Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 454 of 1013.
- CVE-2026-66673 WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-66672 WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability
- CVE-2026-66671 WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability
- CVE-2026-66670 WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability
- CVE-2026-6667 PgBouncer missing authorization check in KILL_CLIENT admin command
- CVE-2026-66668 WordPress Community by PeepSo plugin <= 9.0.5.2 - SQL Injection vulnerability
- CVE-2026-66667 WordPress Templately plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66666 Information disclosure in WordPress
- CVE-2026-66665 WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability
- CVE-2026-66664 WordPress SEO plugin by Squirrly SEO plugin <= 14.2.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66663 WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66662 WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Privilege Escalation vulnerability
- CVE-2026-66661 WordPress Directories Pro plugin <= 2.0.5 - Privilege Escalation vulnerability
- CVE-2026-66660 WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability
- CVE-2026-6666 PgBouncer crash in kill_pool_logins_server_error
- CVE-2026-66659 WordPress Tablesome Table plugin <= 1.2.9 - SQL Injection vulnerability
- CVE-2026-66658 WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability
- CVE-2026-66657 WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerability
- CVE-2026-66656 WordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerability
- CVE-2026-66655 WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-66654 WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-66653 WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability
- CVE-2026-66652 WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-66651 WordPress MultiVendorX plugin <= 5.0.20 - Broken Access Control vulnerability
- CVE-2026-66650 WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability
- CVE-2026-6665 PgBouncer buffer overflow in SCRAM
- CVE-2026-66649 WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability
- CVE-2026-66648 WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability
- CVE-2026-66647 WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability
- CVE-2026-66646 WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66645 WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66644 WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66643 WordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66642 WordPress WP Umbrella plugin 2.24.2-2.26.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-66641 WordPress Video Conferencing with Zoom plugin <= 4.6.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66640 WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-6664 PgBouncer integer overflow in PgBouncer network packet parsing
- CVE-2026-66639 WordPress WPZOOM Forms – Contact Form plugin for Gutenberg plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66638 WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66637 WordPress Featured Video Plus plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66636 WordPress Wise Chat plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66635 WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-66634 WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-66633 WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66632 WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability
- CVE-2026-66631 WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability
- CVE-2026-66630 WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability
- CVE-2026-6663 GWD Connect <= 2.9 - Unauthenticated Limited Code Execution via update_agent
- CVE-2026-66629 WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66628 WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability
- CVE-2026-66627 WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability
- CVE-2026-66626 WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability
- CVE-2026-66625 WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability
- CVE-2026-66624 WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerability
- CVE-2026-66623 WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66622 WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability
- CVE-2026-66621 WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66620 WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability
- CVE-2026-6662 ericc-ch copilot-api Token Endpoint server.ts cors cross-domain policy
- CVE-2026-66619 WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerability
- CVE-2026-66618 WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerability
- CVE-2026-66617 WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66616 WordPress Form Maker by 10Web plugin <= 1.15.49 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66615 WordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66614 WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66613 WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability
- CVE-2026-66612 WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66611 WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66610 WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66609 WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability
- CVE-2026-66608 Server-side request forgery in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- CVE-2026-66607 WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66606 WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66605 Cross-site scripting in Swatchly – WooCommerce Variation Swatches for Products
- CVE-2026-66604 WordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66603 WordPress Draft List plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66602 WordPress HashBar – WordPress Notification Bar plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-66601 WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66600 WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability
- CVE-2026-66599 WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66598 WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66597 WordPress wpDataTables plugin <= 6.5.1.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66596 WordPress Newsletter plugin <= 9.3.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66595 WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability
- CVE-2026-66594 WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability
- CVE-2026-66593 WordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerability
- CVE-2026-66592 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability
- CVE-2026-66591 WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66590 WordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-6659 Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts
- CVE-2026-66589 WordPress B2BKing plugin <= 5.2.30 - Broken Access Control vulnerability
- CVE-2026-66587 WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability
- CVE-2026-66586 WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability
- CVE-2026-66585 WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability
- CVE-2026-66584 WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66583 WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability
- CVE-2026-66582 WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66581 WordPress JetEngine plugin <= 3.8.14.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66580 WordPress Product Feed Manager plugin <= 7.12.0 - SQL Injection vulnerability
- CVE-2026-6658 Cross-site Scripting (XSS) in jupyter/nbconvert