Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 648 of 1013.
- CVE-2026-42716 WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability
- CVE-2026-42715 WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42714 WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerability
- CVE-2026-42713 WordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerability
- CVE-2026-42712 WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability
- CVE-2026-42711 WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42710 WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerability
- CVE-2026-4271 Libsoup: libsoup: denial of service via use-after-free in http/2 server
- CVE-2026-42709 Cross-site scripting in Food Menu – Restaurant Menu & Online Ordering for WooCommerce
- CVE-2026-42708 WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerability
- CVE-2026-42707 WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability
- CVE-2026-42706 WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability
- CVE-2026-42705 WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability
- CVE-2026-42704 WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability
- CVE-2026-42703 WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability
- CVE-2026-42702 WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42701 WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability
- CVE-2026-42700 WordPress Image Slider Widget plugin <= 1.1.130 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-4270 AWS API MCP File Access Restriction Bypass
- CVE-2026-42699 WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42698 WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability
- CVE-2026-42697 WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42696 WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability
- CVE-2026-42695 WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42694 WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability
- CVE-2026-42693 WordPress Jannah theme < 7.6.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42692 WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42691 WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability
- CVE-2026-42690 WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability
- CVE-2026-4269 Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit
- CVE-2026-42689 WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability
- CVE-2026-42688 WordPress Modula Image Gallery plugin <= 2.14.23 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42687 WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerability
- CVE-2026-42686 WordPress EventPrime plugin <= 4.3.2.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42685 WordPress WP Job Portal plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42684 WordPress WP Job Portal plugin <= 2.5.1 - SQL Injection vulnerability
- CVE-2026-42683 WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42682 WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability
- CVE-2026-42681 WordPress e2pdf plugin <= 1.32.14 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-42680 WordPress Contest Gallery Pro plugin <= 29.0.1 - Privilege Escalation vulnerability
- CVE-2026-4268 Cross-site scripting in WP Go Maps (formerly WP Google Maps)
- CVE-2026-42679 WordPress Classified Listing plugin <= 5.3.8 - Arbitrary File Download vulnerability
- CVE-2026-42678 WordPress GiveWP plugin <= 4.14.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42677 WordPress WP Document Revisions plugin <= 3.8.1 - Broken Access Control vulnerability
- CVE-2026-42676 WordPress myCred plugin <= 3.0.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42675 WordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerability
- CVE-2026-42674 WordPress Advanced Access Manager plugin <= 7.1.0 - Bypass Vulnerability vulnerability
- CVE-2026-42673 Information disclosure in Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity
- CVE-2026-42672 WordPress WP Directory Kit plugin <= 1.5.1 - SQL Injection vulnerability
- CVE-2026-42671 WordPress GeoDirectory plugin <= 2.8.157 - Broken Access Control vulnerability
- CVE-2026-42670 WordPress Five Star Restaurant Reservations plugin <= 2.7.14 - Payment Bypass vulnerability
- CVE-2026-4267 Query Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI
- CVE-2026-42669 WordPress EventPrime plugin <= 4.3.2.0 - Broken Access Control vulnerability
- CVE-2026-42668 WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.18.0 - Broken Authentication vulnerability
- CVE-2026-42667 WordPress Bookly plugin <= 27.4 - Sensitive Data Exposure vulnerability
- CVE-2026-42666 WordPress Salon booking system plugin <= 10.30.25 - Broken Access Control vulnerability
- CVE-2026-42665 WordPress WP Data Access plugin <= 5.5.70 - SQL Injection vulnerability
- CVE-2026-42664 Missing authorization in AI Product Search for WooCommerce – Motive Commerce Search
- CVE-2026-42663 WordPress Simple Membership plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42662 WordPress Event Tickets plugin <= 5.27.5 - Bypass Vulnerability vulnerability
- CVE-2026-42661 WordPress WP Customer Area plugin <= 8.3.4 - Path Traversal vulnerability
- CVE-2026-42660 WordPress Contest Gallery plugin <= 28.1.7 - Sensitive Data Exposure vulnerability
- CVE-2026-4266 WatchGuard Firebox Insecure Deserialization in Fireware Access Portal
- CVE-2026-42659 WordPress Advanced Form Integration plugin <= 1.126.12 - Broken Access Control vulnerability
- CVE-2026-42658 WordPress Classified Listing plugin <= 5.3.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42657 WordPress Contest Gallery plugin <= 28.1.7 - Other Vulnerability Type vulnerability
- CVE-2026-42656 WordPress Contest Gallery plugin <= 28.1.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42655 WordPress Best Payments Plugin for WP plugin <= 4.6.19 - Payment Bypass vulnerability
- CVE-2026-42654 WordPress Wallet System for WooCommerce plugin <= 2.7.5 - Broken Authentication vulnerability
- CVE-2026-42653 WordPress SliceWP plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42652 WordPress User Registration plugin <= 5.1.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42651 WordPress Classified Listing plugin <= 5.3.9 - Broken Access Control vulnerability
- CVE-2026-42650 WordPress AutomatorWP plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-4265 Guest user can upload files without permission across teams
- CVE-2026-42649 WordPress Favicon Rotator plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42648 WordPress Spectra plugin <= 2.19.22 - Broken Access Control vulnerability
- CVE-2026-42647 WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability
- CVE-2026-42646 WordPress TaxoPress plugin <= 3.44.0 - SQL Injection vulnerability
- CVE-2026-42645 Cross-site request forgery in Barcode Scanner with Inventory & Order Manager
- CVE-2026-42644 WordPress BetterDocs plugin <= 4.3.10 - Sensitive Data Exposure vulnerability
- CVE-2026-42643 WordPress Image Widget plugin <= 4.4.11 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42642 WordPress GiveWP plugin <= 4.14.5 - Broken Access Control vulnerability
- CVE-2026-42641 WordPress Share This Image plugin <= 2.14 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-42640 WordPress Classified Listing plugin <= 5.3.8 - Broken Access Control vulnerability
- CVE-2026-4264 Reflected Cross-Site Scripting in BeeTienda eCommerce platform
- CVE-2026-42639 WordPress GD Rating System plugin <= 3.6.2 - SQL Injection vulnerability
- CVE-2026-42638 WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability
- CVE-2026-42637 WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability
- CVE-2026-42636 WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42635 WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42634 Cross-site scripting in Video Background Block – Use video as background in the section.
- CVE-2026-42633 WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability
- CVE-2026-42632 WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42631 WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42630 WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vulnerability
- CVE-2026-4263 Incorrect authorization in HiJiffy Chatbot
- CVE-2026-42629 WordPress PowerPack Pro for Elementor plugin < v2.13.0 - Broken Authentication vulnerability
- CVE-2026-42627 In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file
- CVE-2026-42626 HP ENVY 5000 series printers VERBASPP1N003.2237A.00 do not properly manage concurrent TCP connections to port 9100 (JetDirect/RAW printing).
- CVE-2026-4262 Incorrect authorization in HiJiffy Chatbot