Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 538 of 1013.
- CVE-2026-56024 WordPress WP EasyPay plugin <= 4.5.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-56023 WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.2 - Broken Access Control vulnerability
- CVE-2026-56022 Webmin MFA bypass
- CVE-2026-56021 Webmin information disclosure via regex pattern
- CVE-2026-56020 Webmin HTTP header authentication bypass
- CVE-2026-5602 Nor2-io heim-mcp new_heim_application tools.ts registerTools os command injection
- CVE-2026-56018 Denial of service in JavaScript::Minifier::XS
- CVE-2026-56017 Null dereference in JavaScript::Minifier::XS
- CVE-2026-56016 CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources
- CVE-2026-56015 Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix length
- CVE-2026-56014 WordPress Master Slider plugin <= 3.11.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-56013 WordPress License Manager for WooCommerce plugin <= 3.0.15 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-56012 WordPress Media LIbrary Assistant plugin <= 3.35 - SQL Injection vulnerability
- CVE-2026-56011 WordPress MapPress Maps for WordPress plugin <= 2.97.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-56010 WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability
- CVE-2026-5601 Acrel Electrical Prepaid Cloud Platform Backup File bin.rar information disclosure
- CVE-2026-56009 WordPress Bricksable for Bricks Builder plugin <= 1.6.83 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-56008 WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability
- CVE-2026-56007 WordPress Ocean Product Sharing plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-56006 WordPress H5P plugin <= 1.17.6 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-56005 WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-56004 obs-service-tar_scm: command injection via mercurial handler
- CVE-2026-56003 libXfont2 computeProps Property Buffer Heap Buffer Overflow
- CVE-2026-56002 libXfont2 PCF Font Parsing Heap Buffer Overflow
- CVE-2026-56001 libXfont2 BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow
- CVE-2026-56000 xorg-x11-server / xwayland GLX contextTags Use-After-Free in CommonMakeCurrent()
- CVE-2026-5600 pretix: API leaks check-in data between events of the same organizer
- CVE-2026-55999 xorg-server / xwayland glamor font atlas Heap Buffer Overflow
- CVE-2026-55998 Cluster Existence Oracle via Unauthenticated Import Endpoint
- CVE-2026-55997 Long-lived Rancher registration token exposed in plaintext
- CVE-2026-55996 Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent
- CVE-2026-55995 Double-free in the iSNS attribute decoder in open-iscsi
- CVE-2026-55994 Apache Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy
- CVE-2026-55993 Apache Camel-Atmosphere-Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy
- CVE-2026-55991 Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2
- CVE-2026-55990 Packet of death for a DNSCrypt misconfigured Unbound
- CVE-2026-5599 API allows deletion of users of other instance
- CVE-2026-55987 Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
- CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions
- CVE-2026-55985 Tycon Systems TPDIN-Monitor-WEB2 Cleartext Storage of Sensitive Information
- CVE-2026-55984 Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
- CVE-2026-55982 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
- CVE-2026-55981 Firmware verification vulnerability
- CVE-2026-55980 Denial-of-service vulnerability in CatchPulse
- CVE-2026-5598 Non-constant time comparisons risk private key leakage in FrodoKEM.
- CVE-2026-55979 Improper access control check in CatchPulse's named pipe communication interface
- CVE-2026-55978 Improper access control vulnerability in CatchPulse
- CVE-2026-55977 Bypass of application rate-limiting mechanism
- CVE-2026-55976 Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url
- CVE-2026-55975 H.VIEW HV-500S6 IP Camera OS Command Injection
- CVE-2026-55973 'dns-error-reporting: yes' leads to stack buffer overflow
- CVE-2026-55971 Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()
- CVE-2026-55970 Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()
- CVE-2026-5597 griptape-ai griptape ComputerTool tool.py path traversal
- CVE-2026-55969 Integer overflow in Apache Thrift
- CVE-2026-55968 Apache Thrift: Node.js quadratic-time DoS in server receive transports
- CVE-2026-55967 AES-GCM streaming APIs do not reject >64 GiB cumulative single messages, enabling counter wrap and keystream reuse
- CVE-2026-55964 Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA (temporary CA exemption)
- CVE-2026-55962 TLS 1.3 post-handshake authentication: server accepts Finished without client Certificate/CertificateVerify
- CVE-2026-55961 wolfSSL_PKCS7_verify() reports success for degenerate (certs-only) PKCS#7 with no signer
- CVE-2026-55960 Un-negotiated Raw Public Key (RFC 7250) accepted in place of X.509, bypassing chain validation
- CVE-2026-5596 griptape-ai griptape SqlTool tool.py sql injection
- CVE-2026-55958 Renesas TSIP TLS 1.3 transcript buffer out-of-bounds write in tsip_StoreMessage
- CVE-2026-55957 Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
- CVE-2026-55956 Apache Tomcat: Security constraints for default servlet ignored method
- CVE-2026-55955 Apache Tomcat: EncryptInterceptor not protected against replay attacks
- CVE-2026-55954 Missing ID token claim validation in ueberauth_apple allows account takeover
- CVE-2026-55953 TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
- CVE-2026-55952 TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension
- CVE-2026-55951 httpc memory exhaustion via unbounded response header accumulation
- CVE-2026-55950 DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions
- CVE-2026-5595 griptape-ai griptape FileManagerTool save_memory_artifacts_to_disk path traversal
- CVE-2026-55949 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55948 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55947 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55946 Microsoft Copilot Information Disclosure Vulnerability
- CVE-2026-55945 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- CVE-2026-55944 Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability
- CVE-2026-5594 premAI-io premsql followup.py eval code injection
- CVE-2026-5590 net: ip/tcp: Null pointer dereference can be triggered by a race condition
- CVE-2026-55899 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55898 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-55897 luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root
- CVE-2026-55895 Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename
- CVE-2026-55894 Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode
- CVE-2026-55893 Capstone SH disassembler `set_reg_n` heap buffer overflow via crafted SH2A FPU bytecode
- CVE-2026-55892 Vim: Out-of-bounds Write in Spell File Prefix Dump
- CVE-2026-55891 PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI
- CVE-2026-55890 Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style()
- CVE-2026-5589 Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem.
- CVE-2026-55889 XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key
- CVE-2026-55888 XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal
- CVE-2026-55887 MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway
- CVE-2026-55886 Jodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set()
- CVE-2026-55885 Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets
- CVE-2026-55884 Tilt: Missing authentication on the network-exposed Tilt HUD server
- CVE-2026-55883 Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream
- CVE-2026-55882 Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server
- CVE-2026-55881 OpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpoint
- CVE-2026-55880 OpenReplay: Cross-user IDOR in notes and dashboard widgets