Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 720 of 1013.
- CVE-2026-32381 WordPress App Landing Page theme <= 1.2.2 - Broken Access Control vulnerability
- CVE-2026-32380 WordPress Numinous theme <= 1.3.0 - Broken Access Control vulnerability
- CVE-2026-3238 Samba: denial of service against ad dc wins server
- CVE-2026-32379 WordPress Rara Academic theme <= 1.2.2 - Broken Access Control vulnerability
- CVE-2026-32378 WordPress Book Landing Page theme <= 1.2.7 - Broken Access Control vulnerability
- CVE-2026-32377 WordPress Pranayama Yoga theme <= 1.2.2 - Broken Access Control vulnerability
- CVE-2026-32376 WordPress Kalon theme <= 1.2.9 - Broken Access Control vulnerability
- CVE-2026-32375 WordPress Travel Diaries theme <= 1.2.4 - Broken Access Control vulnerability
- CVE-2026-32374 WordPress The Minimal theme <= 1.2.9 - Broken Access Control vulnerability
- CVE-2026-32373 WordPress SMS Alert Order Notifications plugin <= 3.9.0 - Broken Access Control vulnerability
- CVE-2026-32372 WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.2.4 - Sensitive Data Exposure vulnerability
- CVE-2026-32371 WordPress Elegant Pink theme <= 1.3.3 - Broken Access Control vulnerability
- CVE-2026-32370 WordPress Influencer theme <= 1.1.7 - Broken Access Control vulnerability
- CVE-2026-3237 Missing authorization in Octopus Server
- CVE-2026-32369 WordPress Medilink-Core plugin < 2.0.7 - Local File Inclusion vulnerability
- CVE-2026-32368 WordPress Geo to Lat plugin <= 1.0.19 - SQL Injection vulnerability
- CVE-2026-32367 WordPress Modal Dialog plugin <= 3.5.16 - Remote Code Execution (RCE) vulnerability
- CVE-2026-32366 WordPress Collapsing Categories plugin <= 3.0.9 - SQL Injection vulnerability
- CVE-2026-32365 WordPress Collapsing Archives plugin <= 3.0.7 - SQL Injection vulnerability
- CVE-2026-32364 WordPress Turbo Manager plugin < 4.0.8 - Local File Inclusion vulnerability
- CVE-2026-32363 WordPress WPLifeCycle plugin <= 3.3.1 - Broken Access Control vulnerability
- CVE-2026-32362 WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.3 - Broken Access Control vulnerability
- CVE-2026-32361 WordPress Editorial Calendar plugin <= 3.9.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32360 WordPress Rich Showcase for Google Reviews plugin <= 6.9.4.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-3236 Security feature bypass in Octopus Server
- CVE-2026-32359 WordPress Icon List Block plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32358 WordPress Booking Calendar plugin <= 10.14.15 - SQL Injection vulnerability
- CVE-2026-32357 WordPress Simple Blog Card plugin <= 2.37 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-32356 WordPress Robo Gallery plugin <= 5.1.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32355 WordPress JetEngine plugin < 3.8.4.1 - Deserialization of untrusted data vulnerability
- CVE-2026-32354 WordPress WpEvently plugin < 5.1.9 - Sensitive Data Exposure vulnerability
- CVE-2026-32353 WordPress MailerPress plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-32352 WordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32351 WordPress PowerPress Podcasting plugin <= 11.15.13 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32350 WordPress Chocolate House theme <= 1.1.5 - Broken Access Control vulnerability
- CVE-2026-3235 Missing authorization in WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards
- CVE-2026-32349 WordPress Embed PDF Viewer plugin <= 2.4.7 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-32348 WordPress MAS Videos plugin <= 1.3.2 - Broken Access Control vulnerability
- CVE-2026-32347 WordPress Restaurant and Cafe theme <= 1.2.5 - Broken Access Control vulnerability
- CVE-2026-32346 WordPress Travel Agency theme <= 1.5.5 - Broken Access Control vulnerability
- CVE-2026-32345 WordPress Perfect Portfolio theme <= 1.2.4 - Broken Access Control vulnerability
- CVE-2026-32344 WordPress Corpiva theme <= 1.0.96 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-32343 WordPress Easy Table of Contents plugin <= 2.0.80 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-32342 WordPress Quiz Maker plugin <= 6.7.1.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-32341 WordPress Benevolent theme <= 1.3.9 - Broken Access Control vulnerability
- CVE-2026-32340 WordPress Business One Page theme <= 1.3.2 - Broken Access Control vulnerability
- CVE-2026-3234 Mod_proxy_cluster: mod_proxy_cluster: response body corruption via crlf injection
- CVE-2026-32339 WordPress Bakes And Cakes theme <= 1.2.9 - Broken Access Control vulnerability
- CVE-2026-32338 WordPress Construction Landing Page theme <= 1.4.1 - Broken Access Control vulnerability
- CVE-2026-32337 WordPress Preschool and Kindergarten theme <= 1.2.5 - Broken Access Control vulnerability
- CVE-2026-32336 WordPress Rara Business theme <= 1.3.0 - Broken Access Control vulnerability
- CVE-2026-32335 WordPress The Conference theme <= 1.2.5 - Broken Access Control vulnerability
- CVE-2026-32334 WordPress JobScout theme <= 1.1.7 - Broken Access Control vulnerability
- CVE-2026-32333 WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-32332 WordPress Easy Form plugin <= 2.7.9 - Broken Access Control vulnerability
- CVE-2026-32331 WordPress Textmetrics plugin <= 3.6.4 - Broken Access Control vulnerability
- CVE-2026-32330 WordPress Photo Gallery by 10Web plugin <= 1.8.37 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-32329 WordPress Advanced Related Posts plugin <= 1.9.1 - Broken Access Control vulnerability
- CVE-2026-32328 WordPress Lemmony theme < 1.7.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-32327 Apache Portable Runtime Utility: apr-util XML stack recursion crash
- CVE-2026-32326 Missing authorization in 5G Mobile Router SH-U01
- CVE-2026-32325 Privilege escalation in ServerView Agents for Windows
- CVE-2026-32324 Anviz CX7 Firmware Use of Hard-coded Cryptographic Key
- CVE-2026-32323 Mullvad VPN for macOS: Local Privilege Escalation via unverified bundle path in installer
- CVE-2026-32322 soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction
- CVE-2026-32321 ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration
- CVE-2026-32320 Ella Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstrings
- CVE-2026-32319 Ella Core: Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload
- CVE-2026-32318 Cryptomator for IOS: Tampered vault configuration allows MITM attack on Hub API
- CVE-2026-32317 Cryptomator for Android: Tampered vault configuration allows MITM attack on Hub API
- CVE-2026-32316 jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow
- CVE-2026-32315 motionEye: World-Readable Configuration File Exposes Admin Password Hash
- CVE-2026-32314 Yamux remote Panic via malformed Data frame with SYN set and len = 262145
- CVE-2026-32313 xmlseclibs is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
- CVE-2026-32312 GLPI: Unauthorized export of form structure
- CVE-2026-32311 Command Injection and Docker container escape allows root on host machine
- CVE-2026-32310 Cryptomator: Unverified masterkeyfile key IDs can access arbitrary local or UNC paths
- CVE-2026-3231 Cross-site scripting in Checkout Field Editor (Checkout Manager) for WooCommerce
- CVE-2026-32309 Cryptomator: Hub unlocking accepts plaintext HTTP and unvalidated endpoint schemes
- CVE-2026-32308 OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")
- CVE-2026-32306 OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
- CVE-2026-32305 Traefik mTLS bypass via fragmented ClientHello SNI extraction failure
- CVE-2026-32304 Locutus: RCE via unsanitized input in create_function()
- CVE-2026-32303 Cryptomator: Tampered vault configuration allows MITM attack on Hub API
- CVE-2026-32302 OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode
- CVE-2026-32301 Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL
- CVE-2026-32300 Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information
- CVE-2026-3230 Improper key_share validation in TLS 1.3 HelloRetryRequest
- CVE-2026-32299 Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature
- CVE-2026-32298 Angeet ES3 KVM OS command injection
- CVE-2026-32297 Angeet ES3 KVM unauthenticated arbitrary file write
- CVE-2026-32296 Sipeed NanoKVM unauthenticated Wi-Fi configuration endpoint
- CVE-2026-32295 JetKVM insufficient login rate limiting
- CVE-2026-32294 JetKVM insufficient firmware verification
- CVE-2026-32293 GL-iNet Comet (GL-RM1) KVM insufficient certificate validation
- CVE-2026-32292 GL-iNet Comet (GL-RM1) KVM insufficient login rate-limiting
- CVE-2026-32291 GL-iNet Comet (GL-RM1) KVM unauthenticated root access via UART serial console
- CVE-2026-32290 GL-iNet Comet (GL-RM1) KVM insufficient firmware verification
- CVE-2026-3229 Integer Overflow in Certificate Chain Allocation
- CVE-2026-32289 JsBraceDepth Context Tracking Bugs (XSS) in html/template