Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 512 of 1013.
- CVE-2026-59657 Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob
- CVE-2026-59655 Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure
- CVE-2026-59654 Apache CloudStack: DoS caused by database connections leak
- CVE-2026-59652 LDAP filter injection in legacy jdk1.4 LDAPStoreHelper
- CVE-2026-59651 BKS keystore accepts legacy version with 16-bit integrity MAC key
- CVE-2026-59650 MTI/A0 DH agreement exponentiates unvalidated peer value
- CVE-2026-5965 NewSoft｜NewSoftOA - OS Command Injection
- CVE-2026-59649 OpenPGP user-attribute subpacket length bounded only by JVM max memory
- CVE-2026-59648 OpenPGP Argon2 S2K honours attacker-chosen memory and passes
- CVE-2026-59647 CRMF/CMP password-MAC honours unbounded iteration count
- CVE-2026-59646 DTLS handshake reassembler allocates buffer from unchecked 24-bit length
- CVE-2026-59645 OER parser recurses without depth limit on self-referential IEEE 1609.2 schema
- CVE-2026-59644 MLS hash-ratchet honours arbitrary 32-bit generation counter from sender
- CVE-2026-59643 OpenPGP inline-signature policy failures silently ignored
- CVE-2026-59642 CMS AuthenticatedData content not bound to MAC when authAttrs present
- CVE-2026-59641 S/MIME validator trusts signer-asserted signingTime for path validation
- CVE-2026-59640 OpenPGP CFB quick-check oracle active on symmetric/session-key paths
- CVE-2026-5964 Digiwin｜EasyFlow .NET - SQL Injection
- CVE-2026-59639 CMS verifySignatures returns true for SignedData with zero signers
- CVE-2026-59638 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in
- CVE-2026-5963 Digiwin｜EasyFlow .NET - SQL Injection
- CVE-2026-5962 Tenda CH22 httpd R7WebsSecurityHandlerfunction path traversal
- CVE-2026-5961 code-projects Simple IT Discussion Forum topic-details.php sql injection
- CVE-2026-5960 code-projects Patient Record Management System SQL Database Backup File hcpms.sql information disclosure
- CVE-2026-5959 GL.iNet GL-RM1/GL-RM10/GL-RM10RC/GL-RM1PE Factory Reset improper authentication
- CVE-2026-5958 Race Condition in GNU Sed
- CVE-2026-59570 Android ZCC denial of service
- CVE-2026-5957 EmailKit <= 1.6.5 - Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter
- CVE-2026-59569 Android ZCC VPN API method privilege escalation
- CVE-2026-59568 Remote Code Execution
- CVE-2026-59567 Local privilege escalation
- CVE-2026-59566 Local denial-of-service
- CVE-2026-59565 Local and kernel denial-of-service
- CVE-2026-59564 Authentication bypass between ZCC and client connector portal
- CVE-2026-59563 HMAC Confirmation Token Unbinding in zscaler-mcp-server
- CVE-2026-59562 Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC
- CVE-2026-59561 Command injection in Sakura Editor
- CVE-2026-59560 WordPress FundEngine plugin <= 1.7.8 - Broken Access Control vulnerability
- CVE-2026-5956 SQLi in Ankara Hosting's Site Management Panel
- CVE-2026-59559 Cross-site scripting in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg
- CVE-2026-59558 WordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-59557 WordPress Events Made Easy plugin <= 3.1.3 - Broken Access Control vulnerability
- CVE-2026-59556 Cross-site scripting in Dynamic Pricing With Discount Rules for WooCommerce
- CVE-2026-59555 WordPress Participants Database plugin <= 2.7.8.3 - Arbitrary File Deletion vulnerability
- CVE-2026-59554 WordPress Ziina plugin <= 1.2.21 - Broken Authentication vulnerability
- CVE-2026-59553 WordPress Product Feed Manager plugin <= 7.6.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-59552 WordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-59551 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability
- CVE-2026-59550 WordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerability
- CVE-2026-5955 SQLi in Inrove Software's BiEticaret
- CVE-2026-59549 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability
- CVE-2026-59548 WordPress Byteflows Travel & Hotel Booking plugin <= 1.0.0 - Sensitive Data Exposure vulnerability
- CVE-2026-59547 WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.1.4 - Broken Access Control vulnerability
- CVE-2026-59546 WordPress Hide My WP Ghost plugin <= 7.0.06 - 2FA Bypass vulnerability
- CVE-2026-59545 WordPress miniOrange Discord Integration plugin <= 2.2.4 - Broken Authentication vulnerability
- CVE-2026-59544 WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability
- CVE-2026-59543 WordPress Advanced Views plugin <= 3.8.11 - Remote Code Execution (RCE) vulnerability
- CVE-2026-59542 WordPress Kali Forms plugin <= 2.4.18 - Arbitrary File Deletion vulnerability
- CVE-2026-59541 WordPress WP BASE Booking plugin <= 6.3.1 - Privilege Escalation vulnerability
- CVE-2026-59540 WordPress SMS Alert Order Notifications plugin <= 3.9.6 - Privilege Escalation vulnerability
- CVE-2026-5954 Incorrect Authorization in GitLab
- CVE-2026-59539 WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-59538 WordPress GamiPress plugin <= 7.9.7 - SQL Injection vulnerability
- CVE-2026-59537 SQL injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce
- CVE-2026-59536 WordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability
- CVE-2026-59535 WordPress Thrive Product Manager plugin <= 10.9.2 - Broken Access Control vulnerability
- CVE-2026-59534 WordPress Post My CF7 Form plugin <= 6.2.0 - Broken Access Control vulnerability
- CVE-2026-59533 WordPress Relevanssi Light plugin <= 1.2.2 - SQL Injection vulnerability
- CVE-2026-59532 WordPress Booking and Rental Manager plugin <= 2.7.2 - Price Manipulation vulnerability
- CVE-2026-59531 WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.10.0 - Unknown vulnerability
- CVE-2026-59530 WordPress Stripe For WooCommerce plugin <= 4.0.7 - Broken Access Control vulnerability
- CVE-2026-5953 Reflected XSS in Ceviz Informatics's Web Design
- CVE-2026-59529 WordPress Ebook Store plugin <= 6.19 - Sensitive Data Exposure vulnerability
- CVE-2026-59528 WordPress ShipTime: Discounted Shipping Rates plugin <= 1.1.1 - Sensitive Data Exposure vulnerability
- CVE-2026-59527 WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability
- CVE-2026-59526 WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability
- CVE-2026-59525 WordPress Participants Database plugin <= 2.7.8.3 - SQL Injection vulnerability
- CVE-2026-59524 WordPress Easy Digital Downloads plugin <= 3.6.7 - Broken Authentication vulnerability
- CVE-2026-59523 WordPress Simply Schedule Appointments plugin <= 1.6.11.11 - Broken Access Control vulnerability
- CVE-2026-59522 WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability
- CVE-2026-59521 WordPress Real Testimonials plugin <= 3.1.15 - PHP Object Injection vulnerability
- CVE-2026-59520 WordPress CrawlWP SEO plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-5952 Incorrect Authorization in GitLab
- CVE-2026-59519 WordPress FormLayer plugin <= 1.0.6 - Sensitive Data Exposure vulnerability
- CVE-2026-59518 WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability
- CVE-2026-59517 WordPress Easy Form Builder plugin <= 4.0.12 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-59516 WordPress ICS Calendar plugin <= 12.1.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-59515 WordPress AIWU plugin <= 1.5.4 - SQL Injection vulnerability
- CVE-2026-59514 WordPress Buddyboss Platform plugin <= 3.0.5 - SQL Injection vulnerability
- CVE-2026-59513 WordPress Masteriyo - LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-59512 WordPress Product Enquiry for WooCommerce plugin <= 2.2.34.43 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-59511 WordPress Exclusive Addons Elementor plugin <= 2.7.9.9 - Sensitive Data Exposure vulnerability
- CVE-2026-59510 Authenticated Path Traversal in AIL Framework PDF Object Handling Enables Potential Arbitrary File Read
- CVE-2026-59509 Unauthenticated arbitrary MongoDB collection read in cve-search
- CVE-2026-59508 Interuse i-Bos CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- CVE-2026-59507 Hardcoded credentials in Portal Generator addon to Priority ERP (developed by Soft Solutions)
- CVE-2026-59506 Priority – CWE-306: Missing Authentication for Critical Function
- CVE-2026-59505 Priority - CWE-284: Improper Access Control
- CVE-2026-59504 Priority – CWE-602: Client-Side Enforcement of Server-Side Security
- CVE-2026-59503 Information disclosure in Portal Generator addon to Priority ERP (developed by Soft Solutions)