Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 525 of 1013.
- CVE-2026-57662 WordPress Contest Gallery plugin <= 30.0.0 - SQL Injection vulnerability
- CVE-2026-57661 WordPress WPComplete plugin <= 2.9.5.5 - Broken Access Control vulnerability
- CVE-2026-57660 WordPress Booking and Rental Manager plugin <= 2.7.1 - Broken Access Control vulnerability
- CVE-2026-5766 Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass
- CVE-2026-57659 Cross-site request forgery in Paid Memberships Pro - Add Member From Admin
- CVE-2026-57658 WordPress TemplateSpare plugin <= 4.2.0 - Arbitrary File Upload vulnerability
- CVE-2026-57657 WordPress Gmail SMTP plugin <= 1.2.3.19 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-57656 WordPress Hester Core plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57655 WordPress Child theme Wizard plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-57654 WordPress Affiliates Manager plugin <= 2.9.49 - Broken Access Control vulnerability
- CVE-2026-57653 WordPress WP Job Portal plugin <= 2.5.2 - SQL Injection vulnerability
- CVE-2026-57652 WordPress JS Help Desk plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-57651 WordPress Ghost Kit plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57650 WordPress Magazine Blocks plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57649 WordPress Shoppable Images Lite plugin <= 1.3 - Broken Access Control vulnerability
- CVE-2026-57648 WordPress Nelio Content plugin <= 4.3.4 - Broken Access Control vulnerability
- CVE-2026-57647 WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.6.1 - Local File Inclusion vulnerability
- CVE-2026-57646 WordPress Majestic Support plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-57645 WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability
- CVE-2026-57644 WordPress Restaurant Menu by MotoPress plugin <= 2.4.10 - SQL Injection vulnerability
- CVE-2026-57643 WordPress WP Post Author plugin <= 3.9.1 - SQL Injection vulnerability
- CVE-2026-57642 WordPress Gallery plugin <= 4.7.8 - SQL Injection vulnerability
- CVE-2026-57641 WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-57640 WordPress MasterStudy LMS plugin <= 3.7.30 - Broken Access Control vulnerability
- CVE-2026-57638 WordPress Fluent Booking plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57637 WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-57636 WordPress wpForo Forum plugin <= 3.0.9 - SQL Injection vulnerability
- CVE-2026-57635 Cross-site request forgery in FunnelKit Payment Gateway for Stripe WooCommerce
- CVE-2026-57634 WordPress PPWP plugin <= 1.9.19 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-57633 WordPress WCBoost – Products Compare plugin <= 1.1.0 - Sensitive Data Exposure vulnerability
- CVE-2026-57632 WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.19.0 - Broken Access Control vulnerability
- CVE-2026-57631 WordPress Popup box plugin <= 6.0.1 - SQL Injection vulnerability
- CVE-2026-57630 WordPress Blocksy Companion Pro plugin <= 2.1.46 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-57629 WordPress StatCounter plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57628 WordPress WP All Import plugin <= 4.0.1 - SQL Injection vulnerability
- CVE-2026-57627 WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-57626 WordPress MailPoet plugin 5.30.0-5.33.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-57625 WordPress Admin and Site Enhancements (ASE) Pro plugin <= 8.8.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57624 WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability
- CVE-2026-57623 WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability
- CVE-2026-57622 WordPress WPCafe plugin <= 3.0.14 - Broken Access Control vulnerability
- CVE-2026-57621 WordPress Booktics plugin <= 1.0.21 - PHP Object Injection vulnerability
- CVE-2026-57620 WordPress Exclusive Addons Elementor plugin <= 2.7.9.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-5762 ReportIncident DiscussionTools integration causes slow requests
- CVE-2026-57619 WordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerability
- CVE-2026-57618 WordPress Neve PRO theme <= 3.1.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57617 WordPress SeedProd Pro plugin < 6.19.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57600 Information disclosure in DS-2CD Series
- CVE-2026-5760 CVE-2026-5760
- CVE-2026-57599 Privilege escalation in DS-2CD Series
- CVE-2026-57590 Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations
- CVE-2026-5759 Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB
- CVE-2026-57589 Use after free in OpenBSD
- CVE-2026-57588 SQL Injection in Nessus via Malicious Scan Result File Import
- CVE-2026-57587 SQL Injection in Nessus via Reverse DNS Lookup
- CVE-2026-57586 CodeRAG: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution
- CVE-2026-57585 MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error
- CVE-2026-57584 Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS
- CVE-2026-57583 OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source
- CVE-2026-57581 DotVVM: Unrestricted file upload
- CVE-2026-57580 authentik: Account Takeover via SAML NameID Comment Truncation
- CVE-2026-5758 Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution
- CVE-2026-57579 Alchemy: Unauthenticated nested page API leaks restricted & unpublished content
- CVE-2026-57578 DotVVM: Missing authorization in AuthorizeActionFilter
- CVE-2026-57577 DotVVM: ReDOS in routing
- CVE-2026-57576 plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description length
- CVE-2026-57575 Misskey: SSRF bypass in URL Preview
- CVE-2026-57574 Misskey: TOTP tokens can be reused
- CVE-2026-57573 Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint
- CVE-2026-57572 Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args
- CVE-2026-57571 Crawl4AI arbitrary file write via download filename path traversal
- CVE-2026-57570 backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
- CVE-2026-5757 There exists an unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine
- CVE-2026-57569 Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation
- CVE-2026-57568 Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)
- CVE-2026-5756 Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS)
- CVE-2026-57559 Use After Free in DSP_Services
- CVE-2026-57555 Use After Free in DSP Service
- CVE-2026-57554 Use After Free in DSP Service
- CVE-2026-5755 Denial of service via crafted TIFF file upload
- CVE-2026-57546 Buffer Over-read in WLAN HAL
- CVE-2026-57545 Untrusted Pointer Dereference in Graphics
- CVE-2026-5754 Radware Alteon has a reflected XSS vulnerability
- CVE-2026-57537 Use After Free in DSP Service
- CVE-2026-57536 Insufficient validation of payment status in pretix-mollie
- CVE-2026-57535 Server-side request forgery in pretix
- CVE-2026-57534 Stored XSS in pretix-pages
- CVE-2026-57533 Cross-site scripting in pretix
- CVE-2026-57532 Cross-site scripting in pretix
- CVE-2026-57531 Milkdown < 7.21.3 DOM XSS via innerHTML Assignment
- CVE-2026-57530 Milkdown < 7.21.3 Stored XSS via javascript: URL in link href
- CVE-2026-5753 Missing authorization in All-in-One WP Migration Unlimited Extension
- CVE-2026-57527 ZAP ViewState Add-on Insecure Deserialization via JSFViewState.decode()
- CVE-2026-57522 Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates
- CVE-2026-57521 Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController
- CVE-2026-57520 Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint
- CVE-2026-5752 CVE-2026-5752
- CVE-2026-57518 Pagekit CMS 1.0.18 Privilege Escalation via UserApiController
- CVE-2026-57517 Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter
- CVE-2026-57516 Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader