Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 841 of 1013.
- CVE-2026-17585 Information disclosure in Royal Addons for Elementor – Addons and Templates Kit for Elementor
- CVE-2026-17583 Thermo Fisher Applied Biosystems Genetic Analyzers Missing Support for Integrity Check
- CVE-2026-17582 SQL injection in Slider Hero with Video Background, Animation
- CVE-2026-17581 WCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine
- CVE-2026-17580 Missing authorization in Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver…
- CVE-2026-1758 Session Fixation
- CVE-2026-17578 Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement
- CVE-2026-17577 SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter
- CVE-2026-17576 InfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key
- CVE-2026-17574 NULL Pointer Dereference in HDF5 via Invalid Variable-Length Datatype Type Tag
- CVE-2026-17573 Double Free in H5D__chunk_copy() in HDF5 via a Crafted Chunk-Index Size Field
- CVE-2026-17572 HDF5 SOHM List Index Heap Buffer Overflow
- CVE-2026-17571 Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'
- CVE-2026-17570 Missing authorization in Server
- CVE-2026-1757 Libxml2: memory leak leading to local denial of service in xmllint interactive shell
- CVE-2026-17569 Missing authorization in Server
- CVE-2026-17568 Privilege escalation in Server
- CVE-2026-17567 Missing authorization in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- CVE-2026-17566 Command injection in pgAdmin 4
- CVE-2026-17565 Animation Addons for Elementor < 2.7.2 - Unauthenticated Server-Side Request Forgery
- CVE-2026-17563 WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form
- CVE-2026-17562 IDOR in Zirve Security's AdisyonPro
- CVE-2026-17561 Unauthenticated RCE in Innotim Software's Logsign SIEM
- CVE-2026-1756 WP FOFT Loader <= 2.1.39 - Authenticated (Author+) Arbitrary File Upload
- CVE-2026-17559 Content Protector (Passster) < 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass
- CVE-2026-17557 Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding
- CVE-2026-17556 Path traversal in Enterprise Server
- CVE-2026-17555 WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter
- CVE-2026-17553 Privilege escalation in Shopping Cart & eCommerce Store
- CVE-2026-17552 Server-side request forgery in Plack::App::Prerender
- CVE-2026-17550 DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD
- CVE-2026-1755 Menu Icons by ThemeIsle <= 0.13.20 - Authenticated (Author+) Stored Cross-Site Scripting
- CVE-2026-17548 Missing authorization for viewing background jobs
- CVE-2026-17545 PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
- CVE-2026-17544 Out-of-bounds write in bccomp() via crafted operand and scale
- CVE-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout
- CVE-2026-17542 Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector
- CVE-2026-17541 Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure
- CVE-2026-17540 Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch
- CVE-2026-1754 personal-authors-category <= 0.3 - Reflected Cross-Site Scripting
- CVE-2026-17539 Null dereference in RTU500 series CMU firmware
- CVE-2026-17538 Missing authorization in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
- CVE-2026-17535 Velociraptor Multiple Crashes in NTFS Parser when applied to invalid NTFS Volumes
- CVE-2026-17534 Kimi Code FetchURL SSRF protection bypass via DNS-resolving hostnames and redirects
- CVE-2026-17533 All-in-One WP Migration and Backup < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import
- CVE-2026-17532 Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting
- CVE-2026-17531 unitedbyai droidclaw Unsigned Scheduled Callback goals.ts authorization
- CVE-2026-17530 AstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorization
- CVE-2026-1753 Gutena Forms < 1.6.1 - Contributor+ Arbitrary Limited Options Update
- CVE-2026-17529 AstrBotDevs AstrBot astr_main_agent.py authorization
- CVE-2026-17528 Cross-site scripting in nice-select2
- CVE-2026-17527 Privilege escalation in Red Hat Container Native Virtualization 4.14
- CVE-2026-17526 Privilege escalation in Red Hat Data Grid 8
- CVE-2026-17525 My Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup after XML conversion
- CVE-2026-17524 Path traversal in zip-lib
- CVE-2026-17523 can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet
- CVE-2026-17522 Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF
- CVE-2026-17520 Newsletters < 4.17 - Unauthenticated API Access via Predictable API Key
- CVE-2026-1752 Incorrect Authorization in GitLab
- CVE-2026-17518 Memory corruption in Router
- CVE-2026-17517 Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter
- CVE-2026-17515 MLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item
- CVE-2026-17514 ZJONSSON node-unzipper extract.js Extract path traversal
- CVE-2026-17513 ggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertion
- CVE-2026-17512 ggml-org whisper.cpp log_mel_spectrogram out-of-bounds
- CVE-2026-17511 This Power System update is being released to address
- CVE-2026-17510 Null dereference in Crypt::OpenSSL::PKCS12
- CVE-2026-1751 Missing Authorization in GitLab
- CVE-2026-17509 WPML Multilingual CMS <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’
- CVE-2026-17508 Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points
- CVE-2026-17507 MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender
- CVE-2026-17506 Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting
- CVE-2026-17505 TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting
- CVE-2026-17504 This Power System update is being released to address
- CVE-2026-17503 This Power System update is being released to address
- CVE-2026-17502 IBM i is Affected By Multiple Vulnerabilities in NetServer
- CVE-2026-17501 ggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform recursion
- CVE-2026-17500 ggml-org llama.cpp json-schema-to-grammar.cpp _visit_pattern null pointer dereference
- CVE-2026-1750 Privilege escalation in Ecwid by Lightspeed Ecommerce Shopping Cart
- CVE-2026-17499 IBM i is Affected By Multiple Vulnerabilities in Debug Server
- CVE-2026-17497 NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python
- CVE-2026-17496 NoteGen chat preview XSS via unsanitized AI/skill HTML rendering
- CVE-2026-17495 moment vulnerable to Path Traversal via crafted non-string locale name
- CVE-2026-17494 Power System Buffer Overflow
- CVE-2026-17491 IBM i is Affected By An Improper Privilege Management Vulnerability in OpenSSH
- CVE-2026-1749 Missing authorization in HikCentral Professional
- CVE-2026-17488 IBM i is Affected By An Improper Authentication Vulnerability in SST / DST
- CVE-2026-17487 IBM i is Information Disclosure
- CVE-2026-17485 IBM i is Affected By Denial of Service Vulnerability []
- CVE-2026-17484 IBM i is Information Disclosure
- CVE-2026-17483 IBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ]
- CVE-2026-17482 IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution
- CVE-2026-17481 IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution
- CVE-2026-1748 Missing authorization in Invoct – PDF Invoices & Billing for WooCommerce
- CVE-2026-17476 IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime
- CVE-2026-17475 IBM Planning Analytics Local is affected by security vulnerabilities
- CVE-2026-17473 IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution
- CVE-2026-17472 Multiple Vulnerabilities in IBM Concert Software
- CVE-2026-17470 IBM i is Affected By Denial of Service Vulnerabilities in Line Printer Daemon [, ]
- CVE-2026-1747 Authentication Bypass Using an Alternate Path or Channel in GitLab