Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 780 of 1013.
- CVE-2026-24425 Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface
- CVE-2026-24423 SmarterTools SmarterMail Missing Authentication for Critical Function
- CVE-2026-24422 phpMyFAQ: Public API endpoints expose emails and invisible questions
- CVE-2026-24421 phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user
- CVE-2026-24420 phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)
- CVE-2026-2442 Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'
- CVE-2026-24419 OpenSTAManager has an SQL Injection in the Prima Nota module
- CVE-2026-24418 OpenSTAManager has an SQL Injection vulnerability in the Scadenzario bulk operations module
- CVE-2026-24417 OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service
- CVE-2026-24416 OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module
- CVE-2026-24415 OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter
- CVE-2026-24414 Icinga for Windows certificate can have too-open permissions
- CVE-2026-24413 Icinga has insecure permission of %ProgramData%\icinga2\var on Windows
- CVE-2026-24412 iccDEV has Heap Buffer Overflow in icCurvesFromXml()
- CVE-2026-24411 iccDEV has Undefined Behavior and Null Pointer Deference in CIccTagXmlSegmentedCurve::ToXml()
- CVE-2026-24410 iccDEV has Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic()
- CVE-2026-2441 Google Chromium CSS Use-After-Free
- CVE-2026-24409 iccDEV has Undefined Behavior and Null Pointer Deference in CIccTagXmlFloatNum<>::ParseXml()
- CVE-2026-24408 sigstore has CSRF possibility in OIDC authentication during signing
- CVE-2026-24407 iccDEV has Undefined Behavior in icSigCalcOp()
- CVE-2026-24406 iccDEV has Heap Buffer Overflow in CIccTagNamedColor2::SetSize()
- CVE-2026-24405 iccDEV has Heap Buffer Overflow in CIccMpeCalculator::Read()
- CVE-2026-24404 iccDEV has Null Pointer Deference and Undefined Behavior in CIccXmlArrayType()
- CVE-2026-24403 iccDEV Undefined Behavior in CIccProfile::CheckHeader() Leads to Integer Overflow
- CVE-2026-24401 Avahi has Uncontrolled Recursion in lookup_handle_cname function
- CVE-2026-24400 AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
- CVE-2026-2440 SurveyJS: Drag & Drop Form Builder <= 2.5.3 - Unauthenticated Stored Cross-Site Scripting
- CVE-2026-24399 ChatterMate has Stored Cross-Site Scripting (XSS) via Chatbot Input Execution
- CVE-2026-24398 Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing
- CVE-2026-24392 WordPress HurryTimer plugin <= 2.14.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24391 WordPress Car Dealer theme <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-24390 WordPress Kentha Elementor Widgets plugin < 3.1 - Local File Inclusion vulnerability
- CVE-2026-2439 Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids
- CVE-2026-24389 WordPress Gallery PhotoBlocks plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24388 WordPress WPMasterToolKit plugin <= 2.14.0 - Broken Access Control vulnerability
- CVE-2026-24387 WordPress WP Quick Post Duplicator plugin <= 2.1 - Broken Access Control vulnerability
- CVE-2026-24386 WordPress Element Invader – Template Kits for Elementor plugin <= 1.2.4 - Broken Access Control vulnerability
- CVE-2026-24385 WordPress Podlove Web Player plugin <= 5.9.1 - PHP Object Injection vulnerability
- CVE-2026-24384 WordPress Merge + Minify + Refresh plugin <= 2.14 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-24383 WordPress B Slider plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24382 WordPress News Magazine X theme <= 1.2.50 - Broken Access Control vulnerability
- CVE-2026-24381 WordPress PhotoMe theme < 5.7.2 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-24380 WordPress EventPrime plugin <= 4.2.8.0 - Broken Access Control vulnerability
- CVE-2026-24379 WordPress WP Job Portal plugin <= 2.4.3 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-24378 WordPress EventPrime plugin <= 4.2.8.0 - PHP Object Injection vulnerability
- CVE-2026-24377 WordPress Nexter Blocks plugin <= 4.6.3 - Sensitive Data Exposure vulnerability
- CVE-2026-24376 WordPress WPVulnerability plugin <= 4.2.1 - Broken Access Control vulnerability
- CVE-2026-24375 WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.4 - Broken Access Control vulnerability
- CVE-2026-24374 WordPress RegistrationMagic plugin <= 6.0.6.9 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-24373 WordPress RegistrationMagic plugin <= 6.0.7.1 - Account Takeover vulnerability
- CVE-2026-24372 WordPress Subscriptions for WooCommerce plugin <= 1.8.10 - Bypass Vulnerability vulnerability
- CVE-2026-24371 WordPress BA Book Everything plugin <= 1.8.16 - Broken Access Control vulnerability
- CVE-2026-24370 WordPress The Grid plugin <= 2.8.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-2437 Cross-site scripting in WP Travel Engine – Tour Booking Plugin – Tour Operator Software
- CVE-2026-24369 WordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerability
- CVE-2026-24368 WordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerability
- CVE-2026-24367 WordPress Traveler theme < 3.2.8 - SQL Injection vulnerability
- CVE-2026-24366 WordPress YITH WooCommerce Request A Quote plugin <= 2.46.0 - Broken Access Control vulnerability
- CVE-2026-24365 WordPress Stock Manager for WooCommerce plugin < 3.6.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-24364 WordPress WP User Frontend plugin <= 4.2.5 - Broken Access Control vulnerability
- CVE-2026-24363 WordPress WP Cost Estimation & Payment Forms Builder plugin < 10.3.0 - Broken Access Control vulnerability
- CVE-2026-24362 WordPress Ultimate Post Kit plugin <= 4.0.21 - Broken Access Control vulnerability
- CVE-2026-24361 WordPress LearnPress – Course Review plugin <= 4.1.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24360 WordPress Seriously Simple Podcasting plugin <= 3.14.1 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-2436 Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake
- CVE-2026-24359 WordPress Dokan plugin <= 4.2.4 - Broken Authentication vulnerability
- CVE-2026-24358 WordPress Quiz And Survey Master plugin <= 10.3.3 - Broken Access Control vulnerability
- CVE-2026-24357 WordPress WP Recipe Maker plugin <= 10.2.4 - Broken Access Control vulnerability
- CVE-2026-24356 WordPress GetGenie plugin <= 4.3.0 - Broken Access Control vulnerability
- CVE-2026-24355 WordPress Houzez Theme - Functionality plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24354 WordPress Penci Shortcodes & Performance plugin <= 6.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24353 WordPress User Registration plugin <= 4.4.9 - Arbitrary Shortcode Execution vulnerability
- CVE-2026-24352 Session Fixation in PluXml CMS
- CVE-2026-24351 Stored XSS in PluXml CMS
- CVE-2026-24350 Stored XSS in PluXml CMS
- CVE-2026-2435 ASSET-7706
- CVE-2026-24349 Information disclosure in SIMATIC WinCC Unified PC Runtime V16
- CVE-2026-24348 Multiple cross-site scripting vulnerabilities in EZCast Pro II Dongle
- CVE-2026-24347 Arbitrary file write to /tmp directory in EZCast Pro II Dongle
- CVE-2026-24346 Use of well-known default credentials in EZCast Pro II Dongle
- CVE-2026-24345 Cross-Site Request Forgery in EZCast Pro II Dongle
- CVE-2026-24344 Multiple Buffer Overflows in EZCast Pro II Dongle
- CVE-2026-24343 Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions
- CVE-2026-2434 Pz-LinkCard <= 2.5.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-24332 Information disclosure in WebSocket API service
- CVE-2026-24330 Wildfly-core: wildfly: arbitrary file read via malicious archive deployment
- CVE-2026-2433 Cross-site scripting in RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging
- CVE-2026-24329 Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.
- CVE-2026-24328 Open Redirection vulnerability in Business Server Pages Application (TAF_APPLAUNCHER)
- CVE-2026-24327 Missing Authorization Check in SAP Strategic Enterprise Management (Balanced Scorecard in BSP Application)
- CVE-2026-24326 Missing authorization check in SAP S/4HANA Defense & Security (Disconnected Operations)
- CVE-2026-24325 Cross Site Scripting (XSS) vulnerability in SAP BusinessObjects Enterprise (Central Management Console)
- CVE-2026-24324 Denial of service (DOS) vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools)
- CVE-2026-24323 Multiple vulnerabilities in BSP Applications of SAP Document Management System
- CVE-2026-24322 Missing Authorization check in SAP Solution Tools Plug-In (ST-PI)
- CVE-2026-24321 Information Disclosure vulnerability in SAP Commerce Cloud
- CVE-2026-24320 Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)
- CVE-2026-2432 CM Custom Reports <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labels
- CVE-2026-24319 Information Disclosure Vulnerability in SAP Business One (B1 Client Memory Dump Files)
- CVE-2026-24318 Insecure Session Management vulnerability in SAP BusinessObjects Business Intelligence Platform