Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 779 of 1013.
- CVE-2026-24540 WordPress Integrate Google Drive plugin <= 1.5.6 - Broken Access Control vulnerability
- CVE-2026-2454 DoS in Calls plugin via malformed msgpack in websocket request.
- CVE-2026-24539 WordPress Protección de datos – RGPD plugin <= 0.68 - Broken Access Control vulnerability
- CVE-2026-24538 WordPress Omnipress plugin <= 1.6.7 - Local File Inclusion vulnerability
- CVE-2026-24537 WordPress WP Accessibility Helper (WAH) plugin <= 0.6.6 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-24536 WordPress Webpushr plugin <= 4.38.0 - Sensitive Data Exposure vulnerability
- CVE-2026-24535 WordPress Automatic Featured Images from Videos plugin <= 1.2.7 - Broken Access Control vulnerability
- CVE-2026-24534 WordPress Booter plugin <= 1.5.7 - Broken Access Control vulnerability
- CVE-2026-24533 WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24532 WordPress SiteLock Security plugin <= 5.0.2 - Broken Access Control vulnerability
- CVE-2026-24531 WordPress Prowess theme <= 2.3 - Local File Inclusion vulnerability
- CVE-2026-24530 WordPress WebP Conversion plugin <= 2.2 - Broken Access Control vulnerability
- CVE-2026-24529 WordPress Quick Restaurant Reservations plugin <= 1.6.7 - Broken Access Control vulnerability
- CVE-2026-24528 WordPress Nova Blocks plugin <= 2.1.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24527 WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.14.0 - Broken Access Control vulnerability
- CVE-2026-24526 WordPress Email Inquiry & Cart Options for WooCommerce plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24525 WordPress CLP Varnish Cache plugin <= 1.0.2 - Broken Access Control vulnerability
- CVE-2026-24524 WordPress Tablesome plugin <= 1.2.8 - Broken Access Control vulnerability
- CVE-2026-24523 WordPress WP FullCalendar plugin <= 1.6 - Sensitive Data Exposure vulnerability
- CVE-2026-24522 WordPress WP Subscribe plugin <= 1.2.16 - Broken Access Control vulnerability
- CVE-2026-24521 WordPress Kama Thumbnail plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-24520 WordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerability
- CVE-2026-2452 Unsafe variable evaluation in email templates
- CVE-2026-24517 Copeland XWEB and XWEB Pro OS Command Injection
- CVE-2026-24516 DigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint
- CVE-2026-24515 Memory corruption in libexpat
- CVE-2026-24514 ingress-nginx Admission Controller denial of service
- CVE-2026-24513 ingress-nginx auth-url protection bypass
- CVE-2026-24512 ingress-nginx auth-method nginx configuration injection
- CVE-2026-24511 Information disclosure in PowerScale OneFS
- CVE-2026-24510 Privilege escalation in Alienware Command Center (AWCC)
- CVE-2026-2451 Unsafe variable evaluation in email templates
- CVE-2026-24509 Missing authorization in Alienware Command Center (AWCC)
- CVE-2026-24508 Security feature bypass in Alienware Command Center (AWCC)
- CVE-2026-24506 Command injection in PowerProtect Data Domain
- CVE-2026-24505 Command injection in PowerProtect Data Domain
- CVE-2026-24504 Command injection in PowerProtect Data Domain
- CVE-2026-24502 Privilege escalation in Dell Command | Intel vPro Out of Band
- CVE-2026-2450 Privilege escalation in upKeeper Instant Privilege Access
- CVE-2026-24498 Auth bypass in ipTIME AX2004M
- CVE-2026-24497 Memory corruption in ThinkWise
- CVE-2026-24494 SQL injection vulnerability in Order Up Online Ordering System
- CVE-2026-24491 FreeRDP has a heap-use-after-free in video_timer
- CVE-2026-24490 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
- CVE-2026-2449 Command injection in upKeeper Instant Privilege Access
- CVE-2026-24489 Gakido vulnerable to HTTP Header Injection (CRLF Injection)
- CVE-2026-24488 OpenEMR Vulnerable to Arbitrary File Exfiltration via Fax Endpoint
- CVE-2026-24487 OpenEMR has FHIR Patient Compartment Bypass in CareTeam Resource
- CVE-2026-24486 Python-Multipart has Arbitrary File Write via Non-Default Configuration
- CVE-2026-24485 ImageMagick: Infinite loop vulnerability when parsing a PCD file
- CVE-2026-24484 ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS
- CVE-2026-24481 ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression
- CVE-2026-24480 QGIS had validated RCE and Repository Takeover via GitHub Actions
- CVE-2026-2448 Page Builder by SiteOrigin <= 2.33.5 - Authenticated (Contributor+) Local File Inclusion
- CVE-2026-24479 HUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCE
- CVE-2026-24478 AnythingLLM vulnerable to Path Traversal
- CVE-2026-24477 AnythingLLM has key leak in `systemSettings.js`
- CVE-2026-24476 Shaarli vulnerable to stored XSS via Suggested Tags
- CVE-2026-24474 Dioxus Components has JavaScript injection via user-supplied IDs
- CVE-2026-24473 Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)
- CVE-2026-24472 Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception
- CVE-2026-24471 Improper Validation in Conduit-derived homeservers resulting in Unintended Proxy or Intermediary ('Confused Deputy')
- CVE-2026-24470 Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName
- CVE-2026-2447 Heap buffer overflow in libvpx
- CVE-2026-24469 C++ HTTP Server has Critical Path Traversal Vulnerability in RequestHandler Allowing Arbitrary File Read
- CVE-2026-24468 OpenAEV Vulnerable to Username/Email Enumeration Through Differential HTTP Responses in Password Reset API
- CVE-2026-24467 OpenAEV's Improper Password Reset Token Management Leads to Unauthenticated Account Takeover and Platform Compromise
- CVE-2026-24466 Privilege escalation in See "References" section
- CVE-2026-24465 Memory corruption in WAB-S300IW-AC
- CVE-2026-24464 Appliance mode iControl REST vulnerability
- CVE-2026-2446 Powerpack for LearnDash < 1.3.0 - Unauthenticated Arbitrary Option Update
- CVE-2026-24458 DoS attack via login attempts with multi-megabyte passwords
- CVE-2026-24457 Path traversal in Eclipse GlassFish
- CVE-2026-24455 Jinan USR IOT Technology Limited (PUSR) USR-W610 Cleartext Transmission of Sensitive Information
- CVE-2026-24452 Copeland XWEB and XWEB Pro OS Command Injection
- CVE-2026-24451 Gitea fork synchronization can expose private parent repository data
- CVE-2026-24450 Integer overflow in LibRaw
- CVE-2026-2445 Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification
- CVE-2026-24449 Weak cryptography in WRC-X1500GS-B
- CVE-2026-24448 Hardcoded credentials in MR-GM5A-L1
- CVE-2026-24447 Code injection in Movable Type (Cloud Edition)
- CVE-2026-24445 EV Energy ev.energy Improper Restriction of Excessive Authentication Attempts
- CVE-2026-24444 SDMC NE6037 Hardcoded Password via mgmt.php/npcmd.php
- CVE-2026-24443 EventSentry < 6.0.1.20 Web Reports Unverified Password Change
- CVE-2026-24441 Tenda AC7 Transmits Admin Credentials Without HTTPS Protection
- CVE-2026-24440 Tenda W30E V2 Allows Password Changes Without Verifying Current Password
- CVE-2026-24439 Tenda W30E V2 Lacks X-Content-Type-Options Header
- CVE-2026-24437 Tenda W30E V2 Missing Cache Controls for Credential-bearing Pages
- CVE-2026-24436 Tenda W30E V2 Lacks Rate Limiting on Authentication
- CVE-2026-24435 Tenda W30E V2 Permissive CORS Allows Cross-origin Data Access
- CVE-2026-24434 Tenda AC7 Web Interface Lacks CSRF Protections for Admin Actions
- CVE-2026-24433 Tenda W30E V2 Stored XSS via Username Field
- CVE-2026-24432 Tenda W30E V2 Missing CSRF Protections for Administrative Actions
- CVE-2026-24431 Tenda W30E V2 Web UI Reveals Passwords in Cleartext
- CVE-2026-24430 Tenda W30E V2 HTTP Responses Expose Plaintext Credentials
- CVE-2026-2443 Libsoup: out-of-bounds read in libsoup handle_partial_get() leading to heap information disclosure
- CVE-2026-24429 Tenda W30E V2 Hardcoded Default Password for Built-in Account
- CVE-2026-24428 Tenda W30E V2 Incorrect Authorization Allows Administrator Password Change
- CVE-2026-24427 Tenda AC7 Exposes Admin Credentials in Configuration Responses
- CVE-2026-24426 Tenda AC7 Reflected XSS via Web Interface Output Encoding