Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 860 of 1013.
- CVE-2026-15248 Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR
- CVE-2026-15247 Search Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deletion
- CVE-2026-15246 RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass
- CVE-2026-15245 BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode
- CVE-2026-15244 Path traversal in HUSKY
- CVE-2026-15243 Improper Validation of Certificate in CAS Client
- CVE-2026-15241 ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_response
- CVE-2026-15240 Privilege escalation in Customer Switching
- CVE-2026-1524 Auth misconfiguration when multiple providers enabled
- CVE-2026-15239 Security feature bypass in Simple CAPTCHA with Cloudflare Turnstile
- CVE-2026-15238 Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR
- CVE-2026-15237 Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint
- CVE-2026-15236 Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure
- CVE-2026-15235 Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action
- CVE-2026-15234 Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute
- CVE-2026-15233 Nested Pages < 3.2.15 - Editor+ Stored XSS via Post Title
- CVE-2026-15232 Appointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion
- CVE-2026-15231 TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR
- CVE-2026-15230 YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure
- CVE-2026-1523 Path Traversal in Digitek from Grupo Azkoyen
- CVE-2026-15229 Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation
- CVE-2026-15228 Kong Kubernetes Ingress Controller cluster-wide ingress configuration DoS via CA-certificate ID collision
- CVE-2026-15227 Missing Authorization Allows Editing of Foreign Reports
- CVE-2026-15226 snapd snap-confine Sandbox Confinement Bypass via Omission of setuid Restriction in Seccomp Templates
- CVE-2026-15222 User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name
- CVE-2026-1522 Open5GS SGWC s5c-handler.c sgwc_s5c_handle_modify_bearer_response denial of service
- CVE-2026-15219 IDOR in SFM Software's Costifier
- CVE-2026-15218 Misconfiguration in Red Hat OpenShift AI 3.4
- CVE-2026-15217 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-15216 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-15215 Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation
- CVE-2026-15214 Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOR
- CVE-2026-15213 Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback
- CVE-2026-15212 Cross-site request forgery in WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
- CVE-2026-15211 Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token
- CVE-2026-15210 Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force
- CVE-2026-1521 Open5GS SGWC s5c-handler.c denial of service
- CVE-2026-15209 Missing authorization in JS Help Desk
- CVE-2026-15208 RegistrationMagic < 6.0.9.5 - Unauthenticated Payment Bypass via Amount-Blind PayPal Verification
- CVE-2026-15206 Auth bypass in SMS Alert
- CVE-2026-15205 Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup
- CVE-2026-15204 TOTOLINK X5000R OpenVPN Export cstecgi.cgi exportOvpn path traversal
- CVE-2026-15203 Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software
- CVE-2026-15202 YzmCMS Header yzmphp.php get_url cross site scripting
- CVE-2026-1520 rethinkdb Secondary Index cross site scripting
- CVE-2026-15195 apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution
- CVE-2026-15194 Open5GS AMF context.c amf_context_final use after free
- CVE-2026-15193 AidanPark openclaw-android Android WebView Bridge JsBridge.kt os command injection
- CVE-2026-15192 mettle sendportal APIv1 Webhooks mailjet missing authentication
- CVE-2026-15191 mettle sendportal Campaign Creation Endpoint CampaignStoreRequest.php authorization
- CVE-2026-15190 SourceCodester Simple and Nice Shopping Cart Script login.php sql injection
- CVE-2026-1519 Excessive NSEC3 iterations cause high CPU load during insecure delegation validation
- CVE-2026-15189 aerostackdev aerostack-mcp mcp-whatsapp upload_media server-side request forgery
- CVE-2026-15188 manjurulhoque django-job-portal Employee Dashboard Endpoint views.py EditEmployeeProfileAPIView access control
- CVE-2026-15187 enquirer Public Package API Enquirer.set prototype pollution
- CVE-2026-15186 macrozheng mall Portal Endpoint create resource injection
- CVE-2026-15185 GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds
- CVE-2026-15184 GNU LibreDWG DWG File dwg.c dwg_next_entity null pointer dereference
- CVE-2026-15183 Input Validation Vulnerabilities in Snowflake Spark Connector
- CVE-2026-15182 GNU LibreDWG BMP Image dwg.c dwg_bmp heap-based overflow
- CVE-2026-15180 Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'
- CVE-2026-15178 Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification
- CVE-2026-15176 NGINX ngx_http_core_module vulnerability
- CVE-2026-15174 Heap-based Buffer Overflow in Wireshark
- CVE-2026-15173 Heap-based Buffer Overflow in Wireshark
- CVE-2026-15172 Unchecked Input for Loop Condition in Wireshark
- CVE-2026-15171 NULL Pointer Dereference in Wireshark
- CVE-2026-15170 Heap-based Buffer Overflow in Wireshark
- CVE-2026-1517 iomad Company Admin Block sql injection
- CVE-2026-15169 Heap-based Buffer Overflow in Wireshark
- CVE-2026-15168 Use of Uninitialized Variable in Wireshark
- CVE-2026-15167 Stack-based Buffer Overflow in Wireshark
- CVE-2026-15166 Stack-based Buffer Overflow in Wireshark
- CVE-2026-15165 Heap-based Buffer Overflow in Wireshark
- CVE-2026-15164 Heap-based Buffer Overflow in ciscodump
- CVE-2026-15163 Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
- CVE-2026-15162 Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection
- CVE-2026-15161 Ninja Forms - Excel Export <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'filter' Parameter
- CVE-2026-15160 Ninja Forms - Excel Export <= 3.3.6 - Missing Authorization to Authenticated (Subscriber+) XLS Write via Path Traversal
- CVE-2026-1516 Improper Control of Generation of Code ('Code Injection') in GitLab
- CVE-2026-15159 Missing authorization in Ninja Forms - Excel Export
- CVE-2026-15158 Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter
- CVE-2026-15157 undici vulnerable to CRLF Injection via blob-like body 'type' property
- CVE-2026-15156 Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CVE-2026-15155 Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection
- CVE-2026-15154 Denial of service in Red Hat OpenShift AI 2.25
- CVE-2026-15153 WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search
- CVE-2026-15152 WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass
- CVE-2026-15151 Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notifications
- CVE-2026-15150 myCred < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED
- CVE-2026-15149 WP Hotel Booking < 2.3.3 - Unauthenticated Payment Bypass via Price Manipulation
- CVE-2026-15148 WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR
- CVE-2026-15147 Five Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR
- CVE-2026-15146 CVE-2026-15146
- CVE-2026-15145 Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CVE-2026-15144 @fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation
- CVE-2026-15143 Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)
- CVE-2026-15142 Privilege escalation in Real Estate Manager Pro
- CVE-2026-15141 Referer Validation Bypass in TL-WR820N Web Management Interface
- CVE-2026-15140 Privilege escalation in Portworx Operator