Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 224 of 1013.
- CVE-2026-96560 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel
- CVE-2026-9656 Information disclosure in HubSpot All-In-One Marketing – Forms, Popups, Live Chat
- CVE-2026-96558 Cross-site scripting in Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
- CVE-2026-96556 Neethuharii CafeManagement AddCashierCode.php addcashier improper authorization
- CVE-2026-96553 WordPress FiboSearch plugin <= 1.34.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-96552 sfturing hosp_order User Password MD5.java MD5.getMD5 hash without salt
- CVE-2026-96551 sfturing hosp_order CommonUserController.java cross-site request forgery
- CVE-2026-96550 sfturing hosp_order MailUtil.java getProperties cleartext transmission
- CVE-2026-96549 sfturing hosp_order CommonUserServiceImpl.java cleartext storage
- CVE-2026-96548 sfturing hosp_order jdbc.properties hard-coded credentials
- CVE-2026-96546 Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader
- CVE-2026-96545 Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader
- CVE-2026-96542 EA Javelin Anticheat Installer Local Privilege Escalation
- CVE-2026-96541 Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline
- CVE-2026-96540 Missing authorization in Network Security Manager (NSM)
- CVE-2026-96539 WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
- CVE-2026-96538 WarehousePG pg_file_write/pg_file_rename/pg_file_unlink/pg_logdir_ls privilege escalation
- CVE-2026-96537 Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite
- CVE-2026-96535 Cross-Site Scripting in the YouMind web application
- CVE-2026-96534 Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export
- CVE-2026-96533 Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL
- CVE-2026-96532 Testimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post Update
- CVE-2026-96531 Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block
- CVE-2026-96530 Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget
- CVE-2026-9653 1756-EN2, 1756-EN3, and 1756-ENBT - Denial of Service via CIP Connection ID
- CVE-2026-96526 MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route
- CVE-2026-96525 MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check
- CVE-2026-96524 MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF
- CVE-2026-96523 Photoshop Desktop | Out-of-bounds Write (CWE-787)
- CVE-2026-96522 Photoshop Desktop | Out-of-bounds Write (CWE-787)
- CVE-2026-96521 Photoshop Desktop | Out-of-bounds Write (CWE-787)
- CVE-2026-96518 WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability
- CVE-2026-96515 Command Injection Vulnerability in Netlink ICT HG323RW Router
- CVE-2026-96514 Neethuharii CafeManagement Login CafePortalLogin.php sql injection
- CVE-2026-96513 Neethuharii CafeManagement AddProductCode.php unrestricted upload
- CVE-2026-96512 Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
- CVE-2026-9651 Misconfiguration in EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller
- CVE-2026-9650 Information disclosure in EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller
- CVE-2026-9648 CVE-2026-9648
- CVE-2026-96461 WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability
- CVE-2026-9646 ScadaBR Unauthenticated Reflected Cross-Site Scripting
- CVE-2026-96456 Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device
- CVE-2026-96455 Reachy Mini daemon allows unauthenticated remote code execution through the app installation endpoint
- CVE-2026-96454 Pake grants unrestricted IPC access to every HTTPS origin loaded in generated applications
- CVE-2026-96451 WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
- CVE-2026-96450 WordPress pixfort Core plugin < 4.3.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-9645 ScadaBR Authenticated Remote Code Execution
- CVE-2026-96449 WordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability
- CVE-2026-96448 Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation
- CVE-2026-96446 Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path
- CVE-2026-96445 Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers
- CVE-2026-96443 Apache Doris: JDBC driver URL validation bypass leads to remote code execution
- CVE-2026-96442 Emacs: emacs: arbitrary code execution in flymake mode
- CVE-2026-96440 Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）
- CVE-2026-9644 LiveSmart Video Chat <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2026-96432 Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt
- CVE-2026-96431 Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type
- CVE-2026-96430 Flowring Agentflow 4.0 - Exposed Dangerous Method or Function
- CVE-2026-9643 WP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging
- CVE-2026-96429 Flowring Agentflow 4.0 - SQL Injection
- CVE-2026-96428 Flowring Agentflow 4.0 - SQL Injection
- CVE-2026-96425 Incorrect Permission Assignment for Critical Resource in lomiri-download-manager
- CVE-2026-96424 Incorrect Permission Assignment for Critical Resource in lomiri-download-manager
- CVE-2026-96423 Heap-based Buffer Overflow in Wireshark
- CVE-2026-96422 Reachable Assertion in Wireshark
- CVE-2026-96421 Improperly Controlled Sequential Memory Allocation in Wireshark
- CVE-2026-96420 Buffer Over-read in Wireshark
- CVE-2026-96419 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark
- CVE-2026-96418 Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
- CVE-2026-96417 Heap-based Buffer Overflow in Wireshark
- CVE-2026-96416 Heap-based Buffer Overflow in Wireshark
- CVE-2026-96415 Stack-based Buffer Overflow in Wireshark
- CVE-2026-9641 Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations
- CVE-2026-96408 Code injection in Movable Type
- CVE-2026-96406 VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound
- CVE-2026-96405 Aggregate DNS name chained pointer decompression work leads to degradation of service.
- CVE-2026-96404 Gitea installer authentication bypass for existing accounts
- CVE-2026-96402 USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count
- CVE-2026-96400 Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS
- CVE-2026-9640 LXD Snapshot Import Privilege Escalation Vulnerability
- CVE-2026-96399 Gitea denial of service through external issue tracker patterns
- CVE-2026-96398 Webform - Less critical - Access bypass - SA-CONTRIB-2026-173
- CVE-2026-96396 Integer overflow in affinity
- CVE-2026-96395 Memory corruption in affinity
- CVE-2026-96394 Memory corruption in affinity
- CVE-2026-96393 Memory corruption in affinity
- CVE-2026-96392 AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187
- CVE-2026-96391 Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186
- CVE-2026-96390 Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185
- CVE-2026-9639 Authenticated Denial of Service via Malicious Backup Tarball in LXD
- CVE-2026-96388 Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184
- CVE-2026-96387 Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183
- CVE-2026-96386 Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190
- CVE-2026-96385 REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182
- CVE-2026-96384 Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180
- CVE-2026-96382 Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191
- CVE-2026-96380 CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189
- CVE-2026-9638 Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts
- CVE-2026-96379 CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181
- CVE-2026-96378 Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179