Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 568 of 1013.
- CVE-2026-52748 Missing authentication for backup functionality in Kaon AR2140X
- CVE-2026-52747 Security feature bypass in ModSecurity
- CVE-2026-52746 JSONata: Malicious inputs to "$toMillis" function can cause resource exhaustion
- CVE-2026-52745 CordysCRM: Customer Public Pool Sorting Field SQL Injection
- CVE-2026-52744 GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API
- CVE-2026-52743 GoCD before 26.1.0 is vulnerable to authorization bypass via job status API
- CVE-2026-52742 GoCD is vulnerable to historical server configuration API authorization bypass
- CVE-2026-52741 GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages
- CVE-2026-52740 GoCD is vulnerable to pipeline template view API authorization bypass
- CVE-2026-5274 Integer overflow in Chrome
- CVE-2026-52739 ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection
- CVE-2026-52738 ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks
- CVE-2026-52737 ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block
- CVE-2026-52736 ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache
- CVE-2026-52735 ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser
- CVE-2026-52734 ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention
- CVE-2026-52733 ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip
- CVE-2026-52732 ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation
- CVE-2026-52731 ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplate
- CVE-2026-52730 Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence
- CVE-2026-5273 Use after free in Chrome
- CVE-2026-52729 Missing authorization in xibo-cms
- CVE-2026-52727 lxc-ci: Pacman keyring stored in archlinux image with a private key
- CVE-2026-52726 Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload
- CVE-2026-52725 Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
- CVE-2026-52724 kuma-dp connects to control plane without verifying TLS certificate when no CA is configured
- CVE-2026-52723 ePA 3.x Integration: VAU Server Authentication Bypass via Circular Certificate Trust
- CVE-2026-52722 Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling
- CVE-2026-52721 Gstreamer1-plugins-bad-free: gstreamer: multiple out-of-bounds reads in pcapparse ipv4/tcp header parsing
- CVE-2026-52720 Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb
- CVE-2026-5272 Memory corruption in Chrome
- CVE-2026-52719 Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoder
- CVE-2026-52718 Gstreamer1-plugins-bad-free: gstreamer: denial of service via av1 tile_list_obu parser byte/bit confusion
- CVE-2026-52716 WordPress WorkScout-Core plugin <= 1.7.11 - Arbitrary File Deletion vulnerability
- CVE-2026-52715 WordPress GEO my WordPress plugin <= 4.5.5 - SQL Injection vulnerability
- CVE-2026-52714 WordPress SEO Plugin by Squirrly SEO plugin <= 12.4.16 - Broken Access Control vulnerability
- CVE-2026-52712 WordPress Attendance Manager plugin <= 0.6.2 - SQL Injection vulnerability
- CVE-2026-52711 WordPress WooCommerce POS plugin <= 1.8.14 - Broken Access Control vulnerability
- CVE-2026-5271 Possible to hijack modules in current working directory
- CVE-2026-52709 WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-52708 WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability
- CVE-2026-52707 WordPress Kastell theme <= 2.0 - Local File Inclusion vulnerability
- CVE-2026-52706 WordPress JetEngine plugin <= 3.8.10 - PHP Object Injection vulnerability
- CVE-2026-52705 WordPress SigmaForms Pro – AI Generated Forms plugin <= 1.4.5 - Arbitrary File Upload vulnerability
- CVE-2026-52704 WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Remote Code Execution (RCE) vulnerability
- CVE-2026-52703 WordPress FastDup plugin <= 2.7.2 - Path Traversal vulnerability
- CVE-2026-52702 WordPress SEO Redirection plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-52701 WordPress User Registration plugin <= 5.2.2 - Broken Access Control vulnerability
- CVE-2026-52700 WordPress WCMultiShipping plugin <= 3.0.2 - SQL Injection vulnerability
- CVE-2026-5270 Authentication Bypass in Navigator and Blue Planet Products
- CVE-2026-52699 WordPress VikRentCar plugin <= 1.4.5 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-52698 Information disclosure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget
- CVE-2026-52697 WordPress Taskbuilder plugin <= 5.0.7 - SQL Injection vulnerability
- CVE-2026-52696 WordPress JetBlog plugin <= 2.4.8 - Sensitive Data Exposure vulnerability
- CVE-2026-52695 WordPress ABC Crypto Checkout plugin <= 1.8.2 - Sensitive Data Exposure vulnerability
- CVE-2026-52694 WordPress Signature Add-On for WooCommerce plugin <= 2.0 - Sensitive Data Exposure vulnerability
- CVE-2026-52693 WordPress eCommerce Product Catalog plugin <= 3.5.5 - SQL Injection vulnerability
- CVE-2026-52692 WordPress Affiliates Manager plugin <= 2.9.50 - Sensitive Data Exposure vulnerability
- CVE-2026-52691 Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Module
- CVE-2026-52690 Spoofed answers can mark an authoritative non-EDNS capable
- CVE-2026-5269 Navigator NCS and MCP System Accounts with Default Passwords
- CVE-2026-52688 RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
- CVE-2026-52687 Denial of service in OX Dovecot CE
- CVE-2026-52686 Wildcard CNAME proof validation bypass
- CVE-2026-52684 Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack
- CVE-2026-52681 Denial of service in OX Dovecot CE
- CVE-2026-52680 Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write
- CVE-2026-5268 SFTP Server Authentication Weakness
- CVE-2026-52673 SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to execute arbitrary code via the getDimensionsValues comp
- CVE-2026-5267 Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS
- CVE-2026-5266 Information disclosure in Echo
- CVE-2026-52656 An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute a
- CVE-2026-5265 Ovn: ovn: heap over-read in icmp error response generation
- CVE-2026-5264 DTLS 1.3 ACK heap buffer overflow
- CVE-2026-52630 SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the
- CVE-2026-5263 URI nameConstraints not enforced in ConfirmNameConstraints()
- CVE-2026-52622 An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows
- CVE-2026-5262 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-52610 An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to create or overwrite files any
- CVE-2026-5261 Shandong Hoteam InforCenter PLM BaseHandler.ashx uploadFileToIIS unrestricted upload
- CVE-2026-52609 A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in th
- CVE-2026-52608 An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the
- CVE-2026-52607 A directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web se
- CVE-2026-52606 A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in th
- CVE-2026-5260 Gnutls: gnutls: information disclosure via heap overread in rsa key exchange
- CVE-2026-5259 AutohomeCorp frostmourne Alarm Preview AlarmController.java server-side request forgery
- CVE-2026-52584 Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG
- CVE-2026-5258 Sanster IOPaint File Manager file_manager.py _get_file path traversal
- CVE-2026-5257 code-projects Simple Laundry System Parameter delstaffinfo.php sql injection
- CVE-2026-5256 code-projects Simple Laundry System Parameter modify.php sql injection
- CVE-2026-5255 code-projects Simple Laundry System Parameter delstaffinfo.php cross site scripting
- CVE-2026-5254 welovemedia FFmate Webhook AppJsonTreeView.vue cross site scripting
- CVE-2026-52539 Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret.
- CVE-2026-52533 An issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the etc/shadow component file
- CVE-2026-5253 bufanyun HotGo editNotice Endpoint MessageList.vue cross site scripting
- CVE-2026-52521 A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat feature.
- CVE-2026-52520 Emlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publishing module (/admin/article.php).
- CVE-2026-5252 z-9527 admin Message Create Endpoint message.js cross site scripting
- CVE-2026-5251 z-9527 admin User Update Endpoint user.js dynamically-determined object attributes
- CVE-2026-52492 An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized he