Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 588 of 1013.
- CVE-2026-49045 WordPress Adminimize plugin <= 1.11.11 - Broken Access Control vulnerability
- CVE-2026-49044 WordPress Advanced Custom Fields: Font Awesome Field plugin <= 5.0.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-49043 WordPress WP Migrate Lite plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-49042 Apache Camel: langchain4j-tools: filter tool argument headers against declared parameters
- CVE-2026-4904 Tenda AC5 POST Request setcfm formSetCfm stack-based overflow
- CVE-2026-49035 Stack-based Buffer Overflow in MZ Automation libIEC61850
- CVE-2026-49033 Stack-Based Buffer Overflow in Labcenter Proteus
- CVE-2026-4903 Tenda AC5 POST Request QuickIndex formQuickIndex memory corruption
- CVE-2026-4902 Tenda AC5 POST Request addressNat fromAddressNat memory corruption
- CVE-2026-49017 OpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body
- CVE-2026-49014 GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow
- CVE-2026-4901 Insertion of Sesitive Information into Log File in AlanWeb SCADA
- CVE-2026-49009 Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.
- CVE-2026-49008 Integrity‑check credential leakage vulnerability in an application function of ZTE F689 product
- CVE-2026-49007 Information leakage vulnerability in ZTE F689 product
- CVE-2026-49006 TLS credential leakage vulnerability in ZTE F689 product
- CVE-2026-49005 Root password hash exposure vulnerability in ZTE F689 product
- CVE-2026-49004 PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product
- CVE-2026-49003 Unauthenticated RCE Vulnerability in ZTE ZXDU68 S202 V5.0 Product
- CVE-2026-49002 Broken Access Control Vulnerabily in ZTE ZXUniPOS NDS-LTE product
- CVE-2026-49001 Cross-Site Request Forgery (CSRF) vulnerability in ZTE ZXUniPOS NDS-LTE product
- CVE-2026-49000 Cryptography Implementation Flaw vulnerability in ZTE ZXUniPOS NDS-LTE product
- CVE-2026-4900 code-projects Online Food Ordering System localhost.sql privilege escalation
- CVE-2026-48999 Stored Cross-Site Scripting (XSS) vulnerability in ZTE ZXUniPOS NDS-LTE product
- CVE-2026-48998 guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
- CVE-2026-48997 e107: Command Injection via shell expansion in ImageMagick resize destination path
- CVE-2026-48996 Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client
- CVE-2026-48995 pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile
- CVE-2026-48994 ImageMagick: Heap Buffer Over-Write in MAT decoder on 32-bit systems
- CVE-2026-48991 XianYuLauncher: Legacy Microsoft account OAuth sign-in flow lacks PKCE and state validation
- CVE-2026-48990 joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization
- CVE-2026-4899 code-projects Online Food Ordering System food.php cross site scripting
- CVE-2026-48989 Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS
- CVE-2026-48988 markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
- CVE-2026-48987 pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager
- CVE-2026-48986 pam_usb: Infinite loop DoS in process-tree walk when parent process exits during authentication
- CVE-2026-48985 pam_usb: NULL Dereference Crash in pusb_is_loginctl_local when loginctl Returns Empty Remote Field
- CVE-2026-48984 pam_usb: xfree() does not call explicit_bzero — sensitive cryptographic material may linger in freed heap
- CVE-2026-48983 pam_usb: TOCTOU race condition in pad directory creation allows symlink substitution
- CVE-2026-48982 pam_usb: Missing O_EXCL on pad temp file creation allows concurrent update race
- CVE-2026-48981 pam_usb: xmlReadFile flags=0 permits XXE network entity fetching in conf.c
- CVE-2026-48980 pam_usb: getenv() used in PAM context allows environment variable injection into local-check logic
- CVE-2026-4898 code-projects Online Food Ordering System contact.php cross site scripting
- CVE-2026-48979 PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling
- CVE-2026-48978 oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens
- CVE-2026-48977 OpenSlide: Arbitrary memory write with crafted Ventana BIF file
- CVE-2026-48976 HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack
- CVE-2026-48975 Missing authorization in homebox
- CVE-2026-48974 HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler
- CVE-2026-48973 WordPress SVG Support plugin <= 2.5.14 - Broken Access Control vulnerability
- CVE-2026-48972 WordPress SeedProd Pro plugin < 6.19.5 - Local File Inclusion vulnerability
- CVE-2026-48971 WordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability
- CVE-2026-48970 WordPress Really Simple SSL plugin <= 9.5.10 - Broken Authentication vulnerability
- CVE-2026-4897 Polkit: polkit: denial of service via unbounded input processing through standard input
- CVE-2026-48969 WordPress Really Simple SSL plugin <= 9.5.9 - Broken Access Control vulnerability
- CVE-2026-48968 WordPress Master Slider plugin <= 3.10.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-48967 WordPress Geo Mashup plugin <= 1.13.19 - SQL Injection vulnerability
- CVE-2026-48966 WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-48965 WordPress XCloner plugin <= 4.8.6 - Sensitive Data Exposure vulnerability
- CVE-2026-48964 WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.6 - SQL Injection vulnerability
- CVE-2026-48962 Code injection in IO::Compress
- CVE-2026-48961 Denial of service in IO::Compress
- CVE-2026-4896 Missing authorization in WCFM – Frontend Manager for WooCommerce
- CVE-2026-48959 IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward
- CVE-2026-48958 Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints
- CVE-2026-48957 Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints
- CVE-2026-48956 Joomla! Core - [20260710] - Incorrect Access Control in com_modules
- CVE-2026-48955 Joomla! Core - [20260709] - Incorrect Access Control in com_workflow
- CVE-2026-48954 Joomla! Core - [20260708] - XSS through language overrides
- CVE-2026-48953 Joomla! Core - [20260707] - XSS in the generic image output layout
- CVE-2026-48952 Joomla! Core - [20260706] - XSS in com_installer
- CVE-2026-48951 Joomla! Core - [20260705] - XSS in various modalreturn layouts
- CVE-2026-48950 Joomla! Core - [20260704] - XSS in com_templates
- CVE-2026-4895 Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via disablelazy Attribute
- CVE-2026-48949 Joomla! Core - [20260703] - XSS in MFA method management
- CVE-2026-48948 Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download
- CVE-2026-48947 Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints
- CVE-2026-48946 Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26
- CVE-2026-48945 Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26
- CVE-2026-48944 Joomla Extension - getk2.org - Exposure of sensitive files via attachment copy in K2 extension for Joomla < 2.26
- CVE-2026-48943 Joomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla < 2.26
- CVE-2026-48942 Joomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.26
- CVE-2026-48941 Joomla Extension - getk2.org - Unauthenticated folder delete in K2 extension for Joomla < 2.26
- CVE-2026-48940 Joomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.26
- CVE-2026-4894 Authentication bypass in multiple products from Frappe Technologies
- CVE-2026-48939 iCagenda Unrestricted Upload of File with Dangerous Type
- CVE-2026-48937 Denial of service in node
- CVE-2026-48936 Security feature bypass in node
- CVE-2026-48935 Security feature bypass in node
- CVE-2026-48934 Security feature bypass in node
- CVE-2026-48933 Denial of service in node
- CVE-2026-48932 Other in node
- CVE-2026-48931 Race condition in node
- CVE-2026-48930 Security feature bypass in node
- CVE-2026-4893 CVE-2026-4893
- CVE-2026-48929 Missing authorization in Rocket.Chat
- CVE-2026-48928 Security feature bypass in node
- CVE-2026-48927 Jenkins buildgraph-view Plugin does not escape the build URL
- CVE-2026-48926 Jenkins Job Import Plugin does not perform a permission check in an HTTP endpoint
- CVE-2026-48925 Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability