Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 285 of 1013.
- CVE-2026-8794 PaperCut NG/MF: User enumeration via timing attack
- CVE-2026-87939 Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137
- CVE-2026-87938 CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136
- CVE-2026-87937 Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135
- CVE-2026-87936 amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134
- CVE-2026-87935 Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action
- CVE-2026-87933 DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free
- CVE-2026-87931 Memory corruption in Pavlok Behavioral Conditioning Wearable
- CVE-2026-87930 MaxSite CMS through 109.6 PHP Object Injection via ci_session
- CVE-2026-8793 PaperCut NG/MF: Insufficient brute-force protection
- CVE-2026-87929 MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key
- CVE-2026-87928 MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page
- CVE-2026-87927 MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher
- CVE-2026-87926 Rizwan17 inventory-management-system Login Page index.php cross site scripting
- CVE-2026-87925 Rizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injection
- CVE-2026-87924 Rizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authentication
- CVE-2026-87923 Rizwan17 inventory-management-system List DBOperation.php cross site scripting
- CVE-2026-87922 Rizwan17 inventory-management-system AJAX Backend process.php DBOperation.addCategory missing authentication
- CVE-2026-87921 Rizwan17 inventory-management-system manage.php update_record sql injection
- CVE-2026-87920 W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- CVE-2026-87919 Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode
- CVE-2026-87918 WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions
- CVE-2026-87917 MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag
- CVE-2026-87916 WPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure
- CVE-2026-87915 Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter
- CVE-2026-87913 Missing S3 bucket ownership verification in the AWS Security Agent MCP server
- CVE-2026-87912 Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops
- CVE-2026-87911 Command injection in AWS Labs postgres MCP Server
- CVE-2026-87910 tarfile hardlink fallback ignores custom extraction filter rejection via None
- CVE-2026-8791 Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- CVE-2026-87909 Command injection in WP Photo Album Plus
- CVE-2026-87908 multiparty vulnerable to Denial of Service via unbounded part-header accumulation
- CVE-2026-87907 Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes
- CVE-2026-87902 WordPress Core Remote File Inclusion
- CVE-2026-87901 Cross-site scripting in phpBB
- CVE-2026-87900 Command injection in WP Toolkit for cPanel
- CVE-2026-8790 Football Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting
- CVE-2026-87899 Privilege escalation in cPanel
- CVE-2026-87898 Command injection in Plesk extension "Site Import"
- CVE-2026-87897 Server-side request forgery in whiteboard
- CVE-2026-87896 Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route
- CVE-2026-87894 Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR
- CVE-2026-87892 Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass
- CVE-2026-87891 Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API
- CVE-2026-87890 Potential request forgery via spatial lookup byte values
- CVE-2026-8789 Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion
- CVE-2026-87888 YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route
- CVE-2026-87886 Acronis Backup Incorrect Default Permissions
- CVE-2026-87880 Security feature bypass in Acronis Cyber Protect 17
- CVE-2026-8788 Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections
- CVE-2026-87879 Security feature bypass in Acronis Cyber Protect 17
- CVE-2026-87878 Misconfiguration in Acronis Cyber Protect 17
- CVE-2026-87877 zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
- CVE-2026-87876 Auth bypass in Red Hat Enterprise Linux 10
- CVE-2026-87875 Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound
- CVE-2026-87874 Deserialization in Red Hat Ceph Storage 5
- CVE-2026-87872 Weak cryptography in Red Hat Ceph Storage 5
- CVE-2026-87870 Cross-site scripting in Ninja Forms - Scheduled Exports
- CVE-2026-8787 Firebase Support & Chat Management <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
- CVE-2026-87869 Cross-site scripting in Filter Everything — WordPress & WooCommerce Filters
- CVE-2026-87866 wolfSSL public-key pinning bypass
- CVE-2026-87865 knownhost callback mismatches key as missing
- CVE-2026-87864 IMAP APPEND plus CRLF conversion command injection
- CVE-2026-87863 HSTS response erases persisted entries
- CVE-2026-87862 HSTS cache import drops longer-lived child
- CVE-2026-87861 cross-origin reuse of a Negotiate connection
- CVE-2026-87860 Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF
- CVE-2026-8786 Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization
- CVE-2026-87859 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields
- CVE-2026-87858 Missing authorization in Temporal Server
- CVE-2026-87855 JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method
- CVE-2026-87854 Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass
- CVE-2026-87853 Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation
- CVE-2026-8785 projectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection
- CVE-2026-87849 Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
- CVE-2026-87848 MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure
- CVE-2026-87846 Shipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record Deletion
- CVE-2026-87844 Product Designer <= 1.0.40 - Unauthenticated Design Template Data Injection
- CVE-2026-87843 Trust Payments Gateway for WooCommerce < 3.1.0 - Unauthenticated Order Payment Completion via Payment Return Page
- CVE-2026-87842 Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure
- CVE-2026-87841 UnitechPay <= 1.0.6.3 - Unauthenticated Order Payment Bypass via Unsigned Webhook
- CVE-2026-87840 Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering
- CVE-2026-8784 npitre cramfs-tools cramfsck.c change_file_status symlink
- CVE-2026-87839 Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion
- CVE-2026-87838 Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook
- CVE-2026-87837 Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook
- CVE-2026-87836 Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export
- CVE-2026-87835 Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment
- CVE-2026-87831 Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Address Custom Field
- CVE-2026-87830 Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.
- CVE-2026-8783 omec-project amf dispatcher.go UERadioCapabilityCheckResponse null pointer dereference
- CVE-2026-87829 Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID Reparenting
- CVE-2026-87828 Seraphinite Accelerator < 2.29.24 - Subscriber+ DoS via seraph_accel_State Update
- CVE-2026-87827 KGUARD DVR unauthenticated remote command execution vulnerability
- CVE-2026-87825 zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries
- CVE-2026-87824 zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect
- CVE-2026-87823 zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods
- CVE-2026-87822 t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes
- CVE-2026-87821 Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch
- CVE-2026-87820 CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner