Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 665 of 1013.
- CVE-2026-4085 Cross-site scripting in Easy Social Photos Gallery – MIF
- CVE-2026-40849 Authenticated SQLi in user_alarmprofile view
- CVE-2026-40848 Authenticated SQLi in tag view
- CVE-2026-40847 Authenticated SQLi in system_tag view
- CVE-2026-40846 Authenticated SQLi in system view
- CVE-2026-40845 Authenticated SQLi in devices_configuration view
- CVE-2026-40844 Authenticated SQLi in dashboard view
- CVE-2026-40843 Authenticated SQLi in alarming view
- CVE-2026-40842 Authenticated SQLi in getWidgetTags function
- CVE-2026-40841 Authenticated SQLi in getProjectTags function
- CVE-2026-40840 Authenticated SQLi in VerifyCreateLicences function
- CVE-2026-4084 Cross-site scripting in fyyd podcast shortcodes
- CVE-2026-40839 Authenticated SQLi in getComponentScalings function
- CVE-2026-40838 Authenticated SQLi in getDeviceScalings function
- CVE-2026-40837 Authenticated SQLi in getProjectScalings function
- CVE-2026-40836 Authenticated SQLi in inmessage model
- CVE-2026-40835 Authenticated SQLi in saveObjectFromData function
- CVE-2026-40834 Authenticated SQLi in saveDashboardLayout function
- CVE-2026-40833 Authenticated SQLi in saveDashboardLayout function
- CVE-2026-40832 Authenticated SQLi in getDevicegroups function
- CVE-2026-40831 Authenticated SQLi in Easy View
- CVE-2026-40830 Authenticated SQLi in UpdateParam function
- CVE-2026-4083 Cross-site scripting in Scoreboard for HTML5 Games Lite
- CVE-2026-40829 Authenticated SQLi in UpdateParam function
- CVE-2026-40828 Authenticated SQLi in DeleteSysLogEntry function
- CVE-2026-40827 Authenticated SQLi in _RemoveRequest function
- CVE-2026-40826 Authenticated SQLi in dsgvo_contracts view
- CVE-2026-40825 Authenticated SQLi in accountstatus view
- CVE-2026-40824 Authenticated SQLi in accountstatus view
- CVE-2026-40823 Authenticated SQLi in DevSerialReset function
- CVE-2026-40822 Authenticated SQLi in DevSerialReset function
- CVE-2026-40821 Authenticated SQLi in getAccountByID function
- CVE-2026-4082 ER Swiffy Insert <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-40819 Unauthenticated SQLi in sync_data24 task
- CVE-2026-40818 Unauthenticated SQLi in _mb24confi_getDevice function function
- CVE-2026-40817 Unauthenticated SQLi in getAlarmProfiles function
- CVE-2026-40816 Unauthenticated SQLi in _mb24confi_getTagAlarm function
- CVE-2026-40815 Unauthenticated SQLi in _mb24api_getUserAccount function
- CVE-2026-40814 Unauthenticated SQLi in _mb24confi_getTagAlarm function
- CVE-2026-40813 Unauthenticated SQLi in getLiveValues
- CVE-2026-40812 Unauthenticated SQLi in getLiveValues function
- CVE-2026-40811 Unauthenticated SQLi in ssoabstractservice
- CVE-2026-40810 Unauthenticated SQLi in userinfo Endpoint
- CVE-2026-4081 ZeM STL <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-40809 WordPress Metro Magazine theme <= 1.4.1 - Broken Access Control vulnerability
- CVE-2026-40808 WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability
- CVE-2026-40807 Cross-site scripting in CF7 Views – Complete Entry Management for Contact Form 7
- CVE-2026-40806 WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-40805 WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability
- CVE-2026-40804 WordPress aBlocks plugin <= 2.16.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-40803 WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-40802 WordPress Pubjet | پابجت plugin <= 5.4.8 - Settings Change vulnerability
- CVE-2026-40801 WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability
- CVE-2026-40800 SQL injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes
- CVE-2026-4080 Easy Cart <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-40799 WordPress Simple Cloudflare Turnstile plugin <= 1.38.0 - Broken Authentication vulnerability
- CVE-2026-40798 WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability
- CVE-2026-40797 WordPress WebinarIgnition plugin <= 4.08.253 - SQL Injection vulnerability
- CVE-2026-40796 WordPress WPPizza plugin <= 3.19.9 - Sensitive Data Exposure vulnerability
- CVE-2026-40795 WordPress Amelia plugin <= 2.2 - Broken Access Control vulnerability
- CVE-2026-40794 WordPress myCred plugin <= 3.0.3 - Broken Access Control vulnerability
- CVE-2026-40793 WordPress Groundhogg plugin < 4.4.1 - Broken Access Control vulnerability
- CVE-2026-40792 WordPress KiviCare plugin <= 4.2.1 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-40791 WordPress WP Time Slots Booking Form plugin <= 1.2.46 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-40790 WordPress WP SMS plugin <= 7.2.1 - Sensitive Data Exposure vulnerability
- CVE-2026-4079 SQL Chart Builder < 2.3.8 - Unauthenticated SQL Injection
- CVE-2026-40789 WordPress Amelia plugin <= 2.2 - Sensitive Data Exposure vulnerability
- CVE-2026-40788 WordPress ChatBot plugin <= 7.9.7 - Broken Access Control vulnerability
- CVE-2026-40787 WordPress Quiz And Survey Master plugin <= 11.0.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-40786 WordPress MyRewards plugin <= 5.7.3 - Broken Access Control vulnerability
- CVE-2026-40785 WordPress AutomatorWP plugin <= 5.6.7 - Broken Authentication vulnerability
- CVE-2026-40784 WordPress FluentBoards plugin <= 1.91.2 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-40783 WordPress Blocksy Companion Pro plugin <= 2.1.37 - Remote Code Execution (RCE) vulnerability
- CVE-2026-40782 WordPress WPAdverts plugin <= 2.3.0 - Broken Access Control vulnerability
- CVE-2026-40781 WordPress ReviewX plugin <= 2.3.6 - Broken Authentication vulnerability
- CVE-2026-40780 WordPress BookIt plugin < 2.5.4.1 - Broken Authentication vulnerability
- CVE-2026-4078 ITERAS <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-40779 WordPress Link Library plugin <= 7.8.8 - Arbitrary File Deletion vulnerability
- CVE-2026-40778 WordPress Majestic Support plugin <= 1.1.2 - Broken Access Control vulnerability
- CVE-2026-40777 WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability
- CVE-2026-40776 WordPress Eventin plugin <= 4.1.8 - Broken Access Control vulnerability
- CVE-2026-40775 WordPress Royal MCP plugin <= 1.4.2 - Broken Access Control vulnerability
- CVE-2026-40774 WordPress Booking Package plugin <= 1.7.06 - Broken Access Control vulnerability
- CVE-2026-40773 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.9 - Broken Access Control vulnerability
- CVE-2026-40772 WordPress GeekyBot plugin <= 1.2.2 - Arbitrary File Upload vulnerability
- CVE-2026-40771 WordPress Contest Gallery plugin <= 28.1.6 - SQL Injection vulnerability
- CVE-2026-40770 WordPress Coupon Affiliates plugin <= 7.5.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-4077 Cross-site scripting in Ecover Builder For Dummies
- CVE-2026-40769 Path traversal in Contact Form Extender for Divi – Save Entries, File Upload & Country Code Field
- CVE-2026-40768 WordPress Salon booking system plugin <= 10.30.24 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-40767 WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability
- CVE-2026-40766 WordPress MasterStudy LMS plugin <= 3.7.25 - SQL Injection vulnerability
- CVE-2026-40765 WordPress collectchat plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-40764 WordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-40763 WordPress Royal Elementor Addons plugin <= 1.7.1056 - Broken Access Control vulnerability
- CVE-2026-40762 WordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerability
- CVE-2026-40761 WordPress Valeska theme <= 1.2.2 - PHP Object Injection vulnerability
- CVE-2026-40760 WordPress Behold theme <= 1.5 - PHP Object Injection vulnerability
- CVE-2026-4076 Slider Bootstrap Carousel <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-40759 WordPress Esmée theme <= 1.4 - PHP Object Injection vulnerability