Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 821 of 1013.
- CVE-2026-1988 Path traversal in Flexi Product Slider and Grid for WooCommerce
- CVE-2026-19879 Io.undertow/undertow: undertow: http response header integrity issue due to character truncation
- CVE-2026-19878 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-19875 Unauthenticated Registration POST Endpoint Permits Admin Email Overwrite and Outbound Relay Abuse in Langflow
- CVE-2026-19874 Konami's Metal Gear Online 3 contains a heap-based buffer overflow
- CVE-2026-19873 HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements.
- CVE-2026-19872 HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message.
- CVE-2026-19871 Use of hard-coded credentials in Prospero Flow CRM employee onboarding
- CVE-2026-19870 IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation
- CVE-2026-1987 Missing authorization in Scheduler Widget
- CVE-2026-19869 Privilege Escalation via Dropped Field-Level @authentication
- CVE-2026-19867 Uncapped mention keys in user notification properties allow CPU exhaustion during post processing
- CVE-2026-19864 Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object.
- CVE-2026-19863 An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path.
- CVE-2026-19862 JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action
- CVE-2026-19861 JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails
- CVE-2026-19860 JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation Callback
- CVE-2026-1986 FloristPress for Woo <= 7.8.2 - Reflected Cross-Site Scripting via 'noresults' Parameter
- CVE-2026-19859 JetFormBuilder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter
- CVE-2026-19858 JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset
- CVE-2026-19857 Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token
- CVE-2026-19856 All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search Query
- CVE-2026-19855 Code injection in CleanTalk
- CVE-2026-19854 CVE-2026-19854 CVE Record
- CVE-2026-19853 CyberTutor｜NewSiteServer (NSS) - Missing Authentication
- CVE-2026-19852 CyberTutor｜NewSiteServer (NSS) - Arbitrary File Upload
- CVE-2026-19851 Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
- CVE-2026-1985 Press3D <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block
- CVE-2026-19848 ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name
- CVE-2026-19847 TOTOLINK A800R wps.so cstecgi.cgi setWiFiWpsConfig stack-based overflow
- CVE-2026-19846 TOTOLINK A800R firewall.so cstecgi.cgi setUrlFilterRules stack-based overflow
- CVE-2026-19845 TOTOLINK A800R lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow
- CVE-2026-19844 TOTOLINK A800R ipv6.so cstecgi.cgi setRadvdCfg stack-based overflow
- CVE-2026-19843 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor
- CVE-2026-19842 SAML Single Sign On 4.8.85 - 5.4.6 - Unauthenticated Administrator Account Takeover via SAML Trust Anchor Overwrite
- CVE-2026-19841 TRENDNET TEW-813DRU vsftpd vsftpd.conf default permission
- CVE-2026-19840 Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions
- CVE-2026-1984 Missing authorization in Ibtana – Ecommerce Product Addons
- CVE-2026-19839 SourceCodester Simple Doctors Appointment System save_file.php save_doctor unrestricted upload
- CVE-2026-19838 Webkul Bagisto Backend Reporting Endpoint sales authorization
- CVE-2026-19837 Webkul Bagisto Customer Search search information disclosure
- CVE-2026-19836 Webkul Bagisto Backend Customer Detail Feature view authorization
- CVE-2026-19835 Webkul Bagisto Customer Item Deletion Endpoint access control
- CVE-2026-19834 Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization
- CVE-2026-19830 TRENDnet TEW-816DRM bftpd bftpd.conf allocation of resources
- CVE-2026-1983 SEATT: Simple Event Attendance <= 1.5.0 - Cross-Site Request Forgery to Arbitrary Event Deletion
- CVE-2026-19829 648540858 wvp-GB28181-pro Log File Download Endpoint LogController.java path traversal
- CVE-2026-19828 648540858 wvp-GB28181-pro Snapshot Endpoint PlayController.java path traversal
- CVE-2026-19827 alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputStream path traversal
- CVE-2026-19826 alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserialization
- CVE-2026-19825 SourceCodester Simple Client Management System Master.php save_service sql injection
- CVE-2026-19824 Tenda W20E addIpMacBind ipMacBindListStore stack-based overflow
- CVE-2026-19823 Tenda W20E QoS Rule Deletion delQos formQOSRuleDel stack-based overflow
- CVE-2026-19822 Tenda W20E QoS Edit editQos lstAdd stack-based overflow
- CVE-2026-19821 Tenda AC12 httpd web management interface SetSysAutoRebbotCfg formSetRebootTimer buffer overflow
- CVE-2026-19820 Backblaze Client for Windows Improper Link Resolution Vulnerability
- CVE-2026-1982 Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widget
- CVE-2026-19816 PackageKit: dnf5 backend ignores SIMULATE on RepoRemove
- CVE-2026-19815 TOTOLINK A800R firewall.so cstecgi.cgi setParentalRules stack-based overflow
- CVE-2026-19814 TOTOLINK A800R firewall.so cstecgi.cgi setMacQos stack-based overflow
- CVE-2026-19813 TOTOLINK A800R firewall.so cstecgi.cgi setMacFilterRules stack-based overflow
- CVE-2026-19812 TOTOLINK A800R product.so cstecgi.cgi UploadCustomModule stack-based overflow
- CVE-2026-19811 TOTOLINK A800R firewall.so cstecgi.cgi setIpQosRules stack-based overflow
- CVE-2026-19810 Cross-Site Scripting (XSS) in Symantec Endpoint Detection and Response Console
- CVE-2026-1981 Winston AI <= 0.0.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion
- CVE-2026-19807 ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool
- CVE-2026-19806 Weak cryptography in Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System
- CVE-2026-19804 s2Member <= 260814 - Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return
- CVE-2026-19802 Missing authorization in Checkout Custom Fields Builder for WooCommerce
- CVE-2026-19801 Missing authorization in BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP
- CVE-2026-19800 Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter
- CVE-2026-1980 WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure
- CVE-2026-19798 Missing authorization in WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters
- CVE-2026-19797 User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter
- CVE-2026-19796 Cross-site scripting in Listdom: AI-powered Business Directory with Classifieds Ads Listings
- CVE-2026-19795 Qiskit SDK is vulnerable when deserializing QPY Files and may overflow the available stack space.
- CVE-2026-19794 WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting
- CVE-2026-19792 Tenda G0 httpd web management interface module setPortMapping buffer overflow
- CVE-2026-19791 Tenda G0 httpd web management interface module addStaticRoute stack-based overflow
- CVE-2026-19790 Tenda G0 httpd Web Management module formSetPortMirror stack-based overflow
- CVE-2026-1979 mruby JMPNOT-to-JMPIF Optimization vm.c mrb_vm_exec use after free
- CVE-2026-19789 Tenda AC1206 httpd web management interface WifiGuestSet set_wl_guest_iplist stack-based overflow
- CVE-2026-19788 Tenda AC1206 httpd web management interface SetOnlineDevName set_device_name stack-based overflow
- CVE-2026-19787 SourceCodester Air Cargo Management System Master.php save_cargo_type sql injection
- CVE-2026-19786 francoisjacquet RosarioSIS Modules.php cross-site request forgery
- CVE-2026-19785 francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection
- CVE-2026-19784 francoisjacquet RosarioSIS Referrals.php DBUpdate authorization
- CVE-2026-19783 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-19782 WPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users
- CVE-2026-19781 Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-19780 Koha Eval Code Injection Remote Code Execution Vulnerability
- CVE-2026-1978 kalyan02 NanoCMS User Information pagesdata.txt direct request
- CVE-2026-19778 WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter
- CVE-2026-19775 Missing authorization in OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin
- CVE-2026-19774 BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-19773 libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2026-19771 Baicells EG3661M LuCI Web luci os command injection
- CVE-2026-19770 feedmob fm-mcp-servers Download Endpoint index.ts downloadReport server-side request forgery
- CVE-2026-1977 isaacwasserman mcp-vegalite-server visualize_data eval code injection
- CVE-2026-19769 Cross-site scripting in Ninja Forms – The Contact Form Builder That Grows With You