Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 797 of 1013.
- CVE-2026-22602 OpenProject is Vulnerable to User Enumeration via User ID
- CVE-2026-22601 OpenProject is Vulnerable to Code Execution in E-Mail function
- CVE-2026-22600 OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder
- CVE-2026-2260 D-Link DCS-931L setSysAdmin os command injection
- CVE-2026-22599 Strapi Vulnerable to SQL Injection in Content Type Builder
- CVE-2026-22598 ManageIQ vulnerable to DoS Attack when creating TimeProfiles
- CVE-2026-22597 Ghost has SSRF via External Media Inliner
- CVE-2026-22596 Ghost has SQL Injection in Members Activity Feed
- CVE-2026-22595 Ghost has Staff Token permission bypass
- CVE-2026-22594 Ghost has Staff 2FA bypass
- CVE-2026-22593 EVerest has off-by-one stack buffer overflow in IsoMux certificate filename parsing
- CVE-2026-22592 Gogs is Vulnerable to Denial of Service
- CVE-2026-22591 Fast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS)
- CVE-2026-22590 Memory corruption in Fast-DDS
- CVE-2026-2259 aardappel lobster Parsing parser.h ParseStatements memory corruption
- CVE-2026-22589 Spree API has Unauthenticated IDOR - Guest Address
- CVE-2026-22588 Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification
- CVE-2026-22587 Ideagen DevonWay Reports page stored XSS
- CVE-2026-22586 Hardcoded credentials in Marketing Cloud Engagement
- CVE-2026-22585 Weak cryptography in Marketing Cloud Engagement
- CVE-2026-22584 Salesforce Uni2TS has a Code Injection vulnerability
- CVE-2026-22583 Command injection in Marketing Cloud Engagement
- CVE-2026-22582 Command injection in Marketing Cloud Engagement
- CVE-2026-2258 aardappel lobster wfc.h WaveFunctionCollapse memory corruption
- CVE-2026-22576 Information disclosure in FortiSOAR PaaS
- CVE-2026-22575 Missing authorization in FortiManager
- CVE-2026-22574 Information disclosure in FortiSOAR PaaS
- CVE-2026-22573 Path traversal in FortiSOAR PaaS
- CVE-2026-22572 Auth bypass in FortiAnalyzer
- CVE-2026-2257 Cross-site scripting in GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools
- CVE-2026-22569 Incorrect startup configuration in ZCC
- CVE-2026-22568 Unauthorized information retrieval in ZIA Admin UI
- CVE-2026-22567 ZIA Admin UI Input Validation Bug
- CVE-2026-22566 Missing authorization in UniFi Play Audio Port
- CVE-2026-22565 Denial of service in UniFi Play Audio Port
- CVE-2026-22564 Missing authorization in UniFi Play Audio Port
- CVE-2026-22563 Command injection in UniFi Play Audio Port
- CVE-2026-22562 Path traversal in UniFi Play Audio Port
- CVE-2026-22561 Privilege escalation in Claude Desktop - Windows
- CVE-2026-22560 Open redirect in Rocket.Chat
- CVE-2026-2256 Command injection vulnerability in ModelScope's ms-agent
- CVE-2026-22559 Other in UniFi Network Server
- CVE-2026-22558 SQL injection in UniFi Network Application
- CVE-2026-22557 Path traversal in UniFi Network Application
- CVE-2026-22555 Gitea organization forks can expose organization secrets without create permission
- CVE-2026-22554 Memory corruption in MediaInfoLib
- CVE-2026-22553 InSAT MasterSCADA BUK-TS OS Command Injection
- CVE-2026-22552 ePower epower.ie Missing Authentication for Critical Function
- CVE-2026-22551 [Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat
- CVE-2026-22550 Command injection in WRC-X1500GS-B
- CVE-2026-2255 Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials
- CVE-2026-22549 BIG-IP Container Ingress Services vulnerability
- CVE-2026-22548 BIG-IP Advanced WAF and ASM vulnerability
- CVE-2026-22547 Gitea repository creation accepts invalid field values
- CVE-2026-22545 Password Change Bypass via Auth Switch Endpoint
- CVE-2026-22544 EXCHANGE OF CREDENTIALS IN CLEAR TEXT
- CVE-2026-22543 WEEK ENCODING FOR PASSWORDS
- CVE-2026-22542 DENIAL OF SERVICE FOR CONCURRENT CONNECTIONS ON TELNET
- CVE-2026-22541 DENIAL OF SERVICE VIA ICMP PACKETS
- CVE-2026-22540 DENIAL OF SERVICE VIA ARP PACKETS
- CVE-2026-2254 Hitachi Vantara Pentaho Data Integration & Analytics - Incorrect Permission Assignment for Critical Resource
- CVE-2026-22539 INFORMATION DISCLOSURE VIA CURL REQUESTS (OCPP)
- CVE-2026-22537 INFORMATION DISCLOSURE WITHIN THE OPERATING SYSTEM
- CVE-2026-22536 PRIVILEGE ESCALATION VIA SUDO COMMAND
- CVE-2026-22535 FRAIL SECURITY IN MQTT PROTOCOL ALLOWS AN ATTACKER MODIFY CRITICAL PARAMETERS
- CVE-2026-2253 Hitachi Vantara Pentaho Data Integration & Analytics - Improper Restriction of XML External Entity Reference
- CVE-2026-22524 WordPress Legacy Admin plugin <= 9.5 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-22523 WordPress Ultra WordPress Admin plugin <= 11.7 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-22522 WordPress Block Slider plugin <= 2.2.3 - Broken Access Control vulnerability
- CVE-2026-22521 WordPress Handmade Framework plugin <= 3.9 - Local File Inclusion vulnerability
- CVE-2026-22520 WordPress Handmade Framework plugin <= 3.9 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-2252 XML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)
- CVE-2026-22519 WordPress MediaPress plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-22518 WordPress X Addons for Elementor plugin <= 1.0.23 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-22517 WordPress GA4WP: Google Analytics for WordPress plugin <= 2.10.0 - Broken Access Control vulnerability
- CVE-2026-22516 WordPress Wizor's theme <= 2.12 - Local File Inclusion vulnerability
- CVE-2026-22515 WordPress VegaDays theme <= 1.2.0 - Local File Inclusion vulnerability
- CVE-2026-22514 WordPress Unica theme <= 1.4.1 - Local File Inclusion vulnerability
- CVE-2026-22513 WordPress Triompher theme <= 1.1.0 - Local File Inclusion vulnerability
- CVE-2026-22512 WordPress Roisin theme <= 1.2.1 - Local File Inclusion vulnerability
- CVE-2026-22511 WordPress NeoBeat theme <= 1.2 - Local File Inclusion vulnerability
- CVE-2026-22510 WordPress Melody theme <= 1.6.3 - PHP Object Injection vulnerability
- CVE-2026-2251 Path Traversal leading to Remote Code Execution (RCE)
- CVE-2026-22509 WordPress Gioia theme <= 1.4 - Local File Inclusion vulnerability
- CVE-2026-22508 WordPress Dentalux theme <= 3.3 - Local File Inclusion vulnerability
- CVE-2026-22507 WordPress Beelove theme <= 1.2.6 - PHP Object Injection vulnerability
- CVE-2026-22506 WordPress Amoli theme <= 1.0 - Local File Inclusion vulnerability
- CVE-2026-22505 WordPress Morning Records theme <= 1.2 - PHP Object Injection vulnerability
- CVE-2026-22504 WordPress ProLingua theme <= 1.1.12 - Local File Inclusion vulnerability
- CVE-2026-22503 WordPress Nelson theme <= 1.2.0 - Local File Inclusion vulnerability
- CVE-2026-22502 WordPress Mr. Cobbler theme <= 1.1.9 - Local File Inclusion vulnerability
- CVE-2026-22501 WordPress Mounthood theme <= 1.3.2 - PHP Object Injection vulnerability
- CVE-2026-22500 WordPress m2 | Construction and Tools Store theme <= 1.1.2 - PHP Object Injection vulnerability
- CVE-2026-2250 Unauthenticated Data Export and Source Code Disclosure via /dbviewer/ in METIS WIC
- CVE-2026-22499 WordPress Lella theme <= 1.2 - Local File Inclusion vulnerability
- CVE-2026-22498 WordPress Laurent theme <= 3.1 - Local File Inclusion vulnerability
- CVE-2026-22497 WordPress Jardi theme <= 1.7.2 - PHP Object Injection vulnerability
- CVE-2026-22496 WordPress Hypnotherapy theme <= 1.2.10 - Local File Inclusion vulnerability
- CVE-2026-22495 WordPress Greenville theme <= 1.3.2 - Local File Inclusion vulnerability
- CVE-2026-22494 WordPress Good Homes theme <= 1.3.13 - Local File Inclusion vulnerability