Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 755 of 1013.
- CVE-2026-27470 ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields
- CVE-2026-2747 PGP Mixed Plaintext and Encrypted Content
- CVE-2026-27469 Isso: Stored XSS via comment website field
- CVE-2026-27468 Mastodon may allow unconfirmed FASP to make subscriptions
- CVE-2026-27467 BigBlueButton: Audio from participants to the server initially unmuted
- CVE-2026-27466 BigBlueButton: Exposed ClamAV port enables Denial of Service
- CVE-2026-27465 Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users
- CVE-2026-27464 Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE
- CVE-2026-27463 Combodo iTop: Version disclosure via login page logo
- CVE-2026-27462 Combodo iTop: User enumeration via password reset
- CVE-2026-27461 Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause
- CVE-2026-27460 Tandoor Recipes Affected by Denial of Service via Recipe Import
- CVE-2026-2746 Missing PGP Signature Tag
- CVE-2026-27459 pyOpenSSL DTLS cookie callback buffer overflow
- CVE-2026-27458 LinkAce: Stored XSS in Atom Feed via CDATA Escape in List Description
- CVE-2026-27457 Weblate: Missing access control for the AddonViewSet API exposes all addon configurations
- CVE-2026-27456 util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup
- CVE-2026-27454 Discourse has check revision visibility on posts endpoint
- CVE-2026-27452 ASN.1 TypeScript Library: Decoding an INTEGER could leak the underlying ArrayBuffer
- CVE-2026-2745 Authentication Bypass Using an Alternate Path or Channel in GitLab
- CVE-2026-27449 Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints
- CVE-2026-27448 pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback
- CVE-2026-27447 OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup
- CVE-2026-27446 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation
- CVE-2026-27445 PGP Signature Reflection
- CVE-2026-27444 Header Email Address Parsing
- CVE-2026-27443 S/MIME Decryption Tag Sanitization Bypass
- CVE-2026-27442 zip_attachments Path Traversal
- CVE-2026-27441 PDF Password CMDi
- CVE-2026-27440 WordPress myCred plugin <= 2.9.7.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27439 WordPress Dentario theme <= 1.5 - PHP Object Injection vulnerability
- CVE-2026-27438 WordPress Kingler theme <= 1.7 - PHP Object Injection vulnerability
- CVE-2026-27437 WordPress Tennis Club theme <= 1.2.3 - PHP Object Injection vulnerability
- CVE-2026-27436 WordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerability
- CVE-2026-27435 WordPress Woffice theme < 5.4.33 - Broken Access Control vulnerability
- CVE-2026-27434 WordPress WP Rentals theme <= 3.14.2 - Broken Access Control vulnerability
- CVE-2026-27433 WordPress Motors theme < 5.6.85 - Broken Access Control vulnerability
- CVE-2026-27432 WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-27430 WordPress TheFox theme <= 3.9.76 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-2743 SEPPmail User Web Interface Arbitrary File Write to RCE
- CVE-2026-27429 WordPress Nifty theme <= 1.4.1 - PHP Object Injection vulnerability
- CVE-2026-27428 WordPress Eagle Booking plugin <= 1.3.4.3 - SQL Injection vulnerability
- CVE-2026-27427 WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27426 WordPress Automotive Car Dealership Business theme <= 13.3.3 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-27425 WordPress Automotive Listings plugin <= 18.6 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-27424 WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Broken Access Control vulnerability
- CVE-2026-27423 WordPress Participants Database plugin <= 2.7.8.4 - Broken Access Control vulnerability
- CVE-2026-27422 WordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerability
- CVE-2026-27421 WordPress Royal Elementor Addons plugin < 1.7.1053 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27420 WordPress Zotpress plugin <= 7.4.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-2742 Unauthorized session creation via reserved framework path access
- CVE-2026-27419 WordPress Zegen theme <= 1.1.9 - Arbitrary File Upload vulnerability
- CVE-2026-27418 WordPress WP Fast Total Search plugin <= 1.81.282 - Broken Access Control vulnerability
- CVE-2026-27417 WordPress Sweet Date theme < 4.0.1 - PHP Object Injection vulnerability
- CVE-2026-27416 WordPress PDF Poster plugin <= 2.4.1 - Broken Access Control vulnerability
- CVE-2026-27415 WordPress BEAR plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-27414 WordPress Werkstatt theme <= 4.8.3 - PHP Object Injection vulnerability
- CVE-2026-27413 WordPress Profile Builder Pro plugin < 3.14.0 - SQL Injection vulnerability
- CVE-2026-27412 WordPress Pearl - Corporate Business theme <= 3.4.10 - Local File Inclusion vulnerability
- CVE-2026-27411 WordPress SiteGuard WP plugin plugin <= 1.7.9 - Captcha Bypass vulnerability
- CVE-2026-27410 WordPress Slimstat Analytics plugin < 5.4.0 - Deserialization of untrusted data vulnerability
- CVE-2026-2741 Zip Slip Path Traversal on Node Unpack
- CVE-2026-27409 WordPress Webba Booking plugin <= 6.4.13 - Broken Access Control vulnerability
- CVE-2026-27408 WordPress NativeChurch theme < 4.9.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27407 WordPress AI Engine plugin <= 3.4.9 - Privilege Escalation vulnerability
- CVE-2026-27406 WordPress My Tickets plugin <= 2.1.0 - Sensitive Data Exposure vulnerability
- CVE-2026-27405 WordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerability
- CVE-2026-27404 WordPress LMS theme <= 9.7 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-27403 WordPress Hubbub Lite plugin <= 1.36.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27402 WordPress Kids Life | Children School WordPress theme <= 5.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27401 WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability
- CVE-2026-27400 WordPress BookPro plugin <= 1.1.0 - Arbitrary File Deletion vulnerability
- CVE-2026-2740 Remote Code Execution
- CVE-2026-27399 WordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerability
- CVE-2026-27398 WordPress RSVP and Event Management plugin <= 2.7.16 - Broken Access Control vulnerability
- CVE-2026-27397 WordPress Really Simple Security Pro plugin <= 9.5.4.0 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-27396 WordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerability
- CVE-2026-27395 WordPress Support Board plugin < 3.8.9 - Privilege Escalation vulnerability
- CVE-2026-27394 WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-27393 WordPress CF7 WOW Styler plugin <= 1.7.6 - Broken Access Control vulnerability
- CVE-2026-27392 WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability
- CVE-2026-27391 WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability
- CVE-2026-27390 WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability
- CVE-2026-2739 bn.js affected by an infinite loop
- CVE-2026-27389 WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability
- CVE-2026-27388 WordPress DesignThemes Booking Manager plugin <= 2.0 - Broken Access Control vulnerability
- CVE-2026-27387 WordPress DirectoryPress plugin <= 3.6.26 - Broken Access Control vulnerability
- CVE-2026-27386 WordPress DesignThemes Directory Addon plugin <= 1.8 - Broken Access Control vulnerability
- CVE-2026-27385 WordPress DesignThemes Portfolio plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-27384 WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability
- CVE-2026-27383 WordPress Metro theme <= 2.13 - Local File Inclusion vulnerability
- CVE-2026-27382 WordPress Metro theme <= 2.13 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-27381 WordPress Aora theme <= 1.3.15 - Local File Inclusion vulnerability
- CVE-2026-27380 WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability
- CVE-2026-2738 Memory corruption in ovpn-dco-win
- CVE-2026-27379 WordPress NextScripts plugin <= 4.4.7 - PHP Object Injection vulnerability
- CVE-2026-27378 WordPress Deposits and Partial Payments for WooCommerce plugin <= 3.1.0 - Broken Access Control vulnerability
- CVE-2026-27377 WordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control vulnerability
- CVE-2026-27376 Cross-site scripting in Claue - Clean, Minimal Elementor WooCommerce Theme
- CVE-2026-27375 WordPress Gecko theme <= 1.9.8 - Reflected Cross Site Scripting (XSS) vulnerability