Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 853 of 1013.
- CVE-2026-16057 Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library
- CVE-2026-16056 Contest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts
- CVE-2026-16055 Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_login
- CVE-2026-16054 Drag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce Oracle
- CVE-2026-16053 Path Traversal
- CVE-2026-16051 WPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install Action
- CVE-2026-1605 The Eclipse Jetty Server Artifact has a Gzip request memory leak
- CVE-2026-16049 Missing authorization in Mattermost
- CVE-2026-16048 Channel member roles accept out-of-scope roles
- CVE-2026-16047 Board channel linking without read channel permission validation
- CVE-2026-16046 Missing run-state validation on finished playbook runs
- CVE-2026-16045 Delegated OAuth tokens could revoke unrelated OAuth application authorizations
- CVE-2026-16044 Insufficient validation of guest board admin privileges on archive import
- CVE-2026-16042 LWS Optimize < 3.4 - Subscriber+ Cache Deletion
- CVE-2026-16041 MStore API < 4.21.0 - Unauthenticated Product Review Creation
- CVE-2026-16039 MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR
- CVE-2026-16038 MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways
- CVE-2026-16037 Callback Authentication Bypass via Timing Attack in PayTR's PayTR Virtual Pos iFrame API WHMCS Module
- CVE-2026-16036 miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding
- CVE-2026-16035 miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send
- CVE-2026-16033 Arbitrary file read+write on host via templates/ symlink in malicious image
- CVE-2026-16032 LWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring
- CVE-2026-16030 MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication
- CVE-2026-1603 Ivanti Endpoint Manager (EPM) Authentication Bypass
- CVE-2026-16028 Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table.
- CVE-2026-16027 Unauthenticated WebSocket-to-XAdES SSRF in Revenue Administration's E-Signature
- CVE-2026-16025 Improper Payment Validation in PayTR's PayTR Virtual Pos iFrame API WHMCS Module
- CVE-2026-16022 Command Injection in @oblique/cli
- CVE-2026-16020 Stored XSS Fazile BACAK's DefterAsist Financial Advisor Platform
- CVE-2026-1602 SQL injection in Endpoint Manager
- CVE-2026-16019 SQL Injection in Faydam Innovation's FAYDAM Datalogger
- CVE-2026-16017 mosaxiv clawlet cron Chat Tool tool_cron.go remove authorization
- CVE-2026-16016 poco-ai poco-claw task.py run_task server-side request forgery
- CVE-2026-16015 poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
- CVE-2026-16014 code-projects Hospital Bed Management System Login Form sql injection
- CVE-2026-16013 liftoff-sr CIPster cipepath.cc deserialize_symbolic out-of-bounds
- CVE-2026-1601 Totolink A7000R cstecgi.cgi setUploadUserData command injection
- CVE-2026-16009 itsourcecode Hospital Management System prescriptionorderdetail.php sql injection
- CVE-2026-16008 sagold json-schema-library propertyDependencies.ts parsePropertyDependencies prototype pollution
- CVE-2026-16007 Authenticated SQL Injection in AppFlowy
- CVE-2026-16006 Information disclosure in Armoury Crate
- CVE-2026-16005 Memory corruption in Armoury Crate
- CVE-2026-16004 Missing authorization in Armoury Crate
- CVE-2026-16003 Missing authorization in Armoury Crate
- CVE-2026-16002 Out-of-bounds Read in MZ Automation lib60870
- CVE-2026-16001 IesEngine stream-mode MAC forgery via length-dependent KDF split
- CVE-2026-16000 KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used
- CVE-2026-1600 Bdtask Bhojon All-In-One Restaurant Management System Add-to-Cart Submission Endpoint addtocart logic error
- CVE-2026-15999 AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication
- CVE-2026-15997 Native ARM SHA3 / SHAKE `restoreFullState` fails to detect size_t underflow in a crafted encoded state
- CVE-2026-15996 Denial of service in Enterprise Server
- CVE-2026-15995 Race condition in Cognos Analytics
- CVE-2026-15994 Privilege escalation in Commercial Vantage
- CVE-2026-15993 SQL injection in Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
- CVE-2026-15992 WP Password Policy <= 3.7.1 - Authenticated (Subscriber+) Privilege Escalation
- CVE-2026-15991 Missing authorization in File Manager
- CVE-2026-15990 Formidable Charts <= 2.0.1 - Unauthenticated Arbitrary File Read via 'frm_graph' Parameter
- CVE-2026-1599 Bdtask Bhojon All-In-One Restaurant Management System Checkout placeorder logic error
- CVE-2026-15989 Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
- CVE-2026-15988 AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match
- CVE-2026-15985 Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login
- CVE-2026-15984 QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters
- CVE-2026-15983 Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
- CVE-2026-15982 Missing authorization in Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit
- CVE-2026-15981 SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter
- CVE-2026-15980 MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token
- CVE-2026-1598 Bdtask Bhojon All-In-One Restaurant Management System User Information profile cross site scripting
- CVE-2026-15979 Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion
- CVE-2026-15978 CVE-2026-15978
- CVE-2026-15977 CVE-2026-15977
- CVE-2026-15976 CVE-2026-15976
- CVE-2026-15975 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-15974 CVE-2026-15974
- CVE-2026-15973 LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries
- CVE-2026-15972 Unauthenticated denial of service via unbounded external gRPC connection acceptance
- CVE-2026-15971 CVE-2026-15971
- CVE-2026-15970 L7 intention authorization bypass via custom public listener
- CVE-2026-1597 Bdtask SalesERP Administrative Endpoint improper authorization
- CVE-2026-15969 CVE-2026-15969
- CVE-2026-15968 Stored XSS vulnerability in MOVEit Transfer
- CVE-2026-15967 MOVEit Transfer refresh-token processing does not enforce updated account restrictions
- CVE-2026-15966 Improper CORS handling in MOVEit Transfer
- CVE-2026-15965 MaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter
- CVE-2026-15964 Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change
- CVE-2026-15963 Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Option
- CVE-2026-15962 Deserialization in Fluent Forms Pro Add On Pack
- CVE-2026-15961 Power System Information Disclosure
- CVE-2026-1596 D-Link DWR-M961 formLtefotaUpgradeQuectel sub_419920 command injection
- CVE-2026-15958 Easy Dropbox Integration < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX
- CVE-2026-15957 Denial of service in aws-sdk-rust
- CVE-2026-15955 Path traversal in Db2
- CVE-2026-15953 Path Traversal During Project Archive Import
- CVE-2026-15952 Improper Permission Assignment in Scheduler Service
- CVE-2026-15951 Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter
- CVE-2026-15950 Cross-site scripting in Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates
- CVE-2026-1595 itsourcecode Society Management System edit_student_query.php sql injection
- CVE-2026-15948 Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter
- CVE-2026-15947 Missing authorization in Search Atlas SEO – OTTO AI SEO Automation for WordPress
- CVE-2026-15946 Missing authorization in Search Atlas SEO – OTTO AI SEO Automation for WordPress
- CVE-2026-15945 Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2