Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 774 of 1013.
- CVE-2026-25043 Budibase: Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email Flooding
- CVE-2026-25041 Budibase has a Command Injection in PostgreSQL Dump Command
- CVE-2026-25040 Budibase Vulnerable to Privilege Escalation via API Abuse – Creator Can Invite Users with Admin/Any Role
- CVE-2026-2504 Dealia – Request a quote <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Plugin Configuration Reset
- CVE-2026-25039 The application evaluate UNC path in workspace name
- CVE-2026-25038 Gitea private organization labels are visible to unauthorized users
- CVE-2026-25037 Copeland XWEB and XWEB Pro OS Command Injection
- CVE-2026-25036 WordPress Passster plugin <= 4.2.25 - Broken Access Control vulnerability
- CVE-2026-25035 WordPress Contest Gallery plugin <= 28.1.2.2 - Account Takeover vulnerability
- CVE-2026-25034 WordPress KiviCare plugin <= 3.6.16 - Broken Access Control vulnerability
- CVE-2026-25033 WordPress Motta Addons plugin < 1.6.1 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25032 WordPress Ricky theme < 2.31 - PHP Object Injection vulnerability
- CVE-2026-25031 WordPress Tasty Daily theme < 1.27 - PHP Object Injection vulnerability
- CVE-2026-25030 WordPress Goldish theme < 3.47 - PHP Object Injection vulnerability
- CVE-2026-2503 ElementCamp <= 2.3.6 - Authenticated (Author+) SQL Injection via 'meta_query[compare]' Parameter
- CVE-2026-25029 WordPress KIDZ theme <= 5.24 - PHP Object Injection vulnerability
- CVE-2026-25028 WordPress ElementInvader Addons for Elementor plugin <= 1.4.1 - Broken Access Control vulnerability
- CVE-2026-25027 WordPress Unicamp theme <= 2.7.1 - Local File Inclusion vulnerability
- CVE-2026-25026 WordPress Team plugin <= 5.0.11 - Broken Access Control vulnerability
- CVE-2026-25025 WordPress VikRestaurants plugin <= 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25024 WordPress ThirstyAffiliates plugin <= 3.11.9 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-25023 WordPress Run Contests, Raffles, and Giveaways with ContestsWP plugin <= 2.0.7 - Sensitive Data Exposure vulnerability
- CVE-2026-25022 WordPress KiviCare plugin <= 3.6.16 - SQL Injection vulnerability
- CVE-2026-25021 WordPress Mizan Demo Importer plugin <= 0.1.3 - Broken Access Control vulnerability
- CVE-2026-25020 WordPress WP Sync for Notion plugin <= 1.7.0 - Broken Access Control vulnerability
- CVE-2026-2502 xmlrpc attacks blocker <= 1.0 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For'
- CVE-2026-25019 WordPress Atarim plugin <= 4.3.1 - Broken Access Control vulnerability
- CVE-2026-25018 WordPress NaturaLife Extensions plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25017 WordPress NaturaLife Extensions plugin <= 2.1 - Local File Inclusion vulnerability
- CVE-2026-25016 WordPress Nelio Popups plugin <= 1.3.5 - Broken Access Control vulnerability
- CVE-2026-25015 WordPress UsersWP plugin <= 1.2.53 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-25014 WordPress Enter Addons plugin <= 2.3.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-25013 WordPress Phox Hosting plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25012 WordPress WP Bannerize Pro plugin <= 1.11.0 - Broken Access Control vulnerability
- CVE-2026-25011 WordPress WP Custom Admin Interface plugin <= 7.41 - Broken Access Control vulnerability
- CVE-2026-25010 WordPress Share This Image plugin <= 2.09 - Broken Access Control vulnerability
- CVE-2026-2501 Ed's Social Share <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-25009 WordPress Education Zone theme <= 1.3.8 - Broken Access Control vulnerability
- CVE-2026-25008 WordPress Ninja Tables plugin <= 5.2.5 - Sensitive Data Exposure vulnerability
- CVE-2026-25007 WordPress ElementInvader Addons for Elementor plugin <= 1.4.2 - SQL Injection vulnerability
- CVE-2026-25006 WordPress XStore theme <= 9.6.4 - Arbitrary Shortcode Execution vulnerability
- CVE-2026-25005 WordPress Frontend File Manager plugin <= 23.5 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-25004 WordPress CM Business Directory plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25003 WordPress Client Portal plugin <= 1.2.1 - Broken Access Control vulnerability
- CVE-2026-25002 WordPress LearnPress – Sepay Payment plugin <= 4.0.0 - Broken Authentication vulnerability
- CVE-2026-25001 WordPress Post Snippets plugin <= 4.0.12 - Remote Code Execution (RCE) vulnerability
- CVE-2026-25000 WordPress Wheel of Life plugin <= 1.2.0 - Broken Access Control vulnerability
- CVE-2026-2500 Quick Playground <= 1.3.4 - Authenticated (Administrator+) Arbitrary File Read via 'filename' Parameter
- CVE-2026-24999 WordPress Alma plugin <= 5.16.1 - Broken Access Control vulnerability
- CVE-2026-24998 WordPress Hustle plugin <= 7.8.9.2 - Sensitive Data Exposure vulnerability
- CVE-2026-24997 WordPress Wired Impact Volunteer Management plugin <= 2.8 - Broken Access Control vulnerability
- CVE-2026-24996 WordPress WPElemento Importer plugin <= 0.6.4 - Broken Access Control vulnerability
- CVE-2026-24995 WordPress Latest Post Shortcode plugin <= 14.2.0 - Broken Access Control vulnerability
- CVE-2026-24994 WordPress Sunshine Photo Cart plugin <= 3.5.7.2 - Broken Access Control vulnerability
- CVE-2026-24993 WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.3 - SQL Injection vulnerability
- CVE-2026-24992 WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.2 - Sensitive Data Exposure vulnerability
- CVE-2026-24991 WordPress Extensions For CF7 plugin <= 3.4.0 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-24990 WordPress WP Docs plugin <= 2.2.8 - Broken Access Control vulnerability
- CVE-2026-2499 Custom Logo <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Logo Path Setting
- CVE-2026-24989 WordPress SUMO Affiliates Pro plugin < 11.4.0 - PHP Object Injection vulnerability
- CVE-2026-24988 WordPress The Events Calendar Shortcode & Block plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24987 WordPress WP System Log plugin <= 1.2.7 - Broken Access Control vulnerability
- CVE-2026-24986 WordPress Simple Membership WP user Import plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-24985 WordPress WP Forms Signature Contract Add-On plugin <= 1.8.2 - Broken Access Control to Notice Dismissal vulnerability
- CVE-2026-24984 WordPress Visual Link Preview plugin <= 2.2.9 - Broken Access Control vulnerability
- CVE-2026-24983 WordPress UpSolution Core plugin <= 8.41 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-24982 WordPress Spectra plugin <= 2.19.17 - Broken Access Control vulnerability
- CVE-2026-24981 WordPress Visionary Core plugin <= 1.4.9 - PHP Object Injection vulnerability
- CVE-2026-24980 WordPress Visionary Core plugin <= 1.4.9 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-2498 WP Social Meta <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
- CVE-2026-24979 WordPress Jobica Core plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-24978 WordPress Jobica Core plugin <= 1.4.1 - PHP Object Injection vulnerability
- CVE-2026-24977 WordPress Organici Library plugin <= 2.1.2 - SQL Injection vulnerability
- CVE-2026-24976 WordPress Organici Library plugin <= 2.1.2 - PHP Object Injection vulnerability
- CVE-2026-24975 WordPress Organici Library plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-24974 WordPress CitiLights theme <= 3.7.1 - PHP Object Injection vulnerability
- CVE-2026-24973 WordPress CitiLights theme <= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-24972 WordPress Elated Listing plugin <= 1.4 - Broken Access Control vulnerability
- CVE-2026-24971 WordPress Search & Go theme <= 2.8 - Privilege Escalation vulnerability
- CVE-2026-24970 WordPress Energox theme <= 1.2 - Arbitrary File Deletion vulnerability
- CVE-2026-2497 Gallery by BestWebSoft <= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys
- CVE-2026-24969 WordPress Instant VA theme <= 1.0.1 - Arbitrary File Deletion vulnerability
- CVE-2026-24968 WordPress Xagio SEO plugin <= 7.1.0.30 - Privilege Escalation vulnerability
- CVE-2026-24967 WordPress Amelia plugin <= 1.2.38 - Broken Access Control vulnerability
- CVE-2026-24966 WordPress Copyscape Premium plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-24965 WordPress Contest Gallery plugin <= 28.1.1 - Broken Access Control vulnerability
- CVE-2026-24964 WordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-24963 WordPress Amelia plugin <= 1.2.38 - Privilege Escalation vulnerability
- CVE-2026-24962 WordPress Sigmize plugin <= 0.0.9 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-24961 WordPress Grand Blog theme < 3.1.5 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-24960 WordPress Charety theme < 2.0.2 - Arbitrary File Upload vulnerability
- CVE-2026-2496 Ed's Font Awesome <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-24959 WordPress JS Help Desk plugin <= 3.0.1 - SQL Injection vulnerability
- CVE-2026-24958 WordPress JetElements For Elementor plugin <= 2.7.12.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24957 WordPress Strong Testimonials plugin <= 3.2.20 - Broken Access Control vulnerability
- CVE-2026-24956 WordPress Download Manager Addons for Elementor plugin <= 1.3.0 - SQL Injection vulnerability
- CVE-2026-24955 WordPress Whizz Plugins plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-24954 WordPress WpEvently plugin <= 5.0.8 - Deserialization of untrusted data vulnerability
- CVE-2026-24953 WordPress Simple File List plugin <= 6.1.15 - Arbitrary File Download vulnerability
- CVE-2026-24952 WordPress Seriously Simple Podcasting plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerability