Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 312 of 1013.
- CVE-2026-84823 Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role
- CVE-2026-84821 WordPress WP Fast Total Search plugin <= 1.82.284 - Broken Access Control vulnerability
- CVE-2026-84820 Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- CVE-2026-8482 Information leak in NSRPC client history
- CVE-2026-84819 WordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-84818 WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-84817 WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-84816 WordPress WPCS plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-84815 WordPress Enfold theme <= 8.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-84814 WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability
- CVE-2026-84813 WordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerability
- CVE-2026-84812 WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-84811 agentverus-scanner Companion Code Analysis Bypass via Excluded Python Bytecode
- CVE-2026-84810 claude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory Scan
- CVE-2026-8481 Remote Code Execution via Code Validation Endpoint
- CVE-2026-84809 Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode
- CVE-2026-84808 Kimai before 2.65.0 Authorization Bypass via API Timesheet
- CVE-2026-84807 Kimai before 2.65.0 Authentication Bypass via Team Creation
- CVE-2026-84806 Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints
- CVE-2026-84805 Kimai 2.61.0 before 2.63.0 Authentication Bypass via API
- CVE-2026-84804 Kimai before 2.65.0 Authorization Bypass via Team Activity API
- CVE-2026-84803 SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist
- CVE-2026-84802 Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController
- CVE-2026-84801 Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers
- CVE-2026-84800 Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file
- CVE-2026-8480 Connection possible to the Administration portal with a revoked certificate
- CVE-2026-84799 Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations
- CVE-2026-84798 Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite
- CVE-2026-84797 Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate
- CVE-2026-84796 Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass
- CVE-2026-84795 Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance
- CVE-2026-84794 Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset
- CVE-2026-84793 Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name
- CVE-2026-84792 Craft CMS before 5.10.11 Broken Access Control via element-indexes
- CVE-2026-84791 Broken Access Control vulnerability
- CVE-2026-84790 Auth bypass in OpenVPN
- CVE-2026-8479 Null dereference in RTU500 series CMU firmware
- CVE-2026-84789 Broken Access Control vulnerability
- CVE-2026-84787 Privilege Escalation vulnerability
- CVE-2026-84784 QUIC: Unbounded RETIRE_CONNECTION_ID Backlog
- CVE-2026-84783 Use-After-Free in X.509 Extension Cache Under Concurrent Use
- CVE-2026-84782 DTLS Retransmits Handshake Messages From a Stale Buffer Offset
- CVE-2026-84781 WordPress Gallery PhotoBlocks plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-84780 WordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerability
- CVE-2026-8478 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
- CVE-2026-84779 WordPress Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin <= 1.51.0 - Broken Access Control vulnerability
- CVE-2026-84778 WordPress Migrate Guru – Site Migration & Cloning plugin <= 6.65 - Denial of Service Attack vulnerability
- CVE-2026-84777 WordPress Really Simple SSL plugin <= 9.8.0 - 2FA Bypass vulnerability
- CVE-2026-84776 WordPress MalCare Security plugin <= 6.69 - Denial of Service Attack vulnerability
- CVE-2026-84775 WordPress Really Simple SSL plugin <= 9.8.0 - Denial of Service Attack vulnerability
- CVE-2026-84774 WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-84773 WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-84772 WordPress Broken Link Checker plugin <= 2.4.14 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-84771 WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-84770 WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-8477 Security feature bypass in Server
- CVE-2026-84769 WordPress Business Directory plugin <= 6.4.26 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-84768 WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability
- CVE-2026-84767 WordPress BookIt plugin <= 2.6.0.3 - Bypass Vulnerability vulnerability
- CVE-2026-84766 WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability
- CVE-2026-84765 WordPress Breadcrumb NavXT plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-84764 WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-84763 WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-84762 WordPress WP EasyPay plugin <= 4.5.3 - Bypass Vulnerability vulnerability
- CVE-2026-84761 WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-84760 WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.9 - Broken Access Control vulnerability
- CVE-2026-8476 Disk Cache Deserialization Remote Code Execution Vulnerability
- CVE-2026-84759 WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-84758 WordPress Business Directory plugin <= 6.4.26 - Broken Access Control vulnerability
- CVE-2026-84757 WordPress WP Compress plugin <= 7.21.28 - Settings Change vulnerability
- CVE-2026-84756 WordPress WCFM Membership plugin <= 2.11.11 - Privilege Escalation vulnerability
- CVE-2026-84755 WordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerability
- CVE-2026-84754 WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability
- CVE-2026-84753 WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability
- CVE-2026-84752 WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability
- CVE-2026-84750 Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Field
- CVE-2026-84748 Missing authorization in Apache bRPC
- CVE-2026-84747 Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments
- CVE-2026-84745 The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API
- CVE-2026-84744 WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation
- CVE-2026-84743 Missing authorization in The Events Calendar
- CVE-2026-84742 The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API
- CVE-2026-84741 The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST API
- CVE-2026-84740 The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter
- CVE-2026-8474 Possible to run a Cross Site Scripting request on the login API available on Stormshield SNS appliances.
- CVE-2026-84739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-84738 AF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE
- CVE-2026-84737 Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter
- CVE-2026-84736 Security feature bypass in Eclipse aeriOS
- CVE-2026-84734 Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter
- CVE-2026-84732 Integer overflow in OpenVPN
- CVE-2026-84731 Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS
- CVE-2026-84727 Apache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort Message
- CVE-2026-84725 Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap
- CVE-2026-84724 Command injection in Red Hat Ansible Automation Platform 2.5 for RHEL 8
- CVE-2026-84721 Server-side request forgery in Red Hat Ansible Automation Platform 2
- CVE-2026-84720 Information disclosure in Red Hat Ansible Automation Platform 2.5 for RHEL 8
- CVE-2026-8472 Missing Authorization in GitLab
- CVE-2026-84719 Missing authorization in Red Hat Ansible Automation Platform 2.4 for RHEL 8
- CVE-2026-84718 Security feature bypass in Red Hat Ansible Automation Platform 2.5 for RHEL 8