Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 833 of 1013.
- CVE-2026-18415 Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frames
- CVE-2026-18414 Out-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc_sequence buffer size validation
- CVE-2026-18413 Out-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc_sequence buffer size validation
- CVE-2026-18412 The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability
- CVE-2026-18411 Use of hard-coded cryptographic key in Acrisure KARR BT and DR-100
- CVE-2026-1841 PixelYourSite <= 11.2.0 - Unauthenticated Stored Cross-Site Scripting
- CVE-2026-18409 Cross-site scripting in WPForms Pro
- CVE-2026-18408 PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client
- CVE-2026-18406 SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload
- CVE-2026-18405 Jeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- CVE-2026-18404 Cross-site scripting in Social Chat – Click To Chat App Button
- CVE-2026-18403 LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB
- CVE-2026-18402 Cross-site scripting in SureDash – Community, Courses & Member Dashboard
- CVE-2026-18401 jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service
- CVE-2026-18400 Cross-site scripting in Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider
- CVE-2026-1840 Missing authentication for critical function in Hubbell Aclara Metrum Cellular Web Interface
- CVE-2026-18397 SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability
- CVE-2026-18395 Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes
- CVE-2026-18394 Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration
- CVE-2026-18393 Ffmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursor
- CVE-2026-18391 WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection
- CVE-2026-18390 Command Injection in Ministry of Justice's UYAP Document Editor
- CVE-2026-1839 Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers
- CVE-2026-18387 Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter
- CVE-2026-18386 Path traversal in WP BackItUp Community Edition
- CVE-2026-18385 Code injection in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- CVE-2026-18382 Server-side request forgery in Cost Management 4
- CVE-2026-18381 Server-side request forgery in Cost Management 4
- CVE-2026-1838 Hostel <= 1.1.6 - Reflected Cross-Site Scripting via 'shortcode_id' Parameter
- CVE-2026-18378 Server-side request forgery in Cost Management 4
- CVE-2026-18374 Memory corruption in glibc
- CVE-2026-18372 CSS injection in M-Files Web
- CVE-2026-18371 HTML injection in M-Files Web
- CVE-2026-18370 Heap-based buffer overflow in entr
- CVE-2026-1837 libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2
- CVE-2026-18369 Server-side request forgery in Red Hat Certificate System 10
- CVE-2026-18368 Heap buffer overflow in Modbusgwd
- CVE-2026-18367 Privilege escalation in Sophos Endpoint for macOS
- CVE-2026-18366 Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator
- CVE-2026-18365 Zportals < 6.4.2 - Subscriber+ User Email Disclosure
- CVE-2026-18364 Zportals < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update
- CVE-2026-18363 Weak password recovery mechanism in osTicket by Enhancesoft LLC
- CVE-2026-18362 DFIR-IRIS Missing Brute Force Protection in User Authentication
- CVE-2026-18361 DFIR-IRIS Stored XSS in Datastore Upload
- CVE-2026-18360 DFIR-IRIS Stored XSS in Custom Attributes
- CVE-2026-1836 Stored credentials in Redmine
- CVE-2026-18359 Server-Side Request Forgery (SSRF) in eScriptorium
- CVE-2026-18358 Denial of service in Red Hat Enterprise Linux 10
- CVE-2026-18357 WPC Order Tip for WooCommerce < 3.3.1 - Unauthenticated Order Data Disclosure
- CVE-2026-18356 Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email
- CVE-2026-18355 Integer overflow in Red Hat Directory Server 11.5 E4S for RHEL 8
- CVE-2026-18353 Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass
- CVE-2026-18352 User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter
- CVE-2026-18351 Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter
- CVE-2026-1835 lcg0124 BootDo cross-site request forgery
- CVE-2026-18349 SAMA5D44 Fault Injection Vulnerability
- CVE-2026-18348 Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins
- CVE-2026-18347 Missing authorization in Kirki – Freeform Page Builder, Website Builder & Customizer
- CVE-2026-18346 TikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter
- CVE-2026-18345 Missing authorization in WP User Manager – User Profile Builder & Membership
- CVE-2026-18344 Responsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameter
- CVE-2026-18343 IBM i is Affected By An Improper Privilege Management Vulnerability
- CVE-2026-18341 IBM i is Affected By Buffer Overflow Vulnerability []
- CVE-2026-1834 Ibtana - WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2026-18335 Server-side request forgery in Kirki – Freeform Page Builder, Website Builder & Customizer
- CVE-2026-18331 Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter
- CVE-2026-18330 Hardcoded Shared RSA-1024 Private Key in Web Login in TP-Link RE305 and Archer C7
- CVE-2026-1833 Missing authorization in WaMate Confirm – Order Confirmation
- CVE-2026-18329 NGINX ngx_http_js_module vulnerability
- CVE-2026-18328 Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter
- CVE-2026-18325 Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field
- CVE-2026-18324 Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
- CVE-2026-18323 Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)
- CVE-2026-18322 Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator
- CVE-2026-18321 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in ntpsec
- CVE-2026-18320 CVE-2026-18320
- CVE-2026-1832 ThriveDesk <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Cache Deletion
- CVE-2026-18318 IBM i Information Disclosure
- CVE-2026-18317 Missing authorization in Foxtool All-in-One: Contact chat button, Custom login, Media optimize images
- CVE-2026-18316 Missing authorization in Solace Extra
- CVE-2026-18315 Missing authorization in TrueBooker – Appointment Booking and Scheduler System
- CVE-2026-18313 rpcapd memory leak in libpcap before 1.10.7
- CVE-2026-18312 CVE-2026-18312
- CVE-2026-18311 CVE-2026-18311
- CVE-2026-1831 YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation
- CVE-2026-18309 GIMP APNG File Parsing Integer Overflow Remote Code Execution Vulnerability
- CVE-2026-18308 GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability
- CVE-2026-18307 GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-18306 GIMP SGI File Parsing Integer Overflow Remote Code Execution Vulnerability
- CVE-2026-18305 GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability
- CVE-2026-18304 GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability
- CVE-2026-18303 GIMP TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-18302 GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-18301 GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability
- CVE-2026-18300 GIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerability
- CVE-2026-1830 Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload
- CVE-2026-18299 GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability
- CVE-2026-18298 GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-18297 GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-18296 GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability