Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 674 of 1013.
- CVE-2026-39836 Panic in Dial and LookupPort when handling NUL byte on Windows in net
- CVE-2026-39835 Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
- CVE-2026-39834 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
- CVE-2026-39833 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
- CVE-2026-39832 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
- CVE-2026-39831 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
- CVE-2026-39830 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
- CVE-2026-3983 Campcodes Division Regional Athletic Meet Game Result Matrix System save-games.php cross site scripting
- CVE-2026-39829 Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
- CVE-2026-39828 Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
- CVE-2026-39827 Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh
- CVE-2026-39826 Escaper bypass leads to XSS in html/template
- CVE-2026-39825 ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil
- CVE-2026-39824 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
- CVE-2026-39823 Bypass of meta content URL escaping causes XSS in html/template
- CVE-2026-39822 Root escape via symlink plus trailing slash in os
- CVE-2026-39821 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
- CVE-2026-39820 Quadratic string concatentation in consumeComment in net/mail
- CVE-2026-3982 itsourcecode University Management System view_result.php cross site scripting
- CVE-2026-39819 Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go
- CVE-2026-39817 Invoking "go tool pack" does not sanitize output paths in cmd/go
- CVE-2026-39816 Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService
- CVE-2026-39815 SQL injection in FortiDDoS-F
- CVE-2026-39814 Path traversal in FortiWeb
- CVE-2026-39813 Path traversal in FortiSandbox
- CVE-2026-39812 Cross-site scripting in FortiSandbox
- CVE-2026-39811 Integer overflow in FortiWeb
- CVE-2026-39810 Hardcoded credentials in FortiClientEMS
- CVE-2026-3981 itsourcecode Online Doctor Appointment System doctor_action.php sql injection
- CVE-2026-39809 SQL injection in FortiClientEMS
- CVE-2026-39808 Fortinet FortiSandbox OS Command Injection
- CVE-2026-39807 Client-supplied URI scheme trusted without transport verification in bandit
- CVE-2026-39806 HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit
- CVE-2026-39805 CL.CL HTTP request smuggling via duplicate Content-Length in bandit
- CVE-2026-39804 WebSocket permessage-deflate inflate has no output-size cap in bandit
- CVE-2026-39803 HTTP/1 chunked body reader ignores length cap in bandit
- CVE-2026-39802 WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability
- CVE-2026-39801 WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability
- CVE-2026-39800 WordPress Additional Order Filters for WooCommerce plugin <= 1.24 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-3980 itsourcecode Online Doctor Appointment System patient_action.php sql injection
- CVE-2026-39799 WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39798 WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability
- CVE-2026-39797 WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability
- CVE-2026-39796 WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability
- CVE-2026-39795 WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability
- CVE-2026-39794 WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability
- CVE-2026-39793 WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability
- CVE-2026-39792 WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability
- CVE-2026-39791 WordPress Mailjet Email Marketing plugin <= 6.2.3 - Sensitive Data Exposure vulnerability
- CVE-2026-39790 WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-3979 quickjs-ng quickjs quickjs.c js_iterator_concat_return use after free
- CVE-2026-39789 WordPress Fluent Affiliate Pro plugin <= 1.6.4 - Broken Access Control vulnerability
- CVE-2026-39788 WordPress Front End PM plugin <= 11.4.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39787 WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability
- CVE-2026-39785 WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability
- CVE-2026-39784 WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39783 WordPress Polylang plugin <= 3.8.7 - Sensitive Data Exposure vulnerability
- CVE-2026-39782 WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability
- CVE-2026-39781 WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39780 WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-3978 D-Link DIR-513 formEasySetupWizard3 stack-based overflow
- CVE-2026-39779 WordPress Asgaros Forum plugin <= 3.4.0 - Broken Access Control vulnerability
- CVE-2026-39778 Cross-site scripting in Ansar Import – One Click Starter Sites – for Elementor & Themes
- CVE-2026-39776 WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability
- CVE-2026-39775 WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability
- CVE-2026-39774 WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability
- CVE-2026-39773 WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability
- CVE-2026-39772 WordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability
- CVE-2026-39771 WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability
- CVE-2026-39770 WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability
- CVE-2026-3977 projectsend AJAX Endpoints authorization
- CVE-2026-39769 WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability
- CVE-2026-39767 WordPress WPBase Cache plugin <= 5.5.6 - Denial of Service Attack vulnerability
- CVE-2026-39766 WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39765 WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability
- CVE-2026-39764 WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 - SQL Injection vulnerability
- CVE-2026-39763 WordPress WP Dummy Content Generator plugin <= 4.0.0 - Broken Access Control vulnerability
- CVE-2026-39762 WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.17.1 - Broken Access Control vulnerability
- CVE-2026-39761 WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability
- CVE-2026-39760 WordPress Real 3D FlipBook plugin <= 5.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-3976 Tenda W3 POST Parameter WifiMacFilterSet formWifiMacFilterSet stack-based overflow
- CVE-2026-39759 WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability
- CVE-2026-39758 WordPress Midtrans-WooCommerce plugin <= 2.32.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39757 WordPress Taskbot plugin <= 6.6 - Arbitrary File Upload vulnerability
- CVE-2026-39756 WordPress Wappointment plugin <= 2.7.7 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-39755 WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerability
- CVE-2026-39754 WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnerability
- CVE-2026-39753 WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability
- CVE-2026-39752 WordPress Jobs for WordPress plugin <= 2.8.2 - Arbitrary File Deletion vulnerability
- CVE-2026-39751 WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Broken Access Control vulnerability
- CVE-2026-39750 Cross-site scripting in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart
- CVE-2026-3975 Tenda W3 POST Parameter WifiMacFilterGet formWifiMacFilterGet stack-based overflow
- CVE-2026-39749 WordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerability
- CVE-2026-39748 WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-39747 WordPress Woffice theme <= 5.4.35 - SQL Injection vulnerability
- CVE-2026-39746 WordPress Booknetic plugin < 5.10.3 - SQL Injection vulnerability
- CVE-2026-39745 WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39742 WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39741 WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability
- CVE-2026-3974 Tenda W3 HTTP exeCommand formexeCommand stack-based overflow