Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 223 of 1013.
- CVE-2026-96752 Cross-site scripting in Zero Spam for WordPress
- CVE-2026-96751 pmTicket Project-Management-Software add_project.php setSync sql injection
- CVE-2026-96750 Shell script injection via server-supplied database name in Open MongoDB shell
- CVE-2026-9675 undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
- CVE-2026-96749 Heap out-of-bounds write via signed size overflow in BSON document encoding
- CVE-2026-96748 Connection redirection via percent-encoded delimiter injection in connection string hosts
- CVE-2026-96747 Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption
- CVE-2026-96746 Heap buffer overflow via mid-scan command list growth in client topology monitoring
- CVE-2026-96745 PHP object injection via unsuppressible __pclass class inference in command monitoring events
- CVE-2026-96744 Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel
- CVE-2026-96743 Cross-site scripting in Table Field Add-on for ACF and SCF
- CVE-2026-96741 Cross-site scripting in DSGVO All in one for WP
- CVE-2026-96740 Information disclosure in StreamsHub Console for Apache Kafka®
- CVE-2026-9674 Jenkins Multijob Plugin has a cross-site request forgery (CSRF) vulnerability
- CVE-2026-96739 SEMCMS KindEditor Upload upload_json.php cross site scripting
- CVE-2026-9673 json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio
- CVE-2026-9669 bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow
- CVE-2026-96682 Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag
- CVE-2026-96680 ByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization
- CVE-2026-9668 SQL injection vulnerability in ZTE SCP product
- CVE-2026-96678 weiqingwen spring-boot-forum Avatar Upload NewUserFormValidator.java validate path traversal
- CVE-2026-96676 Fast FAC1900R uhttpd get_alias_name stack-based overflow
- CVE-2026-96675 alsa-lib through 1.2.16.1 Denial of Service via pcm_multi
- CVE-2026-96674 alsa-lib through 1.2.16.1 Integer Overflow via Topology File
- CVE-2026-96673 Photoview through 2.4.0 SQL Injection via album download route
- CVE-2026-96672 Frappe ERPNext before 16.34.1 Unauthorized Method Invocation
- CVE-2026-96671 WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-9667 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- CVE-2026-96669 Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie
- CVE-2026-96667 Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter
- CVE-2026-96666 Cross-site scripting in Schema App Structured Data
- CVE-2026-96662 Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter
- CVE-2026-96661 Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmedia__in' Parameter
- CVE-2026-96660 User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
- CVE-2026-96659 Foreman: excessive permissions for viewer role on preview
- CVE-2026-96658 Foreman: foreman: arbitrary code execution via safemode sandbox bypass
- CVE-2026-96656 Plex Media Server External Control of File Name or Path
- CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF)
- CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page
- CVE-2026-96653 WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
- CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF)
- CVE-2026-96651 Plex Media Server path traversal
- CVE-2026-96650 Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field
- CVE-2026-96649 Cross-site scripting in Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms
- CVE-2026-96648 Cross-site scripting in Data Tables Generator by Supsystic
- CVE-2026-96647 Cross-site scripting in Listdom: AI-powered Business Directory with Classifieds Ads Listings
- CVE-2026-96644 Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
- CVE-2026-96643 Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
- CVE-2026-96642 Pillow: TarIO negative size field causes infinite CPU-spin loop
- CVE-2026-96641 Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
- CVE-2026-96640 Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
- CVE-2026-96639 Pillow multi-frame loaders can reuse stale native image storage after mode transitions
- CVE-2026-96638 Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
- CVE-2026-96637 Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
- CVE-2026-96636 Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
- CVE-2026-96628 Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
- CVE-2026-96627 Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
- CVE-2026-96626 Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host
- CVE-2026-96620 Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
- CVE-2026-9662 Recover Exit For WooCommerce <= 1.0.3 - Unauthenticated Local File Inclusion via 'tpf' Parameter
- CVE-2026-96618 Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror
- CVE-2026-96616 Kiloview E3 NDI Encoder Insufficient Session Expiration
- CVE-2026-96615 NGINX Gateway Fabric vulnerability
- CVE-2026-96614 Open redirect in "ゲオアプリ" for Android
- CVE-2026-96613 Missing Authorization in Meari IoT Cloud Platform OpenAPI Service
- CVE-2026-96612 Path traversal in Hex via unvalidated dependency app names
- CVE-2026-96611 Integer overflow in FFmpeg
- CVE-2026-96609 Denial of service in Albatross
- CVE-2026-96607 WordPress NEX-Forms plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-96606 LB-Link BL-CPE600EU Configuration Backup Mifi_config.bin information disclosure
- CVE-2026-96604 SoftNews Media Group DataLife Engine Search search.php strip_data sql injection
- CVE-2026-96603 Abdurrab5 online-makeup-store Admin functions.php confirm_user authorization
- CVE-2026-96602 Abdurrab5 online-makeup-store Customer Login customerSignin.php sql injection
- CVE-2026-96601 Abdurrab5 online-makeup-store Admin Login index.php sql injection
- CVE-2026-96600 Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks
- CVE-2026-9660 Memory corruption in Totolink
- CVE-2026-96599 Isotope eCommerce through 2.9.10 Weak Order Identifier Generation
- CVE-2026-96596 erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole
- CVE-2026-96594 Gitea repository media API stored XSS
- CVE-2026-9659 Memory corruption in Totolink
- CVE-2026-96589 Gitea private repository access retained after rejected transfer
- CVE-2026-96587 Use of Hard-coded Credentials in Viidure Dashcam Android Application
- CVE-2026-96582 Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser
- CVE-2026-96581 Missing authorization in ash
- CVE-2026-96580 Gitea Actions memory exhaustion through large static matrices
- CVE-2026-9658 Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths
- CVE-2026-96578 GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- CVE-2026-96577 Missing authorization in Assisted Installer for Red Hat OpenShift Container Platform 2
- CVE-2026-96575 Cross-site scripting in Transliterator – Multilingual and Multi-script Text Conversion
- CVE-2026-96574 User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter
- CVE-2026-96573 Cross-site scripting in Appointment Hour Booking – Booking Calendar
- CVE-2026-96572 Cross-site scripting in WP Meteor Website Speed Optimization Addon
- CVE-2026-96570 Cross-site scripting in Schema & Structured Data for WP & AMP
- CVE-2026-96568 Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter
- CVE-2026-96567 Cross-site scripting in MW WP Form
- CVE-2026-96566 Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter
- CVE-2026-96564 SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name
- CVE-2026-96563 Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter
- CVE-2026-96562 Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback
- CVE-2026-96561 Cross-site scripting in AI Engine – The Chatbot, AI Framework & MCP for WordPress