Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 453 of 1013.
- CVE-2026-6679 DTLS 1.3 ACK serialization heap buffer overflow via integer truncation
- CVE-2026-66788 Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label
- CVE-2026-66787 Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses
- CVE-2026-66786 Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets
- CVE-2026-66785 Security feature bypass in Red Hat Advanced Cluster Management for Kubernetes 2
- CVE-2026-66783 Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref
- CVE-2026-66782 Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps
- CVE-2026-66781 Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication
- CVE-2026-66780 Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity
- CVE-2026-6678 Integer underflow in wc_PKCS7_DecryptOri handling crafted Other Recipient Info
- CVE-2026-66779 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP
- CVE-2026-66778 Multiple vulnerabilities in SAP Business AI Platform (Approuter)
- CVE-2026-66777 Multiple vulnerabilities in SAP Business AI Platform (Approuter)
- CVE-2026-66776 Multiple vulnerabilities in SAP Business AI Platform (Approuter)
- CVE-2026-66775 Multiple vulnerabilities in SAP Business AI Platform (Approuter)
- CVE-2026-66774 Multiple vulnerabilities in SAP Business AI Platform (Approuter)
- CVE-2026-66773 Server-controlled `__next` URL is not checking cross-origin
- CVE-2026-66772 Missing Authorization Check in SAP BusinessObjects Business Intelligence Platform (Admin Tools)
- CVE-2026-66771 Cross Site Scripting (XSS) vulnerability in SAPUI5
- CVE-2026-66770 SQL Injection vulnerability in SAP Social Intelligence
- CVE-2026-66768 Improper Access Control in SAP NetWeaver (SAP GUI for Java)
- CVE-2026-66767 Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
- CVE-2026-66766 Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)
- CVE-2026-66764 Missing Authorization check in SAP S/4 HANA (Reprocess Bank Statement Items)
- CVE-2026-66763 Credentials disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Server)
- CVE-2026-66761 Multiple vulnerabilities in SAP Business AI Platform (Approuter)
- CVE-2026-66760 Multiple vulnerabilities in SAP Business AI Platform (Approuter)
- CVE-2026-6676 Avira antivirus engine heap buffer OOB write when scanning a malformed POSIX tar archive
- CVE-2026-66759 Gimp: out-of-bounds read in file-icns plugin causes information disclosure or crash on crafted icns images
- CVE-2026-66758 Gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images
- CVE-2026-66757 Gimp: signed integer overflow in file-sgi (sgi-lib) causes the plugin to crash on rle sgi images
- CVE-2026-66756 Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false
- CVE-2026-66755 Apache Tika: Arbitrary Local File Read in ISArchiveParser
- CVE-2026-66754 Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding
- CVE-2026-66753 tiny-http 0.12.0 HTTP Response Splitting via Header Injection
- CVE-2026-66752 tiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding Handling
- CVE-2026-66751 Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room
- CVE-2026-66750 Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route
- CVE-2026-6675 Responsive Blocks <= 2.2.0 - Unauthenticated Open Email Relay via REST API 'email_to' Parameter
- CVE-2026-66749 Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup
- CVE-2026-66748 Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field
- CVE-2026-66747 ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant
- CVE-2026-66746 Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection
- CVE-2026-66745 Artica Proxy 4.50 Session Fixation via fw.login.php
- CVE-2026-6674 Plugin: CMS für Motorrad Werkstätten <= 1.0.0 - Authenticated (Subscriber+) SQL Injection via 'arttype' Parameter
- CVE-2026-66738 SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite
- CVE-2026-66733 Sonic 3 A.I.R. Unbounded Memory Allocation DoS via ReceivedPacketCache
- CVE-2026-66732 Sonic 3 A.I.R. Missing Source Address Validation in ConnectionManager
- CVE-2026-66731 facil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS
- CVE-2026-66730 facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser
- CVE-2026-6673 Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install
- CVE-2026-66729 facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser
- CVE-2026-66724 Permission Bypass Via Undocumented HTTP Methods In MWDB Core
- CVE-2026-66723 Missing authentication requirement in Remote Instances proxy API in MWDB Core
- CVE-2026-66722 Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue
- CVE-2026-66721 Apache CloudStack: Authorization issue with listHostTags for domain admins
- CVE-2026-66720 MZ Automation libiec61850 Out-of-bounds Read
- CVE-2026-6672 Cross-site scripting in Affiliate Program Suite — SliceWP Affiliates
- CVE-2026-66713 Apache Axis2/Java: deserialization of untrusted Data
- CVE-2026-66712 WordPress Simple Membership plugin <= 4.7.8 - Broken Access Control vulnerability
- CVE-2026-66711 WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66710 WordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability
- CVE-2026-66709 WordPress CTX Feed plugin <= 6.6.42 - Remote Code Execution (RCE) vulnerability
- CVE-2026-66708 WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability
- CVE-2026-66707 WordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66706 WordPress Subscribe to Comments plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66705 WordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66704 WordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-66703 WordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66702 WordPress Rank Math SEO plugin <= 1.0.274.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66701 WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability
- CVE-2026-66700 WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-6670 Media Sync <= 1.4.9 - Authenticated (Author+) Path Traversal via 'sub_dir' and 'media_items' Parameters
- CVE-2026-66699 WordPress Dokan plugin <= 5.0.10 - Broken Access Control vulnerability
- CVE-2026-66698 WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66697 Cross-site scripting in Colissimo Officiel : Méthodes de livraison pour WooCommerce
- CVE-2026-66696 WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.8 - Sensitive Data Exposure vulnerability
- CVE-2026-66695 WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability
- CVE-2026-66694 WordPress Thrive Architect plugin <= 10.9.3.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66693 WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability
- CVE-2026-66692 Missing authorization in Colissimo Officiel : Méthodes de livraison pour WooCommerce
- CVE-2026-66691 WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability
- CVE-2026-66690 WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-6669 Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer
- CVE-2026-66689 WordPress Anti Spam and list cleaner – AcyChecker plugin <= 2.0.0 - Broken Access Control vulnerability
- CVE-2026-66688 WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66687 WordPress WpBookingly plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66686 WordPress Plugins Garbage Collector (Database Cleanup) plugin <= 0.14 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-66685 WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability
- CVE-2026-66684 WordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability
- CVE-2026-66683 WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability
- CVE-2026-66682 WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability
- CVE-2026-66681 WordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-66680 WordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerability
- CVE-2026-6668 Integer overflow causes an infinite loop in packet buffer growth in PgBouncer
- CVE-2026-66679 WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability
- CVE-2026-66678 WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.1 - Broken Access Control vulnerability
- CVE-2026-66677 WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability
- CVE-2026-66676 WordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerability
- CVE-2026-66674 WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Captcha Bypass vulnerability