Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 859 of 1013.
- CVE-2026-15359 Templately < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite
- CVE-2026-15358 Path Traversal Vulnerability
- CVE-2026-15352 NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference
- CVE-2026-15351 WC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter
- CVE-2026-15350 Missing authorization in The Cache Purger
- CVE-2026-1535 code-projects Online Music Site AdminReply.php sql injection
- CVE-2026-15349 Missing authorization in ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
- CVE-2026-15348 Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter
- CVE-2026-15346 VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'category_id' Parameter
- CVE-2026-15345 Missing authorization in ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization
- CVE-2026-15344 WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter
- CVE-2026-15343 Path traversal in Enterprise Server
- CVE-2026-15342 CVE-2026-15342
- CVE-2026-15341 Auth bypass in User Session Synchronizer
- CVE-2026-15340 Savannah lwIP SMTP client Classic Buffer Overflow
- CVE-2026-1534 code-projects Online Music Site AdminEditUser.php sql injection
- CVE-2026-15338 Path traversal in LA-Studio Element Kit for Elementor
- CVE-2026-15337 Potential denial-of-service vulnerability in check_for_language()
- CVE-2026-15336 Missing authorization in Catch Themes Demo Import
- CVE-2026-15335 Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter
- CVE-2026-15334 Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
- CVE-2026-15333 Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute
- CVE-2026-15332 zhayujie CowAgent Message Endpoint channel.py authorization
- CVE-2026-15331 zhayujie CowAgent Skill Installation service.py _add_package path traversal
- CVE-2026-15330 zhayujie CowAgent Vision Tool vision.py _download_to_data_url server-side request forgery
- CVE-2026-1533 code-projects Online Music Site AdminAddCategory.php sql injection
- CVE-2026-15329 zhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosure
- CVE-2026-15328 Other in WebSphere Application Server
- CVE-2026-15326 halo-dev halo Theme Installation ThemeUtils.java ThemeUtils.unzipThemeTo path traversal
- CVE-2026-15325 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
- CVE-2026-15324 Cross-site scripting in SysBasics Customize My Account for WooCommerce – Live My Account Customizer
- CVE-2026-15323 Path traversal in Product Designer for WooCommerce WordPress | Lumise
- CVE-2026-15322 Multiple Vulnerabilities in IBM Engineering AI hub.
- CVE-2026-15321 MyEMS Admin Backend svg.py on_post cross site scripting
- CVE-2026-15320 Sipeed PicoClaw pico.go rt.ReloadConfig authorization
- CVE-2026-1532 D-Link DCS-700L Music File Upload Service setUploadMusic uploadmusic path traversal
- CVE-2026-15319 Sipeed PicoClaw Launcher access_control.go IPAllowlist access control
- CVE-2026-15318 Sipeed PicoClaw MQTT Channel mqtt.go authorization
- CVE-2026-15317 Sipeed PicoClaw Guarded Web Fetch Flow web.go WebFetchTool.Execute server-side request forgery
- CVE-2026-15316 Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200
- CVE-2026-15315 Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200
- CVE-2026-15314 Authenticated Denial-of-Service Vulnerability in TP-Link Tapo P110
- CVE-2026-15312 Privilege escalation in Propovoice: All-in-One Client Management System
- CVE-2026-15311 NousResearch hermes-agent Matrix Adapter matrix.py MatrixAdapter._markdown_to_html cross site scripting
- CVE-2026-15310 zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits
- CVE-2026-1531 Foreman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verification
- CVE-2026-15308 Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations
- CVE-2026-15307 Server-side file-write and request forgery via spatial lookups
- CVE-2026-15306 Product Feed Manager For WooCommerce <= 7.6.1 - Reflected Cross-Site Scripting via 's' Search Parameter
- CVE-2026-15305 TYPO3 CMS - Unrestricted File Upload in Form Framework
- CVE-2026-15304 Plugin Organizer <= 10.2.4 - Authenticated (Subscriber+) SQL Injection
- CVE-2026-15303 6Storage Rentals <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter
- CVE-2026-15302 ARMember <= 4.0.27 - Directory Traversal via X-FILENAME
- CVE-2026-15301 BuddyHolis TableSearch <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2026-15300 GEO my WP <= 4.5.4 - Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' Parameters
- CVE-2026-1530 Fog-kubevirt: fog-kubevirt: man-in-the-middle vulnerability due to disabled certificate validation
- CVE-2026-15299 Animation Addons for Elementor <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget
- CVE-2026-15298 TelSender <= 1.14.14 - Unauthenticated Stored Cross-Site Scripting via Telegram Chat Title
- CVE-2026-15297 Cross-site scripting in Brevo – Email, SMS, Web Push, Chat, and more.
- CVE-2026-15296 affiliate-toolkit – WP Affiliate Plugin with Amazon <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2026-15295 Ajax Load More <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2026-15293 Missing authorization in WP Business Intelligence Lite
- CVE-2026-15292 Sudoku Shortcode <= 1.0.0 - Authenticated (Contributor+) Cross-Site Scripting via 'background' Shortcode Attribute
- CVE-2026-15291 Missing authorization in ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form
- CVE-2026-15290 SQL injection in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
- CVE-2026-1529 Keycloak affected by improper invitation token validation
- CVE-2026-15289 Booking calendar, Appointment Booking System <= 3.2.17 - Unauthenticated Time-Based SQL Injection via 'wpdevart_id'
- CVE-2026-15288 SureForms – Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation
- CVE-2026-15287 rtMedia for WordPress, BuddyPress and bbPress <= 4.6.18 - Authenticated (Subscriber+) SQL Injection
- CVE-2026-15286 Missing authorization in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- CVE-2026-15285 Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
- CVE-2026-15284 Cross-site scripting in King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder
- CVE-2026-15283 WPvivid Backup for MainWP <= 0.9.33 - Authenticated (Admin+) Stored Cross-Site Scripting
- CVE-2026-15282 Instant Appointment <= 1.2 - Unauthenticated Arbitrary File Upload
- CVE-2026-15281 User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection
- CVE-2026-15280 Path traversal in WebSphere Application Server - Liberty
- CVE-2026-1528 undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client
- CVE-2026-15276 pdeljanov Symphonia Metadata denial of service
- CVE-2026-15275 WP Multi Store Locator Pro <= 4.5.1 - Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter
- CVE-2026-15274 lo48576 fbxcel Node Header parser.rs denial of service
- CVE-2026-15273 Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI
- CVE-2026-15271 TOTOLINK EX200 Web boa.conf least privilege violation
- CVE-2026-15270 D-link DIR-823G Web boa.conf least privilege violation
- CVE-2026-1527 undici is vulnerable to CRLF Injection via upgrade option
- CVE-2026-15267 Taskbuilder <= 5.0.9 - Authenticated (Subscriber+) SQL Injection
- CVE-2026-15265 Tenable Agent Path Traversal Leading to Remote Code Execution
- CVE-2026-15262 Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column
- CVE-2026-15261 TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Private Wishlist Disclosure via share_key
- CVE-2026-15260 Geo My WP < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR
- CVE-2026-1526 undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression
- CVE-2026-15258 Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter
- CVE-2026-15257 RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification
- CVE-2026-15256 Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default
- CVE-2026-15255 RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR
- CVE-2026-15254 Simply Schedule Appointments < 1.6.12.11 - Contributor+ Sensitive Data Disclosure via Admin Shortcode
- CVE-2026-15253 Easy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment Title
- CVE-2026-15252 Search Atlas SEO < 2.6.12 - Subscriber+ Google Indexing API Access
- CVE-2026-15250 LatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel
- CVE-2026-1525 undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
- CVE-2026-15249 Patterns Kit <= 1.0.3 - Contributor+ Stored XSS via YouTube Popup Link