026-0704 Path traversal in Octopus Server
- CVE-2026-0703 Cross-site scripting in NextMove Lite – Thank You Page for WooCommerce
- CVE-2026-0702 VidShop – Shoppable Videos for WooCommerce <= 1.1.4 - Unauthenticated Time-Based SQL Injection via 'fields'
- CVE-2026-0701 code-projects Intern Membership Management System add_admin.php sql injection
- CVE-2026-0700 code-projects Intern Membership Management System check_admin.php sql injection
- CVE-2026-0699 code-projects Intern Membership Management System edit_activity.php sql injection
- CVE-2026-0698 code-projects Intern Membership Management System edit_students.php sql injection
- CVE-2026-0697 code-projects Intern Membership Management System edit_admin.php sql injection
- CVE-2026-0696 Session Cookies Missing HttpOnly Attribute
- CVE-2026-0695 Stored XSS in Time Entry Audit Trail
- CVE-2026-0694 SearchWiz <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
- CVE-2026-0693 Cross-site scripting in Allow HTML in Category Descriptions
- CVE-2026-0692 Missing authorization in BlueSnap Payment Gateway for WooCommerce
- CVE-2026-0691 CM E-Mail Blacklist <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' Parameter
- CVE-2026-0690 Cross-site scripting in FlatPM – Ad Manager, AdSense and Custom Code
- CVE-2026-0689 XIQ‑SE NAC Admin Credential Exposure via HTTP Response
- CVE-2026-0688 Webmention <= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery
- CVE-2026-0687 Meta-box GalleryMeta <= 3.0.1 - Missing Authorization to Authenticated (Author+) Gallery Management
- CVE-2026-0686 Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery
- CVE-2026-0685 Server side template inject (SSTI) in Edgewall Genshi Template Engine
- CVE-2026-0684 CP Image Store with Slideshow <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Product Import
- CVE-2026-0683 SQL injection in SupportCandy – Helpdesk & Customer Support Ticket System
- CVE-2026-0682 Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter
- CVE-2026-0681 Extended Random Number Generator <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
- CVE-2026-0680 Real Post Slider Lite <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
- CVE-2026-0679 Missing authorization in Fortis for WooCommerce
- CVE-2026-0678 Shipping Rates by City for WooCommerce <= 1.0.3 - Authenticated (Shop Manager+) SQL Injection via 'cities' Parameter
- CVE-2026-0677 WordPress TotalContest Lite plugin <= 2.9.1 - PHP Object Injection vulnerability
- CVE-2026-0676 WordPress Zorka theme <= 1.5.7 - Broken Access Control vulnerability
- CVE-2026-0674 WordPress Campaign Monitor for WordPress plugin <= 2.9.1 - Broken Access Control vulnerability
- CVE-2026-0673 Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection
- CVE-2026-0672 Header injection in http.cookies.Morsel
- CVE-2026-0671 Multiple stored i18n/message-key XSSes in UploadWizard
- CVE-2026-0670 Stored XSS through a system message and a user-provided parameter in ProofreadPage
- CVE-2026-0669 Path Traversal vulnerability in CSS extension on certain web servers
- CVE-2026-0668 VisualData extension: Regular Expression Denial of Service (ReDoS) via crafted user input
- CVE-2026-0667 Other in RemoteConnect
- CVE-2026-0665 Qemu-kvm: heap off-by-one in kvm xen physdevop_map_pirq
- CVE-2026-0664 Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass
- CVE-2026-0663 Denial of Service condition in M-Files Server
- CVE-2026-0662 Untrusted Search Path Vulnerability when opening max Files
- CVE-2026-0661 Out-of-Bounds Write in RGB File Parsing
- CVE-2026-0660 Stack Based Buffer Overflow in GIF File Parsing
- CVE-2026-0659 USD File Parsing Out-of-Bounds Write Vulnerability
- CVE-2026-0658 Five Star Restaurant Reservations < 2.7.9 - Arbitrary Bookings Deletion via CSRF
- CVE-2026-0656 Missing authorization in iPaymu Payment Gateway for WooCommerce
- CVE-2026-0655 Path Traversal on TP-Link Deco BE25
- CVE-2026-0654 Command injection on TP-Link Deco BE25
- CVE-2026-0653 Insecure Access Control on TP-Link Tapo D235 and C260
- CVE-2026-0652 Remote Code Execution on TP-Link Tapo C260 by Guest User
- CVE-2026-0651 Path Traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local https
- CVE-2026-0650 OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization
- CVE-2026-0649 invoiceninja Migration Import Import.php copy server-side request forgery
- CVE-2026-0648 Memory corruption in Eclipse ThreadX
- CVE-2026-0647 Rockwell Automation FLEX I/O Dual-port EtherNet/IP Adapters – Multiple Vulnerabilities
- CVE-2026-0646 Rockwell Automation FLEX I/O Dual-port EtherNet/IP Adapters – Multiple Vulnerabilities
- CVE-2026-0643 projectworlds House Rental and Property Listing Signup register.php unrestricted upload
- CVE-2026-0642 projectworlds House Rental and Property Listing complaint.php cross site scripting