Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 396 of 1013.
- CVE-2026-74007 Information disclosure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery
- CVE-2026-74006 WordPress WP Table Builder plugin <= 2.2.0 - Broken Access Control vulnerability
- CVE-2026-74005 WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-74004 Missing authorization in Gravity Booster – Styles & Layouts for Gravity Forms
- CVE-2026-74003 WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability
- CVE-2026-74002 WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability
- CVE-2026-74001 WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability
- CVE-2026-74000 WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability
- CVE-2026-7400 geekgod382 filesystem-mcp-server read_file_tool/write_file_tool server.py is_path_allowed path traversal
- CVE-2026-73999 WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-73998 WordPress WP w3all phpBB plugin <= 3.0.5 - SQL Injection vulnerability
- CVE-2026-73997 WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability
- CVE-2026-73996 WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability
- CVE-2026-73995 WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability
- CVE-2026-73994 WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability
- CVE-2026-73993 WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
- CVE-2026-73992 WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability
- CVE-2026-7399 IDOR in MeWare Software's PDKS
- CVE-2026-7398 florensiawidjaja BioinfoMCP Upload Endpoint app.py upload path traversal
- CVE-2026-73976 djehuty: Unauthenticated SPARQL injection in the search API (`order`, `operator`, `key`)
- CVE-2026-73975 djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples
- CVE-2026-73974 linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)
- CVE-2026-73973 Path traversal in monitoring-plugins
- CVE-2026-7397 NousResearch hermes-agent file_tools.py _check_sensitive_path symlink
- CVE-2026-73966 Missing authorization in Siebel Apps - Marketing
- CVE-2026-73965 Missing authorization in Siebel CRM Deployment
- CVE-2026-73964 Information disclosure in Oracle Database Server
- CVE-2026-73963 Auth bypass in Oracle WebCenter Portal
- CVE-2026-73962 Missing authorization in Oracle Access Manager
- CVE-2026-73961 Auth bypass in Oracle JDeveloper
- CVE-2026-73960 Denial of service in PeopleSoft Enterprise PeopleTools
- CVE-2026-7396 NousResearch hermes-agent WeChat Work Platform Adapter wecom.py path traversal
- CVE-2026-73959 Missing authorization in Oracle WebCenter Portal
- CVE-2026-73958 Missing authorization in Oracle Access Manager
- CVE-2026-73957 Missing authorization in Oracle WebCenter Portal
- CVE-2026-73956 Auth bypass in Oracle WebCenter Portal
- CVE-2026-73955 Missing authorization in PeopleSoft Enterprise PeopleTools
- CVE-2026-73954 Missing authorization in PeopleSoft Enterprise PeopleTools
- CVE-2026-73953 Auth bypass in Oracle WebCenter Portal
- CVE-2026-73952 Auth bypass in Oracle WebCenter Portal
- CVE-2026-73951 Missing authorization in Oracle WebCenter Portal
- CVE-2026-73950 Auth bypass in Oracle Access Manager
- CVE-2026-7395 Missing authorization in Asset Suite
- CVE-2026-73949 Missing authorization in Oracle WebCenter Portal
- CVE-2026-73948 Missing authorization in Oracle WebCenter Portal
- CVE-2026-73947 Auth bypass in Oracle Access Manager
- CVE-2026-73946 Missing authorization in Oracle Access Manager
- CVE-2026-73945 Missing authorization in Oracle Access Manager
- CVE-2026-73944 Auth bypass in Oracle Access Manager
- CVE-2026-73943 Missing authorization in Oracle Identity Manager
- CVE-2026-73942 Missing authorization in Oracle Identity Manager
- CVE-2026-73941 Missing authorization in Oracle Access Manager
- CVE-2026-73940 Auth bypass in Oracle Access Manager
- CVE-2026-7394 SourceCodester Pizzafy Ecommerce System GET Parameter view_order.php sql injection
- CVE-2026-73939 Missing authorization in Helidon
- CVE-2026-73938 Missing authorization in Helidon
- CVE-2026-73937 Other in Helidon
- CVE-2026-73936 Denial of service in Helidon
- CVE-2026-73935 Denial of service in Helidon
- CVE-2026-73934 Denial of service in Helidon
- CVE-2026-73933 Missing authorization in Helidon
- CVE-2026-73932 Denial of service in Helidon
- CVE-2026-73931 Missing authorization in Helidon
- CVE-2026-73930 Missing authorization in Helidon
- CVE-2026-7393 SourceCodester Pizzafy Ecommerce System File Extension admin_class_novo.php save_menu unrestricted upload
- CVE-2026-73929 Missing authorization in Helidon
- CVE-2026-73928 Missing authorization in Helidon
- CVE-2026-73927 Denial of service in Helidon
- CVE-2026-73926 Missing authorization in Oracle Access Manager
- CVE-2026-73925 Missing authorization in Helidon
- CVE-2026-73924 Missing authorization in Helidon
- CVE-2026-73923 Missing authorization in Helidon
- CVE-2026-73922 Missing authorization in Helidon
- CVE-2026-73921 Missing authorization in Helidon
- CVE-2026-73920 Missing authorization in Helidon
- CVE-2026-7392 SourceCodester Pharmacy Sales and Inventory System ajax.php delete_supplier sql injection
- CVE-2026-73919 Missing authorization in Helidon
- CVE-2026-73918 Missing authorization in Helidon
- CVE-2026-73917 Missing authorization in Helidon
- CVE-2026-73916 Missing authorization in Helidon
- CVE-2026-73915 Denial of service in Helidon
- CVE-2026-73914 Missing authorization in Helidon
- CVE-2026-73913 Missing authorization in Helidon
- CVE-2026-73912 Missing authorization in Helidon
- CVE-2026-73911 Missing authorization in Helidon
- CVE-2026-73910 Missing authorization in Helidon
- CVE-2026-7391 SourceCodester Pharmacy Sales and Inventory System ajax.php save_supplier sql injection
- CVE-2026-73909 Missing authorization in Helidon
- CVE-2026-73908 Missing authorization in Helidon
- CVE-2026-73907 Missing authorization in Helidon
- CVE-2026-73906 Missing authorization in Helidon
- CVE-2026-73905 Missing authorization in Helidon
- CVE-2026-73904 Missing authorization in Helidon
- CVE-2026-73903 Missing authorization in Helidon
- CVE-2026-73902 Denial of service in Helidon
- CVE-2026-73901 Missing authorization in Helidon
- CVE-2026-73900 Missing authorization in Helidon
- CVE-2026-7390 SourceCodester Pharmacy Sales and Inventory System index.php customer cross site scripting
- CVE-2026-73899 Missing authorization in Helidon
- CVE-2026-73898 Missing authorization in Helidon