Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 678 of 1013.
- CVE-2026-39455 BIG-IP Configuration utility vulnerability
- CVE-2026-39454 Misconfiguration in SKYMEC IT Manager
- CVE-2026-39453 Red Lion Controls N-Tron 700 Series Reachable Assertion
- CVE-2026-39452 Security feature bypass in Intel(R) Transfer Learning Tool
- CVE-2026-39451 WordPress WP Google Review Slider plugin <= 18.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39450 WordPress FunnelKit Automations plugin <= 3.7.3 - Broken Authentication vulnerability
- CVE-2026-3945 tinyproxy Integer Overflow in HTTP Chunked Transfer-Encoding Parser Leading to Denial of Service
- CVE-2026-39449 WordPress Contact Form to Any API plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39448 WordPress NOWPayments for WooCommerce plugin <= 1.4.0 - Broken Access Control vulnerability
- CVE-2026-39447 WordPress Simply Schedule Appointments plugin <= 1.6.10.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39446 WordPress Kapee theme < 1.7.0 - PHP Object Injection vulnerability
- CVE-2026-39445 WordPress Alukas theme < 3.0.0 - PHP Object Injection vulnerability
- CVE-2026-39444 WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-39443 WordPress EmallShop theme <= 2.4.21 - PHP Object Injection vulnerability
- CVE-2026-39442 WordPress PressMart theme <= 1.2.26 - PHP Object Injection vulnerability
- CVE-2026-39441 WordPress Feed KuantoKusta for WooCommerce – Free plugin <= 5.3 - SQL Injection vulnerability
- CVE-2026-39440 WordPress FunnelFormsPro plugin <= 3.8.1 - Remote Code Execution (RCE) vulnerability
- CVE-2026-3944 itsourcecode University Management System att_add.php sql injection
- CVE-2026-39439 WordPress WebSamurai plugin <= 1.0.7 - Broken Access Control vulnerability
- CVE-2026-39438 WordPress ListingPro plugin <= 2.9.10 - SQL Injection vulnerability
- CVE-2026-39437 Cross-site scripting in Min Max Step Quantity Limits Manager for WooCommerce
- CVE-2026-39436 WordPress CformsII plugin <= 15.1.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-39435 WordPress CformsII plugin <= 15.1.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39434 WordPress CTX Feed plugin <= 6.6.26 - PHP Object Injection vulnerability
- CVE-2026-39433 WordPress WPAMS plugin < 49.5.3 - Arbitrary Content Deletion vulnerability
- CVE-2026-39432 WordPress Timetics plugin <= 1.0.53 - Broken Access Control vulnerability
- CVE-2026-3943 H3C ACG1000-AK230 aaa_portal_auth_local_submit command injection
- CVE-2026-39429 kcp's cache server is accessible without authentication or authorization checks
- CVE-2026-39428 CubeCart: Stored Cross-Site Scripting (XSS)
- CVE-2026-39426 MaxKB: Stored XSS via Unsanitized iframe_render Parsing
- CVE-2026-39425 MaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering
- CVE-2026-39424 MaxKB has CSV Injection in its Application Chat Export Functionality
- CVE-2026-39423 Stored XSS via Eval Injection in EchartsRander Component
- CVE-2026-39422 MaxKB has Stored XSS via ChatHeadersMiddleware
- CVE-2026-39421 MaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect
- CVE-2026-39420 MaxKB: Sandbox escape via LD_PRELOAD bypass
- CVE-2026-3942 Other in Chrome
- CVE-2026-39419 MaxKB: Sandbox Result Validation Bypass via Tool Output Spoofing
- CVE-2026-39418 MaxKB: SSRF via sandbox network hook bypass
- CVE-2026-39417 MaxKB: RCE via MCP stdio command injection in workflow engine
- CVE-2026-39416 Stored XSS in modal item preview for long item content in AIL Framework
- CVE-2026-39415 Frappe Learning Management System has Client-Side Manipulation of Quiz Scores
- CVE-2026-39414 MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing
- CVE-2026-39413 LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API
- CVE-2026-39412 LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
- CVE-2026-39411 LobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header
- CVE-2026-39410 Hono has a non-breaking space prefix bypass in cookie name handling in getCookie()
- CVE-2026-3941 Security feature bypass in Chrome
- CVE-2026-39409 Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
- CVE-2026-39408 Hono has a path traversal in toSSG() allows writing files outside the output directory
- CVE-2026-39407 Hono has a middleware bypass via repeated slashes in serveStatic
- CVE-2026-39406 @hono/node-server has a middleware bypass via repeated slashes in serveStatic
- CVE-2026-39405 Frappe has Path Transversal via SCORM
- CVE-2026-39402 lxc lxc-user-nic insufficient ownership validation allows cross-tenant OVS port deletion
- CVE-2026-39401 Privilege Escalation via update_event Job Output in Cronicle
- CVE-2026-39400 Stored XSS via Job HTML/Table Output in Cronicle
- CVE-2026-3940 Security feature bypass in Chrome
- CVE-2026-39399 NuGet Gallery: Arbitrary Blob Overwrite via Nuspec Confusion and URI Fragment Truncation
- CVE-2026-39397 @delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections
- CVE-2026-39396 OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)
- CVE-2026-39395 Cosign's verify-blob-attestation reports false positive when payload parsing fails
- CVE-2026-39394 CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller
- CVE-2026-39393 Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms
- CVE-2026-39392 CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization
- CVE-2026-39391 CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List
- CVE-2026-39390 CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting
- CVE-2026-3939 Security feature bypass in Chrome
- CVE-2026-39389 CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files
- CVE-2026-39388 OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate
- CVE-2026-39387 BoidCMS: Local File Inclusion (LFI) leads to Remote Code Execution (RCE) via tpl parameter
- CVE-2026-39386 Neko has Self-service Privilege Escalation for Authenticated Users
- CVE-2026-39385 Frappe LMS enrollment bypass in paid courses via unrelated batch
- CVE-2026-39384 FreeScout Customer Merge Cross-Mailbox Authorization Bypass
- CVE-2026-39383 Gotenberg unauthenticated blind SSRF via unfiltered webhook URL
- CVE-2026-39382 dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output
- CVE-2026-39381 Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`
- CVE-2026-39380 Open Source Point of Sale has Stored XSS in Stock Location (Configuration)
- CVE-2026-3938 Security feature bypass in Chrome
- CVE-2026-39378 nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding
- CVE-2026-39377 nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames
- CVE-2026-39376 FastFeedParser has an infinite redirect loop DoS via meta-refresh chain
- CVE-2026-39374 Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint
- CVE-2026-39373 JWCrypto: JWE ZIP decompression bomb
- CVE-2026-39372 InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments
- CVE-2026-39371 RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests
- CVE-2026-39370 WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)
- CVE-2026-3937 Other in Chrome
- CVE-2026-39369 WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs
- CVE-2026-39368 WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services
- CVE-2026-39367 WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page
- CVE-2026-39366 WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php
- CVE-2026-39365 Vite has a Path Traversal in Optimized Deps `.map` Handling
- CVE-2026-39364 Vite has a `server.fs.deny` bypass with queries
- CVE-2026-39363 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket
- CVE-2026-39362 InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs
- CVE-2026-39361 OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url
- CVE-2026-39360 RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration
- CVE-2026-3936 Use after free in Chrome
- CVE-2026-39359 Wazuh: Unauthenticated Path Traversal in authd via Agent Group Name
- CVE-2026-39358 CubeCart: Time-based Blind SQL Injection