Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 826 of 1013.
- CVE-2026-19271 Blind LDAP Injection in Sign-In Endpoint in TÜBİTAK BİLGEM's Liderahenk
- CVE-2026-19270 Hulupeep mcp-ui-probe Journey/Usage JourneyStorage.ts usage_stats path traversal
- CVE-2026-1927 Missing authorization in Greenshift – animation and page builder blocks
- CVE-2026-19268 abdullah1854 MCPGateway Claude Usage Range Endpoint claude-usage.ts getUsageByDateRange command injection
- CVE-2026-19267 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
- CVE-2026-19266 Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection
- CVE-2026-19264 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover
- CVE-2026-19263 INQUIRELAB mcp-bridge-api Servers Endpoint mcp-bridge.js command injection
- CVE-2026-1926 Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation
- CVE-2026-19259 Memory corruption in libiec61850
- CVE-2026-19253 Path traversal in Cache Enabler
- CVE-2026-19251 Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity
- CVE-2026-1925 Missing authorization in EmailKit – Email Customizer for WooCommerce & WP
- CVE-2026-19248 Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt
- CVE-2026-19246 HKUDS nanobot Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgery
- CVE-2026-19245 HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure
- CVE-2026-19244 HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control
- CVE-2026-19243 HKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injection
- CVE-2026-1924 Aruba HiSpeed Cache <= 3.0.4 - Cross-Site Request Forgery to Plugin Settings Reset
- CVE-2026-19234 Power System Buffer Overflow
- CVE-2026-19233 Server-side request forgery in EcoStruxure™ IT Data Center Expert (Formerly known as StruxureWare Data Center Expert)
- CVE-2026-19232 Adobe Experience Manager | Incorrect Authorization (CWE-863)
- CVE-2026-19231 SourceCodester Simple Doctors Appointment System ajax.php delete_appointment sql injection
- CVE-2026-19230 SourceCodester Photo Share Website Comment Input Box ajax.php save_upload cross site scripting
- CVE-2026-1923 Social Rocket – Social Sharing Plugin <= 1.3.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via id
- CVE-2026-19229 SourceCodester Online Clothing Store Dreamweaver Metadata Files _notes file information disclosure
- CVE-2026-19228 Authorization Bypass Through User-Controlled Key in GitLab
- CVE-2026-19226 Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings
- CVE-2026-19225 Defender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on Multisite
- CVE-2026-19224 Hummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite
- CVE-2026-19223 Smush < 4.3.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite
- CVE-2026-19222 Forminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass
- CVE-2026-19221 Forminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite
- CVE-2026-19220 Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation
- CVE-2026-1922 Cross-site scripting in The Events Calendar Shortcode & Block
- CVE-2026-19219 DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-19218 Password Reset Code Brute Force Leading to Account Takeover in AKIN Software's MyRezzta
- CVE-2026-19217 Royal Elementor Addons < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget
- CVE-2026-19213 WonderTrader Pending Order TraderAdapter.h _undone_qty behavioral workflow
- CVE-2026-19212 WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variable
- CVE-2026-19211 SourceCodester Photo Share Website ajax.php signup sql injection
- CVE-2026-19210 SourceCodester Photo Share Website ajax.php save_upload unrestricted upload
- CVE-2026-1921 Loco Translate <= 2.8.2 - Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter
- CVE-2026-19209 SourceCodester Photo Share Website index.php home cross site scripting
- CVE-2026-19208 WonderTrader TraderDD.cpp queryTrades behavioral workflow
- CVE-2026-19207 PHPGurukul Company Visitor Management System manage-newvisitors.php cross site scripting
- CVE-2026-19206 MZ Automation libiec61850 ASDU Element sv_subscriber.c SVReceiver_stopThreadless heap-based overflow
- CVE-2026-19205 User Enumeration in GastroMenum's GastroMenum Web Panel
- CVE-2026-19204 Denial of service in Eclipse Jetty
- CVE-2026-19203 Other in Eclipse Jetty
- CVE-2026-19202 Token Cache Reuse in mcp-toolbox-sdk-python
- CVE-2026-19201 Denial of Service via Unbounded Recursion in go-attestation Windows SIPA Parser
- CVE-2026-19200 Velociraptor Analyst overwrites live built-in artifacts through verify()
- CVE-2026-1920 Booktics <= 1.0.16 - Missing Authorization to Addon Plugin Installation
- CVE-2026-19198 Akaunting 3.1.21 - Improper authorization in BulkActions handle dispatch
- CVE-2026-19197 Broken access control in dashboard snapshots
- CVE-2026-19196 SourceCodester Photo Share Website ajax.php login sql injection
- CVE-2026-19195 V-Secure Jingyun Antivirus Kernel Driver ZyArk.sys access control
- CVE-2026-19193 Jiangmin Antivirus Minifilter Port kvcore.sys MessageNotifyCallback access control
- CVE-2026-19192 DeepCool DisplayService DeepCoolDisplayService.exe access control
- CVE-2026-19191 StableBit DrivePool DrivePoolService DrivePool.Service.exe permission
- CVE-2026-19190 StableBit Scanner ScannerService Scanner.Service.exe permission
- CVE-2026-1919 Booktics <= 1.0.16 - Missing Authorization to Get Items via REST API endpoints
- CVE-2026-19189 Power Sofware PowerISO Kernel Driver scdemu.sys privileges management
- CVE-2026-19188 Haiwell IoT Cloud HMI Gateway OS Command Injection
- CVE-2026-19186 Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write
- CVE-2026-19185 Memory corruption in zephyr
- CVE-2026-19184 Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatch
- CVE-2026-19182 Missing authorization in Horizon
- CVE-2026-1918 IBM Sterling B2B Integrator and IBM Sterling File Gateway store sensitive information in a log file
- CVE-2026-19179 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
- CVE-2026-19178 TS4500 Tape Library Race Condition
- CVE-2026-19177 Security feature bypass in Chrome
- CVE-2026-19176 Use after free in Chrome
- CVE-2026-19175 Use after free in Chrome
- CVE-2026-19174 Integer overflow in Chrome
- CVE-2026-19173 Memory corruption in Chrome
- CVE-2026-19172 Use after free in Chrome
- CVE-2026-19171 Use after free in Chrome
- CVE-2026-19170 Use after free in Chrome
- CVE-2026-1917 Login Disable - Less critical - Access bypass - SA-CONTRIB-2026-008
- CVE-2026-19169 Privilege escalation in Chrome
- CVE-2026-19168 Security feature bypass in Chrome
- CVE-2026-19167 Integer overflow in Chrome
- CVE-2026-19166 Use after free in Chrome
- CVE-2026-19165 Use after free in Chrome
- CVE-2026-19164 Security feature bypass in Chrome
- CVE-2026-19163 Use after free in Chrome
- CVE-2026-19162 Memory corruption in Chrome
- CVE-2026-19161 Information disclosure in Chrome
- CVE-2026-19160 Information disclosure in Chrome
- CVE-2026-1916 Missing authorization in WPGSI: Spreadsheet Integration
- CVE-2026-19159 Use after free in Chrome
- CVE-2026-19158 Use after free in Chrome
- CVE-2026-19157 Memory corruption in Chrome
- CVE-2026-19156 Memory corruption in Chrome
- CVE-2026-19155 Use after free in Chrome
- CVE-2026-19154 Use after free in Chrome
- CVE-2026-19153 Security feature bypass in Chrome
- CVE-2026-19152 Security feature bypass in Chrome