Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 537 of 1013.
- CVE-2026-56128 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php
- CVE-2026-56127 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php
- CVE-2026-56126 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php
- CVE-2026-56124 phpUploader < 2.0.2 Unauthenticated Database Exposure via index model
- CVE-2026-56123 socat 1.8.0.0 - 1.8.1.1 Heap Buffer Overflow via SOCKS5 Reply Parser
- CVE-2026-56122 Winstone Servlet Engine 0.9.10 Path Traversal via HTTP Request Paths
- CVE-2026-56121 Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization
- CVE-2026-5612 Belkin F9K1015 formWlEncrypt stack-based overflow
- CVE-2026-56117 dhcpcd Heap Use-After-Free via Control Socket Handling
- CVE-2026-56116 dhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling
- CVE-2026-56115 Bootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass
- CVE-2026-56114 dhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage()
- CVE-2026-56113 dhcpcd Heap Use-After-Free in dhcp6_deprecateaddrs via DHCPv6 RENEW
- CVE-2026-56111 Marlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code Handler
- CVE-2026-5611 Belkin F9K1015 formCrossBandSwitch stack-based overflow
- CVE-2026-56109 ALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c
- CVE-2026-56104 Chainlit < 2.10.1 Session Hijacking via WebSocket Session Restoration
- CVE-2026-56101 OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS
- CVE-2026-56100 SpringBlade 2.7.3 < 5.0.0 Privilege Escalation via Exposed Feign Endpoint
- CVE-2026-5610 Belkin F9K1015 formWISP5G stack-based overflow
- CVE-2026-56099 OpenBSD mpls_do_error Kernel Stack Memory Disclosure via MPLS Input
- CVE-2026-56098 Rubygem-katello: improper authorization logic allows resource enumeration
- CVE-2026-56097 Rubygem-katello: sql injection in registry proxy via labels
- CVE-2026-56096 Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
- CVE-2026-56095 Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
- CVE-2026-56094 Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
- CVE-2026-56093 Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
- CVE-2026-56092 Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
- CVE-2026-56091 Apache Shiro: Authentication bypass in Guice-Web integration
- CVE-2026-56090 Privilege escalation in ObjectScale
- CVE-2026-5609 Tenda i12 Parameter wifiSSIDset formwrlSSIDset stack-based overflow
- CVE-2026-56089 Path traversal in ObjectScale
- CVE-2026-56088 SQL injection in OpenManage Enterprise
- CVE-2026-56087 Security feature bypass in ThinOS 10
- CVE-2026-56086 Missing authorization in PowerProtect Data Domain
- CVE-2026-56085 Information disclosure in PowerProtect Data Domain
- CVE-2026-56084 Server-side request forgery in PowerProtect Data Domain
- CVE-2026-56082 Capgo - Unauthenticated Cross-Tenant Billing Log Tampering via public.record_build_time RPC
- CVE-2026-56081 Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email
- CVE-2026-56080 Cap-go - Authentication Logic Flaw in Enforce Password Policy
- CVE-2026-5608 Belkin F9K1122 formWlanSetup stack-based overflow
- CVE-2026-56079 Capgo - Cross-Tenant Authorization Bypass via PostgREST Webhook Access
- CVE-2026-56078 PraisonAI - Arbitrary File Read and Write via Path Traversal in MultiAgentMonitor
- CVE-2026-56077 PraisonAI - Information Disclosure via Shared MultiAgentLedger State
- CVE-2026-56076 PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint
- CVE-2026-56075 PraisonAI - Arbitrary Shell Command Execution via Hardcoded Approval Mode Override
- CVE-2026-56074 PraisonAI - Tool Approval Cache Bypass via Coarse-Grained Caching
- CVE-2026-56073 Cap-go - OTP Bypass via Response Manipulation in Email Verification
- CVE-2026-56072 WordPress WoodMart theme <= 8.5.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-56071 WordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-56070 WordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerability
- CVE-2026-5607 imprvhub mcp-browser-agent URL Parameter handlers.ts CallToolRequestSchema server-side request forgery
- CVE-2026-56069 WordPress Toolset Forms plugin <= 2.6.24 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-56068 WordPress JetEngine plugin <= 3.8.10.2 - SQL Injection vulnerability
- CVE-2026-56067 WordPress JetSmartFilters plugin <= 3.8.3 - SQL Injection vulnerability
- CVE-2026-56066 WordPress ShortPixel Adaptive Images plugin <= 3.11.4 - Arbitrary File Deletion vulnerability
- CVE-2026-56064 WordPress Tourfic plugin <= 2.22.5 - SQL Injection vulnerability
- CVE-2026-56063 WordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerability
- CVE-2026-56062 WordPress Quotes llama plugin <= 3.1.5 - SQL Injection vulnerability
- CVE-2026-56061 WordPress Subscriptions for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerability
- CVE-2026-56060 WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 7.1.1 - Sensitive Data Exposure vulnerability
- CVE-2026-5606 PHPGurukul Online Shopping Portal Project Parameter order-details.php sql injection
- CVE-2026-56059 WordPress Travel Booking theme <= 2.2.5 - Arbitrary File Upload vulnerability
- CVE-2026-56058 WordPress Quform plugin <= 2.23.0 - Arbitrary File Upload vulnerability
- CVE-2026-56057 WordPress Uncanny Automator Pro plugin <= 7.3.0.6 - PHP Object Injection vulnerability
- CVE-2026-56056 WordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-56055 WordPress RealHomes theme <= 4.5.3 - PHP Object Injection vulnerability
- CVE-2026-56054 WordPress JS Help Desk plugin <= 3.1.1 - Arbitrary File Deletion vulnerability
- CVE-2026-56053 WordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerability
- CVE-2026-56052 WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.5 - SQL Injection vulnerability
- CVE-2026-56051 WordPress TablePress plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-56050 WordPress PPOM for WooCommerce plugin <= 33.0.18 - Broken Access Control vulnerability
- CVE-2026-5605 Tenda CH22 WrlExtraSet formWrlExtraSet stack-based overflow
- CVE-2026-56049 WordPress Post Snippets plugin <= 4.0.19 - Remote Code Execution (RCE) vulnerability
- CVE-2026-56048 Missing authorization in Payment Gateway Based Fees and Discounts for WooCommerce
- CVE-2026-56047 WordPress perfmatters plugin <= 2.6.3 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-56046 WordPress ListingPro theme <= 2.9.11 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-56045 WordPress Automatic plugin < 3.135.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-56044 WordPress Blog2Social plugin <= 8.9.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-56043 WordPress Customer Reviews for WooCommerce plugin <= 5.110.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-56042 WordPress Advanced Order Export For WooCommerce plugin <= 4.0.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-56041 WordPress Responsive Lightbox plugin <= 2.7.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-56040 WordPress Gutenverse Form plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-5604 Tenda CH22 Parameter CertLocalPrecreate formCertLocalPrecreate stack-based overflow
- CVE-2026-56039 WordPress Quick Interest Slider plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-56038 WordPress Frisbii Pay plugin <= 1.8.2 - Privilege Escalation vulnerability
- CVE-2026-56037 WordPress Themify Popup plugin <= 1.4.3 - PHP Object Injection vulnerability
- CVE-2026-56036 WordPress 워드프레스 결제 심플페이 plugin <= 5.5.6 - SQL Injection vulnerability
- CVE-2026-56035 WordPress BitFire Security plugin <= 5.0.3 - Multiple Vulnerabilities vulnerability
- CVE-2026-56034 WordPress Library Management System plugin <= 3.5.7 - SQL Injection vulnerability
- CVE-2026-56033 WordPress Dokan Pro plugin <= 5.0.4 - Privilege Escalation vulnerability
- CVE-2026-56032 WordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerability
- CVE-2026-56031 WordPress Uncanny Automator plugin <= 7.3.1.2 - PHP Object Injection vulnerability
- CVE-2026-56030 WordPress Paytium plugin <= 5.0.2 - Privilege Escalation vulnerability
- CVE-2026-5603 elgentos magento2-dev-mcp index.ts executeMagerun2Command os command injection
- CVE-2026-56029 WordPress CorvusPay WooCommerce Payment Gateway plugin <= 2.7.4 - Broken Authentication vulnerability
- CVE-2026-56028 WordPress Easy Elements for Elementor – Addons & Website Templates plugin <= 1.4.9 - Privilege Escalation vulnerability
- CVE-2026-56027 WordPress Booster for WooCommerce plugin <= 8.0.1 - Arbitrary File Upload vulnerability
- CVE-2026-56026 WordPress utm.codes plugin <= 1.9.0 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-56025 WordPress Paymob for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability