Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 862 of 1013.
- CVE-2026-15043 DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text
- CVE-2026-15041 389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification
- CVE-2026-1504 Information disclosure in Chrome
- CVE-2026-15039 Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload
- CVE-2026-15038 InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite
- CVE-2026-15037 XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization
- CVE-2026-15036 Harness gitspaces Endpoint list_all.go getAuthorizedSpaces authorization
- CVE-2026-15035 bentoml OpenLLM Model Repository Directory Name common.py async_run_command command injection
- CVE-2026-15034 flask-dashboard Flask-MonitoringDashboard cross-site request forgery
- CVE-2026-15033 christopherthielen check-peer-dependencies peerDependencies packageUtils.js shelljs.exec os command injection
- CVE-2026-15032 wpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion
- CVE-2026-15030 Memory corruption in Business Manager
- CVE-2026-1503 login_register <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2026-15029 Memory corruption in Business Manager
- CVE-2026-15028 Libarchive: heap overflow oob read while parsing a tar archive contains a pax extended header
- CVE-2026-15027 Changing｜CGServiSign - OS Command Injection
- CVE-2026-15026 Missing authorization in Import and export users and customers
- CVE-2026-15025 Missing authorization in Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
- CVE-2026-15023 SQL injection in Events Manager – Calendar, Bookings, Tickets, and more!
- CVE-2026-15022 Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array
- CVE-2026-15021 wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field
- CVE-2026-1502 HTTP client proxy tunnel headers not validated for CR/LF
- CVE-2026-15019 Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment
- CVE-2026-15018 Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter
- CVE-2026-15017 Privilege escalation in MDJM Event Management
- CVE-2026-15016 Cross-site scripting in Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
- CVE-2026-15015 Missing authorization in MountDev AI MCP Connector for WordPress
- CVE-2026-15014 SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter
- CVE-2026-15013 Auth bypass in SAML Single Sign On – SSO Login
- CVE-2026-15012 Demi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy
- CVE-2026-15011 Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter
- CVE-2026-15010 bbp style pack <= 6.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Topic Form Additional Fields
- CVE-2026-1501 IBM Concert Software Improper Certificate Validation
- CVE-2026-15009 Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter
- CVE-2026-15008 Deserialization in Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
- CVE-2026-15007 Denial of service in Enterprise Server
- CVE-2026-15006 Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field
- CVE-2026-15005 Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter
- CVE-2026-15004 Cross-site scripting in FileBird – WordPress Media Library Folders & File Manager
- CVE-2026-15003 Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service
- CVE-2026-15002 Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter
- CVE-2026-15001 Privilege escalation in bLoyal: Loyalty & Promotions by bLoyal
- CVE-2026-15000 Cross-site scripting in Connect Contact Form 7 and Mailchimp
- CVE-2026-1500 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-14999 IBM DataPower Gateway Improper Verification of Cryptographic Signature
- CVE-2026-14996 Multiple vulnerabilities in IBM Aspera Faspex
- CVE-2026-14995 Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path
- CVE-2026-14992 IBM DataPower Gateway Out-of-bounds Write
- CVE-2026-14991 IBM DataPower Gateway Out-of-bounds Write
- CVE-2026-14990 IBM DataPower Gateway affected by cross-site scripting
- CVE-2026-1499 WP Duplicate <= 1.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via 'process_add_site' AJAX Action
- CVE-2026-14989 Cross-site scripting in WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
- CVE-2026-14988 IBM DataPower Gateway Out-of-bounds Read
- CVE-2026-14987 Cross-site scripting in GiveWP – Donation Plugin and Fundraising Platform
- CVE-2026-14986 Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction
- CVE-2026-14985 CVE-2026-14985
- CVE-2026-14984 Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2
- CVE-2026-14983 Missing Authentication in Teledyne FLIR Robots running Aware2
- CVE-2026-14982 WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter
- CVE-2026-14981 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
- CVE-2026-14980 IBM WebSphere Application Server Liberty is affected by a cross-site request forgery
- CVE-2026-1498 WatchGuard Firebox LDAP Injection
- CVE-2026-14979 IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack
- CVE-2026-14978 Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions
- CVE-2026-14976 Code injection in WebSphere Application Server - Liberty
- CVE-2026-14975 WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter
- CVE-2026-14974 IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities
- CVE-2026-14973 Path Traversal in IBM Desktop App
- CVE-2026-14971 This PowerVM Novalink update is being released to address
- CVE-2026-14970 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-1497 Incorrect privilege assignment in composite databases
- CVE-2026-14969 389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption
- CVE-2026-14967 Path traversal in github_workflows allows writing artifacts outside output directory
- CVE-2026-14966 Symlink guard bypass in unarchive module allows planting symlinks during extraction
- CVE-2026-14962 ELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_id
- CVE-2026-14961 CVE-2026-14961
- CVE-2026-14960 CVE-2026-14960
- CVE-2026-1496 Coverity CLI Authentication Bypass
- CVE-2026-14959 OS Command Injection in IBM Aspera Faspex
- CVE-2026-14958 OS command injection in IBM Aspera Faspex
- CVE-2026-14957 FIPS mode assertion failure via malicious CERT payload
- CVE-2026-14956 Bricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter
- CVE-2026-14955 Path traversal in Checkout Field Editor for WooCommerce (Pro)
- CVE-2026-14953 Missing authorization in FDS 102
- CVE-2026-14952 Missing authorization in FDS 102
- CVE-2026-14951 Cross-site request forgery in FDS 102
- CVE-2026-14950 Auth bypass in FDS 102
- CVE-2026-1495 Insertion of Sensitive Information into Log File vulnerability in AVEVA PI to CONNECT Agent
- CVE-2026-14949 Privilege escalation in FDS 102
- CVE-2026-14948 Information disclosure in FDS 102
- CVE-2026-14947 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious ZIP file
- CVE-2026-14946 File upload in FDS 102
- CVE-2026-14943 Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API
- CVE-2026-14941 Customer Reviews for WooCommerce < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions
- CVE-2026-14940 389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn
- CVE-2026-14939 Visualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import
- CVE-2026-14938 FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR
- CVE-2026-14936 Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification
- CVE-2026-14935 Security feature bypass in Red Hat Enterprise Linux 10
- CVE-2026-14934 Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise