Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 858 of 1013.
- CVE-2026-15471 Eleveo Call Recording Software pci_dss_status.jsp improper authorization
- CVE-2026-15470 Eleveo Call Recording Software group.jsp improper authorization
- CVE-2026-1547 Totolink A7000R cstecgi.cgi setUnloadUserData command injection
- CVE-2026-15469 Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800
- CVE-2026-15468 Auth bypass in Passwordless
- CVE-2026-15467 Security feature bypass in Red Hat OpenShift AI 2.25
- CVE-2026-15464 Cross-site scripting in WP Hotel Booking
- CVE-2026-15463 SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' Parameters
- CVE-2026-15462 Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection
- CVE-2026-15461 Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input
- CVE-2026-15460 Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path
- CVE-2026-1546 jishenghua jshERP com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam sql injection
- CVE-2026-15459 Auth bypass in WPMU DEV Dashboard
- CVE-2026-15458 SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'sort_field' Parameter
- CVE-2026-15457 Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter
- CVE-2026-15453 KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter
- CVE-2026-15452 Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String
- CVE-2026-15451 Privilege escalation in MemberPress Corporate Accounts
- CVE-2026-15450 NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter
- CVE-2026-1545 itsourcecode School Management System index.php sql injection
- CVE-2026-15449 TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruption
- CVE-2026-15448 Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter
- CVE-2026-15446 Cross-site scripting in EWWW Image Optimizer
- CVE-2026-15445 SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
- CVE-2026-15444 Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter
- CVE-2026-15442 Heap use-after-free on read during bidirectional (D)TLS shutdown
- CVE-2026-15441 Cross-site scripting in Product Table & List Builder For WooCommerce
- CVE-2026-1544 D-Link DIR-823X set_mode sub_41E2A0 os command injection
- CVE-2026-15439 GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection
- CVE-2026-15435 IBM App Connect Enterprise is vulnerable to arbitrary file write vulnerability
- CVE-2026-15432 Observable Timing Discrepancy in Tink-Java and Tink-Android ChunkedMacVerification
- CVE-2026-15431 HP Support Assistant – Potential Escalation of Privilege
- CVE-2026-15430 CVE-2026-15430
- CVE-2026-1543 Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes
- CVE-2026-15429 Privilege Escalation via Improper Input Sanitization in TP-Link Archer VX1800v
- CVE-2026-15428 OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v
- CVE-2026-15427 OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v
- CVE-2026-15426 Missing authorization in AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
- CVE-2026-15425 Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)
- CVE-2026-15423 Incorrect Authorization in GitLab
- CVE-2026-15422 SCTP needs to better-check INIT ACK chunk parameters
- CVE-2026-15421 Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes
- CVE-2026-15420 Path traversal in Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder
- CVE-2026-1542 Super Stage WP <= 1.0.1 - Unauthenticated PHP Object Injection
- CVE-2026-15419 CP210x Driver Memory Corruption results in Arbitrary Code Execution
- CVE-2026-15418 CP210x Memory Leakage
- CVE-2026-15417 CP210x Denial of Service
- CVE-2026-15416 Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint
- CVE-2026-15415 Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server
- CVE-2026-15414 Privilege escalation in Subscriptions for WooCommerce
- CVE-2026-15413 Link Factory - Backdoor
- CVE-2026-15412 IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Open Redirect
- CVE-2026-15411 Missing authorization in StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce
- CVE-2026-15410 SonicWall SMA1000 Appliances Code Injection
- CVE-2026-1541 Information disclosure in Avada (Fusion) Builder
- CVE-2026-15409 SonicWall SMA1000 Appliances Server-Side Request Forgery
- CVE-2026-15407 Missing authorization in Themify Builder
- CVE-2026-15406 Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
- CVE-2026-15404 Bulk Page Generator <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
- CVE-2026-15403 Pinpoint Booking System <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameter
- CVE-2026-15402 Cross-site scripting in Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
- CVE-2026-15401 Cross-site scripting in VikBooking Hotel Booking Engine & PMS
- CVE-2026-1540 Spam Protect for Contact Form 7 < 1.2.10 - Editor+ Remote Code Execution
- CVE-2026-15399 Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection via 'counterid' Parameter
- CVE-2026-15397 Missing authorization in Subscriptions for WooCommerce
- CVE-2026-15396 IBM WebSphere Application Server IBM WebSphere Application Server - Liberty HTTP Request Smuggling
- CVE-2026-15395 Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value
- CVE-2026-15394 Header Footer Script Adder <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Meta
- CVE-2026-15393 Cross-site scripting in Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates
- CVE-2026-15392 DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location
- CVE-2026-15390 Out-of-bounds write in Das U-Boot
- CVE-2026-1539 Libsoup: libsoup: credential leakage via http redirects
- CVE-2026-15389 Inadequate access control in Sesame Time session management
- CVE-2026-15388 Cookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure
- CVE-2026-15387 Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab
- CVE-2026-15386 Meow Gallery < 5.5.2 - Author+ Stored XSS via Attachment Alt-Text
- CVE-2026-15385 RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS
- CVE-2026-15384 Manual Image Crop < 1.15 - Subscriber+ Arbitrary Attachment Image Overwrite via IDOR
- CVE-2026-15383 Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header
- CVE-2026-15382 Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Deletion via delete-bsf-fonts
- CVE-2026-15381 WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter
- CVE-2026-15380 Local privilege escalation in Symantec ITMS
- CVE-2026-15379 Arbitrary File Read as SYSTEM in Symantec ITMS
- CVE-2026-15378 Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)
- CVE-2026-15377 Eleveo Call Recording Software sendlogfile improper authorization
- CVE-2026-15376 Eleveo Call Recording Software statisticReportAction.do improper authorization
- CVE-2026-15375 Eleveo Call Recording Software LDAP User users_ldap.jsp improper authorization
- CVE-2026-15374 Eleveo Call Recording Software Group roleAddAction.do improper authorization
- CVE-2026-15373 Eleveo Call Recording Software userAddAction.do improper authorization
- CVE-2026-15372 WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider
- CVE-2026-15371 Velociraptor Stored XSS in URL column types
- CVE-2026-15370 Libssh: libssh: stack buffer overflow in sftp server longname construction
- CVE-2026-1537 Missing authorization in LatePoint – Calendar Booking Plugin for Appointments and Events
- CVE-2026-15369 Privilege escalation in Custom User Registration Fields for WooCommerce
- CVE-2026-15368 Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration
- CVE-2026-15366 Security feature bypass in Kids Mode
- CVE-2026-15365 Security feature bypass in Kids Mode
- CVE-2026-15361 Content Views < 4.5 - Subscriber+ SQL Injection via preview_request
- CVE-2026-15360 Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args
- CVE-2026-1536 Libsoup: libsoup: http header injection or response splitting via crlf injection in content-disposition header