Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 856 of 1013.
- CVE-2026-15675 code-projects Online Job Portal EditUser.php sql injection
- CVE-2026-15673 SQL injection in SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery
- CVE-2026-15672 itsourcecode Electronic Judging System add_judges.php sql injection
- CVE-2026-15671 SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter
- CVE-2026-15670 SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
- CVE-2026-1567 IBM InfoSphere Information Server is affected by an XML external entity injection (XXE) vulnerability
- CVE-2026-15669 louisho5 picobot exec Tool exec.go ExecTool.Execute os command injection
- CVE-2026-15668 louisho5 picobot web Tool web.go WebTool.Execute server-side request forgery
- CVE-2026-15667 Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
- CVE-2026-15665 Cross-site scripting in Fluent Support – Helpdesk & Customer Support Ticket System
- CVE-2026-15664 Cross-site scripting in Quill Forms | Conversational Multi Step Forms, Surveys & quizzes
- CVE-2026-15663 Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key
- CVE-2026-15662 Advanced Woo Labels <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parameter
- CVE-2026-15661 IBM Concert Software Improper Output Neutralization for Logs
- CVE-2026-15660 Missing authorization in SEO Booster
- CVE-2026-1566 LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation
- CVE-2026-15658 foreUP customer REST API allows unauthenticated endpoint access
- CVE-2026-15657 foreUP customer REST API allows authenticated users to read cleartext payment-processor merchant credentials
- CVE-2026-15656 Information disclosure in Maximo Application Suite
- CVE-2026-15653 Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter
- CVE-2026-15652 Easy Accordion <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block Attribute
- CVE-2026-15651 WP TripAdvisor Review Slider <= 14.6 - Authenticated (Administrator+) SQL Injection via 'filtersource' Parameter
- CVE-2026-15650 Cross-site scripting in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg
- CVE-2026-1565 File upload in User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration
- CVE-2026-15649 Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-15648 Cross-site scripting in Brands for WooCommerce
- CVE-2026-15647 Cross-site scripting in Brands for WooCommerce
- CVE-2026-15646 Cross-site scripting in Brands for WooCommerce
- CVE-2026-15645 Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute
- CVE-2026-15644 Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
- CVE-2026-15643 AWS HealthLake MCP Server SSRF via Pagination URL
- CVE-2026-15642 Information disclosure in Server
- CVE-2026-15641 Missing authorization in Server
- CVE-2026-15640 Authentication Bypass via SAML Response Manipulation
- CVE-2026-1564 Cross-site scripting in Pega Infinity
- CVE-2026-15639 Reflected Cross-Site Scripting
- CVE-2026-15638 Cryptographic Padding Oracle
- CVE-2026-15637 Missing authorization in Server
- CVE-2026-15634 IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Request Smuggling
- CVE-2026-15631 @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal
- CVE-2026-15630 CVE-2026-15630
- CVE-2026-1563 Cross-site scripting in Pega Infinity
- CVE-2026-15629 louisho5 picobot Workspace filesystem.go GetSkill link following
- CVE-2026-15628 zhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision._download_to_data_url server-side request forgery
- CVE-2026-15627 nextlevelbuilder GoClaw tool.go handleNavigate information disclosure
- CVE-2026-15626 nextlevelbuilder GoClaw ACP ToolBridge Workspace tool_bridge.go writeFile path traversal
- CVE-2026-15625 nextlevelbuilder GoClaw exec_approval.go ExecApprovalManager.CheckCommand incomplete blacklist
- CVE-2026-15624 nextlevelbuilder GoClaw invoke Endpoint create_video_byteplus.go bytePlusDownloadVideo server-side request forgery
- CVE-2026-15623 Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service
- CVE-2026-15622 poco-ai poco-claw Workspace API workspace.py get_workspace_file authorization
- CVE-2026-15621 mosaxiv clawlet File Tools fs_ops.go edit_file link following
- CVE-2026-15620 mosaxiv clawlet tool_web_fetch.go tools.webFetch server-side request forgery
- CVE-2026-1562 Cross-site scripting in Pega Infinity
- CVE-2026-15619 mosaxiv clawlet IPv4 tool_web_fetch.go web_fetch server-side request forgery
- CVE-2026-15618 mosaxiv clawlet exec Safety Guard tool_exec.go guardExecCommand protection mechanism
- CVE-2026-15617 Principal/domain lookup without case normalization
- CVE-2026-15616 Local MFA not enforced during SSO sign-in
- CVE-2026-15615 SAML <Conditions> element not validated
- CVE-2026-15614 IdP-initiated SAML sessions not reliably invalidated (replay)
- CVE-2026-15612 LOIDC nonce validation bypass
- CVE-2026-15611 Unverified email-based SSO account linking
- CVE-2026-15610 Missing authorization in WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- CVE-2026-1561 IBM WebSphere Application Server Liberty Server-Side Request Forgery
- CVE-2026-15609 Cross-site scripting in Bridge - Creative Multipurpose WordPress Theme
- CVE-2026-15607 tanstack db Alias Path select.ts select prototype pollution
- CVE-2026-15606 Missing authorization in Frontend Admin by DynamiApps
- CVE-2026-15605 wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash
- CVE-2026-15604 Toocheke Companion <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta
- CVE-2026-15603 morgan vulnerable to Log Forging via unescaped Unicode line separators
- CVE-2026-15602 NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter
- CVE-2026-15601 Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)
- CVE-2026-15600 SQL Injection in Alior Bank raty PrestaShop module
- CVE-2026-1560 Custom Block Builder – Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code Execution
- CVE-2026-15599 Arbitrary Process Termination in TÜBİTAK BİLGEM's pardus-domain-joiner
- CVE-2026-15598 antv layout object.js setNestedValue prototype pollution
- CVE-2026-15597 SourceCodester Class and Exam Timetabling System edit_exam2.php sql injection
- CVE-2026-15596 SourceCodester Class and Exam Timetabling System subject.php cross site scripting
- CVE-2026-15595 SourceCodester Class and Exam Timetabling System forsubject.php cross site scripting
- CVE-2026-15594 waooAI waoowaoo Media hash.ts stablePublicIdFromStorageKey improper authorization
- CVE-2026-1559 Youzify <= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkin_place_id' Parameter
- CVE-2026-15588 Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering
- CVE-2026-15587 Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication Header
- CVE-2026-15586 OTP Brute-Force Account Takeover in Idvlabs Software's Ontime
- CVE-2026-15585 Path Traversal in AKIN Software's Wolvox9 ERP
- CVE-2026-15584 Privilege escalation in Pen Drive Powered by Red Hat Lightspeed
- CVE-2026-15583 SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header
- CVE-2026-15581 Auth bypass in Red Hat OpenShift AI 2.25
- CVE-2026-15580 PassPortal browser extension: vault token disclosure via unvalidated postMessage
- CVE-2026-1558 Missing authorization in WP Recipe Maker
- CVE-2026-15579 Memory corruption in TN-4500B Series
- CVE-2026-15577 Git Sync connection configuration can be modified with read-only access
- CVE-2026-15576 Agent receiver accepts mTLS requests without a client certificate
- CVE-2026-15575 Sensitive Information Disclosure Due to Enabled Debug Mode in Production in SFM Software's Costifier
- CVE-2026-15574 Information disclosure in Red Hat OpenShift AI 2.25
- CVE-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
- CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
- CVE-2026-15571 Weak cryptography in Red Hat Data Grid 8
- CVE-2026-15570 Improper URL Scheme and Destination Validation in SmartCenter browserseturl Command
- CVE-2026-1557 WP Responsive Images <= 1.0 - Unauthenticated Path Traversal to Arbitrary File Read via src
- CVE-2026-15567 Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener