Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 220 of 1013.
- CVE-2026-97241 WordPress BackupEase plugin <= 2.2.2 - Sensitive Data Exposure vulnerability
- CVE-2026-97240 WordPress StifLi Backup Tools plugin <= 2.2.7 - Sensitive Data Exposure vulnerability
- CVE-2026-9724 MotorDesk <= 1.1.2 - Cross-Site Request Forgery to Settings Update
- CVE-2026-97239 WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability
- CVE-2026-97238 WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97237 WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97236 WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97235 WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97233 volotat Anagnorisis Media Filename PlaylistManager.js html cross site scripting
- CVE-2026-97232 volotat Anagnorisis page.html start_streaming path traversal
- CVE-2026-97231 volotat Anagnorisis Socket.IO Connect app.py missing authentication
- CVE-2026-97230 IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL.
- CVE-2026-9723 Google Plus One Bottom <= 0.0.2 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page
- CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound
- CVE-2026-97228 Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup
- CVE-2026-97227 NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion
- CVE-2026-97226 DbGate files-style Endpoint files.js fs.readFile path traversal
- CVE-2026-97225 DbGate JSON Runner runners.js code injection
- CVE-2026-97224 Excalidraw Imported File restore.ts cross site scripting
- CVE-2026-97222 Gnumeric: gnumeric: heap use-after-free when opening a malformed workbook
- CVE-2026-9722 Laiser Tag <= 1.2.5 - Cross-Site Request Forgery to Plugin Settings Update via Settings Form
- CVE-2026-97219 MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter
- CVE-2026-97212 Monta monta.app Insufficient Session Expiration
- CVE-2026-9721 Book a Room Event Calendar <= 1.9 - Cross-Site Request Forgery to Settings Update
- CVE-2026-97208 Gitea push mirror API bypass of DISABLE_NEW_PUSH policy
- CVE-2026-97206 DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
- CVE-2026-97205 NGINX ngx_http_core_module vulnerability
- CVE-2026-97204 Gitea label deletion across repository and organization IDs
- CVE-2026-97200 Unbounded response body buffering and decompression in hackney
- CVE-2026-9720 Facturación Electrónica Costa Rica <= 2.0.2 - Cross-Site Request Forgery to Plugin Settings Update
- CVE-2026-97197 WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability
- CVE-2026-97196 WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability
- CVE-2026-9719 LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action
- CVE-2026-97188 String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor
- CVE-2026-97185 Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file
- CVE-2026-97183 WP-Invoice <= 4.3.1 - Subscriber+ User PII Disclosure via Unprotected AJAX Handlers
- CVE-2026-97182 halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization
- CVE-2026-97181 ezGlobal｜GPM LIGHT - Sensitive Data Exposure
- CVE-2026-9718 Denial of service in PowerLogic™ P7
- CVE-2026-97179 O2OA Cipher Connection CipherConnectionAction.java list information disclosure
- CVE-2026-97177 Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission
- CVE-2026-97176 Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator
- CVE-2026-9717 Command injection in PowerLogic™ P7
- CVE-2026-97165 Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0
- CVE-2026-97164 Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0
- CVE-2026-97163 Path traversal in UP plugin for Joomla
- CVE-2026-97162 Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
- CVE-2026-97161 Path traversal in UP plugin for Joomla
- CVE-2026-97160 Code injection in UP plugin for Joomla
- CVE-2026-9716 Null dereference in PowerLogic™ P7
- CVE-2026-97155 Security feature bypass in Folio Client
- CVE-2026-97152 Memory corruption in Nanomsg
- CVE-2026-97151 Code injection in mammoth.js
- CVE-2026-97150 Code injection in BcAddonMigrator
- CVE-2026-97149 Security feature bypass in Swift
- CVE-2026-97147 Missing authorization in Mistral
- CVE-2026-97146 Apache YuniKorn: Admission control bypass via system label forgery
- CVE-2026-9714 Simple Divi Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
- CVE-2026-9713 SQL injection in Product Designer for WooCommerce WordPress | Lumise
- CVE-2026-9712 Insecure direct object reference
- CVE-2026-9711 EventON - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter
- CVE-2026-9710 Themeco Cornerstone < 7.8.8 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Password Hash Disclosure
- CVE-2026-9709 Themeco Cornerstone < 7.8.9 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Meta Disclosure
- CVE-2026-9708 Incoming webhook user attribution via unvalidated webhook owner
- CVE-2026-97079 WordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-97078 Missing authorization in Client Invoicing by Sprout Invoices
- CVE-2026-97077 WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97076 WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerability
- CVE-2026-97075 WordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerability
- CVE-2026-97074 Missing authorization in Newsletters, Email Marketing, SMS and Popups by Omnisend
- CVE-2026-97073 WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability
- CVE-2026-97071 WordPress CURCY plugin <= 2.2.17 - Broken Access Control vulnerability
- CVE-2026-97070 WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-97067 WordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97066 WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-97065 WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97064 X-SpringBoot through 6.0 Authentication Bypass via Static Master Code
- CVE-2026-97063 X-SpringBoot through 6.0 Authentication Bypass via Login Code
- CVE-2026-97062 Aureus ERP 1.6.0 Stored XSS via SVG File Upload
- CVE-2026-97061 Black Candy through 3.2.1 Information Disclosure via Playlist Search
- CVE-2026-97060 X-SpringBoot through 6.0 Authorization Bypass via User Management
- CVE-2026-97059 DCMTK through 3.7.0 Heap Over-read via NumberOfFrames
- CVE-2026-97057 redis-parser through 3.0.0 Denial of Service via Invalid Array Length
- CVE-2026-97056 SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass
- CVE-2026-97055 SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret
- CVE-2026-9705 Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token
- CVE-2026-97045 Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
- CVE-2026-9704 Keycloak: keycloak: privilege escalation due to oversized subject_token jwt
- CVE-2026-97032 HTTP/2 server crash due to HPACK encoder race in net/http
- CVE-2026-97031 Reject malformed ECH outer extension references in crypto/tls
- CVE-2026-97030 Recognize yield as regexp preceder keyword in html/template
- CVE-2026-9703 Viewer role can create, modify and delete Loki alerting rules
- CVE-2026-97029 Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group
- CVE-2026-97027 Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files
- CVE-2026-97026 Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path
- CVE-2026-97025 Flatpak: flatpak: world-readable oci authentication token in system-helper cache path
- CVE-2026-97024 Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc
- CVE-2026-97023 Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin
- CVE-2026-97020 PO/MO Editor <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter
- CVE-2026-9702 InPost PL < 1.9.1 - Unauthenticated WooCommerce Order Parcel-Locker Hijacking