Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 647 of 1013.
- CVE-2026-42810 Apache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or table names
- CVE-2026-4281 Missing authorization in FormLift for Infusionsoft Web Forms
- CVE-2026-42809 Apache Polaris: staged table creation could vend storage credentials for unvalidated locations
- CVE-2026-42808 Memory corruption in COINES SDK
- CVE-2026-42807 Memory corruption in COINES SDK
- CVE-2026-42806 Memory corruption in BME690 SensorAPI (C)
- CVE-2026-42805 Memory corruption in BHI385 SensorAPI (C Library)
- CVE-2026-42804 Memory corruption in BHI360 SensorAPI (C-Library)
- CVE-2026-42801 Deference after null check in as_rrc
- CVE-2026-42800 Deference after null check in ims_client sip
- CVE-2026-4280 Breaking News WP <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Local File Inclusion/Read
- CVE-2026-42799 Out-of-bounds read in ulp
- CVE-2026-42798 Integer overflow in little cms color engine
- CVE-2026-42797 Apache Syncope: JexlContextBuilder Information Disclosure
- CVE-2026-42796 Arelle < 2.39.10 Unauthenticated RCE via /rest/configure
- CVE-2026-42795 Symlink Following in Hex Package Export Allows Embedding Files Outside Project Root
- CVE-2026-42794 Reflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plug
- CVE-2026-42793 Atom table exhaustion via attacker-controlled GraphQL SDL names in absinthe
- CVE-2026-42792 epmd permanent DoS via EMFILE on accept(2) in erts
- CVE-2026-42791 OCSP responder certificate validity period not checked in public_key
- CVE-2026-42790 nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification
- CVE-2026-4279 Cross-site scripting in Bread & Butter: AI-Powered Lead Intelligence
- CVE-2026-42789 Non-CA certificate accepted as intermediate issuer in public_key path validation
- CVE-2026-42788 HTTP/2 frame size limit checked after body is buffered in bandit
- CVE-2026-42786 WebSocket fragmented message reassembly unbounded in bandit
- CVE-2026-42785 OpenKM 6.3.12 Remote Code Execution via Administrative Scripting
- CVE-2026-42784 Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion
- CVE-2026-42782 Apache Syncope: Post-auth RCE via Groovy static
- CVE-2026-42781 BIG-IP FastL4 virtual server vulnerability
- CVE-2026-42780 BIG-IP SSL Orchestrator vulnerability
- CVE-2026-4278 Cross-site scripting in Simple Download Counter
- CVE-2026-42779 Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix)
- CVE-2026-42778 Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)
- CVE-2026-42777 WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability
- CVE-2026-42776 WordPress Sunshine Photo Cart plugin <= 3.6.7 - Broken Access Control vulnerability
- CVE-2026-42775 WordPress AutomatorWP plugin <= 5.7.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42774 WordPress JetEngine plugin <= 3.8.8.1 - SQL Injection vulnerability
- CVE-2026-42773 WordPress eMagicOne Store Manager plugin <= 1.3.2 - SQL Injection vulnerability
- CVE-2026-42772 Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC
- CVE-2026-42771 Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()
- CVE-2026-42770 FFC-DH Peer Validation Uses Attacker-Supplied q
- CVE-2026-4277 Privilege abuse in GenericInlineModelAdmin
- CVE-2026-42769 Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate
- CVE-2026-42768 Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()
- CVE-2026-42767 NULL Pointer Dereference in CRMF EncryptedValue Decryption
- CVE-2026-42766 Possible NULL Dereference in Password-Based CMS Decryption
- CVE-2026-42765 NULL Dereference in Certificate Verification with OCSP Checking
- CVE-2026-42764 NULL Pointer Dereference in QUIC Server Initial Packet Handling
- CVE-2026-42763 WordPress SePay Gateway plugin <= 1.1.20 - Sensitive Data Exposure vulnerability
- CVE-2026-42762 WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42761 WordPress Active Products Tables for WooCommerce plugin <= 1.0.9 - SQL Injection vulnerability
- CVE-2026-42760 WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.25 - Broken Authentication vulnerability
- CVE-2026-4276 LibreChat RAG API, version 0.7.0, contains a log-injection vulnerability that allows attackers to forge log entries.
- CVE-2026-42759 WordPress Affiliate Super Assistent plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42758 WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability
- CVE-2026-42757 WordPress WebinarIgnition plugin < 4.08.253 - Arbitrary File Deletion vulnerability
- CVE-2026-42756 Path traversal in QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly
- CVE-2026-42755 WordPress TableOn plugin <= 1.0.5.1 - SQL Injection vulnerability
- CVE-2026-42754 WordPress Favicon plugin <= 1.3.46 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42753 WordPress WCFM Membership plugin <= 2.11.10 - Broken Access Control vulnerability
- CVE-2026-42752 WordPress Stripe Payments plugin <= 2.0.98 - Bypass Vulnerability vulnerability
- CVE-2026-42751 WordPress Booking Manager plugin <= 2.1.18 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42750 WordPress WPComplete plugin <= 2.9.5.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-4275 Cross-site request forgery in Divi Torque Lite – Divi Modules for the Divi Builder & Theme
- CVE-2026-42749 WordPress Disable Comments for Any Post Types (Remove comments) plugin <= 1.3.0 - Broken Authentication vulnerability
- CVE-2026-42748 WordPress WPify Woo Czech plugin <= 5.4.1 - Arbitrary File Upload vulnerability
- CVE-2026-42747 WordPress Easy Form Builder plugin <= 4.0.6 - SQL Injection vulnerability
- CVE-2026-42746 WordPress Smart Online Order for Clover plugin <= 1.6.0 - Sensitive Data Exposure vulnerability
- CVE-2026-42745 WordPress Smart Online Order for Clover plugin <= 1.6.0 - Broken Authentication vulnerability
- CVE-2026-42744 WordPress Ads by WPQuads plugin <= 3.0.2 - Bypass Vulnerability vulnerability
- CVE-2026-42743 WordPress Masteriyo - LMS plugin <= 2.1.8 - Broken Authentication vulnerability
- CVE-2026-42742 WordPress Views for WPForms plugin <= 3.4.6 - SQL Injection vulnerability
- CVE-2026-42741 SQL injection in Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend
- CVE-2026-42740 WordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerability
- CVE-2026-4274 Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access
- CVE-2026-42739 WordPress Advanced IP Blocker plugin <= 8.10.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42738 WordPress Smart Online Order for Clover plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42737 WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Arbitrary File Deletion vulnerability
- CVE-2026-42736 WordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-42735 WordPress KiviCare plugin <= 4.3.0 - Broken Authentication vulnerability
- CVE-2026-42734 WordPress Geo Mashup plugin <= 1.13.19 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42733 WordPress WPCS plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42732 WordPress Ads by WPQuads plugin <= 3.0.2 - Broken Authentication vulnerability
- CVE-2026-42731 WordPress miniorange otp verification plugin <= 5.4.9 - Privilege Escalation vulnerability
- CVE-2026-42730 WordPress MasterStudy LMS plugin <= 3.7.29 - SQL Injection vulnerability
- CVE-2026-4273 Insufficient token rotation validation in remote cluster invite confirmation
- CVE-2026-42729 WordPress PropertyHive plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42728 WordPress HT Contact Form 7 plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42727 WordPress Active Products Tables for WooCommerce plugin <= 1.0.8 - SQL Injection vulnerability
- CVE-2026-42726 WordPress AWP Classifieds plugin <= 4.4.5 - Broken Access Control vulnerability
- CVE-2026-42725 Missing authorization in Checkout Files Upload for WooCommerce
- CVE-2026-42724 WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability
- CVE-2026-42723 WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability
- CVE-2026-42722 WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability
- CVE-2026-42721 WordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerability
- CVE-2026-42720 WordPress Dynamic User Directory plugin <= 2.4 - SQL Injection vulnerability
- CVE-2026-4272 CVE-2026-4272 - Bluetooth Remote Execution of System Commands Vulnerability
- CVE-2026-42719 WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability
- CVE-2026-42718 WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability
- CVE-2026-42717 WordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerability