Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 676 of 1013.
- CVE-2026-39640 WordPress Theme Editor plugin <= 3.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution vulnerability
- CVE-2026-3964 OpenAkita Chat API Endpoint shell.py run os command injection
- CVE-2026-39639 WordPress RPS Include Content plugin <= 1.2.2 - Broken Access Control vulnerability
- CVE-2026-39638 WordPress Qubely plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39637 WordPress Mogi theme <= 1.2.3 - Arbitrary Shortcode Execution vulnerability
- CVE-2026-39636 WordPress Livemesh Addons for Elementor plugin <= 9.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39635 WordPress Grand Magazine theme <= 3.5.5 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-39634 WordPress Grand Portfolio theme <= 3.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-39633 WordPress Grand Car Rental theme <= 3.6.9 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-39632 WordPress Grand Blog theme <= 3.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-39631 WordPress WPSchoolPress plugin <= 2.2.35 - Broken Access Control vulnerability
- CVE-2026-39630 WordPress Getty Images plugin <= 4.1.0 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-3963 perfree go-fastdfs-web Apache Shiro RememberMe ShiroConfig.java rememberMeManager hard-coded key
- CVE-2026-39629 WordPress Uminex theme <= 1.0.9 - Arbitrary Shortcode Execution vulnerability
- CVE-2026-39628 WordPress DukaMarket theme <= 1.3.0 - Arbitrary Shortcode Execution vulnerability
- CVE-2026-39627 WordPress Ashe theme <= 2.266 - Broken Access Control vulnerability
- CVE-2026-39626 WordPress Armania theme <= 1.4.8 - Arbitrary Shortcode Execution vulnerability
- CVE-2026-39625 WordPress TechOne theme <= 3.0.3 - Arbitrary Shortcode Execution vulnerability
- CVE-2026-39624 WordPress Biolife theme <= 3.2.3 - Arbitrary Shortcode Execution vulnerability
- CVE-2026-39623 WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability
- CVE-2026-39622 WordPress Education Base theme <= 3.0.8 - Broken Access Control vulnerability
- CVE-2026-39621 WordPress SpicePress theme <= 2.3.2.5 - CSRF to Arbitrary Plugin Installation vulnerability
- CVE-2026-39620 WordPress Appointment theme <= 3.5.5 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability
- CVE-2026-3962 Jcharis Machine-Learning-Web-Apps Jinja2 Template app.py render_template cross site scripting
- CVE-2026-39619 WordPress Busiprof theme <= 2.5.2 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability
- CVE-2026-39618 WordPress NewsExo theme <= 7.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-39617 WordPress Bluestreet theme <= 1.7.3 - Cross Site Request Forgery (CSRF) to Arbitrary Plugin Installation vulnerability
- CVE-2026-39616 WordPress Download Attachments plugin <= 1.4.0 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-39615 WordPress Download Manager plugin <= 3.3.53 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39614 WordPress JW Player for WordPress plugin <= 2.3.6 - Broken Access Control vulnerability
- CVE-2026-39613 WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability
- CVE-2026-39612 WordPress KuteShop theme <= 4.2.9 - Arbitrary Shortcode Execution vulnerability
- CVE-2026-39611 WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability
- CVE-2026-39610 WordPress WpXmas-Snow plugin <= 1.1 - Broken Access Control vulnerability
- CVE-2026-3961 zyddnys manga-image-translator Translate Endpoints request_extraction.py to_pil_image server-side request forgery
- CVE-2026-39609 WordPress Wava Payment plugin <= 0.3.7 - Broken Access Control vulnerability
- CVE-2026-39608 WordPress iPOSpays Gateways WC plugin <= 1.3.7 - Broken Access Control vulnerability
- CVE-2026-39607 WordPress Filter Plus plugin <= 1.1.17 - Broken Access Control vulnerability
- CVE-2026-39606 WordPress BizReview plugin <= 1.5.13 - Broken Access Control vulnerability
- CVE-2026-39605 WordPress Super Custom Login plugin <= 1.1 - Broken Access Control vulnerability
- CVE-2026-39604 WordPress MyBookTable Bookstore plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39603 WordPress Grand Photography theme <= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-39602 WordPress Order Tracking plugin <= 3.4.3 - Broken Access Control vulnerability
- CVE-2026-39601 WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability
- CVE-2026-39600 WordPress Aculect AI Companion plugin <= 0.8.2 - Unvalidated Redirects and Forwards vulnerability
- CVE-2026-3960 Remote Code Execution in h2oai/h2o-3
- CVE-2026-39599 WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability
- CVE-2026-39598 WordPress Academy LMS Pro plugin < 3.5.2 - Arbitrary File Upload vulnerability
- CVE-2026-39597 WordPress WPZOOM Addons for Elementor plugin <= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-39596 WordPress Blocksy Companion Pro plugin < 2.1.29 - SQL Injection vulnerability
- CVE-2026-39595 WordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerability
- CVE-2026-39594 WordPress Ultra Addons for WPForms plugin <= 1.0.11 - Broken Access Control vulnerability
- CVE-2026-39593 WordPress HAPPY plugin <= 1.0.10 - Broken Access Control vulnerability
- CVE-2026-39592 WordPress DEPART plugin <= 1.0.7 - Broken Access Control vulnerability
- CVE-2026-39591 WordPress WP-BusinessDirectory plugin <= 4.0.0 - Arbitrary File Upload vulnerability
- CVE-2026-39590 WordPress Atomlab theme <= 2.4.5 - Local File Inclusion vulnerability
- CVE-2026-3959 0xKoda WireMCP Tshark CLI index.js server.tool os command injection
- CVE-2026-39589 WordPress Webenvo theme <= 0.0.6 - Arbitrary File Upload vulnerability
- CVE-2026-39588 WordPress NM Gift Registry and Wishlist Lite plugin <= 5.13 - Broken Access Control vulnerability
- CVE-2026-39587 WordPress WP BASE Booking plugin <= 5.9.0 - Privilege Escalation vulnerability
- CVE-2026-39586 WordPress RepairBuddy plugin <= 4.1132 - Sensitive Data Exposure vulnerability
- CVE-2026-39585 WordPress Booktics plugin <= 1.0.16 - Broken Access Control vulnerability
- CVE-2026-39584 WordPress RepairBuddy plugin <= 4.1132 - Broken Access Control vulnerability
- CVE-2026-39583 WordPress Datalogics Ecommerce Delivery plugin <= 2.6.62 - Privilege Escalation vulnerability
- CVE-2026-39582 WordPress Hitek theme < 1.8.3 - Local File Inclusion vulnerability
- CVE-2026-39581 WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.4 - SQL Injection vulnerability
- CVE-2026-39580 WordPress Micdrop theme <= 1.3.1 - PHP Object Injection vulnerability
- CVE-2026-3958 Woahai321 ListSync JSON api_server.py requests.post server-side request forgery
- CVE-2026-39579 WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability
- CVE-2026-39578 WordPress Valiance theme <= 1.2 - PHP Object Injection vulnerability
- CVE-2026-39577 WordPress Playroom theme <= 1.4.1 - PHP Object Injection vulnerability
- CVE-2026-39576 WordPress SingleMalt theme <= 1.5 - PHP Object Injection vulnerability
- CVE-2026-39575 WordPress Custom Query Blocks plugin <= 5.5.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39574 WordPress InPost Gallery plugin <= 2.1.4.6 - SQL Injection vulnerability
- CVE-2026-39573 WordPress Mildhill theme <= 1.5 - PHP Object Injection vulnerability
- CVE-2026-39572 WordPress Bus Ticket Booking with Seat Reservation plugin < 5.6.5 - Sensitive Data Exposure vulnerability
- CVE-2026-39571 WordPress Instantio plugin <= 3.3.30 - Sensitive Data Exposure vulnerability
- CVE-2026-39570 WordPress 12 Step Meeting List plugin <= 3.19.9 - Sensitive Data Exposure vulnerability
- CVE-2026-3957 xierongwkhd weimai-wetapp Endpoint HomeController.java getLikeMovieList sql injection
- CVE-2026-39569 WordPress 12 Step Meeting List plugin <= 3.19.9 - Broken Access Control vulnerability
- CVE-2026-39568 WordPress Mr. SEO theme <= 2.0 - Local File Inclusion vulnerability
- CVE-2026-39567 WordPress Santé theme <= 1.5.1 - PHP Object Injection vulnerability
- CVE-2026-39566 WordPress DirectoryPress plugin <= 3.6.26 - Sensitive Data Exposure vulnerability
- CVE-2026-39565 WordPress WpTravelly plugin <= 2.1.7 - Broken Access Control vulnerability
- CVE-2026-39564 WordPress Sunshine Photo Cart plugin < 3.6.2 - Sensitive Data Exposure vulnerability
- CVE-2026-39563 WordPress Share This Image plugin <= 2.12 - Broken Access Control vulnerability
- CVE-2026-39562 WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.10 - Broken Access Control vulnerability
- CVE-2026-39561 WordPress Revive.so plugin <= 2.0.7 - Broken Access Control vulnerability
- CVE-2026-39560 WordPress Hiroshi theme <= 1.5.1 - PHP Object Injection vulnerability
- CVE-2026-3956 xierongwkhd weimai-wetapp Admin_AdminUserController.java getAdmins sql injection
- CVE-2026-39559 WordPress Uppercase theme < 1.2.2 - Local File Inclusion vulnerability
- CVE-2026-39558 WordPress Malmö theme <= 2.2 - Local File Inclusion vulnerability
- CVE-2026-39557 WordPress NeoBeat theme <= 1.7 - PHP Object Injection vulnerability
- CVE-2026-39556 WordPress Konsept theme <= 1.9 - PHP Object Injection vulnerability
- CVE-2026-39555 WordPress Askka theme <= 1.3.1 - PHP Object Injection vulnerability
- CVE-2026-39554 WordPress Fidalgo theme <= 1.2.2 - PHP Object Injection vulnerability
- CVE-2026-39553 WordPress WaveRide theme <= 1.4 - Local File Inclusion vulnerability
- CVE-2026-39552 WordPress Blueprint theme < 1.1.5 - Local File Inclusion vulnerability
- CVE-2026-39551 WordPress Töbel theme <= 1.8.1 - PHP Object Injection vulnerability
- CVE-2026-39550 WordPress Aperitif theme <= 1.6 - PHP Object Injection vulnerability