Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 554 of 1013.
- CVE-2026-54198 WordPress Media LIbrary Assistant plugin <= 3.35 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-54197 WordPress GetGenie plugin <= 4.4.1 - Sensitive Data Exposure vulnerability
- CVE-2026-54196 WordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerability
- CVE-2026-54195 WordPress JetFormBuilder plugin <= 3.6.0.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-54194 WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability
- CVE-2026-54193 WordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerability
- CVE-2026-54192 WordPress Popup box plugin <= 6.2.9 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-54191 WordPress Pods plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-54190 WordPress Envira Photo Gallery plugin <= 1.12.5 - Broken Access Control vulnerability
- CVE-2026-5419 Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal
- CVE-2026-54189 WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-54188 WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-54187 WordPress JetEngine plugin <= 3.8.10.1 - SQL Injection vulnerability
- CVE-2026-54186 WordPress JobSearch plugin <= 3.2.9 - SQL Injection vulnerability
- CVE-2026-54185 WordPress Cornerstone plugin < 7.8.8 - SQL Injection vulnerability
- CVE-2026-54184 WordPress Clean Login plugin <= 1.15 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-54183 Apache Airflow: Airflow Variables were not masked in the UI for authenticated users
- CVE-2026-54182 backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
- CVE-2026-54181 backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
- CVE-2026-54180 backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
- CVE-2026-5418 appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery
- CVE-2026-54179 Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
- CVE-2026-54178 Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
- CVE-2026-54177 Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
- CVE-2026-54176 backpack/crud: MyAccountController allows changing the login email without a current-password check
- CVE-2026-54175 backpack/crud: Unverified password change in MyAccountController via mass assignment
- CVE-2026-54174 melange: Incomplete package integrity verification allows data section substitution
- CVE-2026-54171 Excon: redact additional sensitive/risky headers when following redirects
- CVE-2026-5417 Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgery
- CVE-2026-54168 Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
- CVE-2026-54167 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
- CVE-2026-54166 Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass
- CVE-2026-54165 Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)
- CVE-2026-54164 API Platform Core: Missing IRI type check enables resource type confusion
- CVE-2026-54163 secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input
- CVE-2026-54162 Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI
- CVE-2026-54160 Network UPS Tools: A PWN Request in make-dist workflow can execute PR-controlled code with write-scoped GITHUB_TOKEN
- CVE-2026-5416 Command Injection via name parameter
- CVE-2026-54159 ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE
- CVE-2026-54158 SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()
- CVE-2026-54157 LobeHub: Unauthenticated SSRF in `/webapi/proxy`
- CVE-2026-54156 node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
- CVE-2026-54155 node-opcua: Missing nonce verification in UserNameIdentityToken authentication
- CVE-2026-54150 next-video: Unauthenticated arbitrary file read via /api/video request handler
- CVE-2026-5415 WP Captcha PRO <= 5.38 - Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link
- CVE-2026-54149 MaxKB MCP tool import validation bypass allows post-authentication remote code execution
- CVE-2026-54148 http4k: `DigestAuthProvider.verify` did not bind to request URI
- CVE-2026-54147 http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI
- CVE-2026-5414 Newgen OmniDocs WebApiRequestRedirection resource injection
- CVE-2026-54136 Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search
- CVE-2026-54135 AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP Server
- CVE-2026-54134 OctoPrint: File exfiltration possible via query parameters on upload endpoints
- CVE-2026-54133 jmespath.php has CompilerRuntime code injection via unescaped function names
- CVE-2026-54132 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-54131 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-54130 M365 Copilot Information Disclosure Vulnerability
- CVE-2026-5413 Newgen OmniDocs GetWebApiConfiguration information disclosure
- CVE-2026-54129 Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2026-54128 Windows DHCP Client Remote Code Execution Vulnerability
- CVE-2026-54127 Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2026-54126 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
- CVE-2026-54125 Windows Runtime Elevation of Privilege Vulnerability
- CVE-2026-54124 Windows Terminal Remote Code Execution Vulnerability
- CVE-2026-54123 Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability
- CVE-2026-54122 Windows GDI+ Remote Code Execution Vulnerability
- CVE-2026-54121 Active Directory Certificate Services Elevation of Privilege Vulnerability
- CVE-2026-54120 Microsoft Surface Remote Code Execution Vulnerability
- CVE-2026-5412 Juju CloudSpec API could leak senstive information
- CVE-2026-54119 Windows Active Directory Denial of Service Vulnerability
- CVE-2026-54118 Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-54117 Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-54116 Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-54115 Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability
- CVE-2026-54114 Windows Win32k Elevation of Privilege Vulnerability
- CVE-2026-54113 Remote Procedure Call Denial of Service Vulnerability
- CVE-2026-54112 Windows Win32k Elevation of Privilege Vulnerability
- CVE-2026-54111 Universal Print Management Service Elevation of Privilege Vulnerability
- CVE-2026-5411 WP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2026-54109 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
- CVE-2026-54108 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-54107 Windows Win32k Elevation of Privilege Vulnerability
- CVE-2026-54106 U.S. GAO EPDS and CBCA EDS network access control bypass
- CVE-2026-54105 U.S. GAO EPDS and CBCA EDS user information disclosure
- CVE-2026-54104 U.S. GAO EPDS and CBCA EDS client-based privilege escalation
- CVE-2026-54103 U.S. GAO EPDS and CBCA EDS unauthenticated password change
- CVE-2026-54100 Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft
- CVE-2026-5410 Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input
- CVE-2026-54099 Privilege escalation in Red Hat OpenShift Container Platform 4
- CVE-2026-54097 File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix
- CVE-2026-54096 File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path
- CVE-2026-54094 File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope
- CVE-2026-54093 File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames
- CVE-2026-54092 File Browser: DoS Vulnerability on Public Login API
- CVE-2026-54091 File Browser: Incorrect access control in public directory shares via rule path rebasing
- CVE-2026-54090 File Browser: Command Allowlist Bypass via Shell Metacharacter Injection
- CVE-2026-5409 Uncontrolled Recursion in Wireshark
- CVE-2026-54089 File Browser: Authentication Bypass via Proxy Auth Header Forgery
- CVE-2026-54088 File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)
- CVE-2026-54087 EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField
- CVE-2026-54086 SLE API for Java: Uncontrolled Memory Allocation / handled exception leading to Denial of Service