Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 775 of 1013.
- CVE-2026-24951 WordPress myCred plugin <= 2.9.7.3 - Broken Access Control vulnerability
- CVE-2026-24950 WordPress Authorsy plugin <= 1.0.6 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-2495 WPNakama <= 0.6.5 - Unauthenticated SQL Injection via 'order' REST API Parameter
- CVE-2026-24949 WordPress PhotoMe theme <= 5.7.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24948 WordPress Reflector plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-24947 WordPress LA-Studio Element Kit for Elementor plugin < 1.5.6.3 - Broken Access Control vulnerability
- CVE-2026-24946 WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.8.0 - Broken Access Control vulnerability
- CVE-2026-24945 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.34 - Broken Access Control vulnerability
- CVE-2026-24944 WordPress Subscribe2 plugin <= 10.44 - Broken Access Control vulnerability
- CVE-2026-24943 WordPress Grand Conference theme <= 5.3.4 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-24942 WordPress WpEvently plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-24941 WordPress WP Job Portal plugin <= 2.4.4 - Broken Access Control vulnerability
- CVE-2026-24940 WordPress Travelfic Toolkit plugin <= 1.3.3 - Broken Access Control vulnerability
- CVE-2026-2494 ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial
- CVE-2026-24939 WordPress Modula Image Gallery plugin <= 2.13.6 - Broken Access Control vulnerability
- CVE-2026-24938 WordPress Better Search plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24937 WordPress Broadcast Live Video plugin < 7.1.3 - Remote Code Execution (RCE) vulnerability
- CVE-2026-24936 An improper input validation vulnerability was found in ADM while joining a AD Domain.
- CVE-2026-24935 An improper certificate validation vulnerability was found in a third-party NAT traversal module.
- CVE-2026-24934 Security feature bypass in ADM
- CVE-2026-24933 An improper certificate validation vulnerability was found in ADM while sending HTTPS requests to the server.
- CVE-2026-24932 An improper certificate validation vulnerability was found in ADM while updating the DDNS settings.
- CVE-2026-24931 Security feature bypass in HarmonyOS
- CVE-2026-24930 Use after free in HarmonyOS
- CVE-2026-2493 IceWarp collaboration Directory Traversal Information Disclosure Vulnerability
- CVE-2026-24929 Memory corruption in HarmonyOS
- CVE-2026-24928 Memory corruption in EMUI
- CVE-2026-24927 Use after free in EMUI
- CVE-2026-24926 Memory corruption in HarmonyOS
- CVE-2026-24925 Memory corruption in HarmonyOS
- CVE-2026-24924 Missing authorization in HarmonyOS
- CVE-2026-24923 Missing authorization in HarmonyOS
- CVE-2026-24922 Memory corruption in HarmonyOS
- CVE-2026-24921 Memory corruption in HarmonyOS
- CVE-2026-24920 Missing authorization in EMUI
- CVE-2026-2492 TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
- CVE-2026-24919 Memory corruption in EMUI
- CVE-2026-24918 Null dereference in EMUI
- CVE-2026-24917 Use after free in EMUI
- CVE-2026-24916 Auth bypass in HarmonyOS
- CVE-2026-24915 Memory corruption in HarmonyOS
- CVE-2026-24914 Memory corruption in HarmonyOS
- CVE-2026-24913 SQL injection in MATCHA INVOICE
- CVE-2026-24912 ePower epower.ie Insufficient Session Expiration
- CVE-2026-24911 Memory corruption in Intel(R) PROSet/Wireless WiFi Software for Windows
- CVE-2026-24910 Security feature bypass in Bun
- CVE-2026-2491 Socomec DIRIS A-40 HTTP API Authentication Bypass Vulnerability
- CVE-2026-24909 vlt Mishandles Path Sanitization for tar
- CVE-2026-24908 OpenEMR has SQL Injection in Patient API Sort Parameter
- CVE-2026-24907 October CMS has Stored XSS via Event Log Mail Preview
- CVE-2026-24906 October CMS has Stored XSS in its Backend Editor Markup Classes
- CVE-2026-24905 Inspektor Gadget has a Command Injection vulnerability in Makefile.build
- CVE-2026-24904 TrustTunnel has `client_random_prefix` rule bypass via fragmented or partial TLS ClientHello
- CVE-2026-24903 OrcaStatLLM Researcher Stored Cross-Site Scripting (XSS) via Log Message Injection in Session Page
- CVE-2026-24902 TrustTunnel has SSRF and private network restriction bypass via numeric address destinations
- CVE-2026-24901 Outline's IDOR allows unauthorized viewing and seizing of private deleted drafts
- CVE-2026-24900 MarkUs has a submission-view IDOR exposes all student submissions
- CVE-2026-2490 RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability
- CVE-2026-24899 Fleet Windows MDM Azure AD JWT Authentication Bypass
- CVE-2026-24898 OpenEMR has an Unauthenticated MedEx Token Disclosure
- CVE-2026-24897 Authenticated Remote Code Execution via Arbitrary File Upload
- CVE-2026-24896 OpenEMR has Broken Access Control that allows unauthorized access to EDI Logs
- CVE-2026-24895 FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files
- CVE-2026-24894 FrankenPHP leaks session data between requests in worker mode
- CVE-2026-24893 openITCOCKPIT has Authenticated Command Injection Leading to Remote Code Execution via Host Address Macro Expansion
- CVE-2026-24892 openITCOCKPIT has Unsafe Deserialization in openITCOCKPIT Changelog Handling
- CVE-2026-24891 openITCOCKPIT has Unsafe PHP Deserialization in Gearman Worker Allowing Conditional Object Injection
- CVE-2026-24890 OpenEMR Portal Users Can Forge Provider Signatures
- CVE-2026-2489 TP2WP Importer <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textarea
- CVE-2026-24889 soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64
- CVE-2026-24888 Maker.js Vulnerable to Unsafe Property Copying in makerjs.extendObject
- CVE-2026-24887 Claude Code has a Command Injection in find Command Bypasses User Approval Prompt
- CVE-2026-24885 Kanboard Affected by Cross-Site Request Forgery (CSRF) via Content-Type Misconfiguration in Project Role Assignment
- CVE-2026-24884 Compressing Vulnerable to Arbitrary File Write via Symlink Extraction
- CVE-2026-24883 Null dereference in GnuPG
- CVE-2026-24882 Memory corruption in GnuPG
- CVE-2026-24881 Memory corruption in GnuPG
- CVE-2026-24880 Apache Tomcat: Request smuggling via invalid chunk extension
- CVE-2026-2488 ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion
- CVE-2026-24875 Integer overflow in modizer
- CVE-2026-24874 Type confusion in xray-monolith
- CVE-2026-24873 Out-of-bounds read in lpp-vita
- CVE-2026-24872 Pointer arithmetic error in SkyFire_548
- CVE-2026-24871 Code injection in Minecraft-Rcon-Manage
- CVE-2026-24870 Information disclosure in ixray-1.6-stcop
- CVE-2026-2487 Cross-site scripting in Admin Custom Login
- CVE-2026-24869 Use-after-free in the Layout: Scrolling and Overflow component
- CVE-2026-24868 Mitigation bypass in the Privacy: Anti-Tracking component
- CVE-2026-2486 Cross-site scripting in Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits
- CVE-2026-24858 Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel
- CVE-2026-24857 bulk_extractor has Heap-based Buffer Overflow vulnerability
- CVE-2026-24856 iccDEV has UB runtime error in <icTagTypeSignature>
- CVE-2026-24855 ChurchCRM has Stored Cross-Site Scripting (XSS) in Create Events in Church Calendar, Leading to Account Takeover
- CVE-2026-24854 Church CRM has SQL injection in PaddleNumEditor.php
- CVE-2026-24853 Caido has an insufficient patch for DNS rebind leading to RCE
- CVE-2026-24852 iccDEV has a heap-buffer-overflow in icXmlParseTextString()
- CVE-2026-24851 OpenFGA Improper Policy Enforcement
- CVE-2026-24850 ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices
- CVE-2026-2485 IBM InfoSphere Information Server Cross-Site Scripting
- CVE-2026-24849 OpenEMR Arbitrary File Read Vulnerability