Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 861 of 1013.
- CVE-2026-1514 2100 Technology｜Official Document Management System - Incorrect Authorization
- CVE-2026-15138 tumf mcp-text-editor text_editor.py _validate_file_path path traversal
- CVE-2026-15137 code-projects Interview Management System View.php sql injection
- CVE-2026-15136 Cross-site request forgery in WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
- CVE-2026-15135 code-projects Online Food Order System edit_food_items.php sql injection
- CVE-2026-15134 CodeAstro Simple Online Leave Management System index.php sql injection
- CVE-2026-15133 Use after free in Chrome
- CVE-2026-15132 Memory corruption in Chrome
- CVE-2026-15131 Security feature bypass in Chrome
- CVE-2026-15130 Security feature bypass in Chrome
- CVE-2026-1513 billboard.js is vulnerable to XSS during chart option binding
- CVE-2026-15129 Use after free in Chrome
- CVE-2026-15128 Cross-site scripting in Chrome
- CVE-2026-15127 Cross-site scripting in Chrome
- CVE-2026-15126 Use after free in Chrome
- CVE-2026-15125 Code injection in Chrome
- CVE-2026-15124 Security feature bypass in Chrome
- CVE-2026-15123 Memory corruption in Chrome
- CVE-2026-15122 Security feature bypass in Chrome
- CVE-2026-15121 Use after free in Chrome
- CVE-2026-15120 Use after free in Chrome
- CVE-2026-1512 Essential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget
- CVE-2026-15119 Race condition in Chrome
- CVE-2026-15118 Use after free in Chrome
- CVE-2026-15117 Use after free in Chrome
- CVE-2026-15116 Use after free in Chrome
- CVE-2026-15115 Security feature bypass in Chrome
- CVE-2026-15114 Memory corruption in Chrome
- CVE-2026-15113 Use after free in Chrome
- CVE-2026-15112 Use after free in Chrome
- CVE-2026-15111 Use after free in Chrome
- CVE-2026-15110 Use after free in Chrome
- CVE-2026-15109 Information disclosure in Chrome
- CVE-2026-15108 Integer overflow in Chrome
- CVE-2026-15107 Use after free in Chrome
- CVE-2026-15106 WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter
- CVE-2026-15105 davenardella snap7 ReadVar Request s7_server.cpp PerformFunctionRead out-of-bounds write
- CVE-2026-15104 BetterDocs <= 4.6.0 - Authenticated (Custom+) SQL Injection via 'lang' Parameter
- CVE-2026-15103 WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter
- CVE-2026-15102 Cleartext Transmission of Sensitive Information in ADP Desktop SDK
- CVE-2026-15101 WPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter
- CVE-2026-15100 Cross-site scripting in Post Grid Gutenberg Blocks – PostX
- CVE-2026-1510 IBM Concert Software Improper Clearing of Heap Memory
- CVE-2026-15099 WP Delicious <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute
- CVE-2026-15098 Cross-site scripting in Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder
- CVE-2026-15097 Cross-site scripting in Themify Builder
- CVE-2026-15096 Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field
- CVE-2026-15095 Path traversal in Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
- CVE-2026-15094 WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter
- CVE-2026-15093 Multiple Vulnerabilities in IBM Engineering AI hub.
- CVE-2026-15091 Multiple Vulnerabilities in IBM Engineering AI hub.
- CVE-2026-15090 Link Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' Parameter
- CVE-2026-1509 Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution
- CVE-2026-15089 Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079
- CVE-2026-15088 Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089
- CVE-2026-15087 Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078
- CVE-2026-15086 Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077
- CVE-2026-15085 AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076
- CVE-2026-15084 UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075
- CVE-2026-15083 ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074
- CVE-2026-15082 Siteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-073
- CVE-2026-15081 Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072
- CVE-2026-15080 Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071
- CVE-2026-1508 Court Reservation < 1.10.9 - Event Deletion via CSRF
- CVE-2026-15079 Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070
- CVE-2026-15078 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-15077 Improper Neutralization of Input Used for LLM Prompting in GitLab
- CVE-2026-15076 Security feature bypass in Eclipse Vert.x
- CVE-2026-15075 Information disclosure in Eclipse Vert.x
- CVE-2026-15074 @fastify/static vulnerable to route guard bypass via path traversal
- CVE-2026-15073 KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController
- CVE-2026-15072 KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder
- CVE-2026-15070 Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter
- CVE-2026-1507 Uncaught Exception vulnerability in AVEVA PI Data Archive
- CVE-2026-15069 Multiple Vulnerabilities in IBM Engineering AI hub.
- CVE-2026-15068 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-15067 SQL injection in Terraform Provider for Snowflake
- CVE-2026-15066 Loco Translate <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments
- CVE-2026-15065 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-15064 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
- CVE-2026-15063 Trustyai-service-operator: trustyai service operator: gorch port bypass when auth is enabled
- CVE-2026-15062 SQL Injection in Snowflake Snowpark Python SDK
- CVE-2026-15061 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-15060 systemd-machined: unprivileged users can terminate arbitrary processes
- CVE-2026-1506 D-Link DIR-615 MAC Filter Configuration adv_mac_filter.php os command injection
- CVE-2026-15059 systemd-oomd: unprivileged users can terminate arbitrary processes
- CVE-2026-15058 Missing authorization in Server
- CVE-2026-15057 IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability
- CVE-2026-15056 StoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL
- CVE-2026-15055 PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input
- CVE-2026-15054 Bit Form < 3.1.2 - Unauthenticated Inactive Form Submission
- CVE-2026-15053 Tanium addressed a denial of service vulnerability in Tanium Server.
- CVE-2026-15052 Cross-site scripting in MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder
- CVE-2026-1505 D-Link DIR-615 URL Filter set_temp_nodes.php os command injection
- CVE-2026-15049 Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import
- CVE-2026-15048 GeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat History
- CVE-2026-15047 s2Member < 260805 - Contributor+ Stored XSS via Shortcode
- CVE-2026-15046 LitExtension: Store to WooCommerce Migration <= 1.2.5 - Connector Token Takeover via CSRF
- CVE-2026-15045 Wallet System for WooCommerce < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount
- CVE-2026-15044 Trustyai-service-operator: trustyai service operator: unauthenticated access to ai guardrails and orchestrator apis