Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 526 of 1013.
- CVE-2026-57511 SuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Title
- CVE-2026-57510 SuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC
- CVE-2026-5751 justhtml before 1.14.0 Mutation XSS via custom sanitization policies
- CVE-2026-57501 Security feature bypass in desktop
- CVE-2026-5750 Insecure direct object reference (IDOR) vulnerability in Fullstep
- CVE-2026-57499 Liman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE)
- CVE-2026-57498 Missing authorization in coolify
- CVE-2026-57497 webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules
- CVE-2026-57496 NetLicensing MCP Server: REST Path Traversal Bypasses Token Redaction
- CVE-2026-57495 AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)
- CVE-2026-57494 AgenticMail: Cross-agent task authorization bypass in AgenticMail API
- CVE-2026-57493 FileRise: Remember-me auto-login uses stale admin role from token instead of current role
- CVE-2026-57492 FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation
- CVE-2026-57491 FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist
- CVE-2026-57490 FileRise: WebDAV authentication bypasses TOTP/MFA entirely
- CVE-2026-5749 Inadequate access control vulnerability in Fullstep
- CVE-2026-57489 FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass
- CVE-2026-57488 pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling
- CVE-2026-57487 libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered
- CVE-2026-57486 pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes
- CVE-2026-57485 Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint
- CVE-2026-57481 Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change
- CVE-2026-57480 Parse Server: Denial of service via exponential-time processing of deeply nested query operators
- CVE-2026-5748 Text Snippets <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'w' Shortcode Attribute
- CVE-2026-57476 Deloitte AI Assist for Customer unauthenticated RAG corpus read and write
- CVE-2026-57475 Deloitte AI Assist for Customer unauthenticated configuration write
- CVE-2026-57474 Deloitte AI Assist for Customer information disclosure
- CVE-2026-57473 Weak cryptography in Home Hub
- CVE-2026-57472 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoad
- CVE-2026-57471 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoad
- CVE-2026-5747 Out-of-bounds Write in Firecracker virtio-pci Transport
- CVE-2026-57469 Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory
- CVE-2026-57458 Vikunja: Scoped API token can mint unrestricted OAuth session credentials
- CVE-2026-57456 Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings
- CVE-2026-57455 Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument
- CVE-2026-57454 Vim: Out-of-bounds Read with Text Properties
- CVE-2026-57453 Vim: PowerShell Command Injection via Unescaped Filename in zip.vim Extraction
- CVE-2026-57452 Vim: Out-of-bounds Read with libsodium-encrypted Files
- CVE-2026-57451 Vim: Out-of-bounds Read in Text Property Count
- CVE-2026-5745 Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive
- CVE-2026-57449 Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
- CVE-2026-57448 Blombooru: administrator image-proxy server-side request forgery
- CVE-2026-57447 Discourse Doc Categories: Doc category index refresh leaks private topic titles
- CVE-2026-57446 libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handle
- CVE-2026-57445 Gardens v2: Approve-side dispute resolution drains active streaming escrow reserve
- CVE-2026-57443 SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
- CVE-2026-57442 MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested
- CVE-2026-57441 MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence
- CVE-2026-57440 Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled
- CVE-2026-57439 CyberChef: Prototype pollution in Series Chart operation
- CVE-2026-57438 Nokogiri: Possible Use-After-Free in XInclude Processing
- CVE-2026-57437 Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime
- CVE-2026-57436 Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type
- CVE-2026-57435 Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`
- CVE-2026-57434 Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes
- CVE-2026-57433 Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record
- CVE-2026-57432 Integer overflow in perl:perl
- CVE-2026-57431 WordPress Featured Image plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57430 WordPress SEOPress PRO plugin <= 9.1.1 - Broken Access Control vulnerability
- CVE-2026-5743 Cross-site scripting in SimpLy Gallery
- CVE-2026-57429 WordPress Slim SEO plugin <= 4.6.2 - Broken Access Control vulnerability
- CVE-2026-57428 WordPress Sprout Clients plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57427 WordPress Download Monitor - WPForms Lock plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57426 WordPress Modula - PRO plugin <= 2.10.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57425 WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability
- CVE-2026-57424 WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.4 - Broken Access Control vulnerability
- CVE-2026-57423 WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.8 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-57422 Cross-site scripting in Bopo – WooCommerce Product Bundle Builder
- CVE-2026-57421 WordPress CRM Perks Forms plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57420 WordPress Author Box WP Lens plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-5742 UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution
- CVE-2026-57419 WordPress Stock Locations for WooCommerce plugin <= 3.1.8 - Broken Access Control vulnerability
- CVE-2026-57418 WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerability
- CVE-2026-57417 WordPress Cart Lift plugin <= 3.1.57 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57416 WordPress SiteGround Email Marketing plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57415 WordPress Gift Vouchers plugin <= 4.7.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57414 WordPress ChatBot for eCommerce – WoowBot plugin <= 4.6.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57413 WordPress Instant Image Generator plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-57412 WordPress Gift Vouchers plugin <= 4.6.9 - Broken Access Control vulnerability
- CVE-2026-57411 Cross-site scripting in CF7 Views – Complete Entry Management for Contact Form 7
- CVE-2026-57410 WordPress MailerPress plugin <= 2.0.2 - Privilege Escalation vulnerability
- CVE-2026-5741 suvarchal docker-mcp-server HTTP index.ts pull_image os command injection
- CVE-2026-57409 WordPress Active Products Tables for WooCommerce plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57408 WordPress Peach Payments Gateway plugin <= 4.0.2 - Broken Access Control vulnerability
- CVE-2026-57407 WordPress PDF Generator for WordPress plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-57406 WordPress FundEngine plugin <= 1.7.6 - Broken Access Control vulnerability
- CVE-2026-57405 WordPress Open Shop theme <= 1.7.1 - Broken Access Control vulnerability
- CVE-2026-57404 WordPress Booking and Rental Manager plugin <= 2.6.9 - Broken Access Control vulnerability
- CVE-2026-57403 WordPress GD Security Headers plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57402 WordPress Flexible Refund and Return Order for WooCommerce plugin <= 1.0.51 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57401 WordPress SureDash plugin <= 1.8.0 - Arbitrary File Deletion vulnerability
- CVE-2026-57400 WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerability
- CVE-2026-5740 Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server
- CVE-2026-57399 WordPress Proxy & VPN Blocker plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57398 WordPress Real Estate Manager Pro plugin <= 12.8.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57397 WordPress Coaching theme <= 3.9.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57396 WordPress Free Gifts for WooCommerce plugin <= 13.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57395 WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability
- CVE-2026-57394 WordPress Newsletters plugin <= 4.14 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57393 WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Sensitive Data Exposure vulnerability