Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 651 of 1013.
- CVE-2026-42426 OpenClaw < 2026.4.8 - Improper Authorization in node.pair.approve via operator.write Scope
- CVE-2026-42425 OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery
- CVE-2026-42424 OpenClaw < 2026.4.8 - Local File Exfiltration via Shared Reply MEDIA Paths
- CVE-2026-42423 OpenClaw < 2026.4.8 - strictInlineEval Approval Boundary Bypass via Approval-Timeout Fallback
- CVE-2026-42422 OpenClaw < 2026.4.8 - Role Bypass in device.token.rotate Function
- CVE-2026-42421 OpenClaw < 2026.4.8 - WebSocket Session Persistence via Shared Gateway Token Rotation
- CVE-2026-42420 OpenClaw < 2026.4.8 - Improper Base64 Decoding Size Validation
- CVE-2026-4242 BabyChakra Pregnancy & Parenting App app.babychakra.babychakra Configuration.java credentials storage
- CVE-2026-42419 WordPress Swish Migrate and Backup plugin <= 1.4.0 - Sensitive Data Exposure vulnerability
- CVE-2026-42418 WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42417 WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability
- CVE-2026-42416 WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability
- CVE-2026-42415 WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability
- CVE-2026-42414 WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability
- CVE-2026-42413 WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerability
- CVE-2026-42412 WordPress WP User Frontend plugin <= 4.3.1 - Broken Access Control vulnerability
- CVE-2026-42411 WordPress CloudSecure WP Security plugin <= 1.4.7 - Broken Authentication vulnerability
- CVE-2026-42410 WordPress TheGem theme Elements (for Elementor) plugin < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-4241 itsourcecode College Management System time-table.php sql injection
- CVE-2026-42409 BIG-IP HTTP/2 vulnerability
- CVE-2026-42408 BIG-IP DNS tmsh vulnerability
- CVE-2026-42406 BIG-IP and BIG-IQ privilege escalation vulnerability
- CVE-2026-42404 Apache Neethi: Unrestricted HTTP Redirect Following in Policy References
- CVE-2026-42403 Apache Neethi: Circular Policy Reference Infinite Loop
- CVE-2026-42402 Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS
- CVE-2026-42401 Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HTML Injection
- CVE-2026-42400 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
- CVE-2026-4240 Open5GS CCA smf_s6b_sta_cb denial of service
- CVE-2026-42399 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
- CVE-2026-42398 Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access
- CVE-2026-42397 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-42396 Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail
- CVE-2026-42395 Denial of service in OX Dovecot CE
- CVE-2026-42393 Information disclosure in OX Dovecot CE
- CVE-2026-42392 Information disclosure in OX Dovecot CE
- CVE-2026-42391 Denial of service in OX Dovecot CE
- CVE-2026-42390 ZONEMD validation can be bypassed
- CVE-2026-4239 Lagom WHMCS Template Datatables prototype pollution
- CVE-2026-42389 Reject more queries with invalid header values
- CVE-2026-42388 Missing input validation for catalog zones
- CVE-2026-42387 Insufficient input validation in ZoneToCache
- CVE-2026-42386 WordPress Order Delivery Date for WooCommerce plugin <= 4.5.1 - SQL Injection vulnerability
- CVE-2026-42385 WordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42384 WordPress Simply Schedule Appointments plugin < 1.6.11.2 - Sensitive Data Exposure vulnerability
- CVE-2026-42383 WordPress YITH WooCommerce Product Add-Ons plugin <= 4.29.0 - SQL Injection vulnerability
- CVE-2026-42382 WordPress Audrey theme <= 1.5 - Local File Inclusion vulnerability
- CVE-2026-42381 WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.1 - SQL Injection vulnerability
- CVE-2026-42380 WordPress AI Lab theme < 5.4.2 - PHP Object Injection vulnerability
- CVE-2026-4238 itsourcecode College Management System courses.php sql injection
- CVE-2026-42379 WordPress Templately plugin <= 3.6.1 - Sensitive Data Exposure vulnerability
- CVE-2026-42378 WordPress WP Full Stripe Free plugin <= 8.4.1 - Broken Authentication vulnerability
- CVE-2026-42377 WordPress SureForms Pro plugin <= 2.8.0 - Broken Access Control vulnerability
- CVE-2026-42376 D-Link DIR-456U A1 Hardcoded Telnet Backdoor Credentials
- CVE-2026-42375 D-Link DIR-600L A1 Hardcoded Telnet Backdoor Credentials
- CVE-2026-42374 D-Link DIR-600L B1 Hardcoded Telnet Backdoor Credentials
- CVE-2026-42373 D-Link DIR-605L B2 Hardcoded Telnet Backdoor Credentials
- CVE-2026-42372 D-Link DIR-605L A1 Hardcoded Telnet Backdoor Credentials
- CVE-2026-42371 Integer overflow in uriparser
- CVE-2026-42370 GeoVision GV-VMS V20 WebCam Server Login stack overflow vulnerability
- CVE-2026-4237 itsourcecode Free Hotel Reservation System index.php sql injection
- CVE-2026-42369 GeoVision GV-VMS V20 WebCam Server stack overflow vulnerability
- CVE-2026-42368 GeoVision LPC2011/LPC2211 Web Interface privilege escalation vulnerability
- CVE-2026-42367 Information disclosure in GV-LPC2011/LPC2211
- CVE-2026-42366 GeoVision LPC2011/LPC2211 Web Interface / ssi.cgi reflected cross-site scripting (XSS) vulnerabilities
- CVE-2026-42365 GeoVision LPC2011/LPC2211 Web Interface guessable session cookie vulnerability
- CVE-2026-42364 GeoVision LPC2011/LPC2211 Web Interface / DdnsSetting.cgi OS command injection vulnerability
- CVE-2026-42363 GeoVision GV-IP Device Utility Device Authentication insufficient encryption vulnerability
- CVE-2026-42360 Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking
- CVE-2026-4236 itsourcecode Online Enrollment System index.php sql injection
- CVE-2026-42359 Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator
- CVE-2026-42358 Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets
- CVE-2026-42357 Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
- CVE-2026-42356 Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories
- CVE-2026-42355 NanaZip: Uncontrolled recursion in NanaZip Electron ASAR parser causes stack exhaustion
- CVE-2026-42354 Sentry: Improper authentication on SAML SSO process allows user identity linking
- CVE-2026-42353 Path traversal / SSRF in i18next-http-middleware via user-controlled language and namespace parameters
- CVE-2026-42352 pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber
- CVE-2026-42351 pygeoapi: Path Traversal in STAC FileSystemProvider
- CVE-2026-42350 Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter
- CVE-2026-4235 itsourcecode Online Enrollment System login.php sql injection
- CVE-2026-42349 Clerk: Authorization bypass when combining organization, billing, or reverification checks
- CVE-2026-42348 OpAMP client reads unbounded HTTP response bodies
- CVE-2026-42346 Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths
- CVE-2026-42345 Server-side request forgery in FastGPT
- CVE-2026-42344 FastGPT: DNS rebinding TOCTOU bypass in isInternalAddress allows SSRF on all protected endpoints
- CVE-2026-42343 FastGPT: Uncontrolled Resource Consumption leading to Sandbox Exhaustion
- CVE-2026-42342 React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
- CVE-2026-42341 FOSSBilling has an unauthenticated payment bypass via IPN callback forgery
- CVE-2026-4234 SSCMS DDL SitesAddController.Submit.cs sql injection
- CVE-2026-42339 New API: SSRF Filter Bypass via 0.0.0.0
- CVE-2026-42338 ip-address: XSS in Address6 HTML-emitting methods
- CVE-2026-42337 MaxKB: Broken Access Control in MaxKB OSS URL Fetch API
- CVE-2026-42336 MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch
- CVE-2026-42335 MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy
- CVE-2026-42334 Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
- CVE-2026-42333 quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations
- CVE-2026-42331 FOSSBilling missing authorization in guest Invoice API endpoints
- CVE-2026-4233 ThingsGateway download path traversal
- CVE-2026-42329 Iris has an Open Redirect issue
- CVE-2026-42328 go-ipld-prime: DAG-CBOR and DAG-JSON decoders unbounded recursion depth