Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 583 of 1013.
- CVE-2026-49787 HTTP.sys Denial of Service Vulnerability
- CVE-2026-49785 UEFI Secure Boot Security Feature Bypass Vulnerability
- CVE-2026-49784 Microsoft Windows App Store Elevation of Privilege Vulnerability
- CVE-2026-49783 Secure Boot Security Feature Bypass Vulnerability
- CVE-2026-49782 WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability
- CVE-2026-49781 WordPress OttoKit plugin <= 1.1.27 - PHP Object Injection vulnerability
- CVE-2026-49780 WordPress Dokan plugin <= 5.0.2 - Privilege Escalation vulnerability
- CVE-2026-4978 SQLi in UMAI Vision's Traffic Analysis System
- CVE-2026-49779 WordPress Tax Exempt for WooCommerce plugin < 1.9.5 - Path Traversal vulnerability
- CVE-2026-49778 WordPress WPFunnels Pro plugin <= 2.9.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-49777 WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability
- CVE-2026-49776 SQL injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites
- CVE-2026-49775 WordPress Welcart e-Commerce plugin <= 2.11.28 - Broken Access Control vulnerability
- CVE-2026-49774 WordPress RD Station plugin <= 5.6.0 - Remote Code Execution (RCE) vulnerability
- CVE-2026-49773 WordPress FV Flowplayer Video Player plugin < 7.5.51.7212 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-49772 WordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerability
- CVE-2026-49771 WordPress Photo Gallery by 10Web plugin <= 1.8.41 - SQL Injection vulnerability
- CVE-2026-49770 WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerability
- CVE-2026-4977 UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter
- CVE-2026-49769 WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability
- CVE-2026-49768 WordPress Happyforms plugin <= 1.26.13 - PHP Object Injection vulnerability
- CVE-2026-49767 WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability
- CVE-2026-49766 WordPress WP User Manager plugin <= 2.9.16 - Arbitrary File Deletion vulnerability
- CVE-2026-49765 Deserialization in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms
- CVE-2026-49764 WordPress RegistrationMagic plugin <= 6.0.8.6 - Broken Authentication vulnerability
- CVE-2026-49763 WordPress Integration for Contact Form 7 HubSpot plugin <= 1.3.7 - PHP Object Injection vulnerability
- CVE-2026-49762 Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service
- CVE-2026-49760 Stack Buffer Overflow in ei_s_print_term at Very Large Integer
- CVE-2026-4976 Totolink LR350 cstecgi.cgi setWiFiGuestCfg buffer overflow
- CVE-2026-49759 Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash
- CVE-2026-49757 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching
- CVE-2026-49756 Multipart form-data header injection in Req via unescaped name/filename/content_type
- CVE-2026-49755 Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies
- CVE-2026-49754 HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation
- CVE-2026-49753 HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing
- CVE-2026-4975 Tenda AC15 POST Request setcfm formSetCfm memory corruption
- CVE-2026-49746 GPU DDK - Dimension Mismatch and Integer Truncation in PMRDevPhysAddrOSMem
- CVE-2026-49745 GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0
- CVE-2026-49744 GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex()
- CVE-2026-49743 GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed
- CVE-2026-49742 TYPO3 CMS - Broken Access Control in Media Module
- CVE-2026-49741 TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework
- CVE-2026-49740 TYPO3 CMS - Insecure Deserialization in Core API
- CVE-2026-4974 Tenda AC7 POST Request SetSysTimeCfg fromSetSysTime memory corruption
- CVE-2026-49738 TYPO3 CMS - Broken Access Control in File Abstraction Layer
- CVE-2026-4973 SourceCodester Online Quiz System add-question.php cross site scripting
- CVE-2026-4972 code-projects Online Reviewer System btn_functions.php cross site scripting
- CVE-2026-4971 SourceCodester Note Taking App cross-site request forgery
- CVE-2026-4970 code-projects Social Networking Site Endpoint delete_photos.php sql injection
- CVE-2026-4969 code-projects Social Networking Site Alert home.php cross site scripting
- CVE-2026-4968 SourceCodester Diary App diary.php cross-site request forgery
- CVE-2026-4967 Memory corruption in SC7731E/SC9832E/SC9863A/T310/T610/T618/T7200/T7225/T7250/T7255/T7280/T7300/T8100/T9100/T8200/T8300
- CVE-2026-4966 itsourcecode Free Hotel Reservation System index.php sql injection
- CVE-2026-4965 letta-ai letta Incomplete Fix CVE-2025-6101 ast_parsers.py resolve_type eval injection
- CVE-2026-4964 letta-ai letta File URL message_helper.py _convert_message_create_to_message server-side request forgery
- CVE-2026-4963 huggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injection
- CVE-2026-4962 UltraVNC Service version.dll uncontrolled search path
- CVE-2026-4961 Tenda AC6 POST Request QuickIndex formQuickIndex stack-based overflow
- CVE-2026-4960 Tenda AC6 POST Request WizardHandle fromWizardHandle stack-based overflow
- CVE-2026-4959 OpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authentication
- CVE-2026-4958 OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization
- CVE-2026-4957 OpenBMB XAgent API Key function_handler.py FunctionHandler.handle_tool_call log file
- CVE-2026-4956 Shenzhen Ruiming Technology Streamax Crocus Parameter DevicePrint.do sql injection
- CVE-2026-4955 Shenzhen Ruiming Technology Streamax Crocus OperateStatistic.do sql injection
- CVE-2026-4954 mingSoft MCMS Web Content List Endpoint ContentAction.java list sql injection
- CVE-2026-4953 mingSoft MCMS Editor Endpoint BaseAction.java catchImage server-side request forgery
- CVE-2026-4952 Cross-site scripting in WebOrderSystem (AuftragsManager)
- CVE-2026-49510 Integer overflow in rlottie
- CVE-2026-4951 Reflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystem
- CVE-2026-49509 Memory corruption in rLottie
- CVE-2026-49506 Path traversal in Wyse Management Suite
- CVE-2026-49502 Auth bypass in PowerFlex
- CVE-2026-49501 Privilege escalation in PowerScale OneFS
- CVE-2026-49500 Privilege escalation in Alienware Command Center (AWCC
- CVE-2026-4950 Stored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS WebOrderSystem
- CVE-2026-49499 Privilege escalation in PowerProtect Data Manager
- CVE-2026-49498 Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username
- CVE-2026-49497 Ghidra < 12.1 - Path Traversal via .gnu_debuglink in DWARF External Debug File Resolution
- CVE-2026-49496 Ghidra < 12.1 - Heap-Use-After-Free in SleighBuilder::generatePointerAdd via Vector Reallocation
- CVE-2026-49495 Ghidra 10.2 < 12.1 - Denial of Service via Circular Reference in Mach-O Export Trie Parser
- CVE-2026-49494 Xcitium Client Security / Comodo Internet Security Remote Denial of Service
- CVE-2026-49493 Markdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS()
- CVE-2026-49492 Markdown Preview Enhanced OS Command Injection in External File and Link Opening
- CVE-2026-49491 Pixa Bank 2.0 SQL Injection via agence-ajax.php API
- CVE-2026-49490 OpenCATS - SQL Injection in DataGrid Filter Handling for Tags Column
- CVE-2026-4949 ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription
- CVE-2026-49489 OpenCATS - SQL Injection in DataGrid sortDirection Parameter
- CVE-2026-49488 Apache OpenMeetings: Arbitrary File Read
- CVE-2026-49487 Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs
- CVE-2026-49486 Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)
- CVE-2026-49485 HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
- CVE-2026-49484 Code for IBM i: Temporary files are visible to all users
- CVE-2026-49483 Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution
- CVE-2026-49482 ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint Allows Mass Subtitle Overwrite
- CVE-2026-49481 UpSnap vulnerable to Remote Code Execution via IP Field Template Injection in wake_cmd/shutdown_cmd
- CVE-2026-4948 Firewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorization
- CVE-2026-49478 Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage
- CVE-2026-49477 Soup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector Parser
- CVE-2026-49476 Soup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieve
- CVE-2026-49475 FreeSWITCH: Out-of-bounds memory access in core STUN attribute parsing