Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 771 of 1013.
- CVE-2026-25369 WordPress Flexmls® IDX plugin <= 3.15.9 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25368 WordPress Calculated Fields Form plugin <= 5.4.4.1 - Broken Access Control vulnerability
- CVE-2026-25367 WordPress CitiLights theme < 3.7.2 - Broken Access Control vulnerability
- CVE-2026-25366 WordPress Woody ad snippets plugin <= 2.7.1 - Remote Code Execution (RCE) vulnerability
- CVE-2026-25365 WordPress Kargo Takip plugin < 0.2.4 - Broken Access Control vulnerability
- CVE-2026-25364 WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.8 - Broken Access Control vulnerability
- CVE-2026-25363 WordPress FooGallery plugin <= 3.1.11 - Broken Access Control vulnerability
- CVE-2026-25362 WordPress FooGallery plugin <= 3.1.11 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25361 WordPress WpEvently plugin <= 5.1.4 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25360 WordPress Vex theme < 1.2.9 - PHP Object Injection vulnerability
- CVE-2026-2536 opencc JFlow Workflow WF_Admin_AttrFlow.java Imp_Done xml external entity reference
- CVE-2026-25359 WordPress Pendulum theme < 3.1.5 - PHP Object Injection vulnerability
- CVE-2026-25358 WordPress Meloo theme < 2.8.2 - PHP Object Injection vulnerability
- CVE-2026-25357 WordPress Ultimate Membership Pro plugin <= 13.7 - Account Takeover vulnerability
- CVE-2026-25356 WordPress Yobazar theme < 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25355 WordPress Sanzo theme < 2.4.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25354 WordPress Reebox theme < 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25353 WordPress Nooni theme < 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25352 WordPress MyDecor theme < 1.5.9 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25351 WordPress MyMedi theme < 1.7.7 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25350 WordPress Miti theme < 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-2535 Comfast CF-N1 V2 mbox-config sub_44AB9C command injection
- CVE-2026-25349 WordPress Loobek theme < 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25348 WordPress Download Alt Text AI plugin <= 1.10.15 - Broken Access Control vulnerability
- CVE-2026-25347 WordPress WP REST Cache plugin <= 2026.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25346 WordPress FAQ Builder AYS plugin <= 1.8.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25345 WordPress SimpLy Gallery plugin <= 3.3.2 - Arbitrary Code Execution vulnerability
- CVE-2026-25344 WordPress Review Schema plugin <= 2.2.6 - Sensitive Data Exposure vulnerability
- CVE-2026-25343 WordPress WP SMS plugin <= 7.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25342 WordPress Boutique theme < 2.4.6 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25341 WordPress RSFirewall! plugin <= 1.1.45 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25340 WordPress Jobmonster theme < 4.8.4 - SQL Injection vulnerability
- CVE-2026-2534 Comfast CF-N1 V2 mbox-config sub_44AC4C command injection
- CVE-2026-25339 WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability
- CVE-2026-25338 WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.7.4 - Broken Access Control vulnerability
- CVE-2026-25337 WordPress Coachify theme <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-25336 WordPress Coachify theme <= 1.1.5 - Broken Access Control vulnerability
- CVE-2026-25335 WordPress Secure Copy Content Protection and Content Locking plugin <= 5.0.0 - Broken Access Control vulnerability
- CVE-2026-25334 WordPress Salon Booking System Pro plugin < 10.30.12 - Account Takeover vulnerability
- CVE-2026-25333 WordPress Shopwell theme <= 1.0.11 - Broken Access Control vulnerability
- CVE-2026-25332 WordPress Endless Posts Navigation plugin <= 2.2.9 - Broken Access Control vulnerability
- CVE-2026-25331 WordPress WP Activity Log plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25330 WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability
- CVE-2026-2533 Tosei Self-service Washing Machine tosei_datasend.php command injection
- CVE-2026-25329 WordPress Quiz And Survey Master plugin <= 10.3.4 - Broken Access Control vulnerability
- CVE-2026-25328 WordPress Product File Upload for WooCommerce plugin <= 2.2.4 - Arbitrary File Deletion vulnerability
