Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 317 of 1013.
- CVE-2026-84270 Gvfs: mtp: out-of-bounds read in do_read()
- CVE-2026-8427 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id)
- CVE-2026-84269 Gvfs: afp: heap-based buffer overflow in dsi read path
- CVE-2026-84268 Gvfs: sftp: heap-based buffer overflow in read_reply()
- CVE-2026-84267 Gvfs: sftp: uninitialized heap disclosure in read_string()
- CVE-2026-84261 click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications
- CVE-2026-84260 click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications
- CVE-2026-8426 Concrete CMS does not validate a CSRF token before processing requests to `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>`
- CVE-2026-84259 click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications
- CVE-2026-84258 click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications
- CVE-2026-84256 Command injection in OpenVPN
- CVE-2026-84254 click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options Update
- CVE-2026-84253 click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update
- CVE-2026-84252 click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update
- CVE-2026-84251 click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update
- CVE-2026-84250 IBM Guardium Data Protection Hard-coded Credentials
- CVE-2026-8425 Notify Odoo <= 1.0.1 - Cross-Site Request Forgery to Settings Update
- CVE-2026-84249 IBM Guardium Data Protection is affected by vulnerability
- CVE-2026-84247 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84246 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
- CVE-2026-84245 IBM Guardium Data Protection Privilege Escalation
- CVE-2026-84244 IBM Guardium Data Protection Cross-Site Scripting
- CVE-2026-84241 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-8424 Remove Yellow BGBOX <= 1.0 - Cross-Site Request Forgery
- CVE-2026-84239 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84238 WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability
- CVE-2026-84235 Rockwell Automation 1756-ENBT Denial of Service Vulnerability
- CVE-2026-84233 Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames
- CVE-2026-84232 Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content
- CVE-2026-84230 IBM Guardium Data Protection is affected by multiple vulnerabilities
- CVE-2026-8423 JaviBola Custom Theme Test <= 2.0.5 - Cross-Site Request Forgery
- CVE-2026-84226 Privilege escalation in OpenVPN
- CVE-2026-84225 Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR
- CVE-2026-84224 Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL
- CVE-2026-84223 Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload
- CVE-2026-84222 Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter
- CVE-2026-84221 Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID
- CVE-2026-84220 Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection
- CVE-2026-8422 Remove meta boxes per user role <= 1.01 - Cross-Site Request Forgery to Settings Update
- CVE-2026-84219 Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding
- CVE-2026-84218 Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)
- CVE-2026-84217 WordPress Classified Listing plugin <= 6.1.3 - Broken Access Control vulnerability
- CVE-2026-84215 WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability
- CVE-2026-8421 Concrete CMS 9.5.0 and below is vulnerable to CSRF on install_package() with conditional token bypass leading to RCE
- CVE-2026-84209 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84208 AVideo User_Location Plugin Unauthenticated SQL Injection
- CVE-2026-84207 Heym before 0.0.98 SSRF via WebSocket endpoints
- CVE-2026-84206 Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore
- CVE-2026-84205 GROWI through 8.0.2 Authorization Bypass Through User-Controlled Key on apiv3 Revision Retrieval
- CVE-2026-84204 GROWI through 8.0.2 Missing Authorization on apiv3 Attachment Retrieval
- CVE-2026-84203 Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change
- CVE-2026-84202 ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading
- CVE-2026-84201 appium-mcp-server through 0.1.61 Path Traversal in write_file and write_files_batch
- CVE-2026-84200 Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions
- CVE-2026-8420 BLOGCHAT Chat System <= 1.3.6.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update
- CVE-2026-84199 Kyverno before 1.16.2 SSRF via APICall Feature
- CVE-2026-84198 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
- CVE-2026-84197 Security feature bypass in Eclipse Ditto
- CVE-2026-84196 Kyverno before 1.18.0 Server-Side Request Forgery via apiCall
- CVE-2026-84195 Kyverno before 1.16.4 Credential Leak via apiCall
- CVE-2026-84194 LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname
- CVE-2026-84193 LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP
- CVE-2026-84192 LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data
- CVE-2026-84191 LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields
- CVE-2026-84190 LibreNMS before 26.5.0 Remote Code Execution via AboutController
- CVE-2026-8419 Amazon Scraper <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update
- CVE-2026-84189 LibreNMS before 26.7.0 Stored XSS via Oxidized API
- CVE-2026-84188 librenms before 26.7.0 Stored XSS via graph_descr settings
- CVE-2026-84187 AVideo on_publish.php Missing Authentication Check via RTMP Callback
- CVE-2026-84186 Incorrect access control in PrestaShop
- CVE-2026-84185 Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification
- CVE-2026-84181 Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse
- CVE-2026-84180 Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions
- CVE-2026-8418 Games Catalog <= 1.2.0 - Cross-Site Request Forgery to Arbitrary Game/Post Deletion
- CVE-2026-84179 Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page
- CVE-2026-84178 Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow
- CVE-2026-84176 Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection
- CVE-2026-84175 Server-side request forgery in Eclipse Ditto
- CVE-2026-84173 Missing authorization in Eclipse Ankaios
- CVE-2026-84171 WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload
- CVE-2026-8417 Concrete CMS 9.5.0 and below is vulnerable to CSRF in do_update() in the package update controller
- CVE-2026-84169 UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery
- CVE-2026-84168 Easy Hide Login < 1.7 - Login Page Protection Bypass / Hidden URL Disclosure
- CVE-2026-84167 Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR
- CVE-2026-84166 Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF
- CVE-2026-84165 Lack of authorisation in OpenNebula by OpenNebula Systems
- CVE-2026-8416 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)
- CVE-2026-84154 Code injection in GEOVIA Geospatial Data Manager
- CVE-2026-84153 Xinhu Rainrock RockOA index.php toaddval sql injection
- CVE-2026-84151 The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening
- CVE-2026-84150 Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint
- CVE-2026-8415 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder
- CVE-2026-84149 Information Disclosure Vulnerability in Manacle Technologies ERP System
- CVE-2026-84148 Insecure Direct Object Reference Vulnerability in Manacle Technologies ERP System
- CVE-2026-84147 Remote Code Execution Vulnerability in Manacle Technologies ERP System
- CVE-2026-84146 Xpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick View
- CVE-2026-84145 Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15
- CVE-2026-84144 Internally found bugs fixed in Thunderbird 155 and Thunderbird ESR 153.2
- CVE-2026-84143 Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15
- CVE-2026-84142 Internally found bugs fixed in Thunderbird 155