Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 587 of 1013.
- CVE-2026-49147 Other in App::Ack
- CVE-2026-49146 App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc
- CVE-2026-49145 App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc
- CVE-2026-49144 BrowserStack Runner 0.9.5 Path Traversal via _default HTTP Handler
- CVE-2026-49143 BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler
- CVE-2026-49142 OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]
- CVE-2026-49141 WACRM Authorization Bypass via Automation Engine Endpoint
- CVE-2026-49140 Nanobot < 0.2.1 Denial of Service via Matrix Media Download Handler
- CVE-2026-4914 Cross-site scripting in Neurons for ITSM (Cloud)
- CVE-2026-49139 Nanobot < 0.2.1 SSRF via Microsoft Teams Channel serviceUrl Poisoning
- CVE-2026-49138 Nanobot < 0.2.1 SSRF via web_fetch Tool Redirect Following
- CVE-2026-49136 Banana Slides 0.4.0 Path Traversal via generate_image() in ai_service.py
- CVE-2026-49135 CodexBar < 0.32.0 Insecure Temporary File Handling in Notarization Workflow
- CVE-2026-49134 CodexBar < 0.32.0 Privilege Escalation via CLI Installer Temp File
- CVE-2026-49133 Typemill < 2.24.0 Path Traversal via ControllerApiImage::getPagemedia()
- CVE-2026-49132 OPNsense < 26.1.9 Stored XSS via Certificate Description Field
- CVE-2026-49131 OPNsense < 26.1.9 Stored XSS via Firewall Rule Description Field
- CVE-2026-49130 Music Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx
- CVE-2026-4913 Auth bypass in Neurons for ITSM (Cloud)
- CVE-2026-49129 Music Player Daemon < 0.24.11 SSRF via CurlInputPlugin
- CVE-2026-49128 Music Player Daemon < 0.24.11 Path Traversal via LocalStorage URI Handling
- CVE-2026-49127 Music Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24be
- CVE-2026-49121 AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization
- CVE-2026-49120 Medplum < 5.1.14 SSRF via FHIR Subscription Endpoint
- CVE-2026-4912 Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery
- CVE-2026-49119 Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess()
- CVE-2026-49114 ONNX symlink-following and path-traversal arbitrary file write
- CVE-2026-49113 WordPress Cornerstone plugin < 7.8.8 - Arbitrary Code Execution vulnerability
- CVE-2026-49112 WordPress Shared Files plugin <= 1.7.64 - Path Traversal vulnerability
- CVE-2026-49111 WordPress Masteriyo - LMS plugin <= 2.2.0 - Privilege Escalation vulnerability
- CVE-2026-49110 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.4 - Price Manipulation vulnerability
- CVE-2026-4911 Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter
- CVE-2026-49109 Deserialization in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
- CVE-2026-49108 WordPress Moderno theme < 1.43 - PHP Object Injection vulnerability
- CVE-2026-49107 WordPress Thrive Apprentice plugin < 10.8.10.2 - PHP Object Injection vulnerability
- CVE-2026-49106 WordPress Integration for Contact Form 7 and Constant Contact plugin <= 1.1.6 - PHP Object Injection vulnerability
- CVE-2026-49105 Deserialization in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
- CVE-2026-49104 Deserialization in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
- CVE-2026-49103 Path traversal in Webmin
- CVE-2026-49102 Cross-site scripting in Webmin
- CVE-2026-4910 Shenzhen Ruiming Technology Streamax Crocus Endpoint RemoteFormat.do sql injection
- CVE-2026-49099 Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter
- CVE-2026-49098 Apache Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter
- CVE-2026-49097 Apache Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter
- CVE-2026-49096 Uncaught Exception in Kibana Cases Leading to Denial of Service
- CVE-2026-49095 Improper Input Validation in Kibana Fleet Leading to Privilege Escalation
- CVE-2026-49094 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
- CVE-2026-49093 Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access
- CVE-2026-49092 Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Information Exposure
- CVE-2026-49091 Improper Output Neutralization for Logs in Kibana Leading to Log Injection
- CVE-2026-49090 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
- CVE-2026-4909 code-projects Exam Form Submission update_s7.php cross site scripting
- CVE-2026-49089 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-49088 Insertion of Sensitive Information into Log File in Kibana Leading to Information Disclosure
- CVE-2026-49087 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-49086 Apache Camel-Dapr: The Dapr Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers
- CVE-2026-49085 Deserialization in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
- CVE-2026-49084 WordPress JetEngine plugin < 3.8.9.1 - SQL Injection vulnerability
- CVE-2026-49083 WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability
- CVE-2026-49082 Information disclosure in Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons
- CVE-2026-49081 WordPress User Registration Stripe plugin <= 1.3.12 - Broken Access Control vulnerability
- CVE-2026-49080 WordPress wpDataTables plugin <= 7.3.6 - SQL Injection vulnerability
- CVE-2026-4908 code-projects Simple Laundry System Parameter modstaffinfo.php sql injection
- CVE-2026-49079 WordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability
- CVE-2026-49078 WordPress WP Travel Engine plugin <= 6.7.10 - Other Vulnerability Type vulnerability
- CVE-2026-49077 WordPress WP eMember plugin <= v10.2.2 - Sensitive Data Exposure vulnerability
- CVE-2026-49076 WordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerability
- CVE-2026-49075 WordPress JetEngine plugin <= 3.8.9.1 - PHP Object Injection vulnerability
- CVE-2026-49074 WordPress JetEngine plugin <= 3.8.9.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-49073 WordPress Directorist Booking plugin <= 3.0.3 - SQL Injection vulnerability
- CVE-2026-49072 WordPress WooCommerce Anti-Fraud plugin <= 7.2.6 - Broken Access Control vulnerability
- CVE-2026-49071 WordPress WooCommerce Dropshipping plugin <= 5.2.4 - Broken Authentication vulnerability
- CVE-2026-49070 WordPress Knit Pay plugin <= 9.4.0.0 - Broken Access Control vulnerability
- CVE-2026-4907 Page-Replica Page Replica Endpoint sitemap sitemap.fetch server-side request forgery
- CVE-2026-49069 WordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-49068 WordPress Coupon Affiliates plugin <= 7.8.1 - Sensitive Data Exposure vulnerability
- CVE-2026-49067 WordPress Advanced 301 and 302 Redirect plugin <= 1.6.9 - SQL Injection vulnerability
- CVE-2026-49066 WordPress Conekta Payment Gateway plugin <= 6.0.0 - Sensitive Data Exposure vulnerability
- CVE-2026-49065 WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerability
- CVE-2026-49064 WordPress GetPaid plugin <= 2.8.49 - Sensitive Data Exposure vulnerability
- CVE-2026-49063 WordPress Listdom plugin <= 5.5.0 - Privilege Escalation vulnerability
- CVE-2026-49062 WordPress Faust.js plugin <= 1.8.7 - Broken Authentication vulnerability
- CVE-2026-49061 WordPress WPC Product Options for WooCommerce plugin <= 3.2.1 - Arbitrary File Download vulnerability
- CVE-2026-49060 WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability
- CVE-2026-4906 Tenda AC5 POST Request WizardHandle decodePwd stack-based overflow
- CVE-2026-49059 WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerability
- CVE-2026-49058 WordPress LoginPress Pro plugin <= 6.2.2 - Privilege Escalation vulnerability
- CVE-2026-49057 WordPress JobSearch plugin <= 3.2.7 - Broken Access Control vulnerability
- CVE-2026-49056 Information disclosure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
- CVE-2026-49055 Cross-site scripting in Drag and Drop Multiple File Upload – Contact Form 7
- CVE-2026-49054 WordPress The Post Grid plugin <= 7.9.2 - Broken Access Control vulnerability
- CVE-2026-49053 WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability
- CVE-2026-49052 WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability
- CVE-2026-49051 WordPress WP Meta and Date Remover plugin <= 2.3.6 - Broken Access Control vulnerability
- CVE-2026-49050 Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens
- CVE-2026-4905 Tenda AC5 POST Request WifiWpsOOB formWifiWpsOOB stack-based overflow
- CVE-2026-49049 Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler
- CVE-2026-49048 Joomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla < 6.4.1
- CVE-2026-49047 WordPress DearFlip plugin <= 2.4.27 - Broken Access Control vulnerability
- CVE-2026-49046 WordPress Duplicate Page and Post plugin <= 2.9.5 - SQL Injection vulnerability