Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 235 of 1013.
- CVE-2026-94169 WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability
- CVE-2026-94168 WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-94167 WordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-94166 WordPress UpSolution Core plugin <= 8.44 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-94161 WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-94160 WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-9416 code-projects Employee Management System myprofile.php cross site scripting
- CVE-2026-94159 WordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-94158 WordPress Gloria Admin Panel plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-94154 Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter
- CVE-2026-94152 Omega Solution FBP Fulfillment by People User Profile API user authorization
- CVE-2026-94151 Omega Solution HRM OS Role Permission API permission missing authentication
- CVE-2026-94150 Omega Solution HRM OS SVG File Upload view cross site scripting
- CVE-2026-9415 code-projects Employee Management System eloginwel.php cross site scripting
- CVE-2026-94149 Omega Solution HRM OS Role Permission Retrieval Endpoint permission resource injection
- CVE-2026-94148 ScadaBR Export Project Endpoint export_project.htm EmportDwr.createExportJSON information disclosure
- CVE-2026-94146 BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where
- CVE-2026-94145 xuxueli xxl-job Task Management JobInfoController.java cross site scripting
- CVE-2026-94144 drogonframework drogon ORM Criteria.cc makeCriteria sql injection
- CVE-2026-94143 drogonframework drogon ORM Mapper Mapper.h orderBy sql injection
- CVE-2026-94142 BioStar Temperature Monitor Utility IOCTL BS_HWMIO64_W10.sys sub_1105C write-what-where
- CVE-2026-94140 Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no.
- CVE-2026-9414 SourceCodester Indian Invoicing System Invoice Template Render Database-Backed add_order.php cross site scripting
- CVE-2026-94139 Chengdu Feiyuxing Technology Feiyu Star Router Cookie send_order.cgi command injection
- CVE-2026-94138 Chengdu Feiyuxing Technology Feiyu Star Router send_order.cgi command injection
- CVE-2026-94137 Hangzhou Shunwang Technology shzh IRP_MJ_DEVICE_CONTROL shdrv_x64.sys sub_180004AC0 denial of service
- CVE-2026-94135 Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default
- CVE-2026-94134 Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
- CVE-2026-94132 File upload in AcyMailing Enterprise extension for Joomla
- CVE-2026-94131 Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0
- CVE-2026-94130 Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3
- CVE-2026-9413 SourceCodester Indian Invoicing System category.php cross site scripting
- CVE-2026-94129 BioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-where
- CVE-2026-94128 BioStar VIVID LED DJ IOCTL BS_LED64.sys sub_1105C write-what-where
- CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow
- CVE-2026-94124 WordPress WP EasyCart plugin <= 5.9.4 - SQL Injection vulnerability
- CVE-2026-94123 WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability
- CVE-2026-94122 WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability
- CVE-2026-94121 Deserialization in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer
- CVE-2026-94120 WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability
- CVE-2026-9412 SourceCodester Indian Invoicing System Backend Endpoint access control
- CVE-2026-94118 WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.17 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-94117 WordPress HashBar – WordPress Notification Bar plugin <= 2.0.3 - SQL Injection vulnerability
- CVE-2026-94115 WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability
- CVE-2026-94114 Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning
- CVE-2026-94113 Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints
- CVE-2026-94112 mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack
- CVE-2026-94111 Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon
- CVE-2026-94110 QCMS Content Detail Controllers.php self_Tmp sql injection
- CVE-2026-9411 SourceCodester Indian Invoicing System Invoice Generation IGST_Invoice.php sql injection
- CVE-2026-94109 openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer
- CVE-2026-94108 getID3 through 1.9.26 XML External Entity Injection via XML2array
- CVE-2026-94107 NivoCart through 2.4.0 Predictable Administrator Password Reset Token
- CVE-2026-94106 getID3 before 1.9.26 OS Command Injection via Unescaped Filenames
- CVE-2026-94105 NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller
- CVE-2026-94104 NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager
- CVE-2026-94103 RooCMS Frontend Rendering site_pagePHP.php eval code injection
- CVE-2026-94102 WuzhiCMS Login index.php redirect
- CVE-2026-94101 Netcore NBR200V2 routerd vlan_load_form_uci buffer overflow
- CVE-2026-94100 Netcore NBR200V2 WAN VLAN Reconfiguration routerd wan_config_set_vlan buffer overflow
- CVE-2026-9410 Sushmi-pal Invoice-System Profile Workflow profile improper authorization
- CVE-2026-94099 Netcore NBR200V2 Backup Restore restore.cgi command injection
- CVE-2026-94098 Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection
- CVE-2026-94097 Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection
- CVE-2026-94096 Netcore NBR200V2 LAN IP Configuration network_tools command injection
- CVE-2026-94095 Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injection
- CVE-2026-94094 OpenClaw Canvas Host Route server.ts createCanvasHostHandler denial of service
- CVE-2026-94093 DLR-RM stable-baselines3 save_util.py VecNormalize.load deserialization
- CVE-2026-94092 dmlc dgl utils.py _read_torch_data deserialization
- CVE-2026-94091 piskvorky gensim Model Loader utils.py load deserialization
- CVE-2026-94090 JusticeRage Manalyze PE Parser pe.cpp _parse_debug integer underflow
- CVE-2026-9409 Sushmi-pal Invoice-System User Management user improper authorization
- CVE-2026-94089 D-Link DIR-868L Authentication webfa_authentication.cgi strcpy stack-based overflow
- CVE-2026-94084 Use after free in Suricata
- CVE-2026-94083 Memory corruption in Suricata
- CVE-2026-94082 WordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerability
- CVE-2026-94081 WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-94080 WordPress MarketKing plugin <= 2.1.70 - Broken Access Control vulnerability
- CVE-2026-9408 Totolink A8000RU Web Management cstecgi.cgi setStaticDhcpRules os command injection
- CVE-2026-94079 WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability
- CVE-2026-94078 WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-94077 WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-94076 WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability
- CVE-2026-94075 WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability
- CVE-2026-94074 WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability
- CVE-2026-9407 Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection
- CVE-2026-94067 WordPress The Voux theme <= 6.9.5 - Local File Inclusion vulnerability
- CVE-2026-94066 WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-94065 WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability
- CVE-2026-94064 WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability
- CVE-2026-94063 WordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-94062 WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability
- CVE-2026-94061 WordPress Whistle - Sports Club theme <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-94060 WordPress Voldor theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-9406 Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection
- CVE-2026-94059 WordPress Ogency theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-94058 WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-94057 Other in Exim
- CVE-2026-94056 Information disclosure in Exim
- CVE-2026-94055 Use after free in Exim