Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 1009 of 1013.
- CVE-2026-0641 TOTOLINK WA300 cstecgi.cgi sub_401510 command injection
- CVE-2026-0640 Tenda AC23 PowerSaveSet sscanf buffer overflow
- CVE-2026-0639 liteos_a has a missing release of memory vulnerability
- CVE-2026-0637 Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products
- CVE-2026-0636 LDAP Injection Vulnerability in LDAPStoreHelper.java
- CVE-2026-0635 Missing authorization in Responsive Accordion Slider
- CVE-2026-0634 Code Execution in AssistFeedbackService on TECNO Pova7 Pro 5G
- CVE-2026-0633 Auth bypass in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- CVE-2026-0632 Fluent Forms Pro Add On Pack <= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource'
- CVE-2026-0631 Authenticated Command Injection Vulnerability in Surfshark VPN Login in multiple Archer products
- CVE-2026-0630 Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and AXE75 v1.0
- CVE-2026-0629 Authentication Bypass in Password Recovery Feature via Local Web App on Multiple VIGI Cameras
- CVE-2026-0628 Missing authorization in Chrome
- CVE-2026-0627 AMP for WP <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2026-0626 WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode
- CVE-2026-0625 D-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint
- CVE-2026-0622 Open 5GS WebUI uses a hard-coded JWT signing key
- CVE-2026-0621 MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS
- CVE-2026-0620 L2TP over IPSec Encryption Failure on ArcherAXE75
- CVE-2026-0619 Integer Wraparound DoS in Silicon Labs Matter Implementation
- CVE-2026-0618 Cross-site scripting in PowerShell Universal
- CVE-2026-0617 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting
- CVE-2026-0616 CVE-2026-0616
- CVE-2026-0615 CVE-2026-0615
- CVE-2026-0613 CVE-2026-0613
- CVE-2026-0612 CVE-2026-0612
- CVE-2026-0611 Spacelabs Healthcare Sentinel 10.5.x < 11.6.0 Unauthenticated RCE via .NET Remoting
- CVE-2026-0610 SQL injection in Server
- CVE-2026-0609 Logo Slider <= 4.9.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'logo-slider' Shortcode
- CVE-2026-0608 Head Meta Data <= 20251118 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta
- CVE-2026-0607 code-projects Online Music Site AdminViewSongs.php sql injection
- CVE-2026-0606 code-projects Online Music Site Albums.php sql injection
- CVE-2026-0605 code-projects Online Music Site login.php sql injection
- CVE-2026-0604 FastDup <= 2.7 - Authenticated (Contributor+) Path Traversal via 'dir_path' REST Parameter
- CVE-2026-0603 Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection
- CVE-2026-0602 Authentication Bypass Using an Alternate Path or Channel in GitLab
- CVE-2026-0601 Nexus Repository 3 - Cross-Site Scripting
- CVE-2026-0600 Nexus Repository 3 - Server-Side Request Forgery in Proxy Repository Configuration
- CVE-2026-0599 Unbounded External Image Fetch in Validation Leads to Resource-Exhaustion DoS in huggingface/text-generation-inference
- CVE-2026-0598 Missing authorization in Red Hat Ansible Automation Platform 2
- CVE-2026-0597 Campcodes Supplier Management System edit_profile.php sql injection
- CVE-2026-0596 Command Injection in mlflow/mlflow
- CVE-2026-0595 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-0594 List Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alpha
- CVE-2026-0593 Missing authorization in WP Go Maps (formerly WP Google Maps)
- CVE-2026-0592 code-projects Online Product Reservation System User Registration register_code.php sql injection
- CVE-2026-0591 code-projects Online Product Reservation System Cart Update update.php sql injection
- CVE-2026-0590 code-projects Online Product Reservation System POST Parameter delete.php sql injection
- CVE-2026-0589 code-projects Online Product Reservation System Administration Backend improper authentication
- CVE-2026-0588 Xinhu Rainrock RockOA API rockfun.php cross site scripting
- CVE-2026-0587 Xinhu Rainrock RockOA Cover Image rock_page_gong.php cross site scripting
