Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 364 of 1013.
- CVE-2026-78292 WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability
- CVE-2026-78291 WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability
- CVE-2026-78290 WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-7829 UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token
- CVE-2026-78289 WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-78288 WordPress Beautiful Taxonomy Filters plugin <= 2.4.6 - SQL Injection vulnerability
- CVE-2026-78286 WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability
- CVE-2026-78285 WordPress Like Button Rating plugin <= 2.6.61 - SQL Injection vulnerability
- CVE-2026-78284 WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability
- CVE-2026-78283 WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-78282 WordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-78281 WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-78280 WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-7828 UltraVNC repeater integer overflow in win_log malloc leading to heap overflow
- CVE-2026-78279 WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-78278 WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-78277 WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-78276 WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability
- CVE-2026-78275 WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Deletion vulnerability
- CVE-2026-78274 WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability
- CVE-2026-78273 WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-78272 WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability
- CVE-2026-78271 WordPress FluentCRM Pro plugin <= 3.1.12 - Privilege Escalation vulnerability
- CVE-2026-78270 WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability
- CVE-2026-7827 Stack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in crafted RDB
- CVE-2026-78269 WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-78268 Information disclosure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads
- CVE-2026-78267 WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability
- CVE-2026-78266 WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability
- CVE-2026-78265 WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability
- CVE-2026-78264 WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-78263 WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-78262 WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability
- CVE-2026-78261 WordPress Realtyna Organic IDX plugin plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-78260 WordPress Epayco plugin <= 8.4.6 - SQL Injection vulnerability
- CVE-2026-7826 Heap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuffer via crafted RDB
- CVE-2026-78259 WordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerability
- CVE-2026-78258 WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability
- CVE-2026-78257 WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability
- CVE-2026-78255 DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media
- CVE-2026-78254 Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write
- CVE-2026-78253 Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts Qt
- CVE-2026-78252 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-78251 DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory
- CVE-2026-78250 bytebot-ai bytebot Agent Execution Workflow infinite loop
- CVE-2026-78249 Path traversal in Apeos 3060 / 2560 / 1860 Japan model
- CVE-2026-78248 SourceCodester Simple Online Food Ordering System ajax.php save_settings sql injection
- CVE-2026-78247 SourceCodester Simple Online Food Ordering System ajax.php confirm_order sql injection
- CVE-2026-78246 itsourcecode Online Clinic Management System Admin Login login.php sql injection
- CVE-2026-78245 itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload
- CVE-2026-78244 itsourcecode Real Estate Management System search.php sql injection
- CVE-2026-78243 Apache YuniKorn: LDAP Group provider panics on lowercase attribute name
- CVE-2026-78242 Apache APISIX: data-mask may fail to redact request headers in logger output
- CVE-2026-7824 PaperCut Hive (Ricoh): Plain text password in logs
- CVE-2026-78239 Xiiaozet LK100W Missing Authentication for Critical Function
- CVE-2026-78238 Cross-site scripting in SOY Gallery
- CVE-2026-78237 Insufficient input validation in Admin By Request (ABR)
- CVE-2026-78236 Insecure PIN derivation mechanism in Admin By Request (ABR)
- CVE-2026-78234 Privilege escalation in Red Hat build of Apache Camel - HawtIO 4
- CVE-2026-78231 Gitea blind SSRF through OpenID assertion verification
- CVE-2026-78230 AshAi aggregate tool can read field-policy-protected fields
- CVE-2026-7823 Totolink A8000RU cstecgi.cgi setAppFilterCfg os command injection
- CVE-2026-78229 Command injection in Image Scanner Driver for Linux (SP Series)
- CVE-2026-78228 Unbounded handle_error recursion enables denial of service in AshOban triggers
- CVE-2026-78227 Use-after-free in DoQ stream output buffer on reset re-transmission
- CVE-2026-78225 Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key
- CVE-2026-78224 NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference
- CVE-2026-78223 Token revocation record built from unverified JWT claims in AshAuthentication
- CVE-2026-78222 NGINX ngx_http_js_module vulnerability
- CVE-2026-78221 Memory corruption in OpenVPN
- CVE-2026-7822 itsourcecode Courier Management System print_pdets.php sql injection
- CVE-2026-78216 AshLua eval read operations can read field-policy-protected fields via aggregates
- CVE-2026-78214 Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths
- CVE-2026-78213 Hepta Platforms｜Heptabase - Stored Cross-Site Scripting
- CVE-2026-78212 4MOSAn Security Technology｜4MOSAn Management Center - Arbitrary File Read
- CVE-2026-78211 4MOSAn Security Technology｜4MOSAn GCB Doctor - OS Command Injection
- CVE-2026-78210 Missing authorization in Octopus Server
- CVE-2026-7821 Security feature bypass in Endpoint Manager Mobile
- CVE-2026-78209 exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values
- CVE-2026-78208 exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename
- CVE-2026-78207 exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization
- CVE-2026-78206 exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression
- CVE-2026-78205 BentoML 1.4.19 through 1.4.39 Server-Side Request Forgery via Unfiltered RFC 6598 Shared Address Space
- CVE-2026-78204 Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints
- CVE-2026-78203 Ghostwriter before 7.1.2 Cross-Client Report Template Disclosure via Unauthorized Template Swap
- CVE-2026-78202 itsourcecode Payroll System admin_class.php save_settings unrestricted upload
- CVE-2026-78201 itsourcecode Payroll System admin_class.php login sql injection
- CVE-2026-78200 itsourcecode Library Management System editbooks.php sql injection
- CVE-2026-7820 pgAdmin 4: Account-lockout bypass via Flask-Security default /login view
- CVE-2026-78199 SourceCodester Simple Online Food Ordering System view_prod.php sql injection
- CVE-2026-78198 SourceCodester Simple Online Food Ordering System ajax.php add_to_cart sql injection
- CVE-2026-78197 SourceCodester Simple Online Food Ordering System ajax.php save_user sql injection
- CVE-2026-78196 achorein expo-share-intent Android File Copy Routine ExpoShareIntentModule.kt getDataColumn path traversal
- CVE-2026-78193 JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection
- CVE-2026-7819 pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write
- CVE-2026-78187 Piwigo Public Authentication cross site scripting
- CVE-2026-78186 Open5GS HSS hss-cx-path.c assertion
- CVE-2026-78185 itsourcecode Sales and Inventory System cust_edit.php sql injection
- CVE-2026-78183 DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float
- CVE-2026-78182 SQL injection in XBROTHER Dynamic Environment Monitoring System