Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 402 of 1013.
- CVE-2026-73356 WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability
- CVE-2026-73355 WordPress Affiliates Manager plugin <= 2.9.53 - SQL Injection vulnerability
- CVE-2026-73354 WordPress SimplyRETS Real Estate IDX plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-73353 WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability
- CVE-2026-73352 WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability
- CVE-2026-73351 WordPress WordPress Social Login and Register plugin <= 7.8.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-73350 WordPress SupportCandy plugin <= 3.5.1 - Broken Authentication vulnerability
- CVE-2026-7335 Use after free in Chrome
- CVE-2026-73349 WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability
- CVE-2026-73348 WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability
- CVE-2026-73347 WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability
- CVE-2026-73346 WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability
- CVE-2026-73345 WordPress License Manager for WooCommerce plugin <= 3.0.18 - SQL Injection vulnerability
- CVE-2026-73344 WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-73343 WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability
- CVE-2026-73342 WordPress WP Multilang plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-73341 WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability
- CVE-2026-73340 WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-7334 Use after free in Chrome
- CVE-2026-73339 WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability
- CVE-2026-73338 WordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-73337 Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2
- CVE-2026-73336 Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2
- CVE-2026-73335 Missing authorization in Android App "Myna Point"
- CVE-2026-73334 Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
- CVE-2026-73332 CamaleonCMS cama_contact_form Plugin Stored XSS via before_html Field
- CVE-2026-73331 CamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug Field
- CVE-2026-73330 CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action
- CVE-2026-7333 Use after free in Chrome
- CVE-2026-73329 CamaleonCMS Stored XSS via Draft Post Title Creation Endpoint
- CVE-2026-73326 CamaleonCMS Missing Authorization via Plugin Administration Endpoints
- CVE-2026-73325 Fujitsu OneCompression < 1.2.1 Arbitrary Code Execution via torch.load Deserialization
- CVE-2026-73324 VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability
- CVE-2026-73321 XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser
- CVE-2026-73320 XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint
- CVE-2026-7332 LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter
- CVE-2026-73319 XenForo < 2.3.13 XSS via Dynamic Redirect Handler
- CVE-2026-73318 XenForo < 2.3.13 Missing Authorization via force-agreement Controller
- CVE-2026-73317 XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher
- CVE-2026-73316 XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider
- CVE-2026-73315 XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler
- CVE-2026-73314 XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook
- CVE-2026-73313 XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider
- CVE-2026-73312 XenForo < 2.3.13 Refresh Token Replay via Expired Access Token
- CVE-2026-73311 XenForo < 2.3.13 OAuth2 Authorization Code Reuse
- CVE-2026-73310 XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass
- CVE-2026-73309 XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint
- CVE-2026-73308 Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders
- CVE-2026-73307 Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
- CVE-2026-73306 Budibase: Account Enumeration via Login Lockout Response Differential
- CVE-2026-73305 Budibase: Privilege escalation via public role assignment API missing app-level authorization
- CVE-2026-73304 Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users
- CVE-2026-73303 Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)
- CVE-2026-73302 Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
- CVE-2026-73301 Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
- CVE-2026-73300 Budibase: SQL Injection via `multipleStatements: true`
- CVE-2026-7330 Auto Affiliate Links <= 6.8.8 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter
- CVE-2026-73299 Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
- CVE-2026-73298 Microsoft Container Migration Solution Accelerator: Authenticated IDOR allowing read/write/delete processes
- CVE-2026-73297 Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation
- CVE-2026-73296 Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure
- CVE-2026-73295 Material for MkDocs: DOM XSS in search suggestions via query parameter
- CVE-2026-73294 Semaphore U: OS Command Injection
- CVE-2026-73293 Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision
- CVE-2026-73292 Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
- CVE-2026-73291 Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag
- CVE-2026-73290 RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback
- CVE-2026-7329 Privilege escalation in Progress MarkLogic Server REST query interfaces
- CVE-2026-73289 RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions
- CVE-2026-73288 Security feature bypass in rustfs
- CVE-2026-73287 RustFS: FTPS MKD bypasses IAM CreateBucket authorization
- CVE-2026-73286 Security feature bypass in rustfs
- CVE-2026-73285 Auth bypass in rustfs
- CVE-2026-73284 RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts
- CVE-2026-73283 Security feature bypass in OpenSSH
- CVE-2026-73282 Use after free in OpenSSH
- CVE-2026-73281 Security feature bypass in OpenSSH
- CVE-2026-7328 Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service
- CVE-2026-73278 Gitea WebAuthn bypass during OAuth and OIDC sign-in
- CVE-2026-73276 inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i
- CVE-2026-73273 Gitea Maven checksum upload quota bypass and memory exhaustion
- CVE-2026-73270 httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems
- CVE-2026-7327 Privilege escalation in Progress MarkLogic Server REST API document processing
- CVE-2026-73269 Privilege escalation in multicluster engine for Kubernetes 2.10
- CVE-2026-73268 Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection
- CVE-2026-73267 Missing authorization in multicluster engine for Kubernetes 2.10
- CVE-2026-73266 Privilege escalation in multicluster engine for Kubernetes 2.10
- CVE-2026-73265 RustFS: Version-specific object reads authorize the non-version action
- CVE-2026-73264 Prowler: Server-Side Request Forgery (SSRF) in Lighthouse Provider
- CVE-2026-73263 Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path
- CVE-2026-73262 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
- CVE-2026-73261 Memory corruption in mongoose
- CVE-2026-73260 Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser
- CVE-2026-7326 Cross-site request forgery in Progress MarkLogic Server Admin UI
- CVE-2026-73259 Mongoose: Reflected XSS via decoded URI in directory listing render
- CVE-2026-73258 Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart
- CVE-2026-73257 Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling
- CVE-2026-73256 Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE
- CVE-2026-73255 Mongoose: Path traversal in SSI #include directives enables arbitrary file read
- CVE-2026-73254 Mongoose: Stored XSS via unescaped filenames in directory listing