Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 523 of 1013.
- CVE-2026-57866 Apache Impala: Secrets Exfiltration via SSRF
- CVE-2026-57863 Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint
- CVE-2026-57862 Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation
- CVE-2026-57860 ForgeCode Arbitrary Code Execution via Unvetted .mcp.json in Untrusted Repository
- CVE-2026-5786 Privilege escalation in Endpoint Manager Mobile
- CVE-2026-57859 e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()
- CVE-2026-57858 Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID
- CVE-2026-57857 Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter
- CVE-2026-57856 Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API
- CVE-2026-57855 Cockpit CMS Missing Authorization in Bucket File Storage API
- CVE-2026-57852 Authentication Bypass via Null Short-Circuit in Grav CMS Scheduler Webhook Token Check
- CVE-2026-57851 MSI KernCoreLib64.sys Privilege Escalation via IOCTL Handlers
- CVE-2026-57850 RustDesk Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injection
- CVE-2026-5785 SQL Injection
- CVE-2026-57848 Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation
- CVE-2026-57845 Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder
- CVE-2026-57843 NetBSD mm_open() PK_KMEM Flag Kernel Pointer Information Disclosure
- CVE-2026-57842 NetBSD COMPAT_NETBSD32 Double Free / Use-After-Free via recvmsg() msg_iovlen
- CVE-2026-5784 Stored XSS in DivvyDrive Information Technologies' DivvyDrive
- CVE-2026-57834 Apache Traffic Server: Malformed chunked message body allows request smuggling
- CVE-2026-57833 Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2
- CVE-2026-57832 Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9
- CVE-2026-57831 Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2
- CVE-2026-57830 Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7
- CVE-2026-5783 Reflected XSS in Beyaz Computer's CityPLus
- CVE-2026-57829 Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7
- CVE-2026-57828 Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3
- CVE-2026-57827 Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12
- CVE-2026-57826 An issue was discovered in openHiTLS 0.2.0 through 0.3.2.
- CVE-2026-57825 Security feature bypass in opam
- CVE-2026-57822 Deserialization in Apache ActiveMQ Artemis
- CVE-2026-57821 Apache Fineract: Office list: SQL Injection via Subquery in orderBy
- CVE-2026-5782 Reflected XSS in MRV Technology's TurkHotspot
- CVE-2026-57819 Apache CXF: No default restriction on the amount of form parameters per message
- CVE-2026-57818 Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider
- CVE-2026-57817 Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow
- CVE-2026-57816 WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57815 WordPress Forminator plugin <= 1.55.0.2 - Arbitrary File Download vulnerability
- CVE-2026-57814 WordPress Forminator plugin <= 1.55.0.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57813 WordPress MailOptin plugin <= 1.2.77.3 - Privilege Escalation vulnerability
- CVE-2026-57812 WordPress Simply Schedule Appointments plugin <= 1.6.12.4 - Broken Access Control vulnerability
- CVE-2026-57811 WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability
- CVE-2026-57810 WordPress APIExperts Square for WooCommerce plugin <= 4.7.4 - SQL Injection vulnerability
- CVE-2026-5781 Multiple vulnerabilities in MphRx's Minerva
- CVE-2026-57809 WordPress AffiliateWP plugin <= 2.34.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-57808 WordPress WP EasyPay plugin <= 4.5.0 - Arbitrary Content Deletion vulnerability
- CVE-2026-57807 WordPress OAuth Single Sign On - SSO (OAuth Client) plugin <= 38.5.8 - Broken Authentication vulnerability
- CVE-2026-57806 Cross-site scripting in Martfury - WooCommerce Marketplace WordPress Theme
- CVE-2026-57805 WordPress Tonda theme <= 2.5 - Local File Inclusion vulnerability
- CVE-2026-57804 WordPress TheGem Theme Elements (for Elementor) plugin < 5.12.1.1 - Local File Inclusion vulnerability
- CVE-2026-57803 WordPress Struktur Core plugin < 2.7 - Local File Inclusion vulnerability
- CVE-2026-57802 WordPress Struktur theme < 2.7 - Local File Inclusion vulnerability
- CVE-2026-57801 WordPress SetSail theme <= 2.1 - Local File Inclusion vulnerability
