Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 237 of 1013.
- CVE-2026-93944 WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability
- CVE-2026-93943 WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability
- CVE-2026-93942 WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability
- CVE-2026-93941 WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability
- CVE-2026-93940 WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability
- CVE-2026-9394 Besen BS20 EV Charging Station Bluetooth Low Energy weak password
- CVE-2026-93938 WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability
- CVE-2026-93937 WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability
- CVE-2026-93936 WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability
- CVE-2026-93935 WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability
- CVE-2026-93934 WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability
- CVE-2026-93933 WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability
- CVE-2026-93932 WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability
- CVE-2026-93931 WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability
- CVE-2026-93930 WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability
- CVE-2026-9393 H3C Magic B0 aspForm Edit_BasicSSID_5G buffer overflow
- CVE-2026-93929 WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability
- CVE-2026-93928 WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Authentication vulnerability
- CVE-2026-93927 WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability
- CVE-2026-93926 Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path
- CVE-2026-93925 Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol id
- CVE-2026-93923 SiYuan through 3.8.4 Stored XSS via Heading Style Attribute
- CVE-2026-93922 SiYuan through 3.8.4 Stored XSS via notebook names
- CVE-2026-93921 SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint
- CVE-2026-93909 IBM WebSphere Application Server Liberty is affected by an authentication bypass
- CVE-2026-93908 Real Estate Manager <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' Parameter
- CVE-2026-93907 IBM WebSphere Application Server is affected by a bypass authentication vulnerability
- CVE-2026-93905 IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data
- CVE-2026-93904 Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter
- CVE-2026-93903 Open redirect in LiteSpeed Web Server
- CVE-2026-93901 Privilege escalation in Optima Express IDX
- CVE-2026-9390 XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup
- CVE-2026-93899 Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter
- CVE-2026-93897 Cross-site scripting in GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- CVE-2026-93896 WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI
- CVE-2026-93895 IBM WebSphere Application Server Liberty Improper Access Control
- CVE-2026-93894 Memory corruption in Varnish Cache
- CVE-2026-93892 Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console
- CVE-2026-93891 Security Vulnerability identified in IBM TRIRIGA - XXE
- CVE-2026-9389 Tenda F456 L7Im frmL7ImForm buffer overflow
- CVE-2026-93889 Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message
- CVE-2026-93888 IBM Sterling Connect:Direct for Unix Buffer Overflow
- CVE-2026-93886 IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI
- CVE-2026-93885 Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter
- CVE-2026-93883 Cross-site scripting in Advanced Classifieds & Directory Pro
- CVE-2026-93882 Missing authorization in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- CVE-2026-93880 Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder
- CVE-2026-9388 Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection
- CVE-2026-93878 DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action
- CVE-2026-93875 JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter
- CVE-2026-93873 Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin
- CVE-2026-93872 Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter
- CVE-2026-93871 Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix
- CVE-2026-93870 Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler
- CVE-2026-9387 Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection
- CVE-2026-93869 Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex
- CVE-2026-93868 Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG
- CVE-2026-93866 Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write
- CVE-2026-93865 Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection
- CVE-2026-93864 Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root
- CVE-2026-93862 Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service
- CVE-2026-93861 Missing authorization in Mistral
- CVE-2026-93860 Missing authorization in Mistral
- CVE-2026-9386 Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injection
- CVE-2026-93858 Command injection in Mistral
- CVE-2026-93857 Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution
- CVE-2026-93856 Information disclosure in Cinder
- CVE-2026-93855 SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter
- CVE-2026-93854 Missing authorization in Blazar
- CVE-2026-93853 Barman snapshot backup deletion trusts unverified backup catalog metadata
- CVE-2026-93852 Missing authorization in Blazar
- CVE-2026-93851 Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post
- CVE-2026-93850 Unbounded memory consumption during PDF text extraction
- CVE-2026-9385 Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection
- CVE-2026-93849 Denial of service in Mattermost
- CVE-2026-93848 Server-side request forgery in Mattermost
- CVE-2026-93847 Improper post type validation on scheduled post endpoints
- CVE-2026-93846 Team admin can escalate a team member's permissions via the team member roles endpoint
- CVE-2026-93841 vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs
- CVE-2026-93840 vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids
- CVE-2026-9384 Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection
- CVE-2026-93839 LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint
- CVE-2026-93838 SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx
- CVE-2026-93836 WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter
- CVE-2026-93834 Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape
- CVE-2026-93832 Missing authorization in Setup App
- CVE-2026-93830 net: stmmac: xgmac2: disable RBUE in default RX interrupt mask
- CVE-2026-9383 itsourcecode Electronic Judging System login.php sql injection
- CVE-2026-93829 smb: client: fix races in cifsd thread creation
- CVE-2026-93828 exfat: fix handling of damaged volume in exfat_create_upcase_table()
- CVE-2026-93827 virtio-fs: avoid double-free on failed queue setup
- CVE-2026-93826 HID: hidpp: fix potential UAF in hidpp_connect_event()
- CVE-2026-93825 spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data()
- CVE-2026-93824 tls: reject the combination of TLS and sockmap
- CVE-2026-93823 drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl
- CVE-2026-93822 PCI: iproc: Protect root bus removal with rescan lock
- CVE-2026-93821 PCI: altera: Protect root bus removal with rescan lock
- CVE-2026-93820 PCI: rockchip: Protect root bus removal with rescan lock
- CVE-2026-9382 Edimax BR-6675nD POST Request formPPTPSetup buffer overflow
- CVE-2026-93819 PCI: mediatek: Protect root bus removal with rescan lock