Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 222 of 1013.
- CVE-2026-96879 "Checked by" label in page history should not be shown if the underlying review log entry is suppressed"
- CVE-2026-96878 Cargo Exhibit field alias allows stored XSS
- CVE-2026-96877 Reflected XSS through Cargo Drilldown full-text search
- CVE-2026-96876 Anonymous reflected XSS in CargoExport invalid-alias errors
- CVE-2026-96875 Reflected XSS in Cargo Drilldown hierarchy filters
- CVE-2026-96874 Stored XSS in Cargo Drilldown tab names
- CVE-2026-96873 Reflected XSS in CirrusSearch debug explain output
- CVE-2026-96872 WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions
- CVE-2026-96871 Mang Board <= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter
- CVE-2026-96870 SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
- CVE-2026-96869 Information disclosure in the Networking component
- CVE-2026-96868 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-96867 Windows NTFS Remote Code Execution Vulnerability
- CVE-2026-96866 Network Device Enrollment Service (NDES) Denial of Service Vulnerability
- CVE-2026-96865 Windows Secure Kernel Mode Information Disclosure Vulnerability
- CVE-2026-96864 Microsoft Failover Cluster Virtual Driver Remote Code Execution Vulnerability
- CVE-2026-96863 Windows Storage Port Driver Elevation of Privilege Vulnerability
- CVE-2026-96862 Windows Spaceport.sys Elevation of Privilege Vulnerability
- CVE-2026-96861 Network Device Enrollment Service (NDES) Denial of Service Vulnerability
- CVE-2026-96860 Windows USB Print Driver Information Disclosure Vulnerability
- CVE-2026-96859 Windows Imaging Component Information Disclosure Vulnerability
- CVE-2026-96858 Windows Security Account Manager Tampering Vulnerability
- CVE-2026-96857 Windows Projected File System Information Disclosure Vulnerability
- CVE-2026-96856 Windows Management Instrumentation Elevation of Privilege Vulnerability
- CVE-2026-96855 Windows Modern Device Management (MDM) Tampering Vulnerability
- CVE-2026-96854 Windows Device Association Service Information Disclosure Vulnerability
- CVE-2026-96853 Windows Win32 Kernel Subsystem Information Disclosure Vulnerability
- CVE-2026-96852 Windows TCP/IP Elevation of Privilege Vulnerability
- CVE-2026-96851 Windows Management Instrumentation Information Disclosure Vulnerability
- CVE-2026-96850 Windows Modern Device Management (MDM) Information Disclosure Vulnerability
- CVE-2026-96849 Windows Kernel-Mode Drivers Information Disclosure Vulnerability
- CVE-2026-96848 Windows Win32 Kernel Subsystem Information Disclosure Vulnerability
- CVE-2026-96847 WebDAV Elevation of Privilege Vulnerability
- CVE-2026-96846 WebDAV Information Disclosure Vulnerability
- CVE-2026-96844 Microsoft Bluetooth Driver Elevation of Privilege Vulnerability
- CVE-2026-96843 WebDAV Elevation of Privilege Vulnerability
- CVE-2026-96840 Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field
- CVE-2026-96838 Cross-site request forgery in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification
- CVE-2026-96837 WordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerability
- CVE-2026-96836 WordPress Parsi Date plugin <= 6.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-96835 WordPress King Addons for Elementor plugin <= 51.1.85 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-96834 WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability
- CVE-2026-96833 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability
- CVE-2026-96832 WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability
- CVE-2026-96831 WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability
- CVE-2026-96830 WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-96829 WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-96828 WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability
- CVE-2026-96827 WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability
- CVE-2026-96826 WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability
- CVE-2026-96825 WordPress All In One WP Security & Firewall plugin <= 5.4.8 - Bypass Vulnerability vulnerability
- CVE-2026-96824 WordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary File Deletion vulnerability
- CVE-2026-96823 WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability
- CVE-2026-96822 WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability
- CVE-2026-96821 WordPress FluentBoards plugin <= 2.0.12 - Privilege Escalation vulnerability
- CVE-2026-96820 WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-96819 WordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-96818 WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability
- CVE-2026-96817 WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability
- CVE-2026-96816 WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-96815 WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerability
- CVE-2026-96814 WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-96813 Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields
- CVE-2026-96812 Host Root Sandbox Escape in gVisor via Character Device Passthrough and CUSE
- CVE-2026-96810 huanzi-qch base-admin Add User CommonController.java save cross site scripting
- CVE-2026-96809 WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability
- CVE-2026-96808 Privilege escalation in Flatpak
- CVE-2026-96807 Path traversal in Flatpak
- CVE-2026-96806 Auth bypass in Apache Airflow Keycloak provider
- CVE-2026-96804 CVE-2026-96804
- CVE-2026-96803 java110 MicroCommunity fallBack API Endpoint BusinessApi.java QueryServiceSMOImpl.fallBack sql injection
- CVE-2026-9680 MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server
- CVE-2026-96795 Horilla: Authenticated RCE in Horilla List-View Export
- CVE-2026-9679 undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
- CVE-2026-96780 figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
- CVE-2026-9678 undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
- CVE-2026-96778 Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
- CVE-2026-96777 Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injection
- CVE-2026-96775 MLflow dspy bypasses pickle deserialization control
- CVE-2026-96774 Information disclosure in IP Network Audio Device XC-9603
- CVE-2026-96773 Intelliants Subrion CMS Login Page login.php authorize redirect
- CVE-2026-96772 Intelliants Subrion CMS actions.json assign-owner information disclosure
- CVE-2026-96770 s2s-proxy accepts untrusted client certificates
- CVE-2026-9677 Shariff for WordPress <= 1.0.11 - Admin+ Stored Cross-Site Scripting
- CVE-2026-96768 GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body
- CVE-2026-96767 NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header
- CVE-2026-96766 GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter
- CVE-2026-96765 Cross-site scripting in WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
- CVE-2026-96764 kvcache-ai mooncake Regular Expression GetReplicaListByRegex allocation of resources
- CVE-2026-96763 kvcache-ai mooncake MountSegment Request Processing segment.cpp access control
- CVE-2026-96762 kvcache-ai mooncake RPC Path UnmountSegment authorization
- CVE-2026-96761 WordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-96760 Authlib library contains a signature‑verification bypass vulnerability
- CVE-2026-9676 f4 Post Tree < 2.0.5 - Subscriber+ Arbitrary Post Parent/Menu Order Modification
- CVE-2026-96759 orval before 8.29.0 Code Injection via operationId
- CVE-2026-96758 orval @orval/core before 8.28.0 Code Injection via Form-Data
- CVE-2026-96757 orval before 8.29.0 Code Injection via unescaped OpenAPI media-type
- CVE-2026-96756 orval before 8.30.0 Code Injection via Factory Generation
- CVE-2026-96755 orval @orval/effect 8.14.0 through 8.28.1 Code Injection
- CVE-2026-96754 orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path