Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 338 of 1013.
- CVE-2026-81893 Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery
- CVE-2026-81892 EasyAdmin custom-action dispatcher bypasses access_control on other routes
- CVE-2026-81891 elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
- CVE-2026-81890 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
- CVE-2026-8189 Wavlink NU516U1 adm.cgi wzdrepeater os command injection
- CVE-2026-81889 elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
- CVE-2026-81888 @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
- CVE-2026-81887 Livewire DOM-based cross-site scripting during client-side state handling
- CVE-2026-81886 radare2: Uncontrolled memory allocation in radare2 dmp64 parser
- CVE-2026-81885 radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser
- CVE-2026-81884 radare2: Heap out-of-bounds read in radare2 Mach-O LC_DATA_IN_CODE parser
- CVE-2026-81883 radare2: Out-of-bounds Read at the end of string in the LUA 5.3 bytecode
- CVE-2026-81882 radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser
- CVE-2026-81881 radare2: Heap out-of-bounds read in radare2 Mach-O Swift metadata parser
- CVE-2026-81880 radare2: Uncontrolled resource consumption in radare2 PEF loader
- CVE-2026-8188 Wavlink NU516U1 adm.cgi change_wifi_password os command injection
- CVE-2026-81879 radare2: Heap out-of-bounds read in radare2 ELF PN_XNUM handling
- CVE-2026-81878 radare2: Integer overflow causes heap out-of-bounds write in radare2 PYC parser
- CVE-2026-81876 HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
- CVE-2026-81875 HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
- CVE-2026-81872 OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full
- CVE-2026-81871 OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
- CVE-2026-81870 OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs
- CVE-2026-8187 Open5GS UPF gtp-path.c _gtpv1_u_recv_cb resource consumption
- CVE-2026-81869 OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
- CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession
- CVE-2026-81867 Deserialization of Untrusted Data in Application Integration allows Remote Code Execution
- CVE-2026-81866 Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration
- CVE-2026-81862 Information disclosure in Apache Airflow Teradata provider
- CVE-2026-81861 Information disclosure in SCADAPack 32
- CVE-2026-8186 Open5GS NF client.c ogs_sbi_client_send_via_scp_or_sepp out-of-bounds
- CVE-2026-81859 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
- CVE-2026-81858 IBM i is Affected By A Denial of Service Vulnerability in Host Servers
- CVE-2026-81856 Terminal escape sequence injection in Hex via unneutralized server-supplied output
- CVE-2026-81855 Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key
- CVE-2026-81853 AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle
- CVE-2026-81852 AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass
- CVE-2026-81851 Fireware OS Heap-Based Buffer Overflow in iked Allows Denial of Service
- CVE-2026-8185 UGREEN CM933 Administrative missing authentication
- CVE-2026-81849 Path traversal in the aws:downloadContent plugin in amazon-ssm-agent
- CVE-2026-81848 cyberchitta scrapling-fetch-mcp _fetcher.py s_fetch_pattern server-side request forgery
- CVE-2026-81847 MAA-AI MaaMCP pipeline_tools.py load_pipeline path traversal
- CVE-2026-81846 runZero MCP 'Findings summaries' Data Leak
- CVE-2026-81845 arben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session path traversal
- CVE-2026-81842 Library panel can be moved into a folder without library panel create permission
- CVE-2026-81841 Paused shared dashboard access tokens still expose data source configuration
- CVE-2026-81839 Incorrect Authorization in GitLab
- CVE-2026-81838 Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)
- CVE-2026-81837 RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal
- CVE-2026-81836 RooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission
- CVE-2026-81835 RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection
- CVE-2026-81834 RooCodeInc Roo-Code README File ExecaTerminalProcess code injection
- CVE-2026-81833 RooCodeInc Roo-Code CodeIndexManager helpers.ts optimizeQuery code injection
- CVE-2026-81832 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
- CVE-2026-81830 Security feature bypass in OpenVPN
- CVE-2026-8183 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement
- CVE-2026-81829 Server-side request forgery in Exploit Intelligence
- CVE-2026-81827 Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input
- CVE-2026-81826 Flowintel Fails to Invalidate Active Sessions After Password Change
- CVE-2026-81825 Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting
- CVE-2026-81824 AVEVA Pipeline Integrity Monitor cross-site scripting
- CVE-2026-81823 AVEVA Pipeline Integrity Monitor Missing Authorization
- CVE-2026-81822 AVEVA Pipeline Integrity Monitor Use of a Broken or Risky Cryptographic Algorithm
- CVE-2026-81821 AVEVA Pipeline Integrity Monitor Use of hard-coded cryptographic key
- CVE-2026-81820 Flowintel HTML Injection in MISP Case History Timeline via Crafted Object Attributes
- CVE-2026-8182 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
- CVE-2026-81819 Flowintel Missing Authorization Allows Regular API Users to View Other Users’ Task Assignments
- CVE-2026-81818 Flowintel Organization Administrator Can Reset Full Administrator Password and Escalate Privileges
- CVE-2026-81817 Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification
- CVE-2026-81814 Flowintel Stored XSS in Calendar via Malicious Case Title
- CVE-2026-81813 Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass
- CVE-2026-81812 Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload
- CVE-2026-81810 Privilege escalation in All-in-One WP Migration and Backup
- CVE-2026-8181 Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover
- CVE-2026-81809 Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback
- CVE-2026-81807 Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification
- CVE-2026-81806 WordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-81805 WordPress SiteSkite plugin <= 2.1.5 - Privilege Escalation vulnerability
- CVE-2026-81804 WordPress ZHBackup – Backup, Restore & Migration plugin <= 2.4.2 - Sensitive Data Exposure vulnerability
- CVE-2026-81803 WordPress RepairBuddy plugin <= 4.1224 - Remote Code Execution (RCE) vulnerability
- CVE-2026-81802 WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-81801 WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability
- CVE-2026-81800 WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability
- CVE-2026-8180 Multiple vulnerabilities in Aspera applications.
- CVE-2026-81799 WordPress Return Refund and Exchange For WooCommerce plugin <= 4.6.4 - Broken Access Control vulnerability
- CVE-2026-81798 WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81797 WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability
- CVE-2026-81796 WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability
- CVE-2026-81795 WordPress Page Visits Counter – Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81794 WordPress Shirt Product Designer for WooCommerce plugin 1.0.4 - Broken Access Control vulnerability
- CVE-2026-81793 WordPress Salon booking system plugin <= 10.31.9 - Broken Access Control vulnerability
- CVE-2026-81792 WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.5 - Privilege Escalation vulnerability
- CVE-2026-81791 WordPress EventON plugin <= 2.5.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81790 WordPress Csomagpontok és szállítási címkék WooCommerce-hez plugin < 4.2.8 - Broken Access Control vulnerability
- CVE-2026-8179 Multiple vulnerabilities in Aspera applications.
- CVE-2026-81789 WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability
- CVE-2026-81788 WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Access Control vulnerability
- CVE-2026-81787 WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Authentication vulnerability
- CVE-2026-81786 WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability
- CVE-2026-81785 WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability