Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 589 of 1013.
- CVE-2026-48924 Jenkins Bitbucket OAuth Plugin does not restrict the redirect URL after login
- CVE-2026-48923 Jenkins AppSpider Plugin does not perform a permission check in a method implementing form validation
- CVE-2026-48922 Jenkins Credentials Binding Plugin does not properly sanitize file names for file and zip file credentials
- CVE-2026-48921 Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries
- CVE-2026-48920 Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem
- CVE-2026-4892 CVE-2026-4892
- CVE-2026-48919 Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation
- CVE-2026-48918 Jenkins Active Directory Plugin follows LDAP referrals by default
- CVE-2026-48917 Jenkins LDAP Plugin deserializes data from LDAP referrals without validation
- CVE-2026-48916 Jenkins LDAP Plugin follows LDAP referrals
- CVE-2026-48914 Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling
- CVE-2026-48913 Apache HTTP Server: mod_http2 memory corruption when file handles exhausted
- CVE-2026-48912 Missing authorization in Apache Answer
- CVE-2026-48911 Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow
- CVE-2026-48910 Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing
- CVE-2026-4891 CVE-2026-4891
- CVE-2026-48909 Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4
- CVE-2026-48908 JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type
- CVE-2026-48907 Widget Factory Joomla Content Editor Improper Access Control
- CVE-2026-48906 Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla
- CVE-2026-48905 Joomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code.
- CVE-2026-48904 Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints
- CVE-2026-48903 Joomla! Framework - [20260519] - Inadequate content filtering within the checkAttribute filter code.
- CVE-2026-48902 Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links
- CVE-2026-48901 Joomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objects
- CVE-2026-48900 Joomla! Core - [20260516] - Incorrect Access Control in com_scheduler
- CVE-2026-4890 CVE-2026-4890
- CVE-2026-48899 Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins
- CVE-2026-48898 Joomla! Core - [20260513] - Privilege escalation through com_users batch task
- CVE-2026-48897 Joomla! Core - [20260512] - MFA Authentication Bypass
- CVE-2026-48896 Joomla! Core - [20260511] - MFA Authentication Bypass
- CVE-2026-48895 Apache APISIX: Cas-auth Host header influence on CAS service URL
- CVE-2026-48892 Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options
- CVE-2026-48891 Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph
- CVE-2026-4889 SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies
- CVE-2026-48889 WordPress Amelia plugin <= 2.3 - Privilege Escalation vulnerability
- CVE-2026-48888 WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability
- CVE-2026-48887 WordPress JS Help Desk plugin <= 3.0.9 - Broken Access Control vulnerability
- CVE-2026-48886 WordPress JS Help Desk plugin <= 3.0.9 - SQL Injection vulnerability
- CVE-2026-48885 WordPress HollerBox plugin <= 2.3.10.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-48884 WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability
- CVE-2026-48883 WordPress WPC Product Bundles for WooCommerce plugin <= 8.5.3 - Broken Access Control vulnerability
- CVE-2026-48882 WordPress WP Time Slots Booking Form plugin <= 1.2.50 - SQL Injection vulnerability
- CVE-2026-48881 WordPress TrueBooker plugin <= 1.1.9 - Broken Access Control vulnerability
- CVE-2026-48880 WordPress WP Job Portal plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-4888 Missing authorization in Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder
- CVE-2026-48879 WordPress AIWU plugin <= 1.4.17 - Privilege Escalation vulnerability
- CVE-2026-48878 WordPress Visual Link Preview plugin <= 2.4.1 - Sensitive Data Exposure vulnerability
- CVE-2026-48877 WordPress GenerateBlocks plugin <= 2.1.0 - Sensitive Data Exposure vulnerability
- CVE-2026-48876 WordPress Stop Spammers plugin <= 2026.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-48875 WordPress JetSmartFilters plugin <= 3.8.1 - SQL Injection vulnerability
- CVE-2026-48874 WordPress GamiPress plugin <= 7.8.7 - SQL Injection vulnerability
- CVE-2026-48873 WordPress Montonio for WooCommerce plugin <= 10.1.2 - Broken Access Control vulnerability
- CVE-2026-48872 WordPress EmbedPress plugin <= 4.5.2 - Sensitive Data Exposure vulnerability
- CVE-2026-48871 WordPress MW WP Form plugin <= 5.1.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-48870 WordPress King Addons for Elementor plugin <= 51.1.62 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-4887 Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image
- CVE-2026-48869 WordPress Enfold theme <= 7.1.4 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-48868 WordPress Simple Shopping Cart plugin <= 5.2.9 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-48867 WordPress Quiz And Survey Master plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-48866 WordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerability
- CVE-2026-48865 WordPress LearnPress plugin <= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-48864 Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data
- CVE-2026-48863 Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service
- CVE-2026-48862 Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency
- CVE-2026-48861 CRLF injection in HTTP/1 request line via unvalidated method in Mint
- CVE-2026-48860 Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist
- CVE-2026-48859 SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumeration
- CVE-2026-48858 ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks
- CVE-2026-48856 httpc leaks Authorization header to cross-origin redirect targets
- CVE-2026-48855 SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured
- CVE-2026-48854 Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc
- CVE-2026-48853 Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc
- CVE-2026-48852 Denial of service in PuTTY
- CVE-2026-48851 Security feature bypass in PuTTY
- CVE-2026-48850 Memory corruption in PuTTY
- CVE-2026-4885 Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload
- CVE-2026-48849 Cross-site scripting in Webmail
- CVE-2026-48848 Cross-site scripting in Webmail
- CVE-2026-48847 Auth bypass in Webmail
- CVE-2026-48846 Security feature bypass in Webmail
- CVE-2026-48845 Security feature bypass in Webmail
- CVE-2026-48844 Code injection in Webmail
- CVE-2026-48843 Server-side request forgery in Webmail
- CVE-2026-48842 SQL injection in Webmail
- CVE-2026-48840 Information disclosure in Exim
- CVE-2026-48839 WordPress WP Statistics plugin <= 14.16.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-48838 WordPress Post SMTP plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-48837 WordPress Unlimited Elements For Elementor plugin <= 2.0.8 - SQL Injection vulnerability
- CVE-2026-48836 WordPress Easy Invoice plugin <= 2.1.19 - Remote Code Execution (RCE) vulnerability
- CVE-2026-48835 WordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerability
- CVE-2026-48834 Apache Answer: Denial of service via crafted Accept-Language header parsing
- CVE-2026-48832 Open redirect in SPIP
- CVE-2026-48831 Security feature bypass in Wine
- CVE-2026-48830 Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests
- CVE-2026-4883 Piotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload
- CVE-2026-48829 Null dereference in GNU SASL
- CVE-2026-48828 Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key
- CVE-2026-48827 Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git
- CVE-2026-48826 HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching