Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 280 of 1013.
- CVE-2026-8885 DeMomentSomTres Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-88849 MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment
- CVE-2026-88848 MasterStudy LMS 1.9 - < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass
- CVE-2026-88847 MasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record Creation
- CVE-2026-88846 MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled
- CVE-2026-88845 MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import
- CVE-2026-88844 MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR
- CVE-2026-88843 MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget
- CVE-2026-88842 Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption
- CVE-2026-88840 Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello
- CVE-2026-8884 Cross-site scripting in Instant-Quote.co Quotation Page
- CVE-2026-88839 Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint
- CVE-2026-88838 Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions
- CVE-2026-88837 Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication
- CVE-2026-88835 Memory corruption in Red Hat Hardened Images
- CVE-2026-88834 Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds
- CVE-2026-88833 Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service
- CVE-2026-88832 Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow
- CVE-2026-88831 Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths
- CVE-2026-88830 Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow
- CVE-2026-8883 Cross-site scripting in Global Body Mass Index Calculator
- CVE-2026-88829 Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy
- CVE-2026-88828 Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass via XML-RPC and Application Passwords
- CVE-2026-88827 Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords
- CVE-2026-88826 SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums
- CVE-2026-88825 iGMS Direct Booking < 2.0 - Unauthenticated Stored XSS via Widget Settings
- CVE-2026-88824 Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings
- CVE-2026-8882 Cross-site scripting in WP ApplicantStack Jobs Display
- CVE-2026-88819 Auth bypass in Eclipse Data Plane Core
- CVE-2026-88817 Privilege escalation via legacy access group creation endpoint
- CVE-2026-88816 DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName
- CVE-2026-88815 DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv
- CVE-2026-88812 X.Org Server XKB SetGeometry TextDoodad Double Free
- CVE-2026-8881 CVE-2026-8881
- CVE-2026-88808 Privilege escalation in Rancher
- CVE-2026-88807 libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow
- CVE-2026-88806 libX11 XkbGetMap Reply Heap-based Buffer Overflow
- CVE-2026-88805 Session Not Revoked Server-Side on Logout in Rancher
- CVE-2026-88804 Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher
- CVE-2026-88802 MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion
- CVE-2026-8880 RomanCart Ecommerce <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-88798 Really Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP Header
- CVE-2026-88797 Vayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and Activation
- CVE-2026-88795 wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token
- CVE-2026-88794 XML External Entity injection in Sparx Enterprise Architect
- CVE-2026-88793 YouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_server
- CVE-2026-88792 Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update
- CVE-2026-88791 Safe Redirect Manager < 2.3.0 - Open Redirect via Wildcard Redirect Rules
- CVE-2026-88790 proma-ai Proma File Preview Service file-preview-service.ts resolveTargetPath path traversal
- CVE-2026-8879 CVE-2026-8879
- CVE-2026-88789 Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening
- CVE-2026-88788 Text Styler <= 1.1.1 - Contributor+ Stored XSS
- CVE-2026-88785 Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String
- CVE-2026-88784 Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewriting
- CVE-2026-88783 Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content
- CVE-2026-88782 Kubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribute
- CVE-2026-88781 Memory corruption in motherboards firmware
- CVE-2026-8878 CVE-2026-8878
- CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer
- CVE-2026-88778 TCP Initial Sequence Number (ISN) prediction
- CVE-2026-88777 Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
- CVE-2026-88776 Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
- CVE-2026-88775 Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
- CVE-2026-88774 Feature policy bypass due to improper HTTP URL based expression usage
- CVE-2026-88773 HTTP Request Smuggling
- CVE-2026-88772 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer
- CVE-2026-88771 Citrix NetScaler Improper Input Validation
- CVE-2026-88770 Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts
- CVE-2026-8877 Responsive Video Embedder <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-88765 Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
- CVE-2026-88764 Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref
- CVE-2026-88763 Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of service
- CVE-2026-88761 Botslab G980H Dashcams Use of Weak Credentials
- CVE-2026-8876 CVE-2026-8876
- CVE-2026-88756 Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public logi
- CVE-2026-88755 Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace conf
- CVE-2026-88753 A Regular-Expression Denial of Service (ReDoS) in the Markdown2.
- CVE-2026-8875 Cross-site scripting in Easy Prism Syntax Highlighter
- CVE-2026-88746 idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.
- CVE-2026-88745 EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.
- CVE-2026-88743 Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags.
- CVE-2026-88742 Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in the client address field.
- CVE-2026-8874 CVE-2026-8874
- CVE-2026-88738 Jazzware RT1000 Edge webUI v.
- CVE-2026-8873 Content Slideshow <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-8872 Animate Your Content <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-8871 Formidable Kinetic <= 1.1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-8870 Team Master <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-8869 Mutual Funds Data <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
- CVE-2026-8868 Single Mailchimp <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-8867 Post Categories Gallery <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-8866 jQuery googleslides <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-8865 Cross-site scripting in Avalon23 Products Filter for WooCommerce
- CVE-2026-88648 Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PK
- CVE-2026-88647 A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communic
- CVE-2026-8864 HP Fan Control App – Potential Escalation of Privilege
- CVE-2026-8863 CVE-2026-8863
- CVE-2026-88624 Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory dele
- CVE-2026-88623 NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read.
- CVE-2026-88622 NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php.