Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 847 of 1013.
- CVE-2026-16734 Stripe Payment Forms by WP Full Pay < 8.5.2 - Unauthenticated Payment Intent Amount Manipulation
- CVE-2026-16733 bahmutov find-cypress-specs Branch index.js shell.exec os command injection
- CVE-2026-16732 fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
- CVE-2026-16731 Authentication and authorization bypass via cryptographic timing side-channel attack in StationScout
- CVE-2026-16730 Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup
- CVE-2026-1673 Cross-site request forgery in BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
- CVE-2026-16729 undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
- CVE-2026-16728 undici vulnerable to downstream response desynchronization via retry interceptor
- CVE-2026-16727 Race condition in Armoury Crate
- CVE-2026-16726 Memory corruption in PANATERM for Multi
- CVE-2026-16724 Power System Integer Overflow
- CVE-2026-16723 Remote Code Execution in fastjson 1.2.68–1.2.83
- CVE-2026-16722 IBM i is Affected By An Unauthorized Privileges Vulnerability in SQL []
- CVE-2026-1672 Cross-site request forgery in BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
- CVE-2026-16713 IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution
- CVE-2026-1671 Activity Log for WordPress <= 1.2.8 - Missing Authorization to Sensitive Information Exposure via Log File
- CVE-2026-16708 IBM Db2 Mirror for i is affected by multiple vulnerabilities
- CVE-2026-16707 Power System Out-of-bounds Read
- CVE-2026-16706 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16703 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16702 Null dereference in Db2
- CVE-2026-1670 Honeywell CCTV Products Missing Authentication for Critical Function
- CVE-2026-16695 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities
- CVE-2026-16694 IBM i is Affected By Stored Cross-site Scripting for i
- CVE-2026-16693 IBM i is Affected By Cryptographic Algorithm Weakness in DCM []
- CVE-2026-16692 IBM i is Affected By Multiple Vulnerabilities in Simple Mail Transfer Protocol
- CVE-2026-16690 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-1669 Arbitrary File Read in Keras via HDF5 External Datasets
- CVE-2026-16689 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
- CVE-2026-16687 Power System Buffer Overflow
- CVE-2026-16686 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16685 Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute
- CVE-2026-16684 Cross-site scripting in Easy Property Listings
- CVE-2026-1668 Input Validation Vulnerability on Multiple Omada Switches
- CVE-2026-16678 IBM Power Systems Firmware Denial of Service
- CVE-2026-16675 Rockwell Automation FactoryTalk® Activation Manager - Privilege Escalation
- CVE-2026-16674 IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty
- CVE-2026-16673 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-16672 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-1667 Missing authorization in GEO Plugin by Squirrly SEO
- CVE-2026-16661 Power System Integer Overflow
- CVE-2026-16660 IBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ]
- CVE-2026-1666 Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter
- CVE-2026-16656 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16655 Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member
- CVE-2026-16654 Cross-site scripting in Avada (Fusion) Builder
- CVE-2026-16653 boazsegev facil.io Public Folder http.c http_sendfile2 path traversal
- CVE-2026-16652 Temporal Server Schedule exclusion search can cause excessive CPU consumption
- CVE-2026-16651 temporalio/sqlparser malformed MySQL version comments can cause a panic
- CVE-2026-16650 Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass
- CVE-2026-1665 Command Injection in nvm via NVM_AUTH_HEADER in wget code path
- CVE-2026-16649 Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value
- CVE-2026-16648 Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128
- CVE-2026-16647 Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111
- CVE-2026-16646 PanKM - Critical - Unsupported - SA-CONTRIB-2026-083
- CVE-2026-16645 PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088
- CVE-2026-16644 Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087
- CVE-2026-16643 Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086
- CVE-2026-16642 Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085
- CVE-2026-16641 Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084
- CVE-2026-16640 Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082
- CVE-2026-1664 Insecure Direct Object Reference (IDOR) via Header-Based Email Routing
- CVE-2026-16639 Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081
- CVE-2026-16638 Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080
- CVE-2026-16637 OPeNDAP Hyrax SSRF and Credential Disclosure via Unvalidated Redirects
- CVE-2026-16636 FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs
- CVE-2026-16635 Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field
- CVE-2026-16634 TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99
- CVE-2026-16632 boazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validation
- CVE-2026-16631 publint package-manager pack.js child_process.exec os command injection
- CVE-2026-16630 syncfusion ej2-javascript-ui-controls package.json child_process.exec os command injection
- CVE-2026-1663 Missing Authorization in GitLab
- CVE-2026-16629 danger danger-js CLI localGetFileAtSHA.ts danger.git.diffForFile os command injection
- CVE-2026-16628 oclif JIT Plugin Entry child_process.exec os command injection
- CVE-2026-16627 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-16626 JasperReports Server: XXE Injection Vulnerability (Unauthenticated)
- CVE-2026-16624 CVE-2026-16624
- CVE-2026-16623 Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)
- CVE-2026-16621 Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via PayPal Advanced Return Handler
- CVE-2026-16620 WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Select Mode
- CVE-2026-1662 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-16619 miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts
- CVE-2026-16618 ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
- CVE-2026-16617 Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description
- CVE-2026-16616 Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal
- CVE-2026-16615 Librest: weak random number generation in pkce implementation
- CVE-2026-16614 GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter
- CVE-2026-16613 GDPR Cookie Compliance < 5.1.0 - Cookie Deletion and Forced Logout via CSRF
- CVE-2026-16612 FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure
- CVE-2026-16611 Product Feed PRO for WooCommerce < 13.5.7 - Unauthenticated Feed Configuration Disclosure
- CVE-2026-16610 Code injection in Admin and Site Enhancements (ASE) Pro
- CVE-2026-1661 WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection
- CVE-2026-16608 Download Monitor < 5.2.6 - Unauthenticated Download Log Injection
- CVE-2026-16607 Authenticated local root privilege escalation vulnerability in openFT for Linux and Oracle Solaris
- CVE-2026-16606 Unauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris
- CVE-2026-16605 MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization
- CVE-2026-16604 Information disclosure in Passster
- CVE-2026-16603 Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API
- CVE-2026-16602 Content Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint
- CVE-2026-16601 CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action