Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 461 of 1013.
- CVE-2026-65631 Denial of service in jose
- CVE-2026-65630 Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose
- CVE-2026-6563 H3C Magic B1 aspForm SetAPWifiorLedInfoById buffer overflow
- CVE-2026-65629 Weak PBKDF2 parameters for password-encrypted private-key export in jose
- CVE-2026-65628 Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types
- CVE-2026-65627 Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2
- CVE-2026-65626 Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose
- CVE-2026-65625 Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose
- CVE-2026-65624 Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion
- CVE-2026-65623 Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit
- CVE-2026-6562 dameng100 muucmf index.html getListByPage sql injection
- CVE-2026-65618 Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability
- CVE-2026-65617 Potential remote code execution on an Artifactory package service container.
- CVE-2026-65616 Potential privilege escalation to JFrog administrator privileges
- CVE-2026-65613 Apache CloudStack: Webhook Deliveries Incorrect Access
- CVE-2026-65612 Shell Command Injection in nnn
- CVE-2026-65611 Shell Command Injection in nnn
- CVE-2026-65610 Numeric Truncation Error in nnn
- CVE-2026-6561 EyouCMS Index.php edit_adminlogo unrestricted upload
- CVE-2026-65609 Out-of-bounds write in nnn
- CVE-2026-65608 Grav before 2.0.9 Remote Code Execution via FlexDirectory
- CVE-2026-65607 SiYuan before v3.7.2 Path Traversal via /export/temp/
- CVE-2026-65606 SiYuan before v3.7.2 Cross-Site Scripting to RCE
- CVE-2026-65605 SiYuan before v3.7.2 Stored XSS to RCE via Attribute View
- CVE-2026-65604 Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass
- CVE-2026-65603 Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update
- CVE-2026-65602 Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass
- CVE-2026-65601 Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef
- CVE-2026-65600 Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex
- CVE-2026-6560 H3C Magic B0 aspForm Edit_BasicSSID buffer overflow
- CVE-2026-65599 n8n before 1.123.64, 2.29.8, and 2.30.1 Credential Exposure via JWT Header
- CVE-2026-65598 n8n before 1.123.64 Remote Code Execution via Git Clone
- CVE-2026-65597 n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe
- CVE-2026-65596 n8n before 1.123.64 Credential Exfiltration via GraphQL Node
- CVE-2026-65595 n8n before 2.29.8 and 2.30.1 Privilege Escalation via Token Exchange
- CVE-2026-65594 n8n before 2.30.1 Missing OAuth Authorization Check
- CVE-2026-65593 n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parameters
- CVE-2026-65592 n8n before 1.123.64 Stored DOM XSS via cachedResultUrl
- CVE-2026-65591 n8n before 1.123.64 Sanitizer Bypass Remote Code Execution
- CVE-2026-65590 n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows
- CVE-2026-6559 Wavlink WL-WN579A3 login.cgi sub_401F80 cross site scripting
- CVE-2026-65589 n8n before 1.123.64 Credential Exposure via LLM Node Execution Data
- CVE-2026-65583 Apache CXF: Self-issued ID token claims validation skipped
- CVE-2026-65582 WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability
- CVE-2026-65581 WordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability
- CVE-2026-65580 WordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-65579 WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability
- CVE-2026-65578 WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability
- CVE-2026-65577 WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability
- CVE-2026-65576 WordPress Adrena theme <= 1.2.14 - PHP Object Injection vulnerability
- CVE-2026-65575 WordPress Accalia theme <= 1.5.3 - PHP Object Injection vulnerability
- CVE-2026-65574 WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability
- CVE-2026-65573 WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability
- CVE-2026-65572 WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability
- CVE-2026-65571 WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability
- CVE-2026-65570 WordPress Login with phone number plugin <= 1.8.70 - Bypass vulnerability vulnerability
- CVE-2026-65569 WordPress WP Job Portal plugin <= 2.5.6 - SQL Injection vulnerability
- CVE-2026-65568 WordPress Visual Composer Website Builder plugin <= 45.15.0 - Broken Access Control vulnerability
- CVE-2026-65567 WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability
- CVE-2026-65565 WordPress Survey Maker plugin <= 5.2.3.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65564 WordPress MapPress Maps for WordPress plugin <= 2.97.6 - Sensitive Data Exposure vulnerability
- CVE-2026-65563 WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65562 WordPress BetterDocs plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65561 WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65560 WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-6556 @fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins
- CVE-2026-65559 WordPress Order Delivery Date for WooCommerce plugin <= 4.6.0 - Privilege Escalation vulnerability
- CVE-2026-65558 WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-65557 WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65556 WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.1.43 - PHP Object Injection vulnerability
- CVE-2026-65554 WordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability
- CVE-2026-65553 WordPress Spider Analyser – WordPress搜索引擎蜘蛛分析插件 plugin <= 2.1.3 - Remote Code Execution (RCE) vulnerability
- CVE-2026-65552 WordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability
- CVE-2026-65551 WordPress Breakdance plugin < 2.7 - Broken Access Control vulnerability
- CVE-2026-65550 WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-6555 ProSolution WP Client <= 2.0.0 - Unauthenticated Arbitrary File Upload via 'files'
- CVE-2026-65549 WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability
- CVE-2026-65548 WordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability
- CVE-2026-65546 WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability
- CVE-2026-65545 WordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65544 WordPress Super Socializer plugin <= 7.14.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65543 WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability
- CVE-2026-65542 WordPress Super Socializer plugin <= 7.14.5 - Broken Authentication vulnerability
- CVE-2026-65541 WordPress Staff Training plugin <= 1.0.7 - Broken Access Control vulnerability
- CVE-2026-65540 WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-6554 infinte loop in libpcap before 1.10.7
- CVE-2026-65539 WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability
- CVE-2026-65538 WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65537 Missing authorization in Cyr to Lat reloaded – transliteration of links and file names
- CVE-2026-65536 Cross-site request forgery in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری)
- CVE-2026-65535 WordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnerability
- CVE-2026-65534 WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65533 WordPress Smart SEO Tool plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65532 WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability
- CVE-2026-65531 WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability
- CVE-2026-65530 WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerability
- CVE-2026-6553 TYPO3 CMS Stores Cleartext Password in User Settings Module
- CVE-2026-65529 WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability
- CVE-2026-65528 WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65527 WordPress LIQUID SPEECH BALLOON plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability