Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 844 of 1013.
- CVE-2026-1705 D-Link DSL-6641K Web ad_virtual_server_vdsl cross site scripting
- CVE-2026-17048 Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api
- CVE-2026-17047 IBM Db2 Mirror for i is vulnerable to Cross-Site Request Forgery []
- CVE-2026-17045 IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager
- CVE-2026-17044 WordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid
- CVE-2026-17043 IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager
- CVE-2026-17042 Power System Out-of-bounds Read
- CVE-2026-17040 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-1704 Missing authorization in Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- CVE-2026-17039 Missing authorization in Red Hat Certificate System 10
- CVE-2026-17038 Use of Hard-coded Credentials in drEryk Gabinet
- CVE-2026-17037 Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter
- CVE-2026-17033 CVE-2026-17033 CVE Record
- CVE-2026-17032 Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server
- CVE-2026-17031 Missing authorization in Checkout Field Manager (Checkout Manager) for WooCommerce
- CVE-2026-1703 Limited path traversal when installing wheel archives
- CVE-2026-17029 IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension
- CVE-2026-17028 Power System Out-of-bounds Read
- CVE-2026-17025 Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields
- CVE-2026-17024 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-17023 Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback
- CVE-2026-17022 Salon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard
- CVE-2026-17021 Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering
- CVE-2026-17020 Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure
- CVE-2026-1702 SourceCodester Pet Grooming Management Software User Management user.php improper authorization
- CVE-2026-17019 JetEngine < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG)
- CVE-2026-17018 CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR
- CVE-2026-17017 CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation
- CVE-2026-17016 Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via PDT Underpayment
- CVE-2026-17015 IBM i Denial of Service
- CVE-2026-17014 WP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzips
- CVE-2026-17013 WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart
- CVE-2026-17012 Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via Unvalidated receiver_email
- CVE-2026-17011 Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection
- CVE-2026-17010 Saitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post Meta
- CVE-2026-1701 itsourcecode School Management System index.php sql injection
- CVE-2026-17009 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-17008 Quick PayPal Payments <= 5.7.50 - Unauthenticated Payment Bypass via PayPal IPN
- CVE-2026-17007 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-17006 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-17005 Horizontal Scrolling Announcements <= 2.6 - Contributor+ Stored XSS via Style Field
- CVE-2026-17004 IBM i is Affected By Multiple Vulnerabilities in Host Servers
- CVE-2026-17003 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-17001 Cross-site scripting in Import and export users and customers
- CVE-2026-17000 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-1700 projectworlds House Rental and Property Listing sms.php cross site scripting
- CVE-2026-16999 XXE in Ministry of Justice's UYAP Document Editor
- CVE-2026-16997 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16996 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16993 DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory
- CVE-2026-16992 Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication
- CVE-2026-16991 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16990 Payment Button for PayPal <= 1.2.3.44 - Unauthenticated Payment Price Manipulation
- CVE-2026-1699 Supply chain in Eclipse Theia - Website
- CVE-2026-16989 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16988 GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint
- CVE-2026-16987 IBM i is Affected By An Improper Validation Vulnerability in PASE []
- CVE-2026-16986 Booking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost Parameters
- CVE-2026-16985 Squeeze < 1.7.12 - Author+ Arbitrary File Upload
- CVE-2026-16984 WP Legal Pages < 3.7.1 - Unauthenticated API Secret Disclosure
- CVE-2026-16983 Gutentor < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST API
- CVE-2026-16982 IBM i is Affected By Multiple Vulnerabilities in Host Servers
- CVE-2026-16981 DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR
- CVE-2026-16980 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-1698 HTTP Host header vulnerability in WebClient and WebScheduler web apps
- CVE-2026-16979 SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration
- CVE-2026-16977 Form Maker by 10Web < 1.15.45 - Subscriber+ SQL Injection via display_name
- CVE-2026-16975 IBM i is Affected By A Remote Code Execution Vulnerability []
- CVE-2026-16974 Cross-site scripting in Kirki – Freeform Page Builder, Website Builder & Customizer
- CVE-2026-16973 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16972 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16971 DFIR-IRIS Missing Brute Force Protection in OTP Validation
- CVE-2026-16970 DFIR-IRIS Insufficient Logout Implementation
- CVE-2026-1697 Use of unsecure cookies for GraphicalData web service and WebClient web app
- CVE-2026-16969 DFIR-IRIS Stored XSS in Assets
- CVE-2026-16968 GeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users
- CVE-2026-16967 IBM i is Affected By Multiple SQL Vulnerabilities [, ]
- CVE-2026-16966 Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content
- CVE-2026-16965 Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status
- CVE-2026-16964 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16962 Tamara Checkout <= 1.9.9.20 - Unauthenticated Order Status Manipulation
- CVE-2026-16961 IBM i is Affected By SQL Injection Vulnerability in Db2 Mirror []
- CVE-2026-16960 Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure
- CVE-2026-1696 Missing security HTTP headers
- CVE-2026-16959 Media Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connector
- CVE-2026-16958 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16957 Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure
- CVE-2026-16956 IBM Db2 Mirror for i is vulnerable to OS command injection []
- CVE-2026-16955 AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription
- CVE-2026-16954 AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens
- CVE-2026-16953 AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie
- CVE-2026-16952 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16951 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16950 Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_products
- CVE-2026-1695 XSS vulnerability upon unsuccessful authentication
- CVE-2026-16949 Term Pages < 2.0.0 - Unauthenticated SQL Injection via tp_lookup
- CVE-2026-16948 Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure
- CVE-2026-16947 Server-side request forgery in Total processing card payments for WooCommerce
- CVE-2026-16946 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16945 Vulnerabilities in IBM AIX and PowerVM VIOS