Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 279 of 1013.
- CVE-2026-8898 Events In City <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-88978 Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter
- CVE-2026-88976 @platejs/core HTML deserialization can trigger browser behavior during parsing
- CVE-2026-88975 Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE
- CVE-2026-88974 WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost
- CVE-2026-8897 Shortcode Buddy <= 0.1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-88967 Azure Monitor access token disclosure via SSRF
- CVE-2026-88964 Integer overflow in OpenVPN
- CVE-2026-88963 Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter
- CVE-2026-88962 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-8896 MIR blocks and shortcodes <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-88959 Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints
- CVE-2026-88956 Botslab G980H Dashcams Missing Authentication for Critical Function
- CVE-2026-88952 OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication
- CVE-2026-8895 kk blog card <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-88944 Missing authorization in Tutor LMS – eLearning and online course solution
- CVE-2026-88941 Denial of service in Administration Server
- CVE-2026-88940 knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint
- CVE-2026-8894 iWR Tooltip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-88939 knowns through 0.33.0 Authorization Bypass via project.set Bootstrap Exemption
- CVE-2026-88938 knowns through 0.33.0 Path Traversal via code.find MCP tool
- CVE-2026-88937 knowns through 0.33.0 Path Traversal via Template Engine
- CVE-2026-88932 multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
- CVE-2026-88931 Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update
- CVE-2026-88930 Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret
- CVE-2026-8893 Cross-site scripting in Express Payment For Stripe
- CVE-2026-88929 Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure
- CVE-2026-88928 PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass
- CVE-2026-88927 rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR
- CVE-2026-88926 VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi
- CVE-2026-88924 Gvfs: gvfs-admin socket ownership race permits local root
- CVE-2026-88922 Go-getter vulnerable to a privilege escalation issue in its archive decompression handling
- CVE-2026-88921 MISP: Unescaped HTML Injection in PDF Report Element Rendering
- CVE-2026-88920 Apache WSS4J: SAML Sender-Vouches Authentication Bypass
- CVE-2026-8892 Cross-site scripting in CM Business Directory – Optimise and showcase local business
- CVE-2026-88916 Admin Access Bypass via Header Fallback in TÜBİTAK ULAKBİM's UlakPDF
- CVE-2026-88915 MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization
- CVE-2026-88914 Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser
- CVE-2026-88912 rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDOR
- CVE-2026-88910 KBoard < 6.7 - Unauthenticated Board Media Deletion via IDOR
- CVE-2026-8891 BitForm <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-88907 SAML ePPN Attribute Validation Bypass in TÜBİTAK ULAKBİM's UlakPDF
- CVE-2026-88905 KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings
- CVE-2026-88904 PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation
- CVE-2026-88903 Topcontent <= 1.2.1 - Unauthenticated Stored XSS via Content Webhook
- CVE-2026-88901 Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default
- CVE-2026-88900 Deserialization in Apache Camel
- CVE-2026-8890 code100x Mobile API Authentication Bypass via Header Spoofing
- CVE-2026-88899 knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header
- CVE-2026-88898 AppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint
- CVE-2026-88897 Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String
- CVE-2026-88896 EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass
- CVE-2026-88895 CyberPanel before 3.0.5 Authentication Bypass via API
- CVE-2026-88894 Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout
- CVE-2026-88893 OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure
- CVE-2026-88892 OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch
- CVE-2026-88891 OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations
- CVE-2026-88890 OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier
- CVE-2026-8889 CVE-2026-8889
- CVE-2026-88889 Renovate before 44.14.7 Command Injection via distributionType
- CVE-2026-88888 Renovate before 44.14.7 Command Injection via Mix organization
- CVE-2026-88887 Renovate before 44.11.2 Credential Exfiltration via Link Header
- CVE-2026-88886 Renovate before 44.14.7 Command Injection via gradle-wrapper
- CVE-2026-88885 Renovate before 44.14.7 Command Injection via depName
- CVE-2026-88884 Renovate before 44.3.1 Authentication Bypass via Digest Updates
- CVE-2026-88883 Renovate before 44.14.4 TLS Private Key Log Sanitisation
- CVE-2026-88882 Renovate before 44.11.2 Credential Exfiltration via Link Header
- CVE-2026-88881 Renovate before 44.11.3 Credential Exfiltration via Link Header
- CVE-2026-88880 Renovate before 44.11.3 Credential Exfiltration via Link Header
- CVE-2026-8888 CVE-2026-8888
- CVE-2026-88879 Traefik before v2.11.56 Identity Spoofing via Header Alias
- CVE-2026-88878 Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass
- CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
- CVE-2026-88876 AVideo PlayerSkins seo.php Missing Authorization Password-Protected VOD
- CVE-2026-88875 AVideo Incomplete API Sanitization Information Disclosure
- CVE-2026-88874 AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass
- CVE-2026-88873 WWBN AVideo Cross-Site Request Forgery via logArchive.json.php
- CVE-2026-88872 AVideo CustomizeUser setPassword.json.php CSRF
- CVE-2026-88871 WWBN AVideo CustomizeUser setSubscribers CSRF via GET
- CVE-2026-88870 WWBN AVideo LoginControl PGP Key CSRF via GET Request
- CVE-2026-8887 Listen Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-88869 AVideo AD_Server Stored XSS via log.php label parameter
- CVE-2026-88868 AVideo LiveLinks Stored XSS via title and description fields
- CVE-2026-88867 WWBN AVideo Stored XSS via Category Name and Icon Class
- CVE-2026-88866 WWBN AVideo LoginControl Stored XSS via User-Agent Header
- CVE-2026-88865 AVideo Missing Authorization via getRestream.json.php
- CVE-2026-88864 Capgo SSO Provider Authentication Bypass via PostgREST Direct Write
- CVE-2026-88863 capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org
- CVE-2026-88862 Capgo API Key Manager Authentication Bypass via x-limited-key-id
- CVE-2026-88861 Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization
- CVE-2026-88860 Capgo Authorization Bypass via Stale Channel Permission Overrides
- CVE-2026-8886 hk_shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
- CVE-2026-88859 Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction
- CVE-2026-88858 Server-side expression parser denial of service
- CVE-2026-88857 File upload in OrdaSoft Joomla Gallery extension for Joomla
- CVE-2026-88856 Code injection in OrdaSoft Joomla Gallery extension for Joomla
- CVE-2026-88855 SQL injection in OrdaSoft Joomla Gallery extension for Joomla
- CVE-2026-88854 Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
- CVE-2026-88853 Cross-site scripting in Modals (Pro) extension for Joomla
- CVE-2026-88852 Cross-site scripting in Snippets (Free) extension for Joomla