Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 335 of 1013.
- CVE-2026-82269 Gophish Account Lockout and Forced Password Change Bypassable via API Key
- CVE-2026-82268 Qwen-Agent Server-Side Request Forgery via Caller-Supplied Document URL
- CVE-2026-82267 Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check
- CVE-2026-82266 Redpanda Admin API Unauthenticated Superuser Access via Default Configuration
- CVE-2026-82265 Zipkin Unauthenticated Spring Boot Actuator Endpoints Exposure
- CVE-2026-82264 Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths
- CVE-2026-82263 Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL
- CVE-2026-82262 Logto Server-Side Request Forgery via webhook test endpoint
- CVE-2026-82261 SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization
- CVE-2026-82260 SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization
- CVE-2026-8226 Open5GS types.c ogs_pcc_rule_install_flow_from_media denial of service
- CVE-2026-82259 SvelteKit 2.49.0 before 2.53.3 Denial of Service via form
- CVE-2026-82258 SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch
- CVE-2026-82257 SvelteKit before 2.69.1 Prototype Pollution via File Input
- CVE-2026-82256 SvelteKit before 2.69.1 Denial of Service via Remote Form
- CVE-2026-82255 gitoxide 0.25.4 HTTP Credential Leak via Redirect
- CVE-2026-82254 gitoxide before 0.69.0 Denial of Service via gix-pack
- CVE-2026-82253 gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass
- CVE-2026-82252 gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules
- CVE-2026-82251 gitoxide before 0.52.1 Path Traversal via Submodule Name
- CVE-2026-82250 gitoxide gix-packetline before 0.21.5 Denial of Service
- CVE-2026-8225 Open5GS delete Endpoint sm-sm.c pcf_npcf_smpolicycontrol_handle_delete denial of service
- CVE-2026-82249 gitoxide before 0.38.2 Credential Helper Protocol Field Injection
- CVE-2026-82248 gitoxide before 0.33.0 Path Traversal via symlink following
- CVE-2026-82247 gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing
- CVE-2026-82246 Budibase Server before 3.41.3 SSRF via Query Import
- CVE-2026-82245 Budibase before 3.41.3 Missing Authorization License Management
- CVE-2026-82244 Budibase before 3.41.3 Remote Code Execution via Plugin eval()
- CVE-2026-82243 Budibase Server before 3.41.3 SSRF with Credential Leakage
- CVE-2026-82242 Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization
- CVE-2026-82241 Budibase backend-core SSRF via incomplete default blacklist
- CVE-2026-82240 Budibase before 3.41.3 Privilege Escalation via User Update API
- CVE-2026-8224 Open5GS PCF context.c pcf_sess_set_ipv6prefix denial of service
- CVE-2026-82239 Budibase before 3.41.3 Authorization Bypass via datasources/query
- CVE-2026-82238 filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads
- CVE-2026-82237 filebrowser through 2.63.23 Stale Share Link via File Rename
- CVE-2026-82236 File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion
- CVE-2026-82235 filebrowser through 2.63.23 Denial of Service via named pipes
- CVE-2026-82234 SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU
- CVE-2026-82233 SiYuan before v3.8.1 Path Traversal via asset.upload
- CVE-2026-82232 Apache Syncope: SQL injection via sort parameter in Task search
- CVE-2026-82231 Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client
- CVE-2026-82230 Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser
- CVE-2026-8223 Open5GS sm-policies Endpoint pcf_sess_sbi_discover_and_send denial of service
- CVE-2026-82229 WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-82228 WordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerability
- CVE-2026-82227 WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerability
- CVE-2026-82226 WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability
- CVE-2026-82225 WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability
- CVE-2026-82224 WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-82223 WordPress WP Event SOlution plugin <= 4.1.22 - Broken Access Control vulnerability
- CVE-2026-82222 WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
- CVE-2026-82221 WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-82220 WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability
- CVE-2026-8222 Open5GS sm-policies Endpoint nbsf-handler.c pcf_nbsf_management_handle_register denial of service
- CVE-2026-82217 Path traversal in Eclipse Theia
- CVE-2026-82215 WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook
- CVE-2026-82213 Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR
- CVE-2026-82212 Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler
- CVE-2026-82211 Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure
- CVE-2026-82210 Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames
- CVE-2026-8221 Devs Palace ERP Online item-save cross site scripting
- CVE-2026-82209 domain-scoped PSL domain cookie
- CVE-2026-82208 wolfSSL CA-cache hit overrides callback
- CVE-2026-8220 Devs Palace ERP Online customer-save cross site scripting
- CVE-2026-82195 10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion
- CVE-2026-82194 WPvivid Backup & Migration < 0.9.134 - Admin+ Arbitrary File Deletion via Path Traversal
- CVE-2026-82193 WPvivid Backup & Migration < 0.9.134 - Admin+ File Write Outside the Backup Directory via Path Traversal
- CVE-2026-82191 Other in J2Store extension for Joomla
- CVE-2026-82190 Weak cryptography in J2Store extension for Joomla
- CVE-2026-8219 Devs Palace ERP Online supplier-save cross site scripting
- CVE-2026-82189 Business logic in J2Store extension for Joomla
- CVE-2026-82187 WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File Upload
- CVE-2026-82186 WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter
- CVE-2026-82185 WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset
- CVE-2026-82184 WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update
- CVE-2026-82183 OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion
- CVE-2026-82182 WPvivid Backup & Migration < 0.9.133 - Admin+ SQLi via Upload Cleaner Isolation
- CVE-2026-82181 Le-yan｜Medical Practice Management System - Sensitive Data in URL
- CVE-2026-82180 Auth bypass in Eclipse Arrowhead
- CVE-2026-8218 Devs Palace ERP Online purchase_return_save cross site scripting
- CVE-2026-8217 Industrial Application Software IAS Canias ERP RMI Runtime.getRuntime.exec os command injection
- CVE-2026-82166 Missing authorization in Application Store
- CVE-2026-82165 Misconfiguration in Command | Integration Suite for System Center
- CVE-2026-82164 Misconfiguration in Trusted Device Client,
- CVE-2026-82163 Misconfiguration in Command | Intel vPro Out of Band
- CVE-2026-82162 Privilege escalation in Command | Configure (DCC)
- CVE-2026-8216 Auth bypass in Canias ERP
- CVE-2026-82157 Security feature bypass in ThinOS 10
- CVE-2026-82153 Information disclosure in OS Recovery Tool
- CVE-2026-8215 Industrial Application Software IAS Canias ERP RMI iasRequestFileEvent path traversal
- CVE-2026-8214 Industrial Application Software IAS Canias ERP RMI doAction improper authentication
- CVE-2026-8213 OSGeo gdal Grid File GDapi.c GDSDfldsrch heap-based overflow
- CVE-2026-82127 Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields
- CVE-2026-82126 Missing authorization in Schema & Structured Data for WP & AMP
- CVE-2026-82125 Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOR
- CVE-2026-82124 Information disclosure in Schema & Structured Data for WP & AMP
- CVE-2026-82123 WordPress Loops & Logic - Reflected XSS
- CVE-2026-82122 Stack-based Buffer Overflow Vulnerability in HiRDB
- CVE-2026-82121 Origin Validation Error Vulnerability in HiRDB