Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 225 of 1013.
- CVE-2026-96377 Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188
- CVE-2026-96376 Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177
- CVE-2026-96375 Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176
- CVE-2026-96374 Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178
- CVE-2026-96373 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168
- CVE-2026-96372 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167
- CVE-2026-96371 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166
- CVE-2026-96370 Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164
- CVE-2026-9637 CompactLogix® 5380 / ControlLogix® 5580 - Multiple Vulnerabilities
- CVE-2026-96369 Webform - Less critical - Access bypass - SA-CONTRIB-2026-165
- CVE-2026-96368 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163
- CVE-2026-96367 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162
- CVE-2026-96366 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169
- CVE-2026-96365 Webform - Less critical - Denial of service - SA-CONTRIB-2026-170
- CVE-2026-96364 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171
- CVE-2026-96363 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161
- CVE-2026-96362 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160
- CVE-2026-96361 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155
- CVE-2026-96360 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154
- CVE-2026-9636 Security feature bypass in ControlLogix® 5580, CompactLogix® 5380, GuardLogix® 5580, Compact GuardLogix® 5380, 1756-EN4TR
- CVE-2026-96359 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159
- CVE-2026-96358 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158
- CVE-2026-96357 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172
- CVE-2026-96356 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174
- CVE-2026-96355 Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175
- CVE-2026-96352 WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-96351 WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-96350 WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability
- CVE-2026-9635 Cross-site scripting in WP Shortcode by MyThemeShop
- CVE-2026-96349 WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability
- CVE-2026-96348 WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability
- CVE-2026-96347 WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-96346 WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability
- CVE-2026-96345 WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability
- CVE-2026-96344 WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability
- CVE-2026-96343 WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability
- CVE-2026-96342 WordPress WPMobile.App plugin <= 11.83 - Sensitive Data Exposure vulnerability
- CVE-2026-96341 WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability
- CVE-2026-9634 Redundancy Module Configuration Tool - Multiple Vulnerabilities
- CVE-2026-96339 WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-96338 WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-96337 WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability
- CVE-2026-96336 WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability
- CVE-2026-96335 WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability
- CVE-2026-96334 WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability
- CVE-2026-96333 WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability
- CVE-2026-96332 WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-96331 WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability
- CVE-2026-96330 WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability
- CVE-2026-9633 Redundancy Module Configuration Tool - Multiple Vulnerabilities
- CVE-2026-96329 WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability
- CVE-2026-96328 WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability
- CVE-2026-96327 WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability
- CVE-2026-96326 Cross-site scripting in HT Contact Form – Drag & Drop Form Builder for WordPress
- CVE-2026-96325 Windows SMB Server Denial of Service Vulnerability
- CVE-2026-96324 Microsoft Windows Search Component Elevation of Privilege Vulnerability
- CVE-2026-96323 Windows Update Elevation of Privilege Vulnerability
- CVE-2026-96322 Windows Remote Desktop Protocol Elevation of Privilege Vulnerability
- CVE-2026-96321 Remote Desktop Display Driver Information Disclosure Vulnerability
- CVE-2026-96320 Windows DHCP Server Remote Code Execution Vulnerability
- CVE-2026-9632 UTT HiPER 1250GW Web Management formGroupConfig strcpy stack-based overflow
- CVE-2026-96319 Windows USB Print Driver Elevation of Privilege Vulnerability
- CVE-2026-96318 Windows Resume Elevation of Privilege Vulnerability
- CVE-2026-96317 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-96316 Windows Routing and Remote Access Service (RRAS) Tampering Vulnerability
- CVE-2026-96315 Windows Overlay Filter Tampering Vulnerability
- CVE-2026-96314 Windows Audio Service Information Disclosure Vulnerability
- CVE-2026-96313 Windows Push Notifications Elevation of Privilege Vulnerability
- CVE-2026-96312 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-96311 Windows Network List Service Tampering Vulnerability
- CVE-2026-96310 Windows USB Print Driver Elevation of Privilege Vulnerability
- CVE-2026-9631 UTT HiPER 1250GW Web Management formConfigFastDirectionW strcpy stack-based overflow
- CVE-2026-96309 Windows Subsystem for Linux Elevation of Privilege Vulnerability
- CVE-2026-96308 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-96307 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-96306 Windows Sysmain Service Elevation of Privilege Vulnerability
- CVE-2026-96305 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-96304 Windows USB Print Driver Elevation of Privilege Vulnerability
- CVE-2026-96303 Microsoft PowerShell Security Feature Bypass Vulnerability
- CVE-2026-96302 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-96301 Windows USB Print Driver Elevation of Privilege Vulnerability
- CVE-2026-96300 RPC Endpoint Mapper Service Denial of Service Vulnerability
- CVE-2026-96299 Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service
- CVE-2026-96297 MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline
- CVE-2026-96294 Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection
- CVE-2026-96293 Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File
- CVE-2026-96292 Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic)
- CVE-2026-9629 Canvas <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Block Attribute
- CVE-2026-96289 Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard
- CVE-2026-96288 Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)
- CVE-2026-96287 Denial of service in Apache Thrift
- CVE-2026-96286 Apache Thrift: Perl servers end `serve()` when serving one connection fails
- CVE-2026-96284 Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following
- CVE-2026-96283 Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull
- CVE-2026-96282 Flatpak: flatpak: extension metadata path traversal file existence oracle
- CVE-2026-96281 Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes
- CVE-2026-96280 Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems
- CVE-2026-9628 UTT HiPER 1200GW Web Management formPptpClientConfig stack-based overflow
- CVE-2026-96279 Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks
- CVE-2026-96278 WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History