- CVE-2026-57800 WordPress Overworld theme <= 1.5 - Local File Inclusion vulnerability
- CVE-2026-5780 Multiple vulnerabilities in MphRx's Minerva
- CVE-2026-57799 WordPress Nuss theme <= 1.3.6 - Local File Inclusion vulnerability
- CVE-2026-57798 WordPress NewsPlus Shortcodes plugin <= 4.2.0 - Local File Inclusion vulnerability
- CVE-2026-57797 WordPress EduMall theme <= 4.5.1 - Broken Access Control vulnerability
- CVE-2026-57796 WordPress Leedo theme <= 3.0.0 - Local File Inclusion vulnerability
- CVE-2026-57795 WordPress Kitchor theme <= 1.4.3 - Local File Inclusion vulnerability
- CVE-2026-57794 WordPress Golo Framework plugin <= 1.7.3 - Local File Inclusion vulnerability
- CVE-2026-57793 WordPress Flow theme <= 1.8 - Local File Inclusion vulnerability
- CVE-2026-57792 WordPress Dør theme <= 2.4.1 - Local File Inclusion vulnerability
- CVE-2026-57791 WordPress Brook theme <= 2.9.0 - Local File Inclusion vulnerability
- CVE-2026-57790 WordPress Billey theme <= 2.1.8 - Local File Inclusion vulnerability
- CVE-2026-5779 Multiple vulnerabilities in MphRx's Minerva
- CVE-2026-57789 WordPress Aqua theme <= 5.1.2 - Local File Inclusion vulnerability
- CVE-2026-57788 WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability
- CVE-2026-57787 WordPress CWS SVGicons plugin <= 1.5.5 - SQL Injection vulnerability
- CVE-2026-57786 WordPress WorkScout-Core plugin <= 1.7.08 - Cross Site Request Forgery (CSRF) to Broken Authentication vulnerability
- CVE-2026-57785 WordPress ApusListing theme <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-57784 WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-57783 WordPress Speaker plugin <= 4.1.13 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57782 WordPress Universal Clocks plugin <= 1.2.0 - Broken Access Control vulnerability
- CVE-2026-57781 WordPress MeetingHub plugin <= 1.25.10 - Broken Access Control vulnerability
- CVE-2026-57780 WordPress Envision Page Builder plugin <= 0.22 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-5778 Integer underflow leads to out-of-bounds access in sniffer ChaCha decrypt path.
- CVE-2026-57779 WordPress Fascinate theme <= 1.1.5 - Broken Access Control vulnerability
- CVE-2026-57778 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerability
- CVE-2026-57777 WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability
- CVE-2026-57776 WordPress VW Wedding theme <= 1.3.7 - Broken Access Control vulnerability
- CVE-2026-57774 WordPress VW Food Corner theme <= 1.1.0 - Broken Access Control vulnerability
- CVE-2026-57773 WordPress Advanced Shipment Tracking for WooCommerce plugin <= 4.0 - SQL Injection vulnerability
- CVE-2026-57772 WordPress WP Inventory Manager plugin <= 2.4.0 - SQL Injection vulnerability
- CVE-2026-57771 WordPress GD Rating System plugin <= 3.7 - SQL Injection vulnerability
- CVE-2026-57770 WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability
- CVE-2026-5777 Security Misconfiguration Vulnerability in Atom 3x Projector
- CVE-2026-57769 WordPress Grand Photography theme <= 5.7.8 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-57768 WordPress Houzez Login Register plugin <= 3.3.3 - Privilege Escalation vulnerability
- CVE-2026-57767 WordPress WP Google Maps Pro plugin <= 10.1.02 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57766 WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.6 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-57765 WordPress WP EasyCart plugin <= 5.9.0 - SQL Injection vulnerability
- CVE-2026-57764 WordPress Surbma | Yoast SEO Breadcrumb Shortcode plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57763 WordPress Structured Content plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57762 WordPress Simple URLs plugin <= 151 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57761 WordPress SEOWP theme <= 3.12.2 - CSRF to Stored XSS vulnerability
- CVE-2026-57760 WordPress Sendcloud Shipping plugin <= 1.0.29 - Broken Access Control vulnerability
- CVE-2026-5776 Email Encoder < 2.4.7 - Unauthenticated Stored XSS
- CVE-2026-57759 WordPress ProfileGrid plugin <= 6.0.0.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-57758 WordPress Permalink Manager for WooCommerce plugin <= 1.0.8.2 - CSRF to Stored XSS vulnerability