Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 756 of 1013.
- CVE-2026-27374 WordPress WooCommerce Order Details plugin <= 3.1 - Broken Access Control vulnerability
- CVE-2026-27373 WordPress Tablesome plugin <= 1.2.3 - SQL Injection vulnerability
- CVE-2026-27372 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability
- CVE-2026-27371 WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-27370 WordPress Chaty plugin <= 3.5.1 - Sensitive Data Exposure vulnerability
- CVE-2026-2737 Possibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon web application
- CVE-2026-27369 WordPress Celeste theme <= 1.3.6 - PHP Object Injection vulnerability
- CVE-2026-27368 Missing authorization in Coming Soon Page, Under Construction & Maintenance Mode by SeedProd
- CVE-2026-27367 WordPress Musico theme < 3.4.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27366 WordPress MainWP Child plugin <= 6.1.1 - Broken Access Control vulnerability
- CVE-2026-27365 WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27364 WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability
- CVE-2026-27363 WordPress WP Bakery Autoresponder Addon plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27362 WordPress WP Bakery Autoresponder Addon plugin <= 1.0.6 - Broken Access Control vulnerability
- CVE-2026-27361 WordPress Responsive Posts Carousel Pro plugin <= 15.1 - Broken Access Control vulnerability
- CVE-2026-27360 WordPress Photo Gallery by 10Web plugin <= 1.8.38 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-2736 Reflected Cross-Site Scripting (XSS) vulnerability in Alkacon's OpenCms
- CVE-2026-27359 WordPress Awa Plugins plugin <= 1.4.4 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-27358 WordPress Architecturer theme < 3.9.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27357 WordPress WP Search Analytics plugin < 1.5.0 - Broken Access Control vulnerability
- CVE-2026-27355 WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability
- CVE-2026-27354 WordPress WooCommerce Coming Soon Product with Countdown plugin <= 5.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27353 WordPress Grand News | Magazine Newspaper WordPress theme <= 3.4.3 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-27352 WordPress Starto theme < 2.2.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27351 WordPress Crew HRM plugin <= 1.2.2 - Broken Access Control vulnerability
- CVE-2026-27350 WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-2735 Stored Cross-Site Scripting (XSS) vulnerability in Alkacon's OpenCms
- CVE-2026-27349 WordPress Mail Mint plugin <= 1.19.5 - Sensitive Data Exposure vulnerability
- CVE-2026-27348 WordPress Photography theme < 7.7.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27347 WordPress JetPopup plugin <= 2.0.20.2 - Broken Access Control vulnerability
- CVE-2026-27346 WordPress B2BKing plugin < 5.2.10 - Broken Access Control vulnerability
- CVE-2026-27345 WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability
- CVE-2026-27344 WordPress inseri core plugin <= 1.0.5 - Broken Access Control vulnerability
- CVE-2026-27343 WordPress Airtifact theme <= 1.2.91 - Local File Inclusion vulnerability
- CVE-2026-27342 WordPress TopFit - Fitness and Gym WordPress Theme theme <= 1.9 - Local File Inclusion vulnerability
- CVE-2026-27341 WordPress TopScorer - Sports WordPress Theme theme <= 1.2 - Local File Inclusion vulnerability
- CVE-2026-27340 WordPress Apollo | Night Club, DJ Event WordPress Theme theme <= 1.3.1 - Local File Inclusion vulnerability
- CVE-2026-2734 Authorization Bypass in SearchModelVersions in mlflow/mlflow
- CVE-2026-27339 WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - Local File Inclusion vulnerability
- CVE-2026-27338 WordPress Car Zone theme <= 3.7 - Deserialization of untrusted data vulnerability
- CVE-2026-27337 WordPress Chronicle - Lifestyle Magazine & Blog WordPress Theme theme <= 1.0 - Local File Inclusion vulnerability
- CVE-2026-27336 Path traversal in Consultor | Consulting, Accounting & Legal Counsel WordPress Theme
- CVE-2026-27335 WordPress Ekoterra - NonProfit, Green Energy & Ecology Theme theme <= 1.0.0 - Local File Inclusion vulnerability
- CVE-2026-27334 WordPress Alchemists theme <= 4.6.0 - Local File Inclusion vulnerability
- CVE-2026-27333 WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Deserialization of untrusted data vulnerability
- CVE-2026-27332 WordPress Agrofood theme < 1.4.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27331 WordPress WpTravelly plugin <= 2.1.5 - Broken Access Control vulnerability
- CVE-2026-27330 WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability
- CVE-2026-2733 Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol
- CVE-2026-27329 WordPress YITH WooCommerce Wishlist plugin <= 4.12.0 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-27328 WordPress EduBlink theme <= 2.0.7 - Broken Access Control vulnerability
- CVE-2026-27327 WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerability
- CVE-2026-27326 Path traversal in AC Services | HVAC, Air Conditioning & Heating Company WordPress Theme
- CVE-2026-2732 Missing authorization in Enable Media Replace
- CVE-2026-27316 Information disclosure in FortiSandbox
- CVE-2026-27315 Apache Cassandra: cqlsh history sensitive information leak
- CVE-2026-27314 Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass
- CVE-2026-27313 Bridge | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-27312 Bridge | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-27311 Bridge | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-27310 Bridge | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-2731 Unauthenticated RCE in Dynamicweb 9 and Dynamicweb 8
- CVE-2026-27309 Substance3D - Stager | Use After Free (CWE-416)
- CVE-2026-27308 ColdFusion | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-27307 ColdFusion | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-27306 ColdFusion | Improper Input Validation (CWE-20)
- CVE-2026-27305 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- CVE-2026-27304 ColdFusion | Improper Input Validation (CWE-20)
- CVE-2026-27303 Adobe Connect | Deserialization of Untrusted Data (CWE-502)
- CVE-2026-27302 Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
- CVE-2026-27301 Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-27300 Adobe Framemaker | Access of Uninitialized Pointer (CWE-824)
- CVE-2026-27299 Adobe Framemaker | Improper Input Validation (CWE-20)
- CVE-2026-27298 Adobe Framemaker | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
- CVE-2026-27297 Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (CWE-191)
- CVE-2026-27296 Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (CWE-191)
- CVE-2026-27295 Adobe Framemaker | Out-of-bounds Write (CWE-787)
- CVE-2026-27294 Adobe Framemaker | Out-of-bounds Read (CWE-125)
- CVE-2026-27293 Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-27292 Adobe Framemaker | Use After Free (CWE-416)
- CVE-2026-27291 InDesign Desktop | Out-of-bounds Write (CWE-787)
- CVE-2026-27290 Adobe Framemaker | Untrusted Search Path (CWE-426)
- CVE-2026-2729 Business logic in Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- CVE-2026-27289 Photoshop Desktop | Out-of-bounds Read (CWE-125)
- CVE-2026-27288 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-27287 InCopy | Out-of-bounds Read (CWE-125)
- CVE-2026-27286 InDesign Desktop | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-27285 InDesign Desktop | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-27284 InDesign Desktop | Out-of-bounds Read (CWE-125)
- CVE-2026-27283 InDesign Desktop | Use After Free (CWE-416)
- CVE-2026-27282 ColdFusion | Improper Input Validation (CWE-20)
- CVE-2026-27281 DNG SDK | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-27280 DNG SDK | Out-of-bounds Write (CWE-787)
- CVE-2026-2728 LibreNMS: Cross-Site Scripting in ShowConfigController
- CVE-2026-27279 Substance3D - Stager | Out-of-bounds Write (CWE-787)
- CVE-2026-27278 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-27277 Substance3D - Stager | Use After Free (CWE-416)
- CVE-2026-27276 Substance3D - Stager | Use After Free (CWE-416)
- CVE-2026-27275 Substance3D - Stager | Out-of-bounds Write (CWE-787)
- CVE-2026-27274 Substance3D - Stager | Out-of-bounds Write (CWE-787)