Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 854 of 1013.
- CVE-2026-15943 Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change
- CVE-2026-15941 Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection
- CVE-2026-1594 itsourcecode Society Management System add_expenses.php sql injection
- CVE-2026-15939 Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST API
- CVE-2026-15937 Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint
- CVE-2026-15933 Cleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)
- CVE-2026-15932 Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal
- CVE-2026-15931 Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name
- CVE-2026-15930 Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision
- CVE-2026-1593 itsourcecode Society Management System edit_expenses_query.php sql injection
- CVE-2026-15929 SQL injection in SmartShare
- CVE-2026-15928 Cross-site scripting in XMLRPC-C
- CVE-2026-15927 Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation
- CVE-2026-15925 Improper TLS Hostname Verification in Snowflake Connector for Python
- CVE-2026-15924 Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets
- CVE-2026-15923 Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_size
- CVE-2026-15921 nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory
- CVE-2026-15920 Potential cross-site scripting via URLField values in the admin
- CVE-2026-1592 Stored XSS via Create New Layer Field found in Foxit PDF Editor Cloud
- CVE-2026-15918 VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection
- CVE-2026-15917 Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011
- CVE-2026-15916 Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010
- CVE-2026-15915 Multiple Vulnerabilities in IBM Concert Software
- CVE-2026-15913 Path Traversal in Fortra's GoAnywhere MFT Endpoint
- CVE-2026-15911 Confluent Kafka Python Improper TLS Certificate Validation
- CVE-2026-1591 Stored XSS via Attachments Feature in https://pdfonline.foxit.com/
- CVE-2026-15909 RafyMrX TOKO-ONLINE-ROTI add.php authorization
- CVE-2026-15907 H3C SecPath F1000-C8300 g=log_fw_nbc_mail_jsondata sql injection
- CVE-2026-15906 Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter
- CVE-2026-15905 Use after free in Chrome
- CVE-2026-15904 Use after free in Chrome
- CVE-2026-15903 Memory corruption in Chrome
- CVE-2026-15902 Use after free in Chrome
- CVE-2026-15901 Use after free in Chrome
- CVE-2026-15900 Use after free in Chrome
- CVE-2026-1590 itsourcecode School Management System index.php sql injection
- CVE-2026-15899 Use after free in Chrome
- CVE-2026-15897 Privilege escalation in Super Forms – Drag & Drop Form Builder
- CVE-2026-15896 Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter
- CVE-2026-15895 OS command injection in jsii-diff in AWS jsii
- CVE-2026-15894 Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement
- CVE-2026-15893 Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS
- CVE-2026-15892 Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service
- CVE-2026-15891 NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway
- CVE-2026-15890 AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization
- CVE-2026-1589 itsourcecode School Management System index.php sql injection
- CVE-2026-15889 Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
- CVE-2026-15887 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- CVE-2026-1588 jishenghua jshERP installByPath install path traversal
- CVE-2026-1587 Open5GS SGWC s11-handler.c sgwc_s11_handle_modify_bearer_request denial of service
- CVE-2026-1586 Open5GS SGWC s11-handler.c ogs_gtp2_f_teid_to_ip denial of service
- CVE-2026-1585 Privilege escalation in IJ Scan Utility
- CVE-2026-1584 Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder
- CVE-2026-15831 Generation of Incorrect Security Tokens in GitLab
- CVE-2026-15830 Potential denial-of-service vulnerability via nested geometry collections
- CVE-2026-15829 SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox
- CVE-2026-15827 Missing authorization in GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
- CVE-2026-15826 Auth bypass in User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- CVE-2026-15824 IBM DataPower Gateway Denial of Service
- CVE-2026-15823 Missing authorization in Builderall for WordPress
- CVE-2026-15822 IBM DataPower Gateway Denial of Service
- CVE-2026-15821 SureDash <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-15820 Cross-site scripting in Builderall for WordPress
- CVE-2026-1582 WP All Export <= 1.4.14 - Unauthenticated Sensitive Information Exposure via PHP Type Juggling
- CVE-2026-15819 IBM DataPower Gateway Out-of-bounds Write
- CVE-2026-15816 Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()
- CVE-2026-15815 CVE-2026-15815 CVE Record
- CVE-2026-15814 Uploading a crafted image causes excessive memory allocation in the Mattermost Server
- CVE-2026-15813 Kronosnet: kronosnet: memory corruption and out-of-bounds access via malformed network packet defragmentation
- CVE-2026-15812 Kronosnet: kronosnet: access control list bypass via link id spoofing on unencrypted dynamic links
- CVE-2026-15811 Kronosnet: kronosnet: encryption key exposure in memory after cryptographic configuration changes
- CVE-2026-15810 Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover
- CVE-2026-1581 wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection
- CVE-2026-15809 Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env
- CVE-2026-15806 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching
- CVE-2026-15804 MetaGuru｜HCM - SQL Injection
- CVE-2026-15803 XML external entity in Eclipse RDF4J
- CVE-2026-15802 Path traversal in WP Foodbakery
- CVE-2026-15801 Cri-o: cri-o: insufficient validation during container checkpoint restore
- CVE-2026-1580 ingress-nginx auth-method nginx configuration injection
- CVE-2026-15798 Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute
- CVE-2026-15797 Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_title
- CVE-2026-15796 Cross-site scripting in Builderall for WordPress
- CVE-2026-15795 Responsive Plus <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-15794 Cross-site scripting in Grid/List View for WooCommerce
- CVE-2026-15793 Git source checkout from a bundle file could lead to command injection
- CVE-2026-15792 Possible panic when incorrect parameters sent from frontend
- CVE-2026-15791 LLB file operation can be tricked to remove /tmp directory contents
- CVE-2026-15790 Cross-site scripting in Video Gallery – YouTube Gallery, Playlist & Video Grid
- CVE-2026-1579 PX4 Autopilot Missing authentication for critical function
- CVE-2026-15789 Malicious client can bypass destination directory validation on local sources upload
- CVE-2026-15788 WCOW cache mount source selector resolves NTFS junctions outside of cache root
- CVE-2026-15787 Cross-site scripting in Ultimate Addons for Elementor
- CVE-2026-15786 WP Encryption <= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Write via 'imploded' Parameter
- CVE-2026-15784 IBM DataPower Gateway Out-of-bounds Write
- CVE-2026-15783 Missing authorization in Enterprise Server
- CVE-2026-15782 Cross-site scripting in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
- CVE-2026-15781 IBM DataPower Gateway Buffer Overflow
- CVE-2026-15780 WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
- CVE-2026-1578 HP App – Potential Cross-Site Scripting