Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 747 of 1013.
- CVE-2026-28296 Gvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file paths
- CVE-2026-28295 Gvfs: gvfs ftp backend: information disclosure via untrusted pasv responses
- CVE-2026-28292 simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE
- CVE-2026-28291 simple-git has Command Execution via Option-Parsing Bypass
- CVE-2026-28289 FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution
- CVE-2026-28288 Dify has a user enumeration issue
- CVE-2026-28287 FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints
- CVE-2026-28286 ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API
- CVE-2026-28284 FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module
- CVE-2026-28282 Discourse vulnerable to group membership addition permission bypass via discourse-policy plugin
- CVE-2026-28281 InstantCMS has Multiple CSRF Vulnerabilities
- CVE-2026-28280 `osctrl-admin` has Stored Cross-Site Scripting (XSS) in On-Demand Query List
- CVE-2026-28279 `osctrl-admin` Vulnerable to OS Command Injection via Environment Configuration
- CVE-2026-28277 LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading
- CVE-2026-28276 Initiative Allows Unauthenticated Access to Uploaded Documents via Public /uploads/ Endpoint
- CVE-2026-28275 Initiative Vulnerable to Improper Session Invalidation (JWT Remains Valid)
- CVE-2026-28274 Initiative Vulnerable to Token Theft via Stored XSS in Document Uploads
- CVE-2026-28272 Kiteworks Email Protection Gateway has a Cross-site Scripting vulnerability
- CVE-2026-28271 Kiteworks Core is vulnerable to Server-Side Request Forgery (SSRF)
- CVE-2026-28270 Kiteworks Core has an Unrestricted Upload of File with Dangerous Type
- CVE-2026-2827 Open User Map PRO <= 1.4.31 - Unauthenticated Stored Cross-Site Scripting via 'oum_location_notification'
- CVE-2026-28269 Kiteworks Core has an OS Command Injection
- CVE-2026-28268 Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse
- CVE-2026-28267 Misconfiguration in DigitalArts@Cloud Agent (for Windows)
- CVE-2026-28265 Path traversal in PowerStore
- CVE-2026-28264 Misconfiguration in PowerProtect Agent
- CVE-2026-28263 Cross-site scripting in PowerProtect Data Domain
- CVE-2026-28262 Other in iDRAC Tools
- CVE-2026-28261 Information disclosure in Elastic Cloud Storage
- CVE-2026-2826 Missing authorization in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- CVE-2026-28256 Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge
- CVE-2026-28255 Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge
- CVE-2026-28254 Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge
- CVE-2026-28253 Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge
- CVE-2026-28252 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge
- CVE-2026-2825 rachelos WeRSS we-mp-rss Article fix.py fix_html cross site scripting
- CVE-2026-2824 Comfast CF-E7 webmggnt mbox-config sub_441CF4 command injection
- CVE-2026-28237 Denial of service in AMD µProf
- CVE-2026-28231 pillow_heif Has Integer Overflow in Encode Path Buffer Validation that Leads to Heap Out-of-Bounds Read
- CVE-2026-28230 Missing authorization in steve
- CVE-2026-2823 Comfast CF-E7 webmggnt mbox-config sub_41ACCC command injection
- CVE-2026-28229 Argo Workflows has unauthorized access to Argo Workflows Template
- CVE-2026-28228 OpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code Execution
- CVE-2026-28227 Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category
- CVE-2026-28226 Phishing Club has Authenticated Blind SQL Injection in GetOrphaned Recipient Listing
- CVE-2026-28225 Manyfold has IDOR in ModelFilesController
- CVE-2026-28224 Firebird Null Pointer Dereference via CryptCallback causes DOS
- CVE-2026-28223 Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface
- CVE-2026-28222 Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes
- CVE-2026-28221 Wazuh: Pre-auth stack-based buffer overflow in wazuh-remoted print_hex_string() due to signed char promotion on x86_64
- CVE-2026-28220 Deserialization in wazuh
- CVE-2026-2822 JeecgBoot Backend airag_app,1,create_by sql injection
- CVE-2026-28219 Privilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Banners
- CVE-2026-28218 Discourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution
- CVE-2026-28217 IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections
- CVE-2026-28216 hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment
- CVE-2026-28215 hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover
- CVE-2026-28214 Firebird server hangs when using specific clumplet on batch creation
- CVE-2026-28213 EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response
- CVE-2026-28212 Firebird has potential server crash via null pointer dereference when processing op_slice packet
- CVE-2026-28211 Arbitrary code execution in log reader via untrusted log file
- CVE-2026-28210 FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports
- CVE-2026-2821 Fujian Smart Integrated Management Platform System XCamera.ashx sql injection
- CVE-2026-28209 FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration
- CVE-2026-28208 Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unix
- CVE-2026-28207 Zen-C Vulnerable to Command Injection via Malicious Output Filename
- CVE-2026-28205 Initialization of a resource with an insecure default in OpenPLC_V3
- CVE-2026-28204 CTEK Chargeportal Insufficiently Protected Credentials
- CVE-2026-28201 SurrealDB Injection on Open Notebook
- CVE-2026-2820 Fujian Smart Integrated Management Platform System XAccessPermissionPlus.ashx sql injection
- CVE-2026-28199 Sensitive File Disclosure via Relative Path Traversal in NetBackup Flex OS Shell
- CVE-2026-28198 Privilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell
- CVE-2026-28197 Privilege Escalation via Argument Injection in NetBackup Flex OS Shell
- CVE-2026-28196 Information disclosure in TeamCity
- CVE-2026-28195 Missing authorization in TeamCity
- CVE-2026-28194 Open redirect in TeamCity
- CVE-2026-28193 Missing authorization in YouTrack
- CVE-2026-28192 WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability
- CVE-2026-28191 WordPress The Grid plugin <= 2.8.0 - Privilege Escalation vulnerability
- CVE-2026-28190 WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability
- CVE-2026-2819 Dromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorization
- CVE-2026-28189 WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability
- CVE-2026-28188 WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability
- CVE-2026-28187 Cross-site scripting in Knowledge Base for Documentation, FAQs with AI Assistance
- CVE-2026-28186 WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability
- CVE-2026-28185 WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability
- CVE-2026-28183 WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability
- CVE-2026-28182 WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-28181 WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability
- CVE-2026-28180 Missing authorization in Mercado Pago payments for WooCommerce
- CVE-2026-2818 Zip Slip Path Traversal in Snapshot Archive Extraction (Windows-Specific)
- CVE-2026-28179 WordPress FiboSearch plugin <= 1.33.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-28178 WordPress Powerkit plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-28177 WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-28176 WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability
- CVE-2026-28175 WordPress Visitors Traffic Real Time Statistics plugin <= 8.11 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-28174 WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerability
- CVE-2026-28173 WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability
- CVE-2026-28172 WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability
- CVE-2026-28171 WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability