Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 836 of 1013.
- CVE-2026-18064 NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference
- CVE-2026-18063 Job Postings <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' Parameter
- CVE-2026-18062 Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- CVE-2026-18061 Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin
- CVE-2026-1806 Cross-site scripting in Tour & Activity Operator Plugin for TourCMS
- CVE-2026-18059 Information disclosure in PixelYourSite Pro – Your smart PIXEL (TAG) Manager
- CVE-2026-18058 Missing authorization in Smart Connect Application
- CVE-2026-18057 Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection
- CVE-2026-18056 Auth bypass in HivePress Authentication
- CVE-2026-18052 ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters
- CVE-2026-18051 Path traversal in W3 Total Cache
- CVE-2026-18050 Events Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads
- CVE-2026-1805 Cross-site scripting in DA Media GigList
- CVE-2026-18049 WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo
- CVE-2026-18048 WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal
- CVE-2026-18047 Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash
- CVE-2026-18046 Cookie Consent < 0.0.10 - Subscriber+ MaxMind License Key Update
- CVE-2026-18044 Estatik Real Estate Plugin < 4.3.4 - Unauthenticated Arbitrary-Recipient Mail Relay via Signed-Value Mismatch
- CVE-2026-18042 WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation
- CVE-2026-18040 HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler
- CVE-2026-1804 Cross-site scripting in WDES Responsive Popup
- CVE-2026-18039 Essential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment
- CVE-2026-18038 nextlevelbuilder GoClaw jq Handler tools_invoke.go ExecTool.Execute information disclosure
- CVE-2026-18037 Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication
- CVE-2026-18036 NTRU leaks private key information by reducing secret values with a non-constant-time integer division
- CVE-2026-18035 User Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API
- CVE-2026-18032 WP Data Access < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization Bypass
- CVE-2026-18031 TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback
- CVE-2026-18030 Bricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Forms
- CVE-2026-1803 Ziroom ZHOME A0101 Dropbear SSH Service default credentials
- CVE-2026-18029 Insufficient validation of payment status in pretix-girosolution
- CVE-2026-18028 Missing authorization check in event quick setup view
- CVE-2026-18027 Path traversal in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
- CVE-2026-18024 PostgreSQL ascii() function reads past end of buffer
- CVE-2026-18023 Information disclosure in Armoury Crate
- CVE-2026-18022 pgvector buffer overflow via integer wraparound in IVFFlat index build on 32-bit systems
- CVE-2026-18021 Beaver Builder Page Builder <= 2.10.3.1 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2026-18020 IBM i is Affected By Multiple Vulnerabilities in NetServer
- CVE-2026-1802 Ziroom ZHOME A0101 zrMacClone.lua macAddrClone command injection
- CVE-2026-18019 Information disclosure in Chrome
- CVE-2026-18018 Other in Chrome
- CVE-2026-18017 Use after free in Chrome
- CVE-2026-18016 Security feature bypass in Chrome
- CVE-2026-18015 Security feature bypass in Chrome
- CVE-2026-18014 Security feature bypass in Chrome
- CVE-2026-18013 Other in Chrome
- CVE-2026-18012 Use after free in Chrome
- CVE-2026-18011 Information disclosure in Chrome
- CVE-2026-18010 Other in Chrome
- CVE-2026-1801 Libsoup: libsoup: http request smuggling via malformed chunk headers
- CVE-2026-18009 Other in Chrome
- CVE-2026-18008 Other in Chrome
- CVE-2026-18007 Other in Chrome
- CVE-2026-18006 Other in Chrome
- CVE-2026-18005 Information disclosure in Chrome
- CVE-2026-18004 Security feature bypass in Chrome
- CVE-2026-18003 Other in Chrome
- CVE-2026-18002 Security feature bypass in Chrome
- CVE-2026-18001 Information disclosure in Chrome
- CVE-2026-18000 Security feature bypass in Chrome
- CVE-2026-1800 Fonts Manager | Custom Fonts <= 1.2 - Unauthenticated SQL Injection via fmcfIdSelectedFnt parameter
- CVE-2026-17999 Race condition in Chrome
- CVE-2026-17998 Other in Chrome
- CVE-2026-17997 Security feature bypass in Chrome
- CVE-2026-17996 Security feature bypass in Chrome
- CVE-2026-17995 Memory corruption in Chrome
- CVE-2026-17994 Security feature bypass in Chrome
- CVE-2026-17993 Race condition in Chrome
- CVE-2026-17992 Information disclosure in Chrome
- CVE-2026-17991 Security feature bypass in Chrome
- CVE-2026-17990 Security feature bypass in Chrome
- CVE-2026-17989 Memory corruption in Chrome
- CVE-2026-17988 Security feature bypass in Chrome
- CVE-2026-17987 Security feature bypass in Chrome
- CVE-2026-17986 Security feature bypass in Chrome
- CVE-2026-17985 Security feature bypass in Chrome
- CVE-2026-17984 Security feature bypass in Chrome
- CVE-2026-17983 Other in Chrome
- CVE-2026-17982 Security feature bypass in Chrome
- CVE-2026-17981 Information disclosure in Chrome
- CVE-2026-17980 Information disclosure in Chrome
- CVE-2026-17979 Race condition in Chrome
- CVE-2026-17978 Information disclosure in Chrome
- CVE-2026-17977 Security feature bypass in Chrome
- CVE-2026-17976 Security feature bypass in Chrome
- CVE-2026-17975 Information disclosure in Chrome
- CVE-2026-17974 Security feature bypass in Chrome
- CVE-2026-17973 Information disclosure in Chrome
- CVE-2026-17972 Other in Chrome
- CVE-2026-17971 Memory corruption in Chrome
- CVE-2026-17970 Other in Chrome
- CVE-2026-1797 Truebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files
- CVE-2026-17969 Privilege escalation in Chrome
- CVE-2026-17968 Information disclosure in Chrome
- CVE-2026-17967 Use after free in Chrome
- CVE-2026-17966 Information disclosure in Chrome
- CVE-2026-17965 Other in Chrome
- CVE-2026-17964 Other in Chrome
- CVE-2026-17963 Information disclosure in Chrome
- CVE-2026-17962 Cross-site scripting in Chrome