Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 548 of 1013.
- CVE-2026-54817 WordPress MStore API plugin <= 4.18.4 - Broken Authentication vulnerability
- CVE-2026-54816 WordPress Advanced Ads plugin <= 2.0.21 - Remote Code Execution (RCE) vulnerability
- CVE-2026-54815 WordPress Cargo Shipping Location for WooCommerce plugin <= 5.6 - SQL Injection vulnerability
- CVE-2026-54814 WordPress Motors plugin <= 1.4.109 - Local File Inclusion vulnerability
- CVE-2026-54813 WordPress SureDash plugin <= 1.8.0 - SQL Injection vulnerability
- CVE-2026-54812 WordPress Motors plugin <= 1.4.109 - SQL Injection vulnerability
- CVE-2026-54811 WordPress WP eMember plugin < v10.9.4 - SQL Injection vulnerability
- CVE-2026-54810 WordPress Nexi XPay plugin <= 8.3.1 - Broken Access Control vulnerability
- CVE-2026-54809 WordPress GIFT4U plugin <= 1.0.10 - SQL Injection vulnerability
- CVE-2026-54808 WordPress WP Travel Gutenberg Blocks plugin <= 3.9.4 - SQL Injection vulnerability
- CVE-2026-54807 WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability
- CVE-2026-54806 WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerability
- CVE-2026-54805 WordPress Falang multilanguage plugin <= 1.4.2 - Privilege Escalation vulnerability
- CVE-2026-54804 WordPress Melhor Envio plugin <= 2.16.3 - Broken Authentication vulnerability
- CVE-2026-54803 WordPress SMS Alert Order Notifications plugin <= 3.9.4 - Privilege Escalation vulnerability
- CVE-2026-54802 WordPress SMS Alert Order Notifications plugin <= 3.9.3 - Broken Authentication vulnerability
- CVE-2026-54801 Privilege escalation in CPCI85 Central Processing/Communication
- CVE-2026-54800 Misconfiguration in CPCI85 Central Processing/Communication
- CVE-2026-54799 Security feature bypass in CPCI85 Central Processing/Communication
- CVE-2026-54798 Denial of service in CPCI85 Central Processing/Communication
- CVE-2026-54796 Command injection in OpenManage Enterprise
- CVE-2026-54795 Command injection in OpenManage Enterprise
- CVE-2026-54794 Server-side request forgery in OpenManage Enterprise
- CVE-2026-54793 Cross-site scripting in OpenManage Enterprise
- CVE-2026-54790 InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module
- CVE-2026-5479 wolfSSL EVP ChaCha20-Poly1305 AEAD authentication tag
- CVE-2026-54789 mod_auth_openidc has out-of-bounds read and write in state cookie parsing
- CVE-2026-54788 dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS
- CVE-2026-54787 sigstore-go fails to check signature timestamps against a signing key's validity period
- CVE-2026-54786 Wasmtime: Leak in WASIp1 `fd_renumber` implementation
- CVE-2026-54785 gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode
- CVE-2026-54784 CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality
- CVE-2026-54783 CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages
- CVE-2026-54782 CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation
- CVE-2026-54781 CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced
- CVE-2026-54780 CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass
- CVE-2026-5478 Everest Forms <= 3.4.4 - Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' Parameter
- CVE-2026-54779 CoreWCF: SAML token replay protection is inoperative
- CVE-2026-54778 CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
- CVE-2026-54777 CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance
- CVE-2026-54776 CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade
- CVE-2026-54775 CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.
- CVE-2026-54774 CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate
- CVE-2026-54773 CoreWCF: WS-Security signature substitution via document-wide Signature lookup
- CVE-2026-54772 CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake
- CVE-2026-54771 Langroid: handle_message() executes user-supplied tool JSON without sender verification
- CVE-2026-54770 WebOb: Open redirect in Location header normalization via leading C0 control / space characters
- CVE-2026-5477 Prefix-substitution forgery via integer overflow in wolfCrypt CMAC
- CVE-2026-54769 Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent
- CVE-2026-54768 WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)
- CVE-2026-54767 WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php
- CVE-2026-54766 Vikunja: Project duplication bypasses write-permission check on the target parent project
- CVE-2026-54765 Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port
- CVE-2026-54764 ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false
- CVE-2026-54763 Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
- CVE-2026-54762 Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails
- CVE-2026-54761 Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services
- CVE-2026-54760 Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls
- CVE-2026-5476 NASA cFS cfe_tbl_passthru_codec.c CFE_TBL_ValidateCodecLoadSize integer overflow
- CVE-2026-54759 Cross-site scripting in siyuan
- CVE-2026-54758 Notepad++: Stack Buffer Overflow in expandNppEnvironmentStrs
- CVE-2026-54757 Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
- CVE-2026-54756 Jodit Editor: Prototype pollution via Jodit.configure() / ConfigMerge
- CVE-2026-54755 Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)
- CVE-2026-54754 Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)
- CVE-2026-54753 Nx: `nx graph` dev server permissive CORS policy
- CVE-2026-54752 Deserialization in devicetype-library
- CVE-2026-5475 NASA cFS CCSDS Header Size cfe_sb_priv.c CFE_SB_TransmitMsg memory corruption
- CVE-2026-54746 Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe
- CVE-2026-54745 Server-side request forgery in pipelines
- CVE-2026-54743 Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed
- CVE-2026-54742 Lemmy: `CollectionAdd::Featured` does not check the post is in the community
- CVE-2026-54741 Lemmy: Blocked users can edit private messages sent before the block
- CVE-2026-54740 Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators
- CVE-2026-5474 NASA cFS CCSDS Packet Header to_lab_passthru_encode.c CFE_MSG_GetSize heap-based overflow
- CVE-2026-54739 Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential
- CVE-2026-54738 Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo
- CVE-2026-54737 @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging
- CVE-2026-54736 Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)
- CVE-2026-54735 prebid-server's request forgery vulnerability allows for possible host environment data extraction
- CVE-2026-54734 Prebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction
- CVE-2026-54733 moodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint
- CVE-2026-54732 libreoffice-convert: path traversal / arbitrary file write
- CVE-2026-54730 Auth bypass in authentik
- CVE-2026-5473 NASA cFS Pickle pickle.load deserialization
- CVE-2026-54729 dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
- CVE-2026-54728 Privilege escalation in bunkerweb
- CVE-2026-54727 proot-distro has a Container Isolation Bypass via Crafted Restore Archive
- CVE-2026-54725 vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API
- CVE-2026-54724 Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint
- CVE-2026-54723 devpi: Database contents leak
- CVE-2026-54722 dssrf: there a critical security bug with remove_at_symbol_in_string
- CVE-2026-54721 Silverstripe UserForms: Remote code execution via userforms email subject
- CVE-2026-54720 Silverstripe Framework: Possible XSS attack through media embed
- CVE-2026-5472 ProjectsAndPrograms School Management System Profile Picture settings.php unrestricted upload
- CVE-2026-54719 goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)
- CVE-2026-54718 Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template
- CVE-2026-54717 Silverstripe: XSS in breadcrumbs in page list view
- CVE-2026-54716 Valhalla: Degenerate exclude_polygons (collinear points, zero area) causes OOM in /sources_to_targets
- CVE-2026-54715 GoAccess: Heap Out-of-Bounds Write in parse_browser()