Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 695 of 1013.
- CVE-2026-34926 Trend Micro Apex One (On-Premise) Directory Traversal
- CVE-2026-3492 Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title
- CVE-2026-34917 Auth bypass in Adserver
- CVE-2026-34916 Code injection in Revive Adserver
- CVE-2026-34915 SQL injection in Adserver
- CVE-2026-34914 SQL injection in Adserver
- CVE-2026-34913 Missing authorization in Adserver
- CVE-2026-34912 Missing authorization in Adserver
- CVE-2026-34911 Path traversal in EFG
- CVE-2026-34910 Ubiquiti UniFi OS Improper Input Validation
- CVE-2026-34909 Ubiquiti UniFi OS Path Traversal
- CVE-2026-34908 Ubiquiti UniFi OS Improper Access Control
- CVE-2026-34907 Reflected Cross-Site Scripting (XSS) in Wirtualna Uczelnia
- CVE-2026-34906 Server-Side Template Injection (SSTI) in Wirtualna Uczelnia
- CVE-2026-34905 Apache Answer: Unlisted Questions Accessible via Direct API Access
- CVE-2026-34904 WordPress Simple Social Media Share Buttons plugin <= 6.2.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-34903 WordPress Ocean Extra plugin <= 2.5.3 - Broken Access Control vulnerability
- CVE-2026-34902 WordPress WooCommerce Product Table Lite plugin <= 4.6.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-34901 WordPress iControlWP plugin <= 5.5.3 - Privilege Escalation vulnerability
- CVE-2026-34900 WordPress GiveWP plugin <= 4.14.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-3490 picklescan - Universal Blocklist Bypass via pkgutil.resolve_name
- CVE-2026-34899 WordPress LTL Freight Quotes – Worldwide Express Edition plugin <= 5.2.1 - Broken Access Control vulnerability
- CVE-2026-34898 WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.3 - Broken Access Control vulnerability
- CVE-2026-34897 WordPress Media LIbrary Assistant plugin <= 3.34 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-34896 Cross-site request forgery in Under Construction, Coming Soon & Maintenance Mode
- CVE-2026-34895 WordPress Softlab Core plugin < 1.2.11 - Local File Inclusion vulnerability
- CVE-2026-34894 WordPress Integrio Core plugin < 1.2.8 - Local File Inclusion vulnerability
- CVE-2026-34893 WordPress Thegov Core plugin < 2.0.23 - Local File Inclusion vulnerability
- CVE-2026-34892 WordPress Rank Math SEO plugin <= 1.0.271 - Broken Access Control vulnerability
- CVE-2026-34891 WordPress IDPay Payment Gateway for Woocommerce plugin <= 2.2.5 - Sensitive Data Exposure vulnerability
- CVE-2026-34890 WordPress MSTW League Manager plugin <= 2.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-3489 DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.26 - Unauthenticated SQL Injection via 'packages'
- CVE-2026-34889 WordPress Ultimate Addons for WPBakery Page Builder plugin < 3.21.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-34888 WordPress Bricksforge plugin <= 3.1.8.4 - Sensitive Data Exposure vulnerability
- CVE-2026-34887 WordPress Kubio AI Page Builder plugin <= 2.7.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-34886 WordPress Simple Membership plugin <= 4.7.1 - Broken Access Control vulnerability
- CVE-2026-34885 WordPress Media LIbrary Assistant plugin <= 3.34 - SQL Injection vulnerability
- CVE-2026-34884 Apache SkyWalking MCP: SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server
- CVE-2026-34883 An issue was discovered in the Portrait Dell Color Management application before 3.7.0 for Dell monitors.
- CVE-2026-34881 OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
- CVE-2026-3488 Missing authorization in WP Statistics – Simple, privacy-friendly Google Analytics alternative
- CVE-2026-34877 Memory corruption in arm:mbed tls
- CVE-2026-34876 Memory corruption in trustedfirmware:mbed tls
- CVE-2026-34875 Memory corruption in trustedfirmware:mbed tls
- CVE-2026-34874 Null dereference in trustedfirmware:mbed tls
- CVE-2026-34873 Auth bypass in trustedfirmware:mbed tls
- CVE-2026-34872 Weak cryptography in arm:mbed tls
- CVE-2026-34871 Weak cryptography in arm:mbed tls
- CVE-2026-3487 itsourcecode College Management System class-result.php sql injection
- CVE-2026-34867 Memory corruption in HarmonyOS
- CVE-2026-34866 Memory corruption in HarmonyOS
- CVE-2026-34865 Memory corruption in HarmonyOS
- CVE-2026-34864 Memory corruption in HarmonyOS
- CVE-2026-34863 Memory corruption in HarmonyOS
- CVE-2026-34862 Race condition in HarmonyOS
- CVE-2026-34861 Race condition in HarmonyOS
- CVE-2026-34860 Missing authorization in HarmonyOS
- CVE-2026-3486 itsourcecode College Management System student-fee.php sql injection
- CVE-2026-34859 Use after free in EMUI
- CVE-2026-34858 Use after free in HarmonyOS
- CVE-2026-34857 Use after free in HarmonyOS
- CVE-2026-34856 Use after free in HarmonyOS
- CVE-2026-34855 Memory corruption in EMUI
- CVE-2026-34854 Use after free in EMUI
- CVE-2026-34853 Security feature bypass in EMUI
- CVE-2026-34852 Denial of service in HarmonyOS
- CVE-2026-34851 Race condition in HarmonyOS
- CVE-2026-34850 Race condition in HarmonyOS
- CVE-2026-3485 D-Link DIR-868L SSDP Service sub_1BF84 os command injection
- CVE-2026-34849 Use after free in HarmonyOS
- CVE-2026-34848 hoppscotch: Stored XSS in team member overflow tooltip via display name
- CVE-2026-34847 hoppscotch: Open redirect via `/enter?redirect=`
- CVE-2026-34841 Axios npm Supply Chain Incident Impacting @usebruno/cli
- CVE-2026-34840 OneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature Verification
- CVE-2026-3484 PhialsBasement nmap-mcp-server Nmap CLI index.ts child_process.exec command injection
- CVE-2026-34839 Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS
- CVE-2026-34838 Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`
- CVE-2026-34837 Zammad is miissing authorization in AI assistance controller for context data used in text tools
- CVE-2026-34836 Combodo iTop: Improper access control in ajax.render.php and ajax.document.php
- CVE-2026-34835 Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.
- CVE-2026-34834 Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation
- CVE-2026-34833 Bulwark Webmail: Information Exposure: password returned in /api/auth/session
- CVE-2026-34832 Scoold: Cross-Account Feedback Deletion (IDOR)
- CVE-2026-34831 Rack: Content-Length mismatch in Rack::Files error responses
- CVE-2026-34830 Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx
- CVE-2026-3483 Privilege escalation in Desktop and Server Management
- CVE-2026-34829 Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length
- CVE-2026-34828 listmonk: Active sessions remain valid after password reset and password change
- CVE-2026-34827 Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser
- CVE-2026-34826 Rack: Unbounded Range Count in get_byte_ranges Enables DoS
- CVE-2026-34825 NocoBase Has SQL Injection via template variable substitution in workflow SQL node
- CVE-2026-34824 Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service
- CVE-2026-34823 Endian Firewall /manage/password/web/ remark Stored Cross-Site Scripting
- CVE-2026-34822 Endian Firewall /manage/ca/certificate/ new_cert_name Stored Cross-Site Scripting
- CVE-2026-34821 Endian Firewall /manage/vpnauthentication/user/ remark Stored Cross-Site Scripting
- CVE-2026-34820 Endian Firewall /manage/ipsec/ remark Stored Cross-Site Scripting
- CVE-2026-3482 IBM Sterling B2B Integrator and IBM Sterling File Gateway Authorization Bypass
- CVE-2026-34819 Endian Firewall /cgi-bin/openvpnclient.cgi REMARK Stored Cross-Site Scripting
- CVE-2026-34818 Endian Firewall /manage/dnsmasq/localdomains/ remark Stored Cross-Site Scripting
- CVE-2026-34817 Endian Firewall /cgi-bin/smtprouting.cgi ADDRESS BCC Stored Cross-Site Scripting