Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 342 of 1013.
- CVE-2026-81353 HEIF Image Extensions Remote Code Execution Vulnerability
- CVE-2026-81352 Web Media Extensions Remote Code Execution Vulnerability
- CVE-2026-8135 Concrete CMS Vulnerable to Deserialization of Untrusted Data
- CVE-2026-81349 Azure HDInsight Ambari Elevation of Privilege Vulnerability
- CVE-2026-81348 My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and Sitemap
- CVE-2026-81347 Path traversal in Frontend Admin by DynamiApps
- CVE-2026-81346 Frontend Admin by DynamiApps < 3.29.11 - Subscriber+ Arbitrary Membership Plan Deletion
- CVE-2026-81344 Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection
- CVE-2026-81343 Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission
- CVE-2026-81342 MasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect
- CVE-2026-81341 wolfEngine reuses the AES-CCM nonce on TLS 1.2 / DTLS 1.2 records
- CVE-2026-81340 MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR
- CVE-2026-8134 Concrete CMS Vulnerable to Relative Path Traversal
- CVE-2026-81339 MasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR
- CVE-2026-81338 MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions
- CVE-2026-81335 Baserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources
- CVE-2026-81334 darknet through 6.0 Out-of-Bounds Read and Write via Unchecked Layer Index in .cfg Parser
- CVE-2026-81330 Softish C6 Ear Camera and EarVision Android Application Cleartext transmission of sensitive information
- CVE-2026-8133 zyx0814 FilePress Shares Filelist API admin.php sql injection
- CVE-2026-81326 Hardcoded credentials in QND Advance
- CVE-2026-81322 Cloaked plaintext leaks through a non-sensitive action argument in AshCloak
- CVE-2026-81321 CareCam CM2507 Cleartext Storage of Sensitive Information
- CVE-2026-81320 Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level
- CVE-2026-8132 CodeAstro Leave Management System login.php sql injection
- CVE-2026-81319 Unsafe deserialization of decrypted terms enables node DoS in AshCloak
- CVE-2026-81318 Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql
- CVE-2026-81316 Same-named aggregates with differing filters are conflated in AshSql
- CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header
- CVE-2026-81310 Path traversal in Image Scanner Driver for Linux (SP Series)
- CVE-2026-8131 SourceCodester SUP Online Shopping replymsg.php sql injection
- CVE-2026-81305 CareCam CM2507 Inclusion of Functionality from Untrusted Control Sphere
- CVE-2026-81303 Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostname
- CVE-2026-81302 Misconfiguration in PALLET CONTROL
- CVE-2026-81301 Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access
- CVE-2026-81300 WordPress Calculation For Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-8130 SourceCodester SUP Online Shopping message.php sql injection
- CVE-2026-81299 WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-81298 WordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81297 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability
- CVE-2026-81296 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability
- CVE-2026-81295 WordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81294 WordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability
- CVE-2026-81293 WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability
- CVE-2026-81292 WordPress Simple Payment plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81291 WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81290 WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-8129 SourceCodester SUP Online Shopping wishlist.php sql injection
- CVE-2026-81289 Cross-site scripting in MP3 Audio Player for Music, Radio & Podcast by Sonaar
- CVE-2026-81288 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81287 WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability
- CVE-2026-81286 WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability
- CVE-2026-81285 WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerability
- CVE-2026-81284 WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability
- CVE-2026-81283 WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability
- CVE-2026-81282 WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81281 WordPress Graphene theme <= 2.9.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-81280 Information disclosure in Print Barcode Labels for your WooCommerce products/orders
- CVE-2026-8128 SourceCodester SUP Online Shopping viewmsg.php sql injection
- CVE-2026-81279 WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability
- CVE-2026-81278 WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability
- CVE-2026-81277 WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability
- CVE-2026-81276 WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability
- CVE-2026-81275 WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability
- CVE-2026-81274 WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability
- CVE-2026-81273 WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-81272 WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability
- CVE-2026-81271 WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-81270 Apache Allura: Information exposure via search
- CVE-2026-8127 eladmin Users API Endpoint UserController.java checkLevel access control
- CVE-2026-81269 Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108
- CVE-2026-81268 Langflow is vulnerable to authentication bypass and insufficient session expiration
- CVE-2026-81267 Stalled popup navigation could allow address bar origin spoofing in Firefox for iOS
- CVE-2026-81265 Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches
- CVE-2026-8126 SourceCodester Comment System post_comment.php sql injection
- CVE-2026-8125 code-projects Simple Chat System sendMessage.php sql injection
- CVE-2026-81240 File upload in Wyse Management Suite
- CVE-2026-8124 GPAC box_code_base.c sidx_box_read allocation of resources
- CVE-2026-81239 File upload in Wyse Management Suite
- CVE-2026-81238 Auth bypass in Wyse Management Suite
- CVE-2026-81237 Auth bypass in Wyse Management Suite
- CVE-2026-81236 File upload in Wyse Management Suite
- CVE-2026-81235 Weak cryptography in Wyse Management Suite
- CVE-2026-8123 Open5GS NSSF message.c ogs_sbi_discovery_option_add_snssais denial of service
- CVE-2026-8122 Open5GS NSSF message.c ogs_sbi_discovery_option_add_service_names denial of service
- CVE-2026-81213 Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches
- CVE-2026-81212 DataStage on Cloud Pak for Data Improper Authorization
- CVE-2026-81211 Missing authorization in Langflow OSS
- CVE-2026-81210 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-8121 Open5GS NSSF conv.c ogs_sbi_parse_plmn_list denial of service
- CVE-2026-81208 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-81207 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-81205 LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115
- CVE-2026-81204 Code injection in Langflow OSS
- CVE-2026-81203 SourceCodester Simple Online Food Ordering System ajax.php login2 sql injection
- CVE-2026-81202 itsourcecode Payroll System CRUD Operation ajax.php delete missing authentication
- CVE-2026-81201 Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116
- CVE-2026-81200 MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR
- CVE-2026-8120 Open5GS NSSF nnssf-handler.c denial of service
- CVE-2026-81199 MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route
- CVE-2026-81198 MasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR