Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 276 of 1013.
- CVE-2026-8942 MetaMagic SEO Plugin <= 1.6 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page
- CVE-2026-89419 Missing authorization in Ironic
- CVE-2026-89418 Uncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf)
- CVE-2026-89417 Cross-site scripting in OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
- CVE-2026-89413 Missing authorization in Filter Gallery
- CVE-2026-89412 TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel
- CVE-2026-89411 Paymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbound Stripe PaymentIntent
- CVE-2026-89410 Out-of-bounds read in Z-Wave NCP SPI Handler
- CVE-2026-8941 CDN Linker lite <= 1.3.1 - Cross-Site Request Forgery to Plugin Settings Update
- CVE-2026-89409 Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes
- CVE-2026-89407 jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS
- CVE-2026-89406 Missing authorization in Modula Image Gallery – Photo Grid & Video Gallery
- CVE-2026-8940 WP Meta Sort Posts <= 0.9 - Cross-Site Request Forgery to Plugin Settings Update
- CVE-2026-8939 Search Simple Fields <= 0.2 - Cross-Site Request Forgery to Plugin Settings Update
- CVE-2026-8938 auto making JSON-LD <= 4.5.3 - Cross-Site Request Forgery to Plugin Certification Settings via Nonce Validation Bypass
- CVE-2026-8937 Missing Authorization in GitLab
- CVE-2026-8936 Unbounded recursion in grpcfuse kernel module allows container to crash Docker Desktop VM
- CVE-2026-8935 Advanced Google Maps < 6.1.1 - Unauthenticated Administrator Account Creation
- CVE-2026-8934 Cross-Project Information Leakage in Google App Engine UI
- CVE-2026-89334 Missing authorization in Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
- CVE-2026-89333 Missing authorization in Tutor LMS – eLearning and online course solution
- CVE-2026-89332 Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration
- CVE-2026-89331 FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints
- CVE-2026-89330 EmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters
- CVE-2026-8933 snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup
- CVE-2026-89329 Device-mapper-multipath: local denial of service via blocking ipc send operations
- CVE-2026-89328 FluentBoards < 2.0.15 - Board Member+ Board Membership and Public Access Modification
- CVE-2026-89327 FluentBoards < 2.0.15 - Board Member+ Comment Author Spoofing via 'comment_by' Parameter
- CVE-2026-89325 Privilege escalation in Insight Agent
- CVE-2026-89322 Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions
- CVE-2026-89321 Denial of service in Eclipse OpenVSX
- CVE-2026-89320 HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity
- CVE-2026-8932 incomplete mTLS config matching in conn reuse
- CVE-2026-89319 Memory corruption in Eclipse KeyPont - GOSE
- CVE-2026-89318 Denial of service in Eclipse KeyPont - GOSE
- CVE-2026-89317 JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)
- CVE-2026-89316 LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion
- CVE-2026-89315 JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix
- CVE-2026-89314 Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s
- CVE-2026-89313 JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil
- CVE-2026-89312 Denial of service in Eclipse KeyPont - GOSE
- CVE-2026-89310 SQL Command Injection Vulnerability in JTL-WMS
- CVE-2026-8931 Critical RCE vulnerability in Disig Web Signer
- CVE-2026-89309 Missing Authentication Vulnerability in JTL-WMS
- CVE-2026-89308 Arbitrary command execution in TrxTimeATTENDANCE
- CVE-2026-89307 HTML injection allows open redirection in WordPress theme design-scuole-wordpress-theme
- CVE-2026-89305 Paymendo Bank Transfer <= 1.1 - Subscriber+ SQLi via 'orderBy' Parameter
- CVE-2026-89304 Paymendo Bank Transfer <= 1.1 - Unauthenticated Blind SQLi via 'paymendo_bank_transfer_completed_payment' Parameter
- CVE-2026-89303 Post Voting System <= 1.0 - Subscriber+ SQLi via 'row' Parameter
- CVE-2026-89302 Post Voting System <= 1.0 - Unauthenticated SQLi via 'id' Parameter
- CVE-2026-89301 Missing authorization in rtMedia for WordPress, BuddyPress and bbPress
- CVE-2026-89300 WP Verify API <= 1.0.0 - Unauthenticated Verification Code Email Sending to Arbitrary Recipients
- CVE-2026-89299 WP Verify API <= 1.0.0 - Unauthenticated SQLi via 'verify' Parameter
- CVE-2026-89298 Information disclosure in Red Hat Build of Keycloak
- CVE-2026-89297 Loja Automática <= 1.0.0 - Unauthenticated SQLi via 'id' Parameter
- CVE-2026-89296 Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter
- CVE-2026-89294 Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
- CVE-2026-89290 HTML Injection in İzometri Informatics' eimzamip
- CVE-2026-89289 Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint
- CVE-2026-89288 Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter
- CVE-2026-89287 ASPL Product Quotation <= 1.1.0 - Unauthenticated SQLi via 'quote_id' Parameter
- CVE-2026-89286 FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File
- CVE-2026-89285 Datalist it <= 0.0.3 - Unauthenticated SQLi via dli_fronted_action
- CVE-2026-89283 WP Posts Password Batch Manager <= 1.1 - Unauthenticated Bulk Post Password Rewrite
- CVE-2026-89282 CVE-2026-89282
- CVE-2026-89281 CVE-2026-89281
- CVE-2026-89280 Missing authorization in Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
- CVE-2026-89279 Active Directory Password Change CSRF in AuthTake Technology's authtake
- CVE-2026-89278 GPTranslate <= 2.34.6 - Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script
- CVE-2026-89277 CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-89276 Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- CVE-2026-89275 Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- CVE-2026-89274 WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
- CVE-2026-89271 WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile
- CVE-2026-8927 env-set cross-proxy Digest auth state leak
- CVE-2026-89269 WP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode
- CVE-2026-89268 QloApps through 1.7.0 Reflected XSS via List Filter Parameters
- CVE-2026-89267 starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass
- CVE-2026-89266 stb_vorbis through 1.22 heap buffer overflow via codebook multiplicands
- CVE-2026-89265 MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint
- CVE-2026-89264 MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity
- CVE-2026-89263 MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint
- CVE-2026-89262 MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check
- CVE-2026-89261 MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints
- CVE-2026-89260 MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint
- CVE-2026-8926 password leak with netrc and user in URL
- CVE-2026-89259 Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS
- CVE-2026-89258 Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get
- CVE-2026-89257 AVideo through 29.0 Cross-User Category Asset Deletion via Missing Ownership Check
- CVE-2026-89256 AVideo Bookmark Plugin Stored XSS via Chapter Names
- CVE-2026-89255 AVideo LoginControl Stored XSS via PGP Public Key
- CVE-2026-89254 AVideo CustomizeUser Stored XSS via field_name Parameter
- CVE-2026-89253 AVideo Stored XSS via donationLink in watch page button
- CVE-2026-89252 AVideo Missing Authorization in addLiveLink.php LiveLink Update
- CVE-2026-89251 AVideo Missing Authorization via AD_Server log.php Wallet Credit
- CVE-2026-89250 WWBN AVideo Unauthenticated File Read via getRecordedFile.php
- CVE-2026-8925 SASL double-free
- CVE-2026-89249 AVideo YPTWallet Stored XSS via CryptoWallet Configuration
- CVE-2026-89248 AVideo WebRTC Plugin Information Disclosure via status.json.php
- CVE-2026-89247 WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php