Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 278 of 1013.
- CVE-2026-89097 Information disclosure in Ad Inserter – Ad Manager & AdSense Ads
- CVE-2026-89096 Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd
- CVE-2026-89094 Code injection in Forgejo
- CVE-2026-89093 Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register
- CVE-2026-89092 Stack overflow in nscd due to unbounded alloca use
- CVE-2026-89091 Path traversal in Migration Toolkit for Applications 8
- CVE-2026-89090 Denial of service in the event stream header decoder in AWS SDK for Go v2
- CVE-2026-8909 WpMobi <= 0.0.3 - Cross-Site Request Forgery via save_general_settings Action
- CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)
- CVE-2026-89088 Parted: parted: denial of service via heap buffer overflow during fat16 resize
- CVE-2026-89087 Other in cstruct
- CVE-2026-89086 Security feature bypass in jose
- CVE-2026-89085 Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image
- CVE-2026-89084 HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write
- CVE-2026-89083 HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write
- CVE-2026-89082 HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write
- CVE-2026-89081 Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
- CVE-2026-89080 Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State Demotion
- CVE-2026-89079 Privilege escalation in Theme My Login
- CVE-2026-89078 Double Free in GitLab
- CVE-2026-89077 MOVEit Transfer Identity validation flaw in SFTP authentication
- CVE-2026-89076 MOVEit Transfer SQL injection in custom reporting
- CVE-2026-89075 MOVEit Transfer Local Disclosure of Session Information Vulnerability
- CVE-2026-89074 MOVEit Transfer Email MFA Bypass
- CVE-2026-89073 MOVEit Transfer Access restriction bypass in OAuth authentication
- CVE-2026-89072 MOVEit Transfer Authorization Flaw in Certificate Management
- CVE-2026-89071 MOVEit Transfer LDAP injection in certificate-based authentication
- CVE-2026-89070 MOVEit Transfer OIDC Authentication Replay Vulnerability
- CVE-2026-8907 WP-Ultimate-Map <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'zoom-level' Parameter
- CVE-2026-89069 MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages
- CVE-2026-89068 MOVEit Transfer Authentication bypass in LDAP sign-on
- CVE-2026-89067 MOVEit Transfer Secure Messaging Authentication Bypass
- CVE-2026-89066 OS command injection in the task synthesis component in projen
- CVE-2026-89065 Relative path traversal in the generated file manifest cleanup component in projen
- CVE-2026-89064 Information disclosure in All-in-One WP Migration and Backup
- CVE-2026-89063 Missing authorization in Online Scheduling and Appointment Booking System – Bookly
- CVE-2026-89062 Memory corruption in Energy Management Driver
- CVE-2026-89060 Missing authorization in Red Hat Advanced Cluster Management for Kubernetes 2.13
- CVE-2026-8906 WP Promoter <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'popup_width' Parameter
- CVE-2026-89059 Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)
- CVE-2026-89058 Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config
- CVE-2026-89057 Auth bypass in Idea Tab Pro (TB373FU)
- CVE-2026-89055 Missing authorization in Customer Reviews for WooCommerce
- CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes
- CVE-2026-89052 Hardcoded AES encryption key in Archer C6
- CVE-2026-89051 Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- CVE-2026-89050 Quads Ads Manager for Google AdSense < 3.0.5 - Subscriber+ Ad-Selling Payment Bypass via Unverified Success Return URL
- CVE-2026-8905 Osiris Signature Banner <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'prepend_text' Parameter
- CVE-2026-89049 Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent
- CVE-2026-89047 Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL
- CVE-2026-89046 zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset
- CVE-2026-89045 zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length
- CVE-2026-89044 Other in netty
- CVE-2026-89043 passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending
- CVE-2026-89042 passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification
- CVE-2026-89040 Tencent Mass Service Engine in Cluster (MSEC) path traversal
- CVE-2026-8904 Cross-site request forgery in FastPicker, an order picker and order management system (oms) for WooCommerce on steroids
- CVE-2026-89039 Arbitrary file read via the convert_playwright_script prompt in mcp-k6
- CVE-2026-89038 Verizon Cloud for Android < 26.7.10 Path Traversal via OneTouchUploadActivity
- CVE-2026-89036 Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter
- CVE-2026-89035 MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass
- CVE-2026-89034 TCH QRing R20_B006 Unauthenticated BLE Access
- CVE-2026-89032 BerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer
- CVE-2026-89031 Blog2Social WordPress Plugin < 9.1.0 Broken Access Control via b2s_calendar_move_post
- CVE-2026-89030 Blog2Social WordPress Plugin < 9.1.0 User Email Disclosure via b2s_search_user
- CVE-2026-8903 Two-factor authentication (formerly IP Vault) <= 2.1 - Cross-Site Request Forgery to Settings Update
- CVE-2026-89029 Blog2Social WordPress Plugin < 9.1.0 User Enumeration via AJAX Handler
- CVE-2026-89028 MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndX
- CVE-2026-89027 miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade
- CVE-2026-89026 Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate
- CVE-2026-89025 Hirschmann HiOS Switch Platform DoS via Malformed HTTP Request
- CVE-2026-89023 ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API
- CVE-2026-89022 BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion
- CVE-2026-89021 MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction
- CVE-2026-89020 MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path
- CVE-2026-8902 AJAX Report Comments <= 2.0.4 - Cross-Site Request Forgery to Settings Update
- CVE-2026-89013 Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php
- CVE-2026-89012 Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter
- CVE-2026-89011 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo
- CVE-2026-89010 WAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_server
- CVE-2026-8901 Integration for Freshsales <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Form Submission Data
- CVE-2026-89009 WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server
- CVE-2026-89008 Bookit < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure
- CVE-2026-89007 Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization
- CVE-2026-89006 WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import
- CVE-2026-89005 WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category
- CVE-2026-89004 WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDOR
- CVE-2026-89003 WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview
- CVE-2026-89002 WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview
- CVE-2026-89001 WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings
- CVE-2026-89000 WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run
- CVE-2026-8900 Simple SEO Slideshow <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-88999 Missing authorization in Redux Framework
- CVE-2026-88998 Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN
- CVE-2026-88997 JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key
- CVE-2026-88996 WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter
- CVE-2026-88995 Bookit < 2.6.0.1 - Unauthenticated Appointment PII Disclosure via Availability Check
- CVE-2026-88994 All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes
- CVE-2026-88993 All Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type Attribute
- CVE-2026-8899 Auto Thumbnails <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes