Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 295 of 1013.
- CVE-2026-86900 Memory corruption in macOS
- CVE-2026-8690 Missing authorization in RentMy Real-Time Rental Management Plugin
- CVE-2026-86898 Cross-site scripting in Safari
- CVE-2026-86897 Missing authorization in Safari
- CVE-2026-86896 Privilege escalation in macOS
- CVE-2026-86895 Information disclosure in iOS and iPadOS
- CVE-2026-86894 Security feature bypass in macOS
- CVE-2026-86893 Information disclosure in iOS and iPadOS
- CVE-2026-86892 Denial of service in iOS and iPadOS
- CVE-2026-86891 Missing authorization in macOS
- CVE-2026-86890 Auth bypass in iOS and iPadOS
- CVE-2026-8689 Missing authorization in Visualizer: Tables and Charts Manager for WordPress
- CVE-2026-86889 Security feature bypass in macOS
- CVE-2026-86888 Information disclosure in iOS and iPadOS
- CVE-2026-86887 Security feature bypass in iOS and iPadOS
- CVE-2026-86886 Path traversal in iOS and iPadOS
- CVE-2026-86885 Denial of service in iOS and iPadOS
- CVE-2026-86884 Privilege escalation in iOS and iPadOS
- CVE-2026-86883 Information disclosure in iOS and iPadOS
- CVE-2026-86882 Memory corruption in iOS and iPadOS
- CVE-2026-86881 Security feature bypass in iOS and iPadOS
- CVE-2026-86880 Missing authorization in iOS and iPadOS
- CVE-2026-8688 Missing authorization in Advance Nav Menu Manager
- CVE-2026-86879 Denial of service in iOS and iPadOS
- CVE-2026-86878 Information disclosure in iOS and iPadOS
- CVE-2026-86877 Path traversal in macOS
- CVE-2026-86876 Memory corruption in iOS and iPadOS
- CVE-2026-86875 Denial of service in Xcode
- CVE-2026-86874 Memory corruption in Xcode
- CVE-2026-86872 Business logic in Safari
- CVE-2026-86871 Integer overflow in macOS
- CVE-2026-86870 Memory corruption in iOS and iPadOS
- CVE-2026-86869 Memory corruption in iOS and iPadOS
- CVE-2026-86868 Auth bypass in macOS
- CVE-2026-86867 Cinnamon's kotaemon contains improper authorization checks in multi‑user chat handlers
- CVE-2026-86865 Tanium addressed a SQL injection vulnerability in Asset.
- CVE-2026-86864 pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool
- CVE-2026-86863 pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode
- CVE-2026-86862 pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools
- CVE-2026-86861 pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment check
- CVE-2026-86860 Unauthenticated Sensitive Data Disclosure in ServiceNow AI Platform
- CVE-2026-8686 DoS from MQTT v5.0 Deserialization Fault in core MQTT
- CVE-2026-86859 Unauthenticated Arbitrary Record Disclosure in ServiceNow AI Platform
- CVE-2026-86858 Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI Platform
- CVE-2026-86857 Authorization Bypass in ServiceNow AI Platform
- CVE-2026-86856 Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver
- CVE-2026-86853 Repeated external URL scheme launches could potentially cause a denial of service in Firefox for iOS
- CVE-2026-86851 Livees Checkout 6.8 - 7.0.2 - Unauthenticated Order Status Change, Order Note Injection & Order Key Disclosure
- CVE-2026-86850 SKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation Deletion
- CVE-2026-8685 Infility Global <= 2.15.16 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter
- CVE-2026-86849 Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto
- CVE-2026-86848 Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto
- CVE-2026-86847 Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup
- CVE-2026-86846 Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto
- CVE-2026-86845 Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup
- CVE-2026-86843 Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag
- CVE-2026-86842 Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings Overwrite
- CVE-2026-86841 Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options
- CVE-2026-86840 Bifrost Unauthorized Channel Commission Attribution Allows Commission Diversion
- CVE-2026-8684 Missing authorization in MotoPress Hotel Booking
- CVE-2026-86839 Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR
- CVE-2026-86838 Bookly < 28.3 - Unauthenticated Payment Bypass via Booking Price Manipulation
- CVE-2026-86837 Bookly < 28.3 - Unauthenticated Customer PII Update via Verification Bypass
- CVE-2026-86836 Race condition in Eclipse Ankaios
- CVE-2026-86834 MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration
- CVE-2026-86833 MetForm < 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field Shortcodes
- CVE-2026-86832 MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API
- CVE-2026-86831 Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS
- CVE-2026-86830 Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center
- CVE-2026-8683 Overly long URLs crash the Mattermost Desktop App
- CVE-2026-86828 BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback
- CVE-2026-86827 BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php
- CVE-2026-86826 BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX
- CVE-2026-86824 Newsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature Key
- CVE-2026-86823 Newsletter < 9.3.7 - Unauthenticated Open Redirect and Subscriber Token Disclosure via ncu Parameter
- CVE-2026-8682 Missing authorization in 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On
- CVE-2026-86819 Waves Central local privilege escalation via Improper XPC Client Authentication in macOS
- CVE-2026-86818 fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
- CVE-2026-86817 Information disclosure in Five Star Business Profile and Schema
- CVE-2026-86816 WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API
- CVE-2026-86815 Missing authorization in BackWPup
- CVE-2026-86814 UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email
- CVE-2026-86813 MetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-To
- CVE-2026-86812 WPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure and Modification via food-orders REST API
- CVE-2026-86810 Open-Web-Analytics Controller Controller.php checkCapabilityAndAuthenticateUser improper authentication
- CVE-2026-8681 Missing authorization in Essential Chat Support
- CVE-2026-86809 Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass
- CVE-2026-86808 moltis-org moltis vault.rs vault_recovery_handler missing authentication
- CVE-2026-86806 opengeos GeoLibre _is_within_roots server-side request forgery
- CVE-2026-86805 AT_SECURE programs may load attacker-controlled code via $ORIGIN
- CVE-2026-86804 seakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization
- CVE-2026-86803 Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template
- CVE-2026-86802 To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import
- CVE-2026-86801 To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler
- CVE-2026-86800 WP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility Check
- CVE-2026-86799 Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission
- CVE-2026-86798 HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint
- CVE-2026-86797 Pricing Table Block 1.0.7 - 2.1.4 - Contributor+ Stored XSS via Pricing Link
- CVE-2026-86796 Security feature bypass in Hide My WP Ghost
- CVE-2026-86794 Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form