Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 666 of 1013.
- CVE-2026-40758 WordPress Léonie theme <= 1.2.1 - PHP Object Injection vulnerability
- CVE-2026-40757 WordPress Château theme <= 1.2.1 - PHP Object Injection vulnerability
- CVE-2026-40756 WordPress Zoya theme <= 1.4 - PHP Object Injection vulnerability
- CVE-2026-40755 WordPress TechLink theme <= 1.3 - PHP Object Injection vulnerability
- CVE-2026-40754 WordPress Roisin theme <= 1.4 - PHP Object Injection vulnerability
- CVE-2026-40753 WordPress EasyMeals theme <= 1.5.1 - PHP Object Injection vulnerability
- CVE-2026-40752 WordPress Manufaktur Solutions theme <= 1.1.1 - PHP Object Injection vulnerability
- CVE-2026-40751 WordPress Ashtanga theme <= 1.2 - PHP Object Injection vulnerability
- CVE-2026-40750 WordPress Kids Online Store theme <= 0.8.9 - Arbitrary File Upload vulnerability
- CVE-2026-4075 Cross-site scripting in BWL Advanced FAQ Manager Lite
- CVE-2026-40749 WordPress Charity Zone theme <= 1.1.1 - Arbitrary File Upload vulnerability
- CVE-2026-40748 WordPress Kids Gift Shop theme <= 0.5.4 - Arbitrary File Upload vulnerability
- CVE-2026-40747 WordPress Ecommerce Zone theme <= 0.9.7 - Arbitrary File Upload vulnerability
- CVE-2026-40746 WordPress Restaurant Zone theme <= 0.7.8 - Arbitrary File Upload vulnerability
- CVE-2026-40745 WordPress Element Pack Elementor Addons plugin <= 8.4.2 - SQL Injection vulnerability
- CVE-2026-40744 WordPress Beaver Builder plugin <= 2.10.1.2 - SQL Injection vulnerability
- CVE-2026-40743 WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability
- CVE-2026-40742 WordPress Nelio AB Testing plugin <= 8.2.8 - Sensitive Data Exposure vulnerability
- CVE-2026-40741 WordPress Redsys for WooCommerce Light plugin <= 7.0.0 - Broken Access Control vulnerability
- CVE-2026-40740 WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability
- CVE-2026-4074 Quran Live Multilanguage <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-40739 WordPress LuxeDrive theme <= 1.4 - PHP Object Injection vulnerability
- CVE-2026-40738 WordPress Eldon theme <= 1.4.1 - PHP Object Injection vulnerability
- CVE-2026-40737 WordPress COMPE plugin <= 1.1.4 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-40736 WordPress Laurits theme <= 1.5.1 - PHP Object Injection vulnerability
- CVE-2026-40735 WordPress Reina theme <= 2.1 - PHP Object Injection vulnerability
- CVE-2026-40734 WordPress Categories Images plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-40733 WordPress ShiftUp theme <= 1.3 - PHP Object Injection vulnerability
- CVE-2026-40732 WordPress Notification for Telegram plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-40731 WordPress ChapterOne theme <= 1.7 - Local File Inclusion vulnerability
- CVE-2026-40730 WordPress ThemeGrill Demo Importer plugin <= 2.0.0.6 - Broken Access Control vulnerability
- CVE-2026-4073 pdfl.io <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute
- CVE-2026-40729 WordPress 3D viewer – Embed 3D Models plugin <= 1.8.5 - Broken Access Control vulnerability
- CVE-2026-40728 WordPress Magazine Blocks plugin <= 1.8.3 - Broken Access Control vulnerability
- CVE-2026-40727 WordPress Groundhogg plugin <= 4.4 - Arbitrary File Deletion vulnerability
- CVE-2026-40726 WordPress User Registration Stripe plugin <= 1.3.14 - Broken Access Control vulnerability
- CVE-2026-40725 WordPress WooCommerce Product Filters plugin < 2.0.6 - PHP Object Injection vulnerability
- CVE-2026-40724 WordPress Client Portal (Pro) plugin <= 5.6.2 - Arbitrary File Download vulnerability
- CVE-2026-40723 WordPress Bricks Builder theme <= 2.1.4 - Broken Access Control vulnerability
- CVE-2026-40722 WordPress Yoast SEO Premium plugin <= 26.6 - Broken Access Control vulnerability
- CVE-2026-40721 WordPress Element Pack Pro plugin <= 9.0.6 - Local File Inclusion vulnerability
