Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 249 of 1013.
- CVE-2026-92462 yshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStep
- CVE-2026-92461 yshop-crm through 2.1.3 Missing Authorization via CRM Approval-Chain Endpoint
- CVE-2026-92460 yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing
- CVE-2026-9246 Missing authorization in Server
- CVE-2026-92459 yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint
- CVE-2026-92458 yshop-crm through 2.1.3 Missing Authorization via StoreProductController onSale
- CVE-2026-92457 yshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoice
- CVE-2026-92456 yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints
- CVE-2026-92455 yshop-crm through 2.1.3 Missing Authorization via CRM Customer Messaging Endpoints
- CVE-2026-92454 JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode
- CVE-2026-92450 Kiloview E3 NDI Encoder Use of Hard-coded Credentials
- CVE-2026-9245 Open redirect in Server
- CVE-2026-92449 Memory corruption in Eclipse ThreadX - GUIX
- CVE-2026-92446 GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader
- CVE-2026-92438 Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin
- CVE-2026-92437 Mailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion
- CVE-2026-92436 Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR
- CVE-2026-92435 Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST API
- CVE-2026-92433 Patreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRF
- CVE-2026-92432 Patreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter
- CVE-2026-92431 Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration
- CVE-2026-92430 Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook
- CVE-2026-9243 Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
- CVE-2026-92429 Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via maxiPago Debit Webhook
- CVE-2026-92428 Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure Webhook
- CVE-2026-92427 Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret Disclosure
- CVE-2026-92426 YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion
- CVE-2026-92425 Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR
- CVE-2026-92424 Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue
- CVE-2026-92423 Meow Gallery < 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_posts
- CVE-2026-92422 Meow Gallery < 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST Route
- CVE-2026-92421 Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR
- CVE-2026-92420 Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR
- CVE-2026-9242 RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request
- CVE-2026-92419 IDOR in WEBCON BPS
- CVE-2026-92418 ChangeWeDer crm Save Endpoint customer.serve.js cross site scripting
- CVE-2026-92417 Open5GS PFCP types.c ogs_pfcp_parse_volume_measurement null pointer dereference
- CVE-2026-92416 Open5GS PFCP Session Report Request n4-handler.c smf_n4_handle_session_report_request assertion
- CVE-2026-92415 Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies
- CVE-2026-92414 Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
- CVE-2026-92413 Artifex MuPDF PDF Xref Loading pdf-stream.c pdf_open_filter null pointer dereference
- CVE-2026-92412 Five Star Restaurant Reviews < 2.3.14 - Reflected XSS
- CVE-2026-92411 WP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name
- CVE-2026-92410 Sign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRF
- CVE-2026-9241 Missing authorization in FOX – Currency Switcher Professional for WooCommerce
- CVE-2026-92409 Donation Thermometer 2.2.9 - 2.2.11 - Contributor+ Stored XSS via Shortcode
- CVE-2026-92406 SourceCodester Inventory and Monitoring System btn_functions.php add sql injection
- CVE-2026-92405 SourceCodester Inventory and Monitoring System index.php sql injection
- CVE-2026-92404 MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure
- CVE-2026-92403 Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Substitution
- CVE-2026-92402 ChangeWeDer crm top.upstudy.crm.controller.UserController UserController.java index authorization
- CVE-2026-92401 ChangeWeDer crm improper authentication
- CVE-2026-92400 Business logic in Payment Gateway for PayPal on WooCommerce
- CVE-2026-9240 Missing authorization in Colissimo shipping methods for WooCommerce
- CVE-2026-92399 GPAC WebSocket rmt_ws.c rmt_client_handle_ws_frame heap-based overflow
- CVE-2026-92398 Ruijie RG-EW3000GX user_list_note admin os command injection
- CVE-2026-92397 Ruijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injection
- CVE-2026-92395 @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
- CVE-2026-92393 Apache YuniKorn: Admission control bypass via workload UPDATE operation
- CVE-2026-92392 HTTP/2 upload Use-After-Free
- CVE-2026-92391 curl_mime_free stack overflow by recursion
- CVE-2026-92390 -J no-clobber guarantee bypassed with 103 early hints
- CVE-2026-92389 TFTP direction confusion
- CVE-2026-92388 FTP wildcard write callback mixup
- CVE-2026-92387 never-ending loop via server response omission
- CVE-2026-92386 server-set cookie aborts cookie jar load
- CVE-2026-92385 SourceCodester Online Food Ordering System Category Update update_category.php cross site scripting
- CVE-2026-92383 PbootCMS User Management UserController.php mod cross-site request forgery
- CVE-2026-92382 Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write
- CVE-2026-92381 PbootCMS Template Rendering ContentController.php decode_string cross site scripting
- CVE-2026-92380 WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery
- CVE-2026-92378 uniFLOW Online Legacy UI Previous login session retained when entering Reduced Function Login
- CVE-2026-92377 Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows
- CVE-2026-92376 Local Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Monitoring for Windows
- CVE-2026-92375 Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring
- CVE-2026-92374 Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS
- CVE-2026-92372 Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution
- CVE-2026-92371 Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording
- CVE-2026-92370 Remote Session Access Control Bypass Leading to Remote Code Execution
- CVE-2026-9237 Missing authorization in Employee, Leave and Recruitment Management System – Crew HRM
- CVE-2026-92369 Race condition in Full Client
- CVE-2026-92368 Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code Execution
- CVE-2026-92366 code-projects Matrimonial System Regular Search search.php sql injection
- CVE-2026-92365 vllm-project vllm thinking_budget_state.py algorithmic complexity
- CVE-2026-92364 itsourcecode Leave Management System index.php sql injection
- CVE-2026-92363 ag-ui-protocol ag-ui JSON sse_parser.cpp resource consumption
- CVE-2026-92362 ag-ui-protocol ag-ui SSE Frame sse.rs resource consumption
- CVE-2026-92361 ag-ui-protocol ag-ui SSE Client client.go resource consumption
- CVE-2026-92360 ag-ui-protocol ag-ui Event Application Layer agent.ts prepareRunAgentInput origin validation
- CVE-2026-9236 CM Ad Changer <= 2.0.7 - Cross-Site Request Forgery to Campaign Deletion via Campaign Management
- CVE-2026-92359 ag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain policy
- CVE-2026-92358 Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking
- CVE-2026-92357 a2ui-project a2ui Model Processor model-processor.ts information disclosure
- CVE-2026-92356 a2ui-project a2ui Update Components basic_functions.ts updateComponents resource consumption
- CVE-2026-92355 Path traversal in Octopus Server
- CVE-2026-9235 Missing authorization in DHL eCommerce (Benelux) for WooCommerce
- CVE-2026-9234 Missing authorization in JTL-Connector for WooCommerce
- CVE-2026-9233 Missing authorization in Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- CVE-2026-9232 Missing authorization in Easy Appointments
- CVE-2026-9231 WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute