Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 758 of 1013.
- CVE-2026-27168 SAIL: Heap-based Buffer Overflow in Sail-codecs-xwd
- CVE-2026-27167 Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret
- CVE-2026-27166 Discourse vulnerable to HTML injection via prohibited iframe URLs
- CVE-2026-27162 DIscourse doesn't prevent whispers to leak in excerpts
- CVE-2026-27161 Unauthenticated Information Disclosure via .htaccess Reliance in Sensitive Directories
- CVE-2026-2716 Cross-site scripting in Client Testimonial Slider
- CVE-2026-27156 NiceGUI has XSS via Code Injection
- CVE-2026-27154 Discourse has XSS when editing a malicious post
- CVE-2026-27153 Discourse doesn't prevent moderators from exporting user Chat DMs
- CVE-2026-27152 DIscourse has DM communication-preference bypass when adding members
- CVE-2026-27151 Discourse doesn't validate destination topic when moving posts
- CVE-2026-27150 Discourse doesn't ensure guardian check when creating QueryGroupBookmark
- CVE-2026-27149 Discourse has SQL injection in PM tag filtering
- CVE-2026-27148 Storybook Dev Server Vulnerable to WebSocket Hijacking
- CVE-2026-27147 GetSimple CMS: Stored Cross-Site Scripting (XSS) via SVG File Upload (Authenticated)
- CVE-2026-27146 GetSimple CMS: Cross-Site Request Forgery (CSRF) in File Upload Allows Arbitrary Uploads
- CVE-2026-27145 Inefficient candidate hostname parsing in crypto/x509
- CVE-2026-27144 Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile
- CVE-2026-27143 Missing bound checks can lead to memory corruption in safe Go in cmd/compile
- CVE-2026-27142 URLs in meta content attribute actions are not escaped in html/template
- CVE-2026-27141 Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net
- CVE-2026-27140 Code execution vulnerability in SWIG code generation in cmd/go
- CVE-2026-2714 Cross-site scripting in Institute Management – Learning Management System
- CVE-2026-27139 FileInfo can escape from a Root in os
- CVE-2026-27138 Panic in name constraint checking for malformed certificates in crypto/x509
- CVE-2026-27137 Incorrect enforcement of email constraints in crypto/x509
- CVE-2026-27136 Invoking duplicate attributes can cause XSS in golang.org/x/net/html
- CVE-2026-27135 nghttp2 Denial of service: Assertion failure due to the missing state validation
- CVE-2026-27134 Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication
- CVE-2026-27133 Strimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clusters
- CVE-2026-27131 Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground
- CVE-2026-27130 Dokploy has Command Injection in its Service Operations
- CVE-2026-2713 IBM Trusteer Rapport installer affected by uncontrolled search path element vulnerability
- CVE-2026-27129 Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
- CVE-2026-27128 Craft CMS's race condition in Token Service potentially allows for token usage greater than the token limit
- CVE-2026-27127 Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
- CVE-2026-27126 Craft CMS has Stored XSS in Table Field via "HTML" Column Type
- CVE-2026-27125 Svelte SSR attribute spreading includes inherited properties from prototype chain
- CVE-2026-27124 FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities
- CVE-2026-27122 Svelte SSR does not validate dynamic element tag names in `<svelte:element>`
- CVE-2026-27121 Svelte affected by cross-site scripting via spread attributes in Svelte SSR
- CVE-2026-27120 Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster
- CVE-2026-2712 Missing authorization in WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance
- CVE-2026-27119 Svelte affected by XSS in SSR `<option>` element
- CVE-2026-27118 Cache poisoning in @sveltejs/adapter-vercel
- CVE-2026-27117 bit7z has a path traversal vulnerability
- CVE-2026-27116 Vikunja has Reflected HTML Injection via filter Parameter in Projects Module
- CVE-2026-27115 ADB Explorer is Vulnerable to Arbitrary Directory Deletion via Command-Line Argument
- CVE-2026-27114 NanaZip has ROMFS Archive Infinite Loop
- CVE-2026-27113 Liquid Prompt arbitrary command injection via crafted Git branch names in gitstatusd backend
- CVE-2026-27112 Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints
- CVE-2026-27111 Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints
- CVE-2026-2711 zhutoutoutousan worldquant-miner URL ssrf_proxy.py server-side request forgery
- CVE-2026-27105 Path traversal in Dell/Alienware Purchased Apps
- CVE-2026-27102 Privilege escalation in PowerScale OneFS
- CVE-2026-27101 Path traversal in Secure Connect Gateway
- CVE-2026-27100 Jenkins has a build information disclosure vulnerability through Run Parameter
- CVE-2026-27099 Jenkins has a stored XSS vulnerability in node offline cause description
- CVE-2026-27098 WordPress Au Pair Agency - Babysitting & Nanny Theme theme <= 1.2.2 - Deserialization of untrusted data vulnerability
- CVE-2026-27097 WordPress CasaMia | Property Rental Real Estate WordPress Theme theme <= 1.1.2 - Local File Inclusion vulnerability
- CVE-2026-27096 Deserialization in ColorFolio - Freelance Designer WordPress Theme
- CVE-2026-27095 WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.6.0 - PHP Object Injection vulnerability
- CVE-2026-27094 WordPress CoBlocks plugin <= 3.1.16 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27093 WordPress Tripgo theme < 1.5.6 - Local File Inclusion vulnerability
- CVE-2026-27092 WordPress WPAdverts plugin <= 2.3.0 - Broken Access Control vulnerability
- CVE-2026-27091 WordPress UiPress lite plugin <= 3.5.09 - Broken Access Control vulnerability
- CVE-2026-27090 WordPress Kenta Companion plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-2709 busy Callback app.js redirect
- CVE-2026-27089 WordPress WpTravelly plugin <= 2.1.7 - Bypass Vulnerability vulnerability
- CVE-2026-27088 WordPress Darna Framework plugin <= 2.9 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-27087 WordPress Wolverine Framework plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-27086 WordPress WoodMart theme < 8.3.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27085 WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability
- CVE-2026-27084 WordPress Buisson theme <= 1.1.11 - PHP Object Injection vulnerability
- CVE-2026-27083 WordPress Work & Travel Company theme <= 1.2 - PHP Object Injection vulnerability
- CVE-2026-27082 WordPress Love Story theme <= 1.3.12 - PHP Object Injection vulnerability
- CVE-2026-27081 WordPress Rosebud theme <= 1.4 - Local File Inclusion vulnerability
- CVE-2026-27080 WordPress Deston theme <= 1.0 - Local File Inclusion vulnerability
- CVE-2026-2708 Libsoup: libsoup: http request smuggling via duplicate content-length headers
- CVE-2026-27079 WordPress Amfissa theme <= 1.1 - Local File Inclusion vulnerability
- CVE-2026-27078 WordPress Emaurri theme <= 1.0.1 - Local File Inclusion vulnerability
- CVE-2026-27077 WordPress MultiOffice theme <= 1.2 - Local File Inclusion vulnerability
- CVE-2026-27076 WordPress LuxeDrive theme <= 1.0 - Local File Inclusion vulnerability
- CVE-2026-27075 WordPress Belfort theme <= 1.0 - Local File Inclusion vulnerability
- CVE-2026-27074 WordPress Shortcoder plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27073 WordPress Addi – Cuotas que se adaptan a ti plugin <= 2.0.4 - Broken Authentication vulnerability
- CVE-2026-27072 WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.2.0.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27071 WordPress WPCafe plugin <= 3.0.7 - Broken Access Control vulnerability
- CVE-2026-27070 WordPress Everest Forms Pro plugin <= 1.9.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-2707 weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API
- CVE-2026-27069 WordPress Soledad theme <= 8.7.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27068 WordPress Website LLMs.txt plugin <= 8.2.6 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-27067 WordPress Mobile App Editor plugin <= 1.3.1 - Arbitrary File Upload vulnerability
- CVE-2026-27065 WordPress BuilderPress plugin <= 2.0.1 - Local File Inclusion vulnerability
- CVE-2026-27064 WordPress Mailster plugin <= 4.1.17 - Arbitrary File Upload vulnerability
- CVE-2026-27063 WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability
- CVE-2026-27062 WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-27060 WordPress ARMember Premium plugin < 7.6 - PHP Object Injection vulnerability
- CVE-2026-2706 code-projects Patient Record Management System fecalysis_not.php sql injection
- CVE-2026-27059 WordPress Penci Recipe plugin <= 4.1 - Cross Site Scripting (XSS) vulnerability