- CVE-2026-40720 WordPress Royal Elementor Addons Pro plugin < 1.7.1041 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-4072 Cross-site scripting in WordPress PayPal Donation
- CVE-2026-40719 Denial of service in MaraDNS
- CVE-2026-40717 Privilege escalation in Monitor driver
- CVE-2026-40715 Privilege escalation in ThinOS 10
- CVE-2026-40714 Privilege escalation in PowerProtect Data Manager
- CVE-2026-40713 Missing authorization in ThinOS 10
- CVE-2026-40712 Privilege escalation in PowerProtect Data Manager
- CVE-2026-40711 Command injection in Container Storage Modules
- CVE-2026-4071 BirdSeed <= 2.2.0 - Cross-Site Request Forgery via BirdSeed Token Change
- CVE-2026-40706 Memory corruption in NTFS-3G
- CVE-2026-40703 BIG-IP Configuration utility CSRF vulnerability
- CVE-2026-40702 EVoke Systems EVoke CSMS Missing Authentication for Critical Function
- CVE-2026-40701 NGINX ngx_http_ssl_module vulnerability
- CVE-2026-4070 Alfie <= 1.2.1 - Cross-Site Request Forgery to Feed Deletion via 'delete' Parameter
- CVE-2026-40699 BIG-IP Configuration utility vulnerability
- CVE-2026-40698 iControl REST and TMSH vulnerability
- CVE-2026-40691 Packet of death for DNSCrypt over TCP
- CVE-2026-40690 Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions
- CVE-2026-4069 Alfie – Feed Plugin <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'naam' Parameter
- CVE-2026-40688 Memory corruption in FortiWeb
- CVE-2026-40687 Memory corruption in Exim
- CVE-2026-40686 Memory corruption in Exim
- CVE-2026-40685 Memory corruption in Exim
- CVE-2026-40684 Denial of service in Exim
- CVE-2026-40683 OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean
- CVE-2026-40682 Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor
- CVE-2026-4068 Add Custom Fields to Media <= 2.0.3 - Cross-Site Request Forgery to Custom Field Deletion via 'delete' Parameter
- CVE-2026-40677 Weak cryptography in AMD Management Console (AMC)
- CVE-2026-4067 Ad Short <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'client' Shortcode Attribute
- CVE-2026-4066 Missing authorization in Smart Custom Fields
- CVE-2026-4065 Missing authorization in Smart Slider 3
- CVE-2026-40641 Weak cryptography in PowerFlex
- CVE-2026-4064 Missing authorization in PowerShell Universal
- CVE-2026-40639 Weak cryptography in DELL EMBEDDED PC 3000
- CVE-2026-40638 Privilege escalation in PowerScale InsightIQ
- CVE-2026-40636 Hardcoded credentials in ECS
- CVE-2026-40635 Other in PowerScale OneFS
- CVE-2026-40633 Information disclosure in PowerScale OneFS
- CVE-2026-40631 BIG-IP iControl SOAP vulnerability
- CVE-2026-40630 SenseLive X3050 Authentication bypass using an alternate path or channel
- CVE-2026-4063 Missing authorization in Social Icons Widget & Block – Social Media Icons & Share Buttons
- CVE-2026-40629 BIG-IP SSL/TLS vulnerability
- CVE-2026-40627 Command injection in Totolink
- CVE-2026-40624 AVer PTC cameras Files or Directories Accessible to External Parties
- CVE-2026-40623 SenseLive X3050 Missing Authorization
- CVE-2026-40622 Another 'ghost domain names' attack variant
- CVE-2026-40621 Auth bypass in WRC-BE65QSD-B
- CVE-2026-40620 SenseLive X3050 Missing authentication for critical function
- CVE-2026-4062 Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'object_ids' Parameter
- CVE-2026-40619 Information disclosure in Genetec Security Center
- CVE-2026-40618 BIG-IP SSL/TLS vulnerability
- CVE-2026-40615 Memory corruption in Totolink
- CVE-2026-40614 PJSIP: Heap buffer overflow in Opus codec decoding
- CVE-2026-40613 Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)
- CVE-2026-40612 jq: Stack overflow via unbounded recursion in jv_contains
- CVE-2026-40611 Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider
- CVE-2026-40610 BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context
- CVE-2026-4061 Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'map_post_type' Parameter