Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 234 of 1013.
- CVE-2026-9433 Totolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injection
- CVE-2026-9432 Totolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injection
- CVE-2026-9431 Tenda F1202 PptpUserAdd fromPptpUserAdd stack-based overflow
- CVE-2026-94301 Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232
- CVE-2026-94300 Concurrent GSS-TSIG messages corrupt memory
- CVE-2026-9430 Tenda F1202 GstDhcpSetSerof formGstDhcpSetSer stack-based overflow
- CVE-2026-94299 elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback
- CVE-2026-94298 BuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter
- CVE-2026-94297 Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term Creation
- CVE-2026-94295 Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature
- CVE-2026-94294 App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php
- CVE-2026-94293 Missing authentication for critical function in the aas-edge-client REST API
- CVE-2026-9429 Tenda F1202 WrlExtraSet formWrlExtraSet stack-based overflow
- CVE-2026-94287 Denial of service via unsigned underflow in libXpm's write path
- CVE-2026-94286 Out-of-bounds read in libXtst's RECORD reply parser
- CVE-2026-94285 Out-of-bounds read in libX11's byte-oriented codeset parser
- CVE-2026-94284 Out-of-bounds read vulnerability in libX11's XIM trigger-keyregistration parser.registration parser
- CVE-2026-94283 Out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser
- CVE-2026-94282 Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion
- CVE-2026-94281 Out-of-bounds read in libXi's XListInputDevices() class parsing
- CVE-2026-9428 Tenda F1202 PPTPUserSetting fromPPTPUserSetting stack-based overflow
- CVE-2026-94278 File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat
- CVE-2026-94277 Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name
- CVE-2026-94276 Apache APISIX: Openid-connect introspection validation issue
- CVE-2026-94275 Track Orders for WooCommerce < 1.2.7 - Unauthenticated PII Disclosure via 'email' Parameter
- CVE-2026-94274 YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API
- CVE-2026-94273 Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_payment
- CVE-2026-94272 Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions
- CVE-2026-94271 Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return
- CVE-2026-94270 Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via Webhook
- CVE-2026-9427 Edimax EW-7438RPn webs formWlSiteSurvey stack-based overflow
- CVE-2026-94269 Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch
- CVE-2026-94268 Privilege escalation in Advanced Custom Fields: Extended
- CVE-2026-94267 Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action
- CVE-2026-94266 password leak in CURLINFO_EFFECTIVE_URL
- CVE-2026-94265 Authorization: Negotiate sent to foreign origin
- CVE-2026-94264 Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes
- CVE-2026-94263 Code injection in Advanced Custom Fields: Extended
- CVE-2026-94262 Missing authorization in Advanced Custom Fields: Extended
- CVE-2026-94261 Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction Id
- CVE-2026-94260 Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure
- CVE-2026-9426 Edimax EW-7438RPn formHwSet stack-based overflow
- CVE-2026-94258 SMS Alert 3.6.4 - 4.0.0 - Admin+ Network User Billing Phone Disclosure via Bulk User Actions
- CVE-2026-94257 SMS Alert 3.9.6 - 4.0.0 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
- CVE-2026-94256 SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP
- CVE-2026-94254 SellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sellkit_product_prices' Parameter
- CVE-2026-94251 Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource
- CVE-2026-94250 Apache APISIX: Batch response aggregation can exhaust worker memory
- CVE-2026-9425 Edimax EW-7438RPn formWlanMP stack-based overflow
- CVE-2026-94246 Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOR
- CVE-2026-94245 Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOR
- CVE-2026-94244 Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via Export
- CVE-2026-94243 Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence
- CVE-2026-9424 Edimax EW-7438RPn Content-Type formWlanMP os command injection
- CVE-2026-94239 Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration
- CVE-2026-94238 Loco Translate < 2.8.9 - Translator+ Limited File Read via 'path' Parameter
- CVE-2026-94235 Simple User Registration <= 6.9 - Subscriber+ Arbitrary Email Sending via wpr_send_email_to_user
- CVE-2026-94231 TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and Modification
- CVE-2026-94230 Missing authorization in TrueBooker
- CVE-2026-9423 Edimax BR-6675nD POST Request mp command injection
- CVE-2026-94229 Missing authorization in TrueBooker
- CVE-2026-94228 TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_data
- CVE-2026-94220 Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin
- CVE-2026-9422 KLiK SocialMediaWebsite HTTP POST Request Parameter injection
- CVE-2026-94218 Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint
- CVE-2026-94217 Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision
- CVE-2026-94216 ST Engineering iDirect iDX/Evo iDX HTTP Request authorize response splitting
- CVE-2026-94215 Missing authorization in Red Hat Build of Keycloak
- CVE-2026-94214 ST Engineering iDirect iDX/Evo iDX Location Header redirect
- CVE-2026-94213 Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity
- CVE-2026-94212 Apache APISIX: unauthenticated impersonation issue in saml-auth
- CVE-2026-94211 Hyve5 Leantime Project Dashboard show.blade.php cross site scripting
- CVE-2026-94210 Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting
- CVE-2026-9421 KLiK SocialMediaWebsite File upload.inc.php uniqid unrestricted upload
- CVE-2026-94206 Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds
- CVE-2026-94205 Gitea fork workflow approval bypass through maintainer-triggered events
- CVE-2026-94204 Incorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Application
- CVE-2026-94202 Module block-pool create validates two of the four parameter words it reads
- CVE-2026-94201 Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash
- CVE-2026-94200 TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl
- CVE-2026-9420 KLiK SocialMediaWebsite HTTP GET Request Parameter injection
- CVE-2026-94197 NGINX Ingress Controller vulnerability
- CVE-2026-94194 Other in mint
- CVE-2026-94192 Module object deallocation can free a live ThreadX kernel object
- CVE-2026-9419 code-projects Employee Management System empproject.php cross site scripting
- CVE-2026-94185 nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias
- CVE-2026-94184 Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)
- CVE-2026-94183 Address bar spoofing risk in affected Android versions of Arc Search
- CVE-2026-94181 Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element
- CVE-2026-94180 WordPress Advanced Ads plugin <= 2.0.26 - Sensitive Data Exposure vulnerability
- CVE-2026-9418 code-projects Employee Management System changepassemp.php cross site scripting
- CVE-2026-94179 WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-94178 WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability
- CVE-2026-94177 WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability
- CVE-2026-94176 WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-94174 WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability
- CVE-2026-94173 WordPress Business Directory plugin <= 6.4.27 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-94171 WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-94170 WordPress Sassy Social Share plugin <= 3.3.79 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-9417 code-projects Employee Management System myprofileup.php cross site scripting