- CVE-2026-0586 code-projects Online Product Reservation System prod.php cross site scripting
- CVE-2026-0585 code-projects Online Product Reservation System GET Parameter order_view.php sql injection
- CVE-2026-0584 code-projects Online Product Reservation System left_cart.php sql injection
- CVE-2026-0583 code-projects Online Product Reservation System User Login login.php sql injection
- CVE-2026-0582 itsourcecode Society Management System edit_activity_query.php sql injection
- CVE-2026-0581 Tenda AC1206 httpd BehaviorManager formBehaviorManager command injection
- CVE-2026-0580 SourceCodester API Key Manager App Import Key cross site scripting
- CVE-2026-0579 code-projects Online Product Reservation System POST Parameter edit.php sql injection
- CVE-2026-0578 code-projects Online Product Reservation System delete.php sql injection
- CVE-2026-0577 code-projects Online Product Reservation System prod.php unrestricted upload
- CVE-2026-0576 code-projects Online Product Reservation System Parameter prod.php sql injection
- CVE-2026-0575 code-projects Online Product Reservation System Administrator Login adminlogin.php sql injection
- CVE-2026-0574 yeqifu warehouse Request UserController.java saveUserRole improper authorization
- CVE-2026-0573 Open redirect in Enterprise Server
- CVE-2026-0572 Missing authorization in WebPurify Profanity Filter
- CVE-2026-0571 yeqifu warehouse AppFileUtils.java createResponseEntity path traversal
- CVE-2026-0570 code-projects Online Music Site Feedback.php sql injection
- CVE-2026-0569 code-projects Online Music Site AlbumByCategory.php sql injection
- CVE-2026-0568 code-projects Online Music Site ViewSongs.php sql injection
- CVE-2026-0567 code-projects Content Management System pages.php sql injection
- CVE-2026-0566 code-projects Content Management System edit_posts.php unrestricted upload
- CVE-2026-0565 code-projects Content Management System delete.php sql injection
- CVE-2026-0563 Cross-site scripting in WP Google Street View (with 360° virtual tour) & Google maps + Local SEO
- CVE-2026-0562 Insecure Direct Object Reference (IDOR) in parisneo/lollms
- CVE-2026-0561 Shield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter
- CVE-2026-0560 Server-Side Request Forgery (SSRF) in parisneo/lollms
- CVE-2026-0559 Cross-site scripting in MasterStudy LMS WordPress Plugin – for Online Courses and Education
- CVE-2026-0558 Unauthenticated File Upload in parisneo/lollms
- CVE-2026-0557 WP Data Access <= 5.5.63 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda_app' Shortcode
- CVE-2026-0556 XO Event Calendar <= 3.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xo_event_field' shortcode
- CVE-2026-0555 Cross-site scripting in Premmerce
- CVE-2026-0554 NotificationX <= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics Reset
- CVE-2026-0552 Cross-site scripting in Simple Shopping Cart
- CVE-2026-0551 PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles
- CVE-2026-0550 myCred <= 2.9.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode
- CVE-2026-0549 Groups <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcode
- CVE-2026-0548 Missing authorization in Tutor LMS – eLearning and online course solution
- CVE-2026-0547 PHPGurukul Online Course Registration Student Registration edit-student-profile.php unrestricted upload
- CVE-2026-0546 code-projects Content Management System search.php sql injection
- CVE-2026-0545 Missing Authentication for Critical Function in mlflow/mlflow
- CVE-2026-0544 itsourcecode School Management System index.php sql injection
- CVE-2026-0543 Improper Input Validation in Kibana Email Connector Leading to Excessive Allocation
- CVE-2026-0542 Remote Code Execution in ServiceNow AI Platform
- CVE-2026-0541 Privilege escalation in AXIS OS
- CVE-2026-0540 DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML
- CVE-2026-0539 Local Privilege Escalation in pcvisit service client
- CVE-2026-0538 GIF File Parsing Out-of-Bounds Write
- CVE-2026-0537 RGB File Parsing Memory Corruption
- CVE-2026-0536 GIF File Parsing Stack Based Buffer Overflow