Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 229 of 1013.
- CVE-2026-9557 Mautic Focus component Vulnerable to SSRF
- CVE-2026-95534 Deserialization in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- CVE-2026-95531 WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability
- CVE-2026-95530 WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.4.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-95529 WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-95528 WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-95527 WordPress Conekta Payment Gateway plugin <= 6.2.4 - Broken Access Control vulnerability
- CVE-2026-95526 WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability
- CVE-2026-95525 WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability
- CVE-2026-95524 WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability
- CVE-2026-95523 WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability
- CVE-2026-95522 WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability
- CVE-2026-95521 Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm
- CVE-2026-95520 Integer overflow in Red Hat Enterprise Linux 10
- CVE-2026-9552 Das Parking Management System 停车场管理系统 Search API Endpoint sql injection
- CVE-2026-95519 Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)
- CVE-2026-95515 WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-95514 WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability
- CVE-2026-95513 Missing authorization in Online Booking & Scheduling Calendar for WordPress by vcita
- CVE-2026-95512 Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader
- CVE-2026-9551 Das Parking Management System 停车场管理系统 API Endpoint ExportParkingRecords xp_cmdshell sql injection
- CVE-2026-95509 Out-of-bounds read vulnerability in string formatting impacts Qt for MCUs
- CVE-2026-95508 Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu
- CVE-2026-95503 Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled
- CVE-2026-95502 Git Sync memory exhaustion via a malicious Git server
- CVE-2026-95501 mtrano APENCMS Template weasel.php eval code injection
- CVE-2026-95500 JosephChuks php-file-manager-with-code-editor Save codeEditor.php file_put_contents unrestricted upload
- CVE-2026-9550 Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform upfile path traversal
- CVE-2026-95499 JosephChuks php-file-manager-with-code-editor filemanager.php move_uploaded_file unrestricted upload
- CVE-2026-9549 Fix XSS in service discovery active check output
- CVE-2026-9548 Cross-site scripting in Synology Chat Server
- CVE-2026-9547 SSH improper host validation
- CVE-2026-9546 sending old referer
- CVE-2026-9545 exposing HTTP/3 early data
- CVE-2026-9544 Shenzhen Sixun Software Sixun Shanghui Group Business Management System PayConfig sql injection
- CVE-2026-9543 Totolink N300RH Web Management cstecgi.cgi setPasswordCfg os command injection
- CVE-2026-9542 CodeAstro Leave Management System add_staff.php sql injection
- CVE-2026-9541 Squirrel Cnut File sqobject.cpp ReadObject heap-based overflow
- CVE-2026-9540 vllm-project vllm OpenAI-compatible Serving Path denial of service
- CVE-2026-95396 sfturing hosp_order Public Search Handlers HospitalController.java cross site scripting
- CVE-2026-95395 Missing Release of Memory after Effective Lifetime in Wireshark
- CVE-2026-95394 Unchecked Input for Loop Condition in Wireshark
- CVE-2026-95393 Heap-based Buffer Overflow in Wireshark
- CVE-2026-95392 Buffer Over-read in Wireshark
- CVE-2026-95391 Use After Free in Wireshark
- CVE-2026-95390 NULL Pointer Dereference in Wireshark
- CVE-2026-9539 libslirp TCP URG OOB Read Information Leak
- CVE-2026-95389 Heap-based Buffer Overflow in Wireshark
- CVE-2026-95388 Heap-based Buffer Overflow in Wireshark
- CVE-2026-95387 Heap-based Buffer Overflow in Wireshark
- CVE-2026-95386 Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
- CVE-2026-95385 Security feature bypass in Chrome
- CVE-2026-95384 Race condition in Chrome
- CVE-2026-95382 Information disclosure in Chrome
- CVE-2026-95381 Other in Chrome
- CVE-2026-95380 Memory corruption in Chrome
- CVE-2026-9538 Denial of service in Archive::Tar
- CVE-2026-95376 Security feature bypass in Chrome
- CVE-2026-95375 Security feature bypass in Chrome
- CVE-2026-95374 Security feature bypass in Chrome
- CVE-2026-95373 Use after free in Chrome
- CVE-2026-95372 Use after free in Chrome
- CVE-2026-95371 Missing authorization in Chrome
- CVE-2026-95370 Security feature bypass in Chrome
- CVE-2026-9537 Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison
- CVE-2026-95369 Code injection in Chrome
- CVE-2026-95368 Missing authorization in Chrome
- CVE-2026-95367 Information disclosure in Chrome
- CVE-2026-95366 Use after free in Chrome
- CVE-2026-95365 Memory corruption in Chrome
- CVE-2026-95364 Other in Chrome
- CVE-2026-95363 Other in Chrome
- CVE-2026-95362 Cross-site request forgery in Chrome
- CVE-2026-95361 Security feature bypass in Chrome
- CVE-2026-95360 Race condition in Chrome
- CVE-2026-9536 Memory corruption in vtk
- CVE-2026-95359 Information disclosure in Chrome
- CVE-2026-95358 Security feature bypass in Chrome
- CVE-2026-95357 Memory corruption in Chrome
- CVE-2026-95356 Use after free in Chrome
- CVE-2026-95355 Missing authorization in Chrome
- CVE-2026-95354 Use after free in Chrome
- CVE-2026-95353 Use after free in Chrome
- CVE-2026-95352 Security feature bypass in Chrome
- CVE-2026-95351 Use after free in Chrome
- CVE-2026-95350 Memory corruption in Chrome
- CVE-2026-9535 Memory corruption in vtk
- CVE-2026-95349 Memory corruption in Chrome
- CVE-2026-95348 Use after free in Chrome
- CVE-2026-95347 Use after free in Chrome
- CVE-2026-95346 Other in Chrome
- CVE-2026-95345 Use after free in Chrome
- CVE-2026-95344 Race condition in Chrome
- CVE-2026-95343 Use after free in Chrome
- CVE-2026-95342 Missing authorization in Chrome
- CVE-2026-95341 Other in Chrome
- CVE-2026-95340 Security feature bypass in Chrome
- CVE-2026-9534 Totolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injection
- CVE-2026-95339 Use after free in Chrome
- CVE-2026-95338 Use after free in Chrome