Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 277 of 1013.
- CVE-2026-89246 WWBN AVideo CSV Formula Injection via myComments.download.php
- CVE-2026-89245 WWBN AVideo Cross-Site Request Forgery via playlistRemove.php
- CVE-2026-89244 WWBN AVideo Reflected XSS via Gallery Category getBackURL
- CVE-2026-89243 WWBN AVideo Stored XSS via UserGroups setGroup_name
- CVE-2026-89242 WWBN AVideo Unauthenticated SSRF via login.json.php
- CVE-2026-89241 WWBN AVideo Reflected XSS via confirmLivePassword.php
- CVE-2026-89240 WWBN AVideo Reflected XSS via confirmLivePassword.php
- CVE-2026-8924 trailing dot domain super cookie
- CVE-2026-89239 WWBN AVideo Reflected XSS via Referer Header Comment Breakout
- CVE-2026-89238 Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection
- CVE-2026-89237 Bluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' Parameters
- CVE-2026-89236 SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' Parameters
- CVE-2026-89235 Testimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQLi via 'offset' Parameter
- CVE-2026-89234 WP-Partner <= 1.2.1 - Unauthenticated SQLi via 'id' Parameter
- CVE-2026-89232 RecordBrowser <= 1.1.7 - Unauthenticated SQLi via 'recordid' Parameter
- CVE-2026-8922 Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services
- CVE-2026-89216 vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter
- CVE-2026-89214 WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission
- CVE-2026-89213 Llavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter
- CVE-2026-89212 XML External Entity in Akana API Platform
- CVE-2026-8921 Privilege escalation in ASUS Business Manager
- CVE-2026-89209 Auth bypass in Mendix SAML (Mendix 10 compatible)
- CVE-2026-89208 Memory corruption in Capital Embedded AR Classic 431-422
- CVE-2026-89207 Denial of service in WTV676-HB6035 Web Interface
- CVE-2026-89206 Missing authorization in RUGGEDCOM CROSSBOW
- CVE-2026-89205 Missing authorization in RUGGEDCOM CROSSBOW
- CVE-2026-89204 Missing authorization in RUGGEDCOM CROSSBOW
- CVE-2026-89203 Missing authorization in RUGGEDCOM CROSSBOW
- CVE-2026-89202 Missing authorization in RUGGEDCOM CROSSBOW
- CVE-2026-89201 SQL injection in RUGGEDCOM CROSSBOW
- CVE-2026-89200 SQL injection in RUGGEDCOM CROSSBOW
- CVE-2026-8920 Path traversal in Aura Wallpaper Service
- CVE-2026-89199 Missing authorization in RUGGEDCOM CROSSBOW
- CVE-2026-89198 SQL injection in RUGGEDCOM CROSSBOW
- CVE-2026-89197 SQL injection in RUGGEDCOM CROSSBOW
- CVE-2026-89196 SQL injection in RUGGEDCOM CROSSBOW
- CVE-2026-89195 Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists
- CVE-2026-89193 Robin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTML Parser
- CVE-2026-89191 Stored Cross-Site Scripting in SQLView KRIS
- CVE-2026-89190 Robin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajax
- CVE-2026-8919 Misconfiguration in GameSDK
- CVE-2026-89186 Information disclosure in mpp
- CVE-2026-89182 Gitea push-to-create bypass of FORCE_PRIVATE policy
- CVE-2026-89180 Thinking Software Technology｜EFence - SQL Injection
- CVE-2026-8918 Security feature bypass in Armoury Crate
- CVE-2026-89179 Howyar｜WeenyGenius - Missing Support for Integrity Check
- CVE-2026-89178 Howyar｜WeenyGenius - Origin Validation Error
- CVE-2026-89177 Howyar｜WeenyGenius - Use of Insecure Protocol
- CVE-2026-89176 Howyar｜WeenyGenius - Missing Authentication
- CVE-2026-89175 Kingdom Communication Associated｜Smart Video Intercom System - Client-Side Authentication
- CVE-2026-89174 Kingdom Communication Associated｜Smart Video Intercom System - Missing Burte-force Protection
- CVE-2026-89173 Kingdom Communication Associated｜Smart Video Intercom System - Sensitive Data Exposure
- CVE-2026-89172 Side-channel attack of AN1044/AN953/SW300052 cryptographic algorithms
- CVE-2026-8917 Memory corruption in AI Suite3
- CVE-2026-89169 Security feature bypass in live-boot
- CVE-2026-89162 Information disclosure in PCRE2
- CVE-2026-89161 Memory corruption in PCRE2
- CVE-2026-89160 Memory corruption in PCRE2
- CVE-2026-8916 Memory corruption in rlottie
- CVE-2026-89158 Integer overflow in PCRE2
- CVE-2026-89157 Memory corruption in PCRE2
- CVE-2026-89156 Memory corruption in PCRE2
- CVE-2026-89151 Missing authorization in Forgejo
- CVE-2026-8915 Memory corruption in Escargot
- CVE-2026-89148 AVideo Open Redirect via playlistSort.php Referer Header
- CVE-2026-89147 Net-SNMP through 5.9.5.2 Denial of Service via Blocking Unauthenticated SMUX Read
- CVE-2026-89146 libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses
- CVE-2026-89145 Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory
- CVE-2026-89141 Missing authorization in AI Engine – The Chatbot, AI Framework & MCP for WordPress
- CVE-2026-89140 Missing authorization in Temporal Server
- CVE-2026-8914 Command injection in Profile change function
- CVE-2026-89139 Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host
- CVE-2026-89138 Missing authorization in Filter Gallery
- CVE-2026-89136 Client accepts unsolicited RawPublicKey server certificate type
- CVE-2026-89135 Failed X509_verify_cert leaves unverified CA in shared CertManager
- CVE-2026-89134 Subject CN name-constraint check bypassed when non-DNS SAN present
- CVE-2026-89133 NameConstraints not enforced across unconstrained intermediate CA
- CVE-2026-8913 Command Injection in TP-Link's Archer MR600 WireGuard Client Configuration
- CVE-2026-89124 Missing authorization in SAP HANA (Display Product Catalog Based on Customs Declaration)
- CVE-2026-89122 Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal
- CVE-2026-89121 Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object)
- CVE-2026-89120 Missing authorization check in SAP ABAP Platform
- CVE-2026-8912 Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection
- CVE-2026-89118 Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal
- CVE-2026-89117 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
- CVE-2026-89116 OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code
- CVE-2026-89113 SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code)
- CVE-2026-89112 Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure
- CVE-2026-89111 OAuth2 SSRF vulnerability in SAP Cloud SDK for Python
- CVE-2026-89110 Broken Access Control in SAP NetWeaver Visual Composer
- CVE-2026-8911 WP AutoBuzz <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'googleAccount' Parameter
- CVE-2026-89108 Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)
- CVE-2026-89107 Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)
- CVE-2026-89106 Cross Site Scripting (XSS) vulnerability in SAPUI5
- CVE-2026-89105 Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integration-library
- CVE-2026-89102 OCSP stapling v2 multi accepts non-CA chain certificates as issuers
- CVE-2026-89100 Cross-site scripting in Payment Plugins for Stripe WooCommerce
- CVE-2026-8910 WP Emoticon Rating <= 1.0.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting via 'emo_settings' Parameter
- CVE-2026-89099 Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption
- CVE-2026-89098 Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd