Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 785 of 1013.
- CVE-2026-23884 Heap-use-after-free in gdi_set_bounds
- CVE-2026-23883 Heap-use-after-free in update_pointer_new
- CVE-2026-23882 Blinko: Admin RCE - MCP Server Command Injection
- CVE-2026-23881 Kyverno Denial of Service via Context Variable Amplification in Policy Engine
- CVE-2026-23880 OnboardLite has stored Cross-site Scripting issue that may lead to admin Account Take Over
- CVE-2026-2388 Cross-site scripting in Reviews and Rating – Google Reviews
- CVE-2026-23879 py7zr: Arbitrary File Write Vulnerability
- CVE-2026-23878 HotCRP vulnerable to exposure of submitted documents
- CVE-2026-23877 Directory Traversal & Filesystem can be accessed by a non-admin user
- CVE-2026-23876 Heap buffer overflow with attacker-controlled data in XBM parser
- CVE-2026-23875 CrawlChat's Discord Bot has a Knowledge Permission vulnerability
- CVE-2026-23874 ImageMagick's MSL: Stack overflow via infinite recursion in ProcessMSLScript
- CVE-2026-23873 HUSTOJ is Vulnerable to Stored CSV Injection (Formula Injection) in Contest Rank Export
- CVE-2026-23870 Facebook React has a Denial of Service Vulnerability in React Server Components
- CVE-2026-2387 Event Organiser <= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode
- CVE-2026-23869 React Server Components have a Denial of Service Vulnerability
- CVE-2026-23868 Memory corruption in giflib
- CVE-2026-23866 Code injection in WhatsApp for Android
- CVE-2026-23865 Integer overflow in FreeType
- CVE-2026-23864 React Server Components have multiple Denial of Service Vulnerabilities
- CVE-2026-23863 Security feature bypass in WhatsApp Desktop for Windows
- CVE-2026-23862 Command injection in ThinOS 10
- CVE-2026-23861 Cross-site scripting in Unisphere for PowerMax vApp,
- CVE-2026-2386 Missing authorization in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
- CVE-2026-23859 Security feature bypass in Wyse Management Suite
- CVE-2026-23858 Cross-site scripting in Wyse Management Suite
- CVE-2026-23857 Privilege escalation in Update Package
- CVE-2026-23856 Privilege escalation in iDRAC Service Module
- CVE-2026-23855 Command injection in iDRAC10
- CVE-2026-23853 Hardcoded credentials in PowerProtect Data Domain
- CVE-2026-23852 SiYuan vulnerable to Stored XSS / RCE via `setBlockAttrs` icon attribute
- CVE-2026-23851 SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality
- CVE-2026-23850 SiYuan vulnerable to arbitrary file read
- CVE-2026-2385 Security feature bypass in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
- CVE-2026-23849 File Browser vulnerable to Username Enumeration via Timing Attack in /api/login
- CVE-2026-23848 MyTube has Rate Limiting Bypass via X-Forwarded-For Header Spoofing
- CVE-2026-23847 SiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon
- CVE-2026-23846 Tugtainer vulnerable to Password Exposure via URL Query Parameter
- CVE-2026-23845 Mailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check API
- CVE-2026-23844 Whisper Money has IDOR Vulnerability on sync/balances endpoint
- CVE-2026-23843 teklifolustur_app's IDOR vulnerability allows unauthorized access to other users' offers
- CVE-2026-23842 ChatterBot has Denial of Service via Database Connection Pool Exhaustion
- CVE-2026-23841 Movary vulnerable to Cross-site Scripting with `?categoryCreated=` param
- CVE-2026-23840 Movary vulnerable to Cross-site Scripting with `?categoryDeleted=` param
- CVE-2026-2384 Quiz Maker <= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2026-23839 Movary vulnerable to Cross-site Scripting with `?categoryUpdated=` param
- CVE-2026-23838 Tandoor Recipes module allows SQLite database to be externally accessible with the default settings
- CVE-2026-23837 MyTube has an Authorization Bypass vulnerability
- CVE-2026-23836 HotCRP vulnerable to remote code execution through formulas
- CVE-2026-23835 LobeHub Vulnerable to Improper Authorization in Presigned Upload
- CVE-2026-23833 ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component
- CVE-2026-23831 Rekor COSE v0.0.1 Canonicalize crashes when passed empty Message
- CVE-2026-23830 SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor
- CVE-2026-2383 Simple Download Monitor <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field
- CVE-2026-23829 Mailpit has SMTP Header Injection via Regex Bypass
- CVE-2026-23827 Unauthenticated Remote Code Execution via Heap Buffer Overflow in Network Management Service
- CVE-2026-23826 Unauthenticated Denial of Service in AOS-8 Network Management Service
- CVE-2026-23825 Unauthenticated Denial-of-Service via Crafted Messages in a Network Protocol Handling Component
- CVE-2026-23824 Unauthenticated Denial-of-Service via Crafted Messages in a Network Protocol Handling Component
- CVE-2026-23823 Authenticated Command Injection leads to RCE in AOS-10 CLI Command
- CVE-2026-23822 Unauthenticated XML External Entity Injection in AOS-8 Instant allows Denial of Service
- CVE-2026-23821 Inconsistent input filtering allows Authenticated Command Injection in AOS-10 CLI
- CVE-2026-23820 Inconsistent input filtering allows Authenticated Command Injection in AOS-8 Instant and AOS-10 CLI
- CVE-2026-2382 FPW Category Thumbnails <= 1.9.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'id' Parameter
- CVE-2026-23819 Error in SSID Processing allows Stored XSS in Web Management Interface
- CVE-2026-23818 Open Redirect Vulnerability in HPE Aruba Networking Private 5G Core On-Prem
- CVE-2026-23817 Unauthenticated Open Redirect allows URL Manipulation in Web Interface
- CVE-2026-23816 Authenticated Command Injection found in admin AOS-CX CLI command
- CVE-2026-23815 Authenticated Command Injection found in AOS-CX Administrative CLI Command
- CVE-2026-23814 Authenticated Command Injection found in AOS-CX CLI Command
- CVE-2026-23813 Authentication Bypass in Web Interface allows Unauthenticated Admin Password Reset
- CVE-2026-23812 Security Boundary Bypass via Routing Node Impersonation
- CVE-2026-23811 Unauthorized Bi-Directional Traffic Interception via L2/L3 Manipulation
- CVE-2026-23810 Cross-BSSID GTK Re-encryption and Traffic Injection
- CVE-2026-2381 Missing authorization in WooCommerce Stripe Payment Gateway
- CVE-2026-23809 MAC Address Spoofing leads to Inter-BSSID Isolation Bypass Resulting in Traffic Redirection
- CVE-2026-23808 Client Isolation Bypass via GTK Manipulation
- CVE-2026-23807 WordPress WP Telegram Widget and Join Link plugin <= 2.2.13 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-23806 WordPress Jobs for WordPress plugin <= 2.8 - Broken Access Control vulnerability
- CVE-2026-23805 WordPress Media Search Enhanced plugin <= 0.9.1 - SQL Injection vulnerability
- CVE-2026-23804 WordPress Better Business Reviews plugin <= 0.1.1 - Broken Access Control vulnerability
- CVE-2026-23803 WordPress Smart Auto Upload Images plugin <= 1.2.2 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-23802 WordPress AI Engine plugin <= 3.3.2 - Arbitrary File Upload vulnerability
- CVE-2026-23801 WordPress The Issue theme <= 1.6.11 - Local File Inclusion vulnerability
- CVE-2026-23800 WordPress Modular DS plugin <= 2.5.2 - Privilege Escalation vulnerability
- CVE-2026-2380 Security Advisory 0168
- CVE-2026-23799 WordPress Tutor LMS plugin <= 3.9.5 - Broken Access Control vulnerability
- CVE-2026-23798 WordPress PowerPress Podcasting plugin <= 11.15.10 - PHP Object Injection vulnerability
- CVE-2026-23797 Plaintext password display in Quick.Cart
- CVE-2026-23796 Session Fixation in Quick.Cart
- CVE-2026-23795 Apache Syncope: Console XXE on Keymaster parameters
- CVE-2026-23794 Apache Syncope: Reflected XSS on Enduser Login
- CVE-2026-23793 Memory corruption in Exynos 1330 firmware
- CVE-2026-23792 Denial of service in Exynos 1080 firmware
- CVE-2026-23791 Memory corruption in Exynos 1280 firmware
- CVE-2026-23790 Memory corruption in Exynos 1280 firmware
- CVE-2026-2379 Arista EOS IPsec Tunnel Sequence Number Mismatch via Interface Flaps when Anti-Replay is Disabled
- CVE-2026-23789 Memory corruption in Exynos 850 firmware
- CVE-2026-23788 Memory corruption in Exynos 1280 firmware
- CVE-2026-23787 Use after free in Exynos 1280 firmware