Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 221 of 1013.
- CVE-2026-97019 AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute
- CVE-2026-97017 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-97016 Microsoft Office Outlook Remote Code Execution Vulnerability
- CVE-2026-97014 Microsoft Office Excel Information Disclosure Vulnerability
- CVE-2026-97012 Microsoft Office Outlook Remote Code Execution Vulnerability
- CVE-2026-97011 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-97010 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-9701 Eventer <= 4.4.2 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
- CVE-2026-97009 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-97008 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-97007 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-97005 Microsoft Office PowerPoint Information Disclosure Vulnerability
- CVE-2026-97004 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-97003 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-97001 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-9700 Eventer <= 4.4.2 - Unauthenticated SQL Injection via 'code' Parameter
- CVE-2026-96997 Microsoft Office OneNote Elevation of Privilege Vulnerability
- CVE-2026-96996 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-96995 Microsoft Office Word Elevation of Privilege Vulnerability
- CVE-2026-96990 Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound
- CVE-2026-9699 Mattermost Agents plugin logs unsanitized OpenAI API keys on authentication errors
- CVE-2026-9698 DBI versions before 1.648 for Perl saved errors in a limited-sized buffer
- CVE-2026-9697 undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
- CVE-2026-96962 Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code
- CVE-2026-96960 .NET Denial of Service Vulnerability
- CVE-2026-9696 Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
- CVE-2026-96959 .NET Denial of Service Vulnerability
- CVE-2026-96958 .NET Denial of Service Vulnerability
- CVE-2026-96957 .NET Security Feature Bypass Vulnerability
- CVE-2026-96956 SQL Server Elevation of Privilege Vulnerability
- CVE-2026-96953 Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerability
- CVE-2026-96952 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
- CVE-2026-96951 Microsoft Windows Command Injection
- CVE-2026-96950 Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
- CVE-2026-9695 Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026
- CVE-2026-96949 Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
- CVE-2026-96948 Windows Client Side Caching driver (csc.sys) Information Disclosure Vulnerability
- CVE-2026-96947 Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
- CVE-2026-96946 Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
- CVE-2026-96945 Windows Failover Cluster Denial of Service Vulnerability
- CVE-2026-96944 Windows Storage Information Disclosure Vulnerability
- CVE-2026-96943 Windows Raw Image Extension Remote Code Execution Vulnerability
- CVE-2026-96940 Microsoft Exchange Server Elevation of Privilege Vulnerability
- CVE-2026-9694 Improper Neutralization of Substitution Characters in GitLab
- CVE-2026-96939 Servicing Stack Updates Elevation of Privilege Vulnerability
- CVE-2026-96938 Windows Distributed File System (DFS) Elevation of Privilege Vulnerability
- CVE-2026-96937 Microsoft Windows Search Component Elevation of Privilege Vulnerability
- CVE-2026-96935 Windows NTFS Information Disclosure Vulnerability
- CVE-2026-96934 Windows DHCP Server Remote Code Execution Vulnerability
- CVE-2026-96933 Windows COM+ Event System Service Elevation of Privilege Vulnerability
- CVE-2026-96932 Windows Embedded Mode Service Elevation of Privilege Vulnerability
- CVE-2026-96931 Windows NTFS Elevation of Privilege Vulnerability
- CVE-2026-96930 Windows Universal Disk Format File System Driver (UDFS) Information Disclosure Vulnerability
- CVE-2026-9693 Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite
- CVE-2026-96929 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-96928 Windows NTFS Elevation of Privilege Vulnerability
- CVE-2026-96927 Windows NTFS Information Disclosure Vulnerability
- CVE-2026-96926 Role: DNS Server Tampering Vulnerability
- CVE-2026-96925 Windows NTFS Information Disclosure Vulnerability
- CVE-2026-96924 Windows OLE Remote Code Execution Vulnerability
- CVE-2026-96923 Windows Workstation Service Elevation of Privilege Vulnerability
- CVE-2026-96921 Windows Message Queuing Queue Manager Information Disclosure Vulnerability
- CVE-2026-96920 Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability
- CVE-2026-9692 Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely
- CVE-2026-96919 Windows Broadcast DVR User Service Elevation of Privilege Vulnerability
- CVE-2026-96918 Windows NTFS Elevation of Privilege Vulnerability
- CVE-2026-96917 Windows PCI Bus Driver Elevation of Privilege Vulnerability
- CVE-2026-96916 Windows NTFS Elevation of Privilege Vulnerability
- CVE-2026-96915 Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability
- CVE-2026-96914 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
- CVE-2026-96913 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-96912 Windows Client License Service Elevation of Privilege Vulnerability
- CVE-2026-96911 Microsoft Windows Search Component Elevation of Privilege Vulnerability
- CVE-2026-96910 Microsoft Windows Search Component Information Disclosure Vulnerability
- CVE-2026-9691 Deserialization in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms
- CVE-2026-96909 Windows BitLocker Remote Code Execution Vulnerability
- CVE-2026-96904 AWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Page
- CVE-2026-96903 Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers
- CVE-2026-96902 Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API
- CVE-2026-96901 Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token
- CVE-2026-96900 Missing authorization in Cart Abandonment Recovery for WooCommerce
- CVE-2026-9690 WordPress WP Media folder Addon plugin <= 4.0.1 - Arbitrary File Download vulnerability
- CVE-2026-96899 Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script
- CVE-2026-96898 yhx070424 ShopXO Ueditor Upload ueditor.php path traversal
- CVE-2026-96897 Missing authorization in Optima Express IDX
- CVE-2026-96896 Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request
- CVE-2026-96895 WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes
- CVE-2026-96893 Improper Neutralization of Input Used for LLM Prompting in GitLab
- CVE-2026-96892 Edimax BR-6428nC goform websRedirect redirect
- CVE-2026-96891 D-Link DIR-825 rp-l2tp tunnel.c tunnel_set_params out-of-bounds write
- CVE-2026-96890 Server-side request forgery in Enterprise Server
- CVE-2026-9689 Keycloak Services has Improper Validation of Consistency within Input
- CVE-2026-96889 Librsvg: use-after-free when xml includes have duplicated entities
- CVE-2026-96888 Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization
- CVE-2026-96886 Course Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV Export
- CVE-2026-96884 MantisZip Preview MainWindow.UI.cs Path.Combine path traversal
- CVE-2026-96883 Type confusion in AWS pgcollection allows remote code execution
- CVE-2026-96882 TaleLin lin-cms-spring-boot book Endpoint BookController.java searchBook improper authorization
- CVE-2026-96881 TaleLin lin-cms-spring-boot book Endpoint BookController.java getBooks improper authorization
- CVE-2026-96880 TaleLin lin-cms-spring-boot book Endpoint BookController.java getBook improper authorization