Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 311 of 1013.
- CVE-2026-84963 Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser
- CVE-2026-84962 Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
- CVE-2026-84961 undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
- CVE-2026-84960 WP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scripting
- CVE-2026-8496 A cross-site scripting (XSS) vulnerability in Alinto SOGo, version 5.12.7
- CVE-2026-8495 Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037
- CVE-2026-84947 undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
- CVE-2026-84942 Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards
- CVE-2026-84941 Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read
- CVE-2026-8494 Permalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
- CVE-2026-84939 Apache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks
- CVE-2026-84937 YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax
- CVE-2026-84936 EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat
- CVE-2026-84935 HT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu Settings
- CVE-2026-84934 JCH Optimize < 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task Override
- CVE-2026-84933 undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
- CVE-2026-84931 Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute
- CVE-2026-84930 CatFolders Document Gallery < 2.0.7 - Author+ Stored XSS via titleTag Block Attribute
- CVE-2026-8493 Colorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036
- CVE-2026-84927 EmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews Modification
- CVE-2026-84926 EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST Route
- CVE-2026-84925 Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter
- CVE-2026-84924 Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125
- CVE-2026-84923 Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124
- CVE-2026-84921 Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133
- CVE-2026-84920 Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132
- CVE-2026-8492 Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035
- CVE-2026-84919 Cross-site scripting in PhotoSwipe - Responsive JavaScript Modal Image Gallery
- CVE-2026-84918 Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130
- CVE-2026-84917 Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127
- CVE-2026-84916 Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126
- CVE-2026-84915 Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123
- CVE-2026-84914 Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122
- CVE-2026-84913 AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121
- CVE-2026-84912 AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120
- CVE-2026-84911 AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119
- CVE-2026-84910 Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118
- CVE-2026-8491 Node View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034
- CVE-2026-84909 Cross-site scripting in Custom Twitter Feeds – A Tweets Widget or X Feed Widget
- CVE-2026-84908 Missing authorization in WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
- CVE-2026-84907 Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint
- CVE-2026-84906 Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay
- CVE-2026-84905 Eventin < 4.1.24 - Contributor+ User Creation via Speaker Creation
- CVE-2026-84904 King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer
- CVE-2026-84903 King Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page Shortcode
- CVE-2026-84902 King Addons for Elementor < 51.1.81 - Contributor+ Stored XSS via Template Catalog Import
- CVE-2026-84901 Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization
- CVE-2026-84900 HP ThinPro 8.1 SP10 and ThinPro 9 SP3 Security Updates
- CVE-2026-84899 VikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffix
- CVE-2026-84898 Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta
- CVE-2026-84897 Denial of service in wolfSSH
- CVE-2026-84896 King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget
- CVE-2026-84895 Use after free in proxygen
- CVE-2026-84894 Use after free in moxygen
- CVE-2026-84893 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84891 Security vulnerability affects the Windows GIM component as part of IBM Guardium Data Protection
- CVE-2026-84890 undici vulnerable to Denial of Service via unbounded decompression of compressed responses
- CVE-2026-8489 Cross-site scripting in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
- CVE-2026-84889 Path traversal in Langflow OSS
- CVE-2026-84888 RightNow-AI OpenFang tool_runner.rs shell_exec memory allocation
- CVE-2026-84887 simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service
- CVE-2026-84886 simular-ai Agent-S OCR HTTP API ocr_server.py ImageData resource consumption
- CVE-2026-84885 simular-ai Agent-S CodeAgent code_agent.py denial of service
- CVE-2026-84884 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84882 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-8488 Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation
- CVE-2026-84875 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
- CVE-2026-8487 Incorrect default permissions vulnerability in Progress Software MOVEit Automation
- CVE-2026-84869 ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization
- CVE-2026-84862 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84860 Scada-LTS DWR Authorization Bypass - Systemic
- CVE-2026-8486 Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation
- CVE-2026-84859 Scada-LTS Authenticated Blind SQL Injection
- CVE-2026-84858 Scada-LTS Authenticated Remote Code Execution via Scripting Sandbox Bypass
- CVE-2026-84857 sigoden aichat API Endpoint serve.rs memory allocation
- CVE-2026-84856 rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service
- CVE-2026-84854 Out of Bound Write on WibuKey for Windows
- CVE-2026-84852 Reader Tools PDF Reader App File ActSplashNew.handleDeeplink path traversal
- CVE-2026-84851 Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6
- CVE-2026-84850 Security feature bypass in Server
- CVE-2026-8485 Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation
- CVE-2026-84849 WordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerability
- CVE-2026-84848 WordPress Quick Event Manager plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-84847 WordPress Quick Event Manager plugin <= 9.17 - Broken Access Control vulnerability
- CVE-2026-84842 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84841 tsi-coop tsi-dpdp-cms client-side enforcement of server-side security
- CVE-2026-84840 tsi-coop tsi-dpdp-cms Bootstrap Setup Endpoint InterceptingFilter.java missing authentication
- CVE-2026-8484 Heap buffer overflow in Jansi
- CVE-2026-84839 tsi-coop tsi-dpdp-cms Admin Console/DPO Compliance Console web.xml missing authentication
- CVE-2026-84838 Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()
- CVE-2026-84837 Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path
- CVE-2026-84836 WordPress WC Ukraine Shipping plugin <= 1.22.3 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-84835 WordPress Rentsyst plugin <= 2.1.5 - Broken Access Control vulnerability
- CVE-2026-84834 WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability
- CVE-2026-84833 ntegrals openbrowser Browser Agent Message Construction agent.ts resource consumption
- CVE-2026-84832 Unsafe deserialization in the REST interface
- CVE-2026-84831 Mandatory MFA bypass before enrollment
- CVE-2026-84830 OS command injection in privileged configuration handling
- CVE-2026-84829 Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter
- CVE-2026-84828 Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token