Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 863 of 1013.
- CVE-2026-14933 Unblu Spark Cross-Site Scripting in Embedded Co-Browsing
- CVE-2026-14932 Unauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChart
- CVE-2026-14931 JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure
- CVE-2026-14930 JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload
- CVE-2026-1493 Cross-Site Scripting in LEX Baza Dokumentów
- CVE-2026-14929 JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR
- CVE-2026-14928 JS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubject
- CVE-2026-14927 FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes
- CVE-2026-14926 FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR
- CVE-2026-14925 Import WP < 2.14.23 - Unauthenticated Sensitive Information Exposure via Export File Download
- CVE-2026-14924 Tablesome < 1.1.31 - Unauthenticated Post Creation and Modification
- CVE-2026-14923 Sync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification
- CVE-2026-14922 WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment
- CVE-2026-14921 Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode
- CVE-2026-14920 AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter
- CVE-2026-1492 User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration
- CVE-2026-14919 ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset Email Reroute
- CVE-2026-14917 Kong API Gateway Enterprise: SAML Authentication bypass
- CVE-2026-14916 Kong API Gateway Enterprise: JWT Algorithm-Confusion
- CVE-2026-14913 SQL Injection vulnerability
- CVE-2026-14911 Cross-site scripting in Router
- CVE-2026-1491 Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-14909 IBM WebSphere Application Server Liberty Information Disclosure
- CVE-2026-14906 Path traversal in Firefox for iOS
- CVE-2026-14905 IBM DataPower Gateway XXE
- CVE-2026-14904 RES Auth.GetUserPrivateKey Arbitrary File Read
- CVE-2026-14903 Path traversal in Xtraction
- CVE-2026-14902 Open redirect in Xtraction
- CVE-2026-14900 Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter
- CVE-2026-1490 Auth bypass in Spam protection, Honeypot, Anti-Spam by CleanTalk
- CVE-2026-14899 Off-by-one out of bounds read in MIME header parser for forwarding
- CVE-2026-14898 Information disclosure in Codex desktop app for macOS
- CVE-2026-14896 Nomad vulnerable to cross-namespace host volume claim deletion
- CVE-2026-14895 String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service
- CVE-2026-14894 Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
- CVE-2026-14893 IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image
- CVE-2026-14892 Tanium addressed an improper access controls vulnerability in Tanium Server.
- CVE-2026-14891 Nomad vulnerable to sandbox escape in Docker task driver
- CVE-2026-14890 CVE-2026-14890
- CVE-2026-1489 Glib: glib: memory corruption via integer overflow in unicode case conversion
- CVE-2026-14888 IBM DataPower Gateway Buffer Overflow
- CVE-2026-14886 Vault Enterprise vulnerable to cross-namespace entity deletion
- CVE-2026-14882 Brizy <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta
- CVE-2026-14881 Command injection in MongoDB Compass
- CVE-2026-14877 Cross-site scripting in Data Tables Generator by Supsystic
- CVE-2026-14876 Cross-site scripting in Smart Slider 3
- CVE-2026-14875 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities
- CVE-2026-14873 Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset
- CVE-2026-14872 Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter
- CVE-2026-14871 osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure
- CVE-2026-14870 Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id
- CVE-2026-1487 LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import
- CVE-2026-14869 terraform-mcp-server vulnerable to server side request forgery leading to token exposure
- CVE-2026-14868 Weak encryption mechanism for User directory
- CVE-2026-14867 Insecure password storage in User directory
- CVE-2026-14866 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities
- CVE-2026-14865 XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX
- CVE-2026-14864 JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode
- CVE-2026-14863 FileRun 2026.2.0 RCE via Thumbnail Generation Command Injection
- CVE-2026-14862 Support Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing Authorization
- CVE-2026-14861 User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR
- CVE-2026-14860 Podcast Player < 8.3.1 - Unauthenticated Server-Side Request Forgery
- CVE-2026-1486 Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant
- CVE-2026-14859 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization
- CVE-2026-14858 WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR
- CVE-2026-14857 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR
- CVE-2026-14856 Stored Cross-Site Scripting (XSS) in TastyIgniter Media Manager
- CVE-2026-14855 Cross-site scripting in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg
- CVE-2026-14854 WooCommerce Bookings < 3.11.0 - Unauthenticated Denial of Service
- CVE-2026-14853 WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization
- CVE-2026-14852 mk_sap_hana: Privilege escalation via crafted sapstartsrv process name
- CVE-2026-14851 Unauthorised disclosure of information on Copart’s online billing service
- CVE-2026-14850 Weak password recovery mechanism for forgotten password in MobiAPParc
- CVE-2026-1485 Glib: glib: local denial of service via buffer underflow in content type parsing
- CVE-2026-14849 Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files
- CVE-2026-14848 Paid Member Subscriptions < 3.0.8 - Subscriber+ Cross-User Subscription Hijack via process_checkout
- CVE-2026-14847 Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR
- CVE-2026-14846 Incorrect neutralisation in the PrestaShop firmware
- CVE-2026-14845 NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget
- CVE-2026-14844 Master Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes
- CVE-2026-14843 Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR
- CVE-2026-14842 Events Made Easy < 3.1.2 - Unauthenticated Payment Bypass
- CVE-2026-14841 King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget
- CVE-2026-14840 YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing
- CVE-2026-1484 Glib: integer overflow leading to buffer underflow and out-of-bounds write in glib g_base64_encode()
- CVE-2026-14839 Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure
- CVE-2026-14838 Session Token Exposure in URL Leading to Account Takeover in Bilin Software's HUMANIST Digital Human Resources
- CVE-2026-14837 SSH Enablement Signature Verification Bypass
- CVE-2026-14836 Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limit Bypass
- CVE-2026-14835 SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox
- CVE-2026-14834 Mailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX
- CVE-2026-14833 Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute
- CVE-2026-14832 ShopSmart Loyalty for WooCommerce <= 1.0.0 - Unauthenticated Sensitive Information Disclosure via shopsmart_check_phone
- CVE-2026-14831 Easy Booking < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass
- CVE-2026-14830 FlxWoo < 3.1.1 - Unauthenticated Payment Bypass
- CVE-2026-1483 Out-of-band SQL injection in Quatuor Performance Evaluation
- CVE-2026-14829 Checkimate <= 1.0.13 - Unauthenticated License Deactivation via Hardcoded Secret
- CVE-2026-14828 SQL injection in ManageEngine Access Manager Plus
- CVE-2026-14827 Calendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter
- CVE-2026-14826 Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR