Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 832 of 1013.
- CVE-2026-18545 Server-side request forgery in Langflow OSS
- CVE-2026-18544 Portieris is vulnerable to Image Policy Bypass via Unvalidated ownerReference
- CVE-2026-18541 IBM Planning Analytics Local is affected by security vulnerabilities
- CVE-2026-18540 undici vulnerable to downstream response splitting via retry interceptor
- CVE-2026-1854 Post Flagger <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slug' Shortcode Attribute
- CVE-2026-18537 IBM Maximo Application Suite - Location Service for Esri Component Code Execution
- CVE-2026-18536 Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP
- CVE-2026-18534 Address bar spoofing risk in affected iOS versions of Arc Search
- CVE-2026-18533 IBM Maximo Application Suite - Location Service for Esri Component Code Execution
- CVE-2026-18531 Weak cryptography in Maximo Application Suite
- CVE-2026-1853 Cross-site scripting in BuddyHolis ListSearch
- CVE-2026-18529 IBM Maximo Application Suite - Location Service for Esri Component Code Execution
- CVE-2026-18527 Privilege escalation in Administration Runtime Expert for i
- CVE-2026-18526 HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation
- CVE-2026-1852 Product Pricing Table by WooBeWoo <= 1.1.0 - Cross-Site Request Forgery to Stored XSS and Pricing Table Deletion
- CVE-2026-18517 IBM Maximo Application Suite - Location Service for Esri Component Improper Access Control
- CVE-2026-18516 Improper Encoding or Escaping of Output in Crafty Controller
- CVE-2026-18515 IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.
- CVE-2026-18513 IBM Maximo Application Suite - Location Service for Esri Component Improper Privilege Management
- CVE-2026-18512 Cross-site scripting in TranslatePress – Translate Multilingual sites with AI Translation
- CVE-2026-18511 IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension
- CVE-2026-18510 TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- CVE-2026-1851 iVysilani Shortcode <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
- CVE-2026-18509 IBM i is Affected By A Prvilege Escalation Vulnerability []
- CVE-2026-18508 Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite
- CVE-2026-18505 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
- CVE-2026-18504 fastify vulnerable to schema validation bypass via root primitive coercion mismatch
- CVE-2026-18503 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()
- CVE-2026-18501 UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution
- CVE-2026-18500 @fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key
- CVE-2026-1850 Denial of service in MongoDB Server
- CVE-2026-18499 IBM WebSphere Application Server Liberty is affected by a privilege escalation
- CVE-2026-18497 The nothings stb TrueType library contains a heap buffer overflow vulnerability
- CVE-2026-18496 Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action
- CVE-2026-18495 Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough
- CVE-2026-18490 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
- CVE-2026-1849 Mongod can run out of stack memory when expressions create deeply nested documents
- CVE-2026-18489 IBM ContextForge Translate is affected by cross-client credential context confusion
- CVE-2026-18488 Cross-site scripting in Blocksy Companion
- CVE-2026-18487 Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()
- CVE-2026-18486 IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter execution
- CVE-2026-18485 Local Privilege Escalation in NI-PAL
- CVE-2026-18482 CVE-2026-18482
- CVE-2026-18481 Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft
- CVE-2026-18480 SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover
- CVE-2026-1848 Connections received from the proxy port may not count towards total accepted connections
- CVE-2026-18478 Stored XSS in Magnolia CMS
- CVE-2026-18477 Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape
- CVE-2026-18474 WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category
- CVE-2026-18473 WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter
- CVE-2026-18470 Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response
- CVE-2026-1847 MongoDB Server may crash when inserting large documents
- CVE-2026-18469 Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Code Brute Force
- CVE-2026-18468 Auth bypass in Login & Register Forms
- CVE-2026-18467 Privilege escalation in Paytium: Mollie payment forms & donations
- CVE-2026-18466 WP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation
- CVE-2026-18465 WP Maps Pro < 6.1.3 - Unauthenticated Local File Inclusion
- CVE-2026-18464 WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service
- CVE-2026-18462 Integer overflow in Connext Professional
- CVE-2026-18461 Memory corruption in Connext Professional
- CVE-2026-18460 Memory corruption in Connext Professional
- CVE-2026-18459 Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existing Functionality.
- CVE-2026-18458 Memory corruption in Connext Professional
- CVE-2026-18457 Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers.
- CVE-2026-18453 Null dereference in Red Hat Directory Server 11.5 E4S for RHEL 8
- CVE-2026-18452 Rich Source｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials
- CVE-2026-18451 Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token
- CVE-2026-18450 Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability
- CVE-2026-1845 Real Estate Pro <= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings
- CVE-2026-18449 Supermicro BMC contains a SMCRAKP Fixed Key vulnerability
- CVE-2026-18446 fast-uri vulnerable to host confusion via backslash authority introducer
- CVE-2026-18445 Integer Overflow Vulnerability Resulting in an Out of Bounds Write in NI LabVIEW
- CVE-2026-18444 Integer Conversion Vulnerability Resulting in an Out of Bounds Read in NI LabVIEW
- CVE-2026-18443 SQL injection in Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet)
- CVE-2026-18442 SQL injection in WCFM Marketplace – Multivendor Marketplace for WooCommerce
- CVE-2026-18441 Missing authorization in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
- CVE-2026-1844 PixelYourSite PRO <= 12.4.0.2 - Unauthenticated Stored Cross-Site Scripting
- CVE-2026-18439 Missing authorization in Tutor LMS – eLearning and online course solution
- CVE-2026-18438 File upload in Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!
- CVE-2026-18437 MailPress <= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates
- CVE-2026-18436 MailerPress <= 1.5.0 - Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint
- CVE-2026-18435 Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute
- CVE-2026-18433 Incorrect Authorization in GitLab
- CVE-2026-18432 Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter
- CVE-2026-18431 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
- CVE-2026-18430 HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason
- CVE-2026-1843 Super Page Cache <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting via Activity Log
- CVE-2026-18428 SQL Query Validation Bypass in OpenSearch Direct Query
- CVE-2026-18427 @fastify/static vulnerable to route guard bypass via non-canonical path segments
- CVE-2026-18426 Missing authorization in Concrete CMS
- CVE-2026-18425 Missing authorization in Concrete CMS
- CVE-2026-18424 Server-side request forgery in Concrete CMS
- CVE-2026-18423 Missing authorization in Concrete CMS
- CVE-2026-18422 Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation
- CVE-2026-18421 Missing authorization in Concrete CMS
- CVE-2026-18420 RCE via Prototype Pollution in OpenSearch Dashboards
- CVE-2026-1842 HyperCloud Improper Refresh Token Validation and Access Token Invalidation Allows Long-Term Unauthorized Access
- CVE-2026-18418 Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name
- CVE-2026-18417 Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error
- CVE-2026-18416 Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri)