Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 491 of 1013.
- CVE-2026-61976 WordPress JetBlocks For Elementor plugin <= 1.5.0 - Sensitive Data Exposure vulnerability
- CVE-2026-61975 WordPress JetReviews plugin <= 3.0.1 - Sensitive Data Exposure vulnerability
- CVE-2026-61974 WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-61973 WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability
- CVE-2026-61972 WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability
- CVE-2026-61971 WordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-61970 WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-6197 Tenda F456 AdvSetWrlsafeset formWrlsafeset stack-based overflow
- CVE-2026-61969 WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability
- CVE-2026-61968 WordPress myCred plugin <= 3.1.2 - Broken Access Control vulnerability
- CVE-2026-61967 WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability
- CVE-2026-61966 WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability
- CVE-2026-61965 WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-61964 WordPress Ninja Tables plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-61963 WordPress Media LIbrary Assistant plugin <= 3.38 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-61962 WordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerability
- CVE-2026-61961 WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-61960 WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-6196 Tenda F456 exeCommand fromexeCommand stack-based overflow
- CVE-2026-61959 WordPress Business Directory plugin <= 6.4.24 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-61958 WordPress License Manager for WooCommerce plugin <= 3.0.17 - Arbitrary Content Deletion vulnerability
- CVE-2026-61957 WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-61956 WordPress ووسلام – همگام سازی ووکامرس و باسلام plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-61955 WordPress گرویتی فرم فارسی plugin <= 3.0.2 - SQL Injection vulnerability
- CVE-2026-61954 WordPress PayU India plugin <= 3.8.9 - Broken Access Control vulnerability
- CVE-2026-61953 WordPress Simple Link Directory Pro plugin <= 15.0.6 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-61952 WordPress WooCommerce Bulk Edit Products – WP Sheet Editor plugin <= 1.8.21 - Broken Access Control vulnerability
- CVE-2026-61951 WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability
- CVE-2026-61950 WordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerability
- CVE-2026-6195 Totolink A7100RU CGI cstecgi.cgi setPasswordCfg os command injection
- CVE-2026-61949 WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability
- CVE-2026-61948 WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability
- CVE-2026-61947 WordPress Form Vibes – Database Manager for Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-61946 WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-61945 WordPress WooCommerce Product Stock Alert plugin <= 3.0.6 - Sensitive Data Exposure vulnerability
- CVE-2026-61944 WordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-61943 WordPress WPDM – Premium Packages plugin <= 6.2.0 - Broken Access Control vulnerability
- CVE-2026-6194 Totolink A3002MU HTTP Request formWlanSetup sub_410188 stack-based overflow
- CVE-2026-61939 Winlogon Elevation of Privilege Vulnerability
- CVE-2026-61938 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-61937 Windows HTTP.sys Elevation of Privilege Vulnerability
- CVE-2026-61936 Windows Defender Firewall Service Security Feature Bypass Vulnerability
- CVE-2026-61934 Windows Bind Filter Driver Elevation of Privilege Vulnerability
- CVE-2026-61933 Windows DWM Core Library Information Disclosure Vulnerability
- CVE-2026-61932 Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2026-61931 Windows Perception Simulation Service Elevation of Privilege Vulnerability
- CVE-2026-61930 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-6193 PHPGurukul Daily Expense Tracking System register.php sql injection
- CVE-2026-61929 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-61928 Windows Hello Tampering Vulnerability
- CVE-2026-61927 Windows Bind Filter Driver Elevation of Privilege Vulnerability
- CVE-2026-61926 Windows USB Driver Elevation of Privilege Vulnerability
- CVE-2026-61925 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-61924 Windows Remote Desktop Client Information Disclosure Vulnerability
- CVE-2026-61923 Windows Display Enhancement Service Elevation of Privilege Vulnerability
- CVE-2026-61921 Windows Remote Desktop Client Information Disclosure Vulnerability
- CVE-2026-61920 Windows DNS Server Remote Code Execution Vulnerability
- CVE-2026-6192 uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflow
- CVE-2026-61918 Windows Remote Desktop Client Information Disclosure Vulnerability
- CVE-2026-61916 Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms
- CVE-2026-61915 Memory corruption in Cyrus IMAP
- CVE-2026-61911 Information disclosure in Cyrus IMAP
- CVE-2026-61910 Missing authorization in Cyrus IMAP
- CVE-2026-6191 itsourcecode Construction Management System equipments.php sql injection
- CVE-2026-61909 Missing authorization in Cyrus IMAP
- CVE-2026-61908 Memory corruption in Cyrus IMAP
- CVE-2026-61907 Missing authorization in Cyrus IMAP
- CVE-2026-61902 Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
- CVE-2026-61901 Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2
- CVE-2026-61900 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6
- CVE-2026-6190 itsourcecode Construction Management System employees.php sql injection
- CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation
- CVE-2026-61898 accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts
- CVE-2026-61897 accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts
- CVE-2026-61893 MZ Automation lib60870 Out-of-bounds Read
- CVE-2026-61892 Weintek cMT3092X Incorrect Permission Assignment for Critical Resource
- CVE-2026-61891 Missing authorization in Eclipse Theia
- CVE-2026-6189 SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
- CVE-2026-61886 Weintek cMT3092X Plaintext Storage of a Password
- CVE-2026-61884 Tycon Systems TPDIN-Monitor-WEB2 Missing Authentication for Critical Function
- CVE-2026-6188 SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
- CVE-2026-61876 LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting
- CVE-2026-61875 luci-app-upnp Stored XSS via UPnP Port Mapping Description
- CVE-2026-61874 filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete
- CVE-2026-61873 Grav before 9.1.8 Arbitrary File Write via Twig-Processed Filename
- CVE-2026-61872 ImageMagick before 7.1.2-26 Memory Leak via TIFF Encoder
- CVE-2026-61871 ImageMagick before 7.1.2-26 Memory Leak in ICON decoder
- CVE-2026-61870 ImageMagick before 7.1.2-26 Memory Leak via VIFF Encoder
- CVE-2026-6187 SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
- CVE-2026-61869 ImageMagick before 7.1.2-26 Memory Leak in MIFF Encoder
- CVE-2026-61868 ImageMagick before 7.1.2-26 Memory Leak in YUV Decoder
- CVE-2026-61867 ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder
- CVE-2026-61866 ImageMagick before 7.1.2-26 Memory Leak in JNG encoder
- CVE-2026-61865 ImageMagick before 7.1.2-26 Memory Leak in Hough Lines
- CVE-2026-61864 ImageMagick before 7.1.2-26 Memory Leak in Log Colorspace
- CVE-2026-61863 ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder
- CVE-2026-61862 ImageMagick before 7.1.2-26 Information Disclosure via identify
- CVE-2026-61861 ImageMagick before 7.1.2-26 Use-After-Free in FormatMagickCaption
- CVE-2026-61860 ImageMagick before 7.1.2-26 Use-After-Free via freetype
- CVE-2026-6186 UTT HiPER 1200GW formNatStaticMap strcpy buffer overflow