Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 677 of 1013.
- CVE-2026-3955 elecV2P jsfile Endpoint wbjs.js runJSFile code injection
- CVE-2026-39549 WordPress Aperitif theme <= 1.5 - Local File Inclusion vulnerability
- CVE-2026-39548 WordPress MagOne theme <= 9.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-39547 WordPress Getaway theme < 1.8 - Local File Inclusion vulnerability
- CVE-2026-39546 WordPress MultiLoca plugin <= 4.2.15 - Privilege Escalation vulnerability
- CVE-2026-39545 WordPress Zermatt theme <= 1.6.1 - PHP Object Injection vulnerability
- CVE-2026-39544 WordPress LabtechCO theme <= 8.3 - Local File Inclusion vulnerability
- CVE-2026-39543 WordPress Tourfic plugin <= 2.21.4 - Broken Access Control vulnerability
- CVE-2026-39542 WordPress Doofinder for WooCommerce plugin <= 2.10.13 - Sensitive Data Exposure vulnerability
- CVE-2026-39541 WordPress Hydra Booking plugin <= 1.1.38 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39540 WordPress Shipment Tracker for Woocommerce plugin <= 1.5.3.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-3954 OpenBMB XAgent workspace.py workspace path traversal
- CVE-2026-39539 WordPress Alloggio - Hotel Booking theme <= 2.1.2 - PHP Object Injection vulnerability
- CVE-2026-39538 WordPress Mikado Core plugin <= 1.6 - Local File Inclusion vulnerability
- CVE-2026-39537 WordPress Mikado Core plugin <= 1.6 - Local File Inclusion vulnerability
- CVE-2026-39536 WordPress RSVP and Event Management plugin <= 2.7.16 - Sensitive Data Exposure vulnerability
- CVE-2026-39535 WordPress Display Eventbrite Events plugin <= 6.5.6 - Broken Access Control vulnerability
- CVE-2026-39534 WordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerability
- CVE-2026-39533 WordPress AWP Classifieds plugin <= 4.4.4 - Broken Access Control vulnerability
- CVE-2026-39532 WordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerability
- CVE-2026-39531 WordPress WP Directory Kit plugin <= 1.5.0 - SQL Injection vulnerability
- CVE-2026-39530 WordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerability
- CVE-2026-3953 Reflected XSS in Gosoft Software's Proticaret E-Commerce
- CVE-2026-39529 WordPress Elementra theme <= 1.0.9 - PHP Object Injection vulnerability
- CVE-2026-39528 WordPress WP Delicious plugin <= 1.9.5 - Broken Access Control vulnerability
- CVE-2026-39527 WordPress WpStream plugin < 4.11.2 - Arbitrary File Upload vulnerability
- CVE-2026-39526 WordPress WpStream plugin < 4.11.2 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-39525 WordPress Booking Activities plugin <= 1.16.48.1 - Broken Access Control vulnerability
- CVE-2026-39524 WordPress Masteriyo - LMS plugin <= 2.1.5 - Payment Bypass vulnerability
- CVE-2026-39523 WordPress Solene Core plugin <= 2.3.2 - Local File Inclusion vulnerability
- CVE-2026-39522 WordPress Solene theme <= 3.4 - Local File Inclusion vulnerability
- CVE-2026-39521 WordPress Nelio Content plugin <= 4.3.1 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-39520 WordPress weDocs plugin <= 2.1.18 - Broken Access Control vulnerability
- CVE-2026-39519 WordPress GeekyBot plugin <= 1.2.0 - SQL Injection vulnerability
- CVE-2026-39518 WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-39517 WordPress Blog Filter plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39516 WordPress Nexter Blocks plugin <= 4.7.0 - Sensitive Data Exposure vulnerability
- CVE-2026-39515 WordPress Motors plugin < 1.4.107 - Broken Access Control vulnerability
- CVE-2026-39514 WordPress Paid Member Subscriptions plugin <= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-39513 WordPress Easy Appointments plugin <= 3.12.21 - Broken Access Control vulnerability
- CVE-2026-39512 WordPress GeoDirectory plugin <= 2.8.152 - SQL Injection vulnerability
- CVE-2026-39511 WordPress WP Photo Album Plus plugin <= 9.1.08.001 - SQL Injection vulnerability
- CVE-2026-39510 Missing authorization in Image Photo Gallery Final Tiles Grid
- CVE-2026-3951 LockerProject Locker Error Response registry.js authIsAwesome cross site scripting
- CVE-2026-39509 WordPress Directorist plugin <= 8.5.10 - Broken Access Control vulnerability
- CVE-2026-39508 WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.7.1.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39507 WordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39506 WordPress AI Engine (Pro) plugin < 3.4.2 - Broken Access Control vulnerability
- CVE-2026-39505 WordPress Seriously Simple Podcasting plugin <= 3.14.2 - Broken Access Control vulnerability
- CVE-2026-39504 WordPress InstaWP Connect plugin <= 0.1.2.5 - Broken Access Control vulnerability
- CVE-2026-39503 WordPress Easy Digital Downloads plugin <= 3.6.5 - Broken Access Control vulnerability
- CVE-2026-39502 WordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerability
- CVE-2026-39501 WordPress FOX plugin <= 1.4.5 - Broken Access Control vulnerability
- CVE-2026-39500 WordPress themesflat-addons-for-elementor plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-3950 strukturag libheif stsz/stts track.cc load out-of-bounds
- CVE-2026-39499 Deserialization in Advanced Product Fields (Product Addons) for WooCommerce
- CVE-2026-39498 WordPress YayMail plugin <= 4.3.3 - PHP Object Injection vulnerability
- CVE-2026-39497 WordPress FOX plugin <= 1.4.5 - SQL Injection vulnerability
- CVE-2026-39496 WordPress YayMail plugin <= 4.3.3 - SQL Injection vulnerability
- CVE-2026-39495 WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability
- CVE-2026-39494 WordPress Product Filter by WBW plugin <= 3.1.2 - SQL Injection vulnerability
- CVE-2026-39493 WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability
- CVE-2026-39492 WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability
- CVE-2026-39491 WordPress JupiterX Core plugin <= 4.14.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39490 WordPress JupiterX Core plugin <= 4.14.1 - Broken Access Control vulnerability
- CVE-2026-3949 strukturag libheif HEIF File decoder_vvdec.cc vvdec_push_data2 out-of-bounds
- CVE-2026-39489 WordPress Download Monitor plugin <= 5.1.9 - Non-Arbitrary File Download vulnerability
- CVE-2026-39488 WordPress SureCart plugin <= 4.0.2 - Broken Access Control vulnerability
- CVE-2026-39487 WordPress Amelia plugin <= 2.1.1 - SQL Injection vulnerability
- CVE-2026-39486 WordPress Download Monitor plugin <= 5.1.8 - SQL Injection vulnerability
- CVE-2026-39485 WordPress Youtube Embed Plus plugin <= 14.2.4 - Broken Access Control vulnerability
- CVE-2026-39484 WordPress Hide My WP Ghost plugin < 7.0.00 - Open Redirection vulnerability
- CVE-2026-39483 WordPress VK All in One Expansion Unit plugin <= 9.113.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39482 WordPress Post Expirator plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39481 WordPress Modula Image Gallery plugin <= 2.14.18 - PHP Object Injection vulnerability
- CVE-2026-39480 WordPress Backup Migration plugin <= 2.1.1 - Sensitive Data Exposure vulnerability
- CVE-2026-39479 WordPress OttoKit plugin <= 1.1.20 - SQL Injection vulnerability
- CVE-2026-39478 WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.87 - PHP Object Injection vulnerability
- CVE-2026-39477 WordPress CartFlows plugin <= 2.2.3 - Broken Access Control vulnerability
- CVE-2026-39476 WordPress User Feedback plugin <= 1.10.1 - Broken Access Control vulnerability
- CVE-2026-39475 WordPress User Feedback plugin <= 1.10.1 - SQL Injection vulnerability
- CVE-2026-39474 WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerability
- CVE-2026-39473 WordPress Simple History plugin <= 5.24.0 - Sensitive Data Exposure vulnerability
- CVE-2026-39472 WordPress WooCommerce PDF Invoices & Packing Slips plugin < 5.9.0 - PHP Object Injection vulnerability
- CVE-2026-39471 WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability
- CVE-2026-39470 WordPress WooCommerce Cart Abandonment Recovery plugin < 2.1.0 - Privilege Escalation vulnerability
- CVE-2026-39469 WordPress PageLayer plugin <= 2.0.8 - Sensitive Data Exposure vulnerability
- CVE-2026-39468 WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion vulnerability
- CVE-2026-39467 WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - PHP Object Injection vulnerability
- CVE-2026-39466 WordPress Broken Link Checker plugin <= 2.4.7 - SQL Injection vulnerability
- CVE-2026-39465 WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - Remote Code Execution (RCE) vulnerability
- CVE-2026-39464 Server-side request forgery in Coming Soon Page, Under Construction & Maintenance Mode by SeedProd
- CVE-2026-39463 WordPress ManageWP Worker plugin <= 4.9.31 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39462 SenseLive X3050 Insufficiently Protected Credentials
- CVE-2026-39461 select(2) file descriptor set overflow causes stack overflow
- CVE-2026-39460 Red Lion Controls N-Tron 700 Series Insufficiently Protected Credentials
- CVE-2026-3946 PHPEMS index.php cross site scripting
- CVE-2026-39459 iControl REST and tmsh vulnerability
- CVE-2026-39458 BIG-IP DNS Cache vulnerability
- CVE-2026-39457 Stack overflow via select() file descriptor set overflow