Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 219 of 1013.
- CVE-2026-97339 Cross-site scripting in Complianz GDPR/CCPA Cookie Consent Banner
- CVE-2026-97338 Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
- CVE-2026-97337 Missing authorization in Simple Membership
- CVE-2026-97336 CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type
- CVE-2026-97335 Incorrect authorization in LXD storage volume API allows reading volumes from other projects
- CVE-2026-97334 Network messaging layer decompression resource exhaustion
- CVE-2026-97333 QAPI stack-based buffer overflow
- CVE-2026-97332 User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)
- CVE-2026-97331 User Private Files < 2.1.9 - Subscriber+ User Email Address Disclosure via dpk_upvf_rmv_access
- CVE-2026-9733 Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter
- CVE-2026-97328 WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser
- CVE-2026-97326 songxinjianqwe Chat chat-server ChatServer.java server-side request forgery
- CVE-2026-97325 YunaiV/zhijiantianya ruoyi-vue-pro OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirect
- CVE-2026-97324 Missing authorization in ruoyi-vue-pro
- CVE-2026-97323 YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal
- CVE-2026-97322 YunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting
- CVE-2026-97321 SQL injection in ruoyi-vue-pro
- CVE-2026-97320 Server-side request forgery in ruoyi-vue-pro
- CVE-2026-9732 EmergencyWP <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update
- CVE-2026-97319 PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block
- CVE-2026-97318 Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated Stored Open Redirect via 'parent_url' Parameter
- CVE-2026-97317 Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page
- CVE-2026-97316 Broken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated SSRF via Redirect Bypass
- CVE-2026-97315 Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email
- CVE-2026-97314 Information disclosure in ThirstyAffiliates
- CVE-2026-97313 Specific RPZ configurations and query patterns may result in an unexpected exit
- CVE-2026-97312 Photoshop Desktop | Out-of-bounds Write (CWE-787)
- CVE-2026-97311 Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization
- CVE-2026-9731 Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update
- CVE-2026-97309 WordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerability
- CVE-2026-97308 WordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerability
- CVE-2026-97307 WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability
- CVE-2026-97305 WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-97304 WordPress Timetics plugin <= 1.0.63 - Broken Access Control vulnerability
- CVE-2026-97303 WordPress Scratch & Win – Giveaways and Contests plugin <= 3.0.2 - Broken Access Control vulnerability
- CVE-2026-97302 WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerability
- CVE-2026-97301 WordPress Cool Formkit Lite plugin <= 2.7.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97300 WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability
- CVE-2026-9730 Remove NoFollow Commenter URL <= 1.0 - Cross-Site Request Forgery to Settings Update
- CVE-2026-97299 WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-97298 WordPress King Addons for Elementor plugin <= 51.1.86 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97297 WordPress Gratisfaction plugin <= 4.6.3 - Broken Access Control vulnerability
- CVE-2026-97296 WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability
- CVE-2026-97295 WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-97294 WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97293 WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability
- CVE-2026-97292 WordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97291 WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability
- CVE-2026-97290 Cross-site scripting in Photonic Gallery & Lightbox for Flickr, SmugMug & Others
- CVE-2026-9729 Cross-site scripting in Web Push Notifications – Webpushr
- CVE-2026-97289 WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97288 WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97287 WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability
- CVE-2026-97286 WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97285 WordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerability
- CVE-2026-97284 WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability
- CVE-2026-97283 WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability
- CVE-2026-97282 WordPress Review Schema plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-97281 WordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerability
- CVE-2026-97280 WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability
- CVE-2026-9728 TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory
- CVE-2026-97279 WordPress Polylang plugin <= 3.8.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97278 WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability
- CVE-2026-97277 WordPress Social Boost plugin <= 3.6.2 - Broken Access Control vulnerability
- CVE-2026-97276 WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97275 Business logic in BuildKit – Product Builder for WooCommerce – Custom PC Builder
- CVE-2026-97274 WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability
- CVE-2026-97273 WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97272 WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97271 WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97270 WordPress CMB2 plugin <= 2.13.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97269 WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-97268 WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97267 WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability
- CVE-2026-97266 WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97265 WordPress JetEngine plugin <= 3.8.15.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97264 WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97263 WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97262 WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97261 WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability
- CVE-2026-97260 WordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-9726 Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038
- CVE-2026-97259 WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-97258 WordPress Aruba Migration Tool plugin <= 1.0.4 - Broken Access Control vulnerability
- CVE-2026-97257 WordPress Simple Event Planner plugin <= 1.5.7 - PHP Object Injection vulnerability
- CVE-2026-97256 WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability
- CVE-2026-97255 WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-97254 WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97253 WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97251 Missing authorization in Bus Ticket Booking with Seat Reservation
- CVE-2026-97250 WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-9725 Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Deletion
- CVE-2026-97249 WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability
- CVE-2026-97248 WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability
- CVE-2026-97247 WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability
- CVE-2026-97246 WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability
- CVE-2026-97245 WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability
- CVE-2026-97244 WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability
- CVE-2026-97243 WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability
- CVE-2026-97242 WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerability