Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 339 of 1013.
- CVE-2026-81784 WordPress Wise Chat plugin <= 3.4.2 - PHP Object Injection vulnerability
- CVE-2026-81783 WordPress MailMunch – Grow your Email List plugin <= 3.2.5 - Broken Authentication vulnerability
- CVE-2026-81782 WordPress WP Docs plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81781 WordPress Unbounce Landing Pages plugin <= 1.1.4 - Broken Access Control vulnerability
- CVE-2026-81780 WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability
- CVE-2026-8178 Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver
- CVE-2026-81779 WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability
- CVE-2026-81778 WordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81777 WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability
- CVE-2026-81776 WordPress WP QuickLaTeX plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81775 WordPress Estatik plugin <= 4.3.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81774 WordPress WooCommerce Product Attachment plugin <= 2.3.4 - Sensitive Data Exposure vulnerability
- CVE-2026-81773 WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81772 WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability
- CVE-2026-81771 WordPress TrustedSite plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81770 WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-8177 Memory corruption in XML::LibXML
- CVE-2026-81769 WordPress Booking Hub plugin <= 1.3.1 - Privilege Escalation vulnerability
- CVE-2026-81768 WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81767 WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability
- CVE-2026-81766 Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin
- CVE-2026-81765 WordPress Tailored Tools plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81764 WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81763 WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability
- CVE-2026-81762 WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability
- CVE-2026-81761 WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability
- CVE-2026-81760 WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-8176 Privilege escalation in LatePoint – Calendar Booking Plugin for Appointments and Events
- CVE-2026-81759 WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability
- CVE-2026-81758 WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability
- CVE-2026-81757 WordPress Rank Math SEO plugin <= 1.0.276 - Remote Code Execution (RCE) vulnerability
- CVE-2026-81756 WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability
- CVE-2026-81755 Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request
- CVE-2026-81754 Vigilant <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting
- CVE-2026-81753 Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content
- CVE-2026-8175 Multiple vulnerabilities in Aspera applications.
- CVE-2026-81743 Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection
- CVE-2026-81742 BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation
- CVE-2026-81741 Groundhogg < 4.7.2 - Open Redirect via 'redirect_to' Parameter
- CVE-2026-81740 Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback
- CVE-2026-8174 Cross-site Request Forgery
- CVE-2026-81739 Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback
- CVE-2026-81738 Memory corruption in OpenVPN
- CVE-2026-81737 FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information
- CVE-2026-81736 Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees
- CVE-2026-81735 Missing authorization in UI-TARS-desktop
- CVE-2026-81733 WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php
- CVE-2026-81732 WWBN AVideo through 30.0 Information Disclosure via report4.json.php
- CVE-2026-81731 Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description
- CVE-2026-81730 Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename
- CVE-2026-8173 Information Disclosure via 'Copy learned MAC Addresses' Function
- CVE-2026-81729 Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion
- CVE-2026-81728 Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys
- CVE-2026-81727 NLTK before 3.10.3 Hardlink File Overwrite via downloader
- CVE-2026-81726 NLTK through 3.10.3 Path Traversal via Model-Artifact APIs
- CVE-2026-81725 NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader
- CVE-2026-81724 NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion
- CVE-2026-81723 NLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView
- CVE-2026-81722 nltk PorterStemmer before 3.10.3 Quadratic-time DoS
- CVE-2026-81721 openssl_encrypt before 1.4.9 Denial of Service via KDF
- CVE-2026-81720 openssl_encrypt before 1.4.9 Denial of Service via Unbounded Argon2
- CVE-2026-8172 Simple Basic Contact Form <= 20250114 - Reflected XSS
- CVE-2026-81719 openssl_encrypt before 1.4.9 Remote Code Execution via Plugin
- CVE-2026-81718 openssl_encrypt before 1.4.9 Weak Cryptographic Parameters
- CVE-2026-81717 openssl_encrypt before 1.4.9 Integrity Bypass via Added Files
- CVE-2026-81716 openssl_encrypt before 1.4.9 Plugin Sandbox Path Traversal
- CVE-2026-81715 openssl_encrypt before 1.4.9 Credential Exposure via Debug Output
- CVE-2026-81714 openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass
- CVE-2026-81707 openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email
- CVE-2026-81706 openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing
- CVE-2026-81705 openssl-encrypt before 1.4.9 Password Cleartext Leak via Debug
- CVE-2026-81704 openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus
- CVE-2026-81703 openssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC Key
- CVE-2026-81702 openssl_encrypt before 1.4.9 Key Substitution via Identity Load
- CVE-2026-81701 openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin
- CVE-2026-81700 openssl_encrypt before 1.4.9 GPG Signature Verification Bypass
- CVE-2026-8170 ExtremeXOS Privilege Escalation via Symlink Following in File Utilities
- CVE-2026-81699 openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF cost
- CVE-2026-81698 openssl_encrypt before 1.4.9 Shell Injection via info command
- CVE-2026-81697 openssl_encrypt before 1.4.9 KDF Downgrade via CWD-relative Configuration
- CVE-2026-81696 openssl_encrypt before 1.4.9 Terminal Injection via info Command
- CVE-2026-81695 openssl_encrypt before 1.4.9 Terminal Injection via key_id
- CVE-2026-81694 openssl-encrypt before 1.4.9 Output Injection via Unsanitized Filenames in verify-usb Command
- CVE-2026-81693 openssl_encrypt before 1.4.9 Denial of Service via QR total field
- CVE-2026-81692 openssl_encrypt before 1.4.9 Denial of Service via STREAMINFO
- CVE-2026-81691 openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs
- CVE-2026-81690 verify-usb before 1.4.9 Symlink Directory Traversal Code Execution
- CVE-2026-8169 ExtremeXOS Debug-Mode Privilege Escalation via Weak PRNG
- CVE-2026-81689 openssl_encrypt before 1.4.9 Weak Pepper Key Derivation
- CVE-2026-81688 openssl_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-256
- CVE-2026-81687 openssl_encrypt before 1.4.9 Denial of Service via KDF
- CVE-2026-81686 openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass
- CVE-2026-81685 openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata
- CVE-2026-81684 openssl_encrypt before 1.4.9 Information Disclosure via Command Line
- CVE-2026-81683 openssl_encrypt before 1.4.9 Plaintext Private Key Storage
- CVE-2026-81682 openssl_encrypt before 1.4.9 Insecure File Permissions
- CVE-2026-81681 openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage
- CVE-2026-81680 openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal
- CVE-2026-8168 Denial-of-service vulnerability in the SVG parser and renderer impacts Qt
- CVE-2026-81679 OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API