Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 260 of 1013.
- CVE-2026-9106 Security feature bypass in Enterprise Server
- CVE-2026-91059 JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size
- CVE-2026-91057 Out-of-bounds read when a multi-line text view string ends with a carriage return
- CVE-2026-91051 EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta
- CVE-2026-91050 Missing authorization in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
- CVE-2026-9105 Authenticated Stack-Based Buffer Overflow in TP-Link TL-WR841N Web Interface
- CVE-2026-91048 Missing authorization in Apache Karaf
- CVE-2026-91047 ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' Parameter
- CVE-2026-91046 ElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Missing Authorization
- CVE-2026-91043 HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory
- CVE-2026-91041 FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT image
- CVE-2026-9104 Draft List <= 2.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via Draft Post Title
- CVE-2026-91039 Auth bypass in ash authentication
- CVE-2026-9103 Unauthenticated Superuser Token Issuance via Auto-Login Endpoint
- CVE-2026-91025 Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR
- CVE-2026-91024 Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)
- CVE-2026-91023 Missing authorization in Motors
- CVE-2026-91022 Motors < 1.4.124 - Listing Manager+ Stored XSS via Badge Color
- CVE-2026-91021 CVE-2026-91021
- CVE-2026-91020 WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt_credit_amount
- CVE-2026-9102 Path Traversal in Altium Enterprise Server ComparisonService Allows Arbitrary File Write
- CVE-2026-91019 Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure
- CVE-2026-91018 Double Free in lwIP (lightweight IP)
- CVE-2026-91017 Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback
- CVE-2026-91016 Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure
- CVE-2026-91015 Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired
- CVE-2026-91014 Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint
- CVE-2026-91013 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-91012 Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation
- CVE-2026-91011 EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference Expansion
- CVE-2026-91010 Invisible Anti-Spam & CAPTCHA < 5.1.1 - Subscriber+ Arbitrary Form Submission Deletion
- CVE-2026-9101 Prototype pollution in csv parsing
- CVE-2026-91009 Missing authorization in Active Woot Products Tables for WooCommerce. 100% FREE
- CVE-2026-91008 Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel
- CVE-2026-91006 Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)
- CVE-2026-91005 File upload in Online Faculty Clearance System
- CVE-2026-91004 SourceCodester Online Faculty Clearance System delete_faculty1.php sql injection
- CVE-2026-91003 D-Link DI-8300 CGI Service rzgl.asp rzgl_asp stack-based overflow
- CVE-2026-91002 stamparm maltrail Blacklist Endpoint httpd.py _blacklist missing authentication
- CVE-2026-91001 D-Link DI-8400 DDNS Configuration ddns.asp ddns_asp stack-based overflow
- CVE-2026-9100 Heap memory out of bounds read and crash in C Driver legacy GridFS file reader
- CVE-2026-90999 Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment
- CVE-2026-90997 Auth bypass in Keycloak
- CVE-2026-90996 Sssd: sssd: denial of service in nss responder via crafted zero-length requests
- CVE-2026-90995 Sssd: sssd: local denial of service due to null pointer dereference in pam responder
- CVE-2026-90994 Sssd: sssd: denial of service via malformed pam v1 requests
- CVE-2026-90992 Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field
- CVE-2026-90991 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-90990 Livestatus injection via monitoring filter values
- CVE-2026-9099 Keycloak: group-admin escalation to realm-admin
- CVE-2026-90989 Tainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST Endpoints
- CVE-2026-90988 Request a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenum
- CVE-2026-90987 Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price
- CVE-2026-90986 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.21 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-90985 Information disclosure in WPC Smart Compare for WooCommerce
- CVE-2026-90984 Generate PDF using Contact Form 7 < 4.2.2 - Unauthenticated Server-Side Request Forgery via Array-Valued Form Field
- CVE-2026-90983 OTP Code Exposure in Hayat Hospital's Hayat Mobile
- CVE-2026-90982 @fastify/static vulnerable to route guard bypass via path case-folding
- CVE-2026-90981 Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter
- CVE-2026-9098 CVE-2026-9098
- CVE-2026-90979 Apache Karaf: LDAP filter injection in JAAS LDAP login modules
- CVE-2026-90978 Filter Gallery < 1.1.5 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce Check
- CVE-2026-90977 Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison
- CVE-2026-90976 Clean Login < 1.19 - Unauthenticated Account Creation with Registration Disabled
- CVE-2026-90974 WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update
- CVE-2026-90972 WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion
- CVE-2026-90971 Server-side request forgery in Server
- CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
- CVE-2026-9097 CVE-2026-9097
- CVE-2026-90969 Missing authorization in Server
- CVE-2026-90961 MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials
- CVE-2026-9096 CVE-2026-9096
- CVE-2026-90959 Path traversal in Red Hat Ansible Automation Platform 2
- CVE-2026-90957 MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures
- CVE-2026-90955 MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load
- CVE-2026-90954 Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush
- CVE-2026-90953 Missing authorization in Image Optimizer
- CVE-2026-90952 WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API
- CVE-2026-90951 Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment
- CVE-2026-90950 Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form
- CVE-2026-9095 CVE-2026-9095
- CVE-2026-90949 Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch
- CVE-2026-90948 Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions
- CVE-2026-90947 Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file
- CVE-2026-90946 DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket
- CVE-2026-90945 Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret
- CVE-2026-90944 Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse
- CVE-2026-90943 parallax filament-comments through 3.0.0 Stored XSS via Comment Body
- CVE-2026-90942 Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints
- CVE-2026-90941 novel-plus through 5.3.3 Missing Authorization on the Admin Book Download Endpoint
- CVE-2026-90940 novel-plus through 5.3.3 Default Cache Management Password in the Front Portal
- CVE-2026-9094 CVE-2026-9094
- CVE-2026-90939 novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint
- CVE-2026-90938 LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket
- CVE-2026-90937 froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL
- CVE-2026-90936 Froxlor before 2.3.7 Information Disclosure via customer_email.php
- CVE-2026-90935 Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API
- CVE-2026-90934 EspoCRM before 10.0.4 Field-level Security Bypass via Attendees
- CVE-2026-90933 laradashboard through 1.2.2 Missing Authorization via License API
- CVE-2026-90932 LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE