Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 748 of 1013.
- CVE-2026-28170 WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-2817 Spring Data Geode Insecure Temporary Directory Usage
- CVE-2026-28169 WordPress YITH WooCommerce Zoom Magnifier plugin <= 2.52.0 - Sensitive Data Exposure vulnerability
- CVE-2026-28168 WordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerability
- CVE-2026-28167 WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability
- CVE-2026-28166 WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-28165 WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability
- CVE-2026-28164 WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-28163 WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability
- CVE-2026-28162 WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-28161 WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability
- CVE-2026-28159 WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability
- CVE-2026-28158 WordPress Do Lasso plugin <= 358 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-28157 WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability
- CVE-2026-28156 WordPress Do Lasso plugin <= 358 - SQL Injection vulnerability
- CVE-2026-28155 WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-28154 WordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerability
- CVE-2026-28153 Missing authorization in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More
- CVE-2026-28152 WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability
- CVE-2026-28151 WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability
- CVE-2026-28150 WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerability
- CVE-2026-2815 Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys
- CVE-2026-28149 WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability
- CVE-2026-28148 WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability
- CVE-2026-28147 Missing authorization in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- CVE-2026-28146 Path traversal in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- CVE-2026-28145 WordPress MasterStudy LMS plugin <= 3.7.39 - Broken Access Control vulnerability
- CVE-2026-28144 WordPress WP Maps plugin <= 4.9.6 - Sensitive Data Exposure vulnerability
- CVE-2026-28143 WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-28142 WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability
- CVE-2026-28141 WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-28140 WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability
- CVE-2026-28139 WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability
- CVE-2026-28138 WordPress uListing plugin <= 2.2.0 - PHP Object Injection vulnerability
- CVE-2026-28137 Cross-site scripting in MediCenter - Health Medical Clinic
- CVE-2026-28136 WordPress WP SMS plugin <= 6.9.12 - SQL Injection vulnerability
- CVE-2026-28135 WordPress Royal Elementor Addons plugin <= 1.7.1052 - Other vulnerability Type vulnerability
- CVE-2026-28134 WordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerability
- CVE-2026-28133 WordPress Filr plugin <= 1.2.14 - Arbitrary File Upload vulnerability
- CVE-2026-28132 WordPress WooCommerce Photo Reviews plugin <= 1.4.4 - Content Injection vulnerability
- CVE-2026-28131 WordPress Elementor Addon Elements plugin <= 1.14.4 - Sensitive Data Exposure vulnerability
- CVE-2026-28130 WordPress UDesign theme <= 4.14.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-2813 Unvalidated Redirect in ArcGIS Server
- CVE-2026-28129 WordPress Little Birdies theme <= 1.3.16 - Local File Inclusion vulnerability
- CVE-2026-28128 WordPress Verse theme <= 1.7.0 - Local File Inclusion vulnerability
- CVE-2026-28127 WordPress Lawyer Directory plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-28126 WordPress RH Frontend Publishing Pro plugin < 4.3.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-28125 WordPress Midi theme <= 1.14 - Local File Inclusion vulnerability
- CVE-2026-28124 WordPress Notarius theme <= 1.9 - Local File Inclusion vulnerability
- CVE-2026-28123 WordPress Veil theme <= 1.9 - Local File Inclusion vulnerability
- CVE-2026-28122 WordPress ListingPro plugin <= 2.9.8 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-28121 WordPress Anderson theme <= 1.4.2 - Local File Inclusion vulnerability
- CVE-2026-28120 WordPress Dr.Patterson theme <= 1.3.2 - Local File Inclusion vulnerability
- CVE-2026-2812 Improper Authentication issue in ArcGIS Server
- CVE-2026-28119 WordPress Nirvana theme <= 2.6 - Local File Inclusion vulnerability
- CVE-2026-28118 WordPress Welldone theme <= 2.4 - Local File Inclusion vulnerability
- CVE-2026-28117 WordPress smart SEO theme <= 2.9 - Local File Inclusion vulnerability
- CVE-2026-28116 WordPress Progress Planner plugin <= 1.9.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-28115 WordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - SQL Injection vulnerability
- CVE-2026-28114 WordPress WooCommerce License Manager plugin <= 7.0.6 - Arbitrary File Upload vulnerability
- CVE-2026-28113 WordPress Ultimate Learning Pro plugin <= 3.9.1 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-28112 WordPress AllInOne - Banner Rotator plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-28111 WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability
- CVE-2026-28110 Cross-site scripting in LambertGroup - AllInOne - Banner with Playlist
- CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection
- CVE-2026-28109 WordPress LambertGroup - AllInOne - Content Slider plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-28108 Cross-site scripting in LambertGroup - AllInOne - Banner with Thumbnails
- CVE-2026-28107 WordPress Muzicon theme <= 1.9.0 - Local File Inclusion vulnerability
- CVE-2026-28106 WordPress B2BKing Premium plugin < 5.4.20 - Open Redirection vulnerability
- CVE-2026-28105 WordPress Good Energy theme <= 1.7.7 - PHP Object Injection vulnerability
- CVE-2026-28104 WordPress Site Suggest plugin <= 1.3.9 - Broken Access Control vulnerability
- CVE-2026-28103 WordPress LBG Zoominoutslider plugin <= 5.4.5 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-28102 WordPress UberSlider Classic plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-28101 WordPress UberSlider MouseInteraction plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-28100 WordPress UberSlider PerpetuumMobile plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-2810 Endpoint DLP Driver Out-of-Bounds Read
- CVE-2026-28099 WordPress UberSlider Ultra plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-28098 WordPress Save Life theme <= 1.2.13 - Local File Inclusion vulnerability
- CVE-2026-28097 WordPress Artrium theme <= 1.0.14 - Local File Inclusion vulnerability
- CVE-2026-28096 WordPress WealthCo theme <= 2.18 - Local File Inclusion vulnerability
- CVE-2026-28095 WordPress Marcell theme <= 1.2.14 - Local File Inclusion vulnerability
- CVE-2026-28094 WordPress RexCoin theme <= 1.2.6 - Local File Inclusion vulnerability
- CVE-2026-28093 WordPress Ozisti theme <= 1.1.10 - Local File Inclusion vulnerability
- CVE-2026-28092 WordPress Sounder theme <= 1.3.11 - Local File Inclusion vulnerability
- CVE-2026-28091 WordPress Coleo theme <= 1.1.7 - Local File Inclusion vulnerability
- CVE-2026-28090 WordPress Gamezone theme <= 1.1.11 - Local File Inclusion vulnerability
- CVE-2026-2809 Endpoint DLP Driver DLL
- CVE-2026-28089 WordPress Daiquiri theme <= 1.2.4 - Local File Inclusion vulnerability
- CVE-2026-28088 WordPress Aqualots theme <= 1.1.6 - Local File Inclusion vulnerability
- CVE-2026-28087 WordPress Filmax theme <= 1.1.11 - Local File Inclusion vulnerability
- CVE-2026-28086 WordPress Run Gran theme <= 2.0 - Local File Inclusion vulnerability
- CVE-2026-28085 WordPress Mahogany theme <= 2.9 - Local File Inclusion vulnerability
- CVE-2026-28084 WordPress Bazinga theme <= 1.1.9 - Local File Inclusion vulnerability
- CVE-2026-28083 WordPress Flatsome theme <= 3.20.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-28082 WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-28081 WordPress Windsor theme <= 2.5.0 - Local File Inclusion vulnerability
- CVE-2026-28080 WordPress Rank Math SEO PRO plugin <= 3.0.95 - Broken Access Control vulnerability
- CVE-2026-2808 Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider
- CVE-2026-28079 WordPress Conquerors theme <= 1.2.13 - Local File Inclusion vulnerability
- CVE-2026-28078 WordPress uListing plugin <= 2.2.0 - Arbitrary File Download vulnerability