- CVE-2026-25327 WordPress Five Star Restaurant Reservations plugin <= 2.7.9 - Broken Access Control vulnerability
- CVE-2026-25326 WordPress CMSMasters Content Composer plugin <= 1.4.5 - Local File Inclusion vulnerability
- CVE-2026-25325 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.8 - Sensitive Data Exposure vulnerability
- CVE-2026-25324 WordPress Quiz And Survey Master plugin <= 10.3.4 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-25323 WordPress OSM plugin <= 6.1.12 - Broken Access Control vulnerability
- CVE-2026-25322 WordPress PublishPress Revisions plugin <= 3.7.22 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-25321 WordPress SupportCandy plugin <= 3.4.4 - Broken Access Control vulnerability
- CVE-2026-25320 WordPress Elementor Contact Form DB plugin <= 2.1.3 - Broken Access Control vulnerability
- CVE-2026-2532 lintsinghua DeepAudit IP Address embedding_config.py server-side request forgery
- CVE-2026-25319 WordPress Zita Elementor Site Library plugin <= 1.6.6 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-25318 WordPress WiserReview Product Reviews for WooCommerce plugin <= 2.9 - Broken Access Control vulnerability
- CVE-2026-25317 WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.9.0 - Broken Access Control vulnerability
- CVE-2026-25316 WordPress CartFlows plugin <= 2.1.19 - PHP Object Injection vulnerability
- CVE-2026-25315 WordPress hCaptcha for WP plugin <= 4.21.1 - Broken Access Control vulnerability
- CVE-2026-25314 WordPress TOP Table Of Contents plugin <= 1.3.31 - Broken Access Control vulnerability
- CVE-2026-25313 WordPress FluentForm plugin <= 6.1.14 - Broken Access Control vulnerability
- CVE-2026-25312 WordPress EventPrime plugin <= 4.2.8.3 - Payment Bypass vulnerability
- CVE-2026-25311 WordPress Autoshare for Twitter plugin <= 2.3.1 - Broken Access Control vulnerability
- CVE-2026-25310 WordPress Extend Link plugin <= 2.0.0 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-2531 MindsDB File Upload security.py clear_filename server-side request forgery
- CVE-2026-25309 WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability
- CVE-2026-25308 WordPress Simple Membership plugin <= 4.6.9 - Broken Access Control vulnerability
- CVE-2026-25307 WordPress XStore Core plugin < 5.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25306 WordPress XStore Core plugin <= 5.6.4 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25305 WordPress XStore theme <= 9.6.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25304 WordPress Jaroti theme < 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25302 Improper Verification of Cryptographic Signature in Boot
- CVE-2026-2530 Wavlink WL-WN579A3 wireless.cgi AddMac command injection
- CVE-2026-25294 Buffer Over-read in WLAN Firmware
- CVE-2026-25293 Incorrect authorization in PLC FW
- CVE-2026-25292 Improper Validation of Syntactic Correctness of Input in Automotive Linux OS
- CVE-2026-25291 Use After Free in Graphics
- CVE-2026-25290 Integer Overflow or Wraparound in OOBM
- CVE-2026-2529 Wavlink WL-WN579A3 wireless.cgi DeleteMac command injection
- CVE-2026-25289 Stack-based Buffer Overflow in WLAN Firmware
- CVE-2026-25288 Buffer Over-read in WLAN Firmware
- CVE-2026-25284 Buffer Over-read in OOBM
- CVE-2026-25283 Stack-based Buffer Overflow in OOBM
- CVE-2026-25282 Out-of-bounds Read in OOBM
- CVE-2026-25281 Allocation of Resources Without Limits or Throttling in OOBM
- CVE-2026-25280 Out-of-bounds Write in DSP Service
- CVE-2026-2528 Wavlink WL-WN579A3 wireless.cgi Delete_Mac_list command injection
- CVE-2026-25278 Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Software platform based on QNX
- CVE-2026-25277 Buffer Copy Without Checking Size of Input in Secure Processor
- CVE-2026-25276 Improper Validation of Array Index in Secure Processor
- CVE-2026-25275 Buffer Over-read in WLAN Firmware
- CVE-2026-25274 Use After Free in Windows WLAN Host
- CVE-2026-25273 Out-of-bounds Write in Camera Driver
- CVE-2026-25272 Out-of-bounds Write in Camera Driver
- CVE-2026-25271 Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service
- CVE-2026-25270 Out-of-bounds Write in Camera Driver
- CVE-2026-2527 Wavlink WL-WN579A3 login.cgi command injection
- CVE-2026-25269 Out-of-bounds Write in Camera Driver
- CVE-2026-25268 Stack-based Buffer Overflow in WLAN Host