Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 848 of 1013.
- CVE-2026-16600 SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image
- CVE-2026-1660 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-16599 Denial of Service in GNU wget
- CVE-2026-16597 GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields
- CVE-2026-16596 WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter
- CVE-2026-16595 WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure
- CVE-2026-16594 WP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure
- CVE-2026-16593 WP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings
- CVE-2026-16592 WP Directory Kit <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes
- CVE-2026-16591 WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields
- CVE-2026-16590 WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure
- CVE-2026-1659 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-16589 WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter
- CVE-2026-16588 WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter
- CVE-2026-16587 Missing authorization in Advanced Form Integration — Connect Forms to 200+ Apps
- CVE-2026-16586 SQL injection in Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- CVE-2026-16585 Path traversal in Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
- CVE-2026-16584 AWS API MCP Server Security Policy Bypass via Startup Failure
- CVE-2026-16583 Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload
- CVE-2026-16582 Missing authorization in Booking for Appointments and Events Calendar – Amelia
- CVE-2026-16581 Inclusion of sensitive information in source code in igloohome Smart Lock Mobile Application
- CVE-2026-1658 Content spoofing vulnerability discovered in OpenText™ Directory Services
- CVE-2026-16578 Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route
- CVE-2026-16577 Dokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount
- CVE-2026-16576 Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API
- CVE-2026-16575 Dokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint
- CVE-2026-16574 Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint
- CVE-2026-16573 Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload
- CVE-2026-16572 LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie
- CVE-2026-16570 NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback
- CVE-2026-1657 EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint
- CVE-2026-16569 ShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update
- CVE-2026-16568 ShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR
- CVE-2026-16567 Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle
- CVE-2026-16565 Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API
- CVE-2026-16564 Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint
- CVE-2026-16563 Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint
- CVE-2026-16562 WP Statistics < 14.16.10 - Subscriber+ Sensitive Data Disclosure via Metabox AJAX Handlers
- CVE-2026-16561 Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure
- CVE-2026-16560 389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued rdn
- CVE-2026-1656 Business Directory Plugin <= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing Modification
- CVE-2026-16559 YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload
- CVE-2026-16558 YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema
- CVE-2026-16557 Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins
- CVE-2026-16554 Integer Overflow Leading to Heap Buffer Overflow in cJSON
- CVE-2026-16553 Insufficiently Protected Credentials in GitLab
- CVE-2026-16551 Denial-of-Service in OpenCanary's MongoDB module
- CVE-2026-1655 Missing authorization in EventPrime – Events Calendar, Bookings and Tickets
- CVE-2026-16548 Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response Endpoint
- CVE-2026-16547 REST API Log < 1.7.1 - Unauthenticated Sensitive Log Data Disclosure via Download Endpoint
- CVE-2026-16546 Wired Impact Volunteer Management < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp
- CVE-2026-16544 Missing authorization in Red Hat Ansible Automation Platform 2
- CVE-2026-16543 Kong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collision
- CVE-2026-16542 Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar
- CVE-2026-16541 Simply Schedule Appointments < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST Endpoints
- CVE-2026-16540 Missing authorization in Simply Schedule Appointments
- CVE-2026-1654 Peter's Date Countdown <= 2.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
- CVE-2026-16539 SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication
- CVE-2026-16538 TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up
- CVE-2026-16537 Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode
- CVE-2026-16536 Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id
- CVE-2026-16535 Link Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabel
- CVE-2026-16534 Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import
- CVE-2026-16532 Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form
- CVE-2026-16531 Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet
- CVE-2026-16530 Pcp: pcp: remote denial of service and information leakage
- CVE-2026-1653 Denial of service in Smart Connect
- CVE-2026-16529 Pcp: pcp: denial of service due to signed integer overflow
- CVE-2026-16528 Information disclosure in Router
- CVE-2026-16527 Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules
- CVE-2026-16526 Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability
- CVE-2026-16524 Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection
- CVE-2026-16521 Supermicro BMC's syslog feature contains a command injection vulnerability
- CVE-2026-16520 SQL injection in Genian NAC V4.0
- CVE-2026-1652 Memory corruption in Smart Connect
- CVE-2026-16519 GeoVision GV-IP Device Utility DLL Search Order Hijacking Vulnerability
- CVE-2026-16517 Libarchive: libarchive: signed integer overflow in archive_write_zip_header
- CVE-2026-16516 wolfSSH ECDSA host key curve not validated against negotiated algorithm
- CVE-2026-16515 Denial of service in zephyr
- CVE-2026-16514 Out-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemoved
- CVE-2026-16513 Missing write validation of user-supplied handle pointer in the RTIO syscall verifier allows arbitrary kernel write
- CVE-2026-16512 Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames
- CVE-2026-1651 Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter
- CVE-2026-16504 VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities
- CVE-2026-16503 VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities
- CVE-2026-16502 Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode
- CVE-2026-1650 MDJM Event Management <= 1.7.8.1 - Missing Authorization to Unauthenticated Arbitrary Custom Event Field Deletion
- CVE-2026-16498 terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
- CVE-2026-16497 Denial of service in Triton Inference Server
- CVE-2026-16496 terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user
- CVE-2026-16495 Cross-site scripting in Countdown Timer – Widget Countdown
- CVE-2026-16494 Missing Authorization in GitLab
- CVE-2026-16493 Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)
- CVE-2026-16492 umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection
- CVE-2026-16491 CVE-2026-16491 CVE Record
- CVE-2026-16490 itsourcecode Hospital Management System prescription.php sql injection
- CVE-2026-1649 Community Events <= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ce_venue_name' Parameter
- CVE-2026-16489 jsforce SFDX Connection Registry sfdx.js _execCommand os command injection
- CVE-2026-16488 QUSETIONS MiniCode-Python Project File config.py subprocess.Popen os command injection
- CVE-2026-16486 SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting