Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 547 of 1013.
- CVE-2026-5496 Labcenter Electronics Proteus PDSPRJ File Parsing Type Confusion Remote Code Execution Vulnerability
- CVE-2026-5495 Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2026-5494 Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2026-5493 Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2026-54920 OpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil image resize
- CVE-2026-5492 DriveLock Directory Traversal Information Disclosure Vulnerability
- CVE-2026-54919 cpp-httplib: TLS certificate chain verification bypassed for IP-literal hosts on Mbed TLS and wolfSSL backends
- CVE-2026-54918 Server-side request forgery in devicetype-library
- CVE-2026-54917 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
- CVE-2026-54916 Code injection in devicetype-library
- CVE-2026-54915 Tautulli: Open redirect via whitespace bypass in /auth/redirect
- CVE-2026-54911 UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()
- CVE-2026-54910 FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files
- CVE-2026-5491 DriveLock Directory Traversal Information Disclosure Vulnerability
- CVE-2026-54909 Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute
- CVE-2026-54908 Pion DTLS: Denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message
- CVE-2026-54907 Caddy Proxy Manager: Registrations enabled by default allows creating users with "user" permission
- CVE-2026-54906 concurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption
- CVE-2026-54905 concurrent-ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity
- CVE-2026-54904 concurrent-ruby: `AtomicReference#update` livelocks when the stored value is `Float::NAN`
- CVE-2026-54903 Oj: Integer Overflow in Oj.load 2GB String Handling
- CVE-2026-54902 Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback
- CVE-2026-54901 Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking
- CVE-2026-54900 Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling
- CVE-2026-5490 DriveLock SQL Injection Privilege Escalation Vulnerability
- CVE-2026-54899 Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle
- CVE-2026-54898 Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation
- CVE-2026-54897 Oj : Use-After-Free in Oj::Doc Iterators via Reentrant Close
- CVE-2026-54896 Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent
- CVE-2026-54894 Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys
- CVE-2026-54893 Email-derived URL path injection in the Swoosh Microsoft Graph adapter
- CVE-2026-54892 Plug: quadratic-time decoding of nested query/body parameters enables denial of service
- CVE-2026-54891 Plaintext APPLICATION_DATA injected during TLS handshake delivered to client application post-handshake in ssl
- CVE-2026-54890 BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding
- CVE-2026-5489 DriveLock Directory Traversal Information Disclosure Vulnerability
- CVE-2026-54889 Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)
- CVE-2026-54888 Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex
- CVE-2026-54887 DTLS server cookie bypass during startup window due to empty initial cookie secret
- CVE-2026-54886 SSH SFTP server denial of service via extended channel data infinite loop
- CVE-2026-54885 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
- CVE-2026-5488 Missing authorization in ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
- CVE-2026-54876 Client-Side Memory Leak in OCSP Response Checking
- CVE-2026-54875 Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V
- CVE-2026-54874 Excessive Memory Use Buffering DTLS Records for a Future Epoch
- CVE-2026-54873 QUIC STREAM Fragment Metadata DoS
- CVE-2026-54872 Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves
- CVE-2026-54871 WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.2 - Broken Access Control vulnerability
- CVE-2026-54870 WordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-5487 DriveLock Directory Traversal Information Disclosure Vulnerability
- CVE-2026-54869 WordPress IMPress for IDX Broker plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-54868 WordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-54867 WordPress Responsive Slider plugin <= 0.1.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-54866 WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-54865 WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-54864 WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-54862 WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-54860 WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability
- CVE-2026-5486 Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter
- CVE-2026-54859 WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability
- CVE-2026-54858 WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability
- CVE-2026-54857 WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability
- CVE-2026-54856 WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability
- CVE-2026-54853 WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability
- CVE-2026-54852 WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability
- CVE-2026-5485 OS command injection in Amazon Athena ODBC driver on Linux
- CVE-2026-54849 WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.11 - SQL Injection vulnerability
- CVE-2026-54848 WordPress APIExperts Square for WooCommerce plugin <= 4.7.3 - Sensitive Data Exposure vulnerability
- CVE-2026-54847 WordPress Stylish Cost Calculator plugin <= 8.3.9 - Broken Access Control vulnerability
- CVE-2026-54846 WordPress Syncee Premium Dropshipping & Wholesale plugin <= 1.0.27 - Broken Access Control vulnerability
- CVE-2026-54845 WordPress MDTF plugin <= 1.3.8 - Local File Inclusion vulnerability
- CVE-2026-54844 WordPress CheckView Automated Testing plugin <= 2.1.0 - Broken Access Control vulnerability
- CVE-2026-54843 WordPress MDTF plugin <= 1.3.7 - SQL Injection vulnerability
- CVE-2026-54842 WordPress Royal MCP plugin <= 1.4.25 - Broken Access Control vulnerability
- CVE-2026-54841 WordPress Vitepos plugin <= 3.4.2 - Sensitive Data Exposure vulnerability
- CVE-2026-54840 WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability
- CVE-2026-5484 BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control
- CVE-2026-54839 Information disclosure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups
- CVE-2026-54838 WordPress WC Vendors Marketplace plugin <= 2.6.8 - SQL Injection vulnerability
- CVE-2026-54837 WordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability
- CVE-2026-54836 WordPress Filter & Grids plugin <= 3.11.5 - SQL Injection vulnerability
- CVE-2026-54835 WordPress Five Star Restaurant Menu plugin <= 2.5.2 - Broken Access Control vulnerability
- CVE-2026-54834 WordPress Object Cache 4 everyone plugin <= 2.3.2 - Sensitive Data Exposure vulnerability
- CVE-2026-54833 WordPress Enable CORS plugin <= 2.0.3 - Backdoor vulnerability
- CVE-2026-54832 WordPress Gutenverse Companion plugin <= 2.5.0 - Broken Access Control vulnerability
- CVE-2026-54831 WordPress GeoDirectory plugin <= 2.8.162 - SQL Injection vulnerability
- CVE-2026-54830 WordPress Five Star Restaurant Reservations plugin <= 2.7.19 - Broken Access Control vulnerability
- CVE-2026-5483 Odh-dashboard: odh dashboard kubernetes service account exposure
- CVE-2026-54829 WordPress WP Photo Album Plus plugin <= 9.1.13.005 - SQL Injection vulnerability
- CVE-2026-54828 WordPress Motors plugin <= 1.4.109 - Broken Access Control vulnerability
- CVE-2026-54827 WordPress Real Estate 7 theme <= 3.5.9 - SQL Injection vulnerability
- CVE-2026-54826 WordPress SupportCandy plugin <= 3.4.6 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-54825 WordPress wpDataTables plugin <= 7.4 - SQL Injection vulnerability
- CVE-2026-54824 WordPress Ads by WPQuads plugin <= 3.0.3 - Sensitive Data Exposure vulnerability
- CVE-2026-54823 WordPress Widget Options plugin <= 4.2.3 - Remote Code Execution (RCE) vulnerability
- CVE-2026-54822 WordPress SALESmanago & Leadoo plugin <= 3.11.2 - SQL Injection vulnerability
- CVE-2026-54821 WordPress Visual Link Preview plugin <= 2.3.1 - Sensitive Data Exposure vulnerability
- CVE-2026-54820 WordPress JetBooking plugin <= 4.0.4.1 - SQL Injection vulnerability
- CVE-2026-5482 Remote Code Execution via Unrestricted File Upload in Responsive FileManager
- CVE-2026-54819 WordPress Listdom plugin <= 5.4.0 - SQL Injection vulnerability
- CVE-2026-54818 WordPress Slimstat Analytics plugin <= 5.4.11 - SQL Injection vulnerability