Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 868 of 1013.
- CVE-2026-14381 Security feature bypass in Chrome
- CVE-2026-14380 DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile
- CVE-2026-1438 Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface
- CVE-2026-14379 GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter
- CVE-2026-14378 Auth bypass in DevKit Pro
- CVE-2026-14373 Nomad Docker driver Linux host namespace bypass
- CVE-2026-14372 Bit Form <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter
- CVE-2026-14371 Command injection in XClarity Integrator for Microsoft Windows Admin Center
- CVE-2026-1437 Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface
- CVE-2026-14368 Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser
- CVE-2026-14367 I3C IBI work-node free-list data race between ISR and workqueue thread
- CVE-2026-14366 SiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pkt
- CVE-2026-14365 TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'
- CVE-2026-14364 TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'
- CVE-2026-14363 Cargo Extension: SQLi in Special:Drilldown
- CVE-2026-14362 Denial of service via crafted push/pull gossip message in memberlist
- CVE-2026-14361 Consul-template is vulnerable to path redirection in writeToFile through symlink attack
- CVE-2026-1436 Improper Access Control (IDOR) vulnerability in Graylog Web Interface
- CVE-2026-14359 Privilege escalation in YITH WooCommerce Waitlist Premium
- CVE-2026-14358 Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title
- CVE-2026-14357 Missing authorization in DevKit Pro
- CVE-2026-14356 Missing authorization in FleekDash V2
- CVE-2026-14355 ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD
- CVE-2026-14354 Information disclosure in EcoStruxure™ Cybersecurity Admin Expert
- CVE-2026-14352 AR for WooCommerce <= 8.40 - Unauthenticated Path Traversal to Arbitrary File Read via 'file' Parameter
- CVE-2026-14351 Exposure of Sensitive Information Through Metadata in GitLab
- CVE-2026-14350 Vulnerabilities exists in IBM Cloud Pak for Data System
- CVE-2026-1435 Incorrect management of session invalidation vulnerability in Graylog Web Interface
- CVE-2026-14349 Missing authorization in TrueBooker – Appointment Booking and Scheduler System
- CVE-2026-14345 WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter
- CVE-2026-14344 Inconsistent authorization checks in Mattermost Boards endpoints
- CVE-2026-14343 Cross-site scripting in Download Manager
- CVE-2026-14342 Mail Mint <= 1.24.2 - Authenticated (Administrator+) SQL Injection via 'contact_ids' Parameter
- CVE-2026-14341 Missing Authorization in GitLab
- CVE-2026-14340 Missing authorization in Enterprise Server
- CVE-2026-1434 Reflected XSS in Omega-PSIR
- CVE-2026-14337 Cross-site scripting in Pega Infinity
- CVE-2026-14336 Server-side request forgery in Eclipse CSI - PIA
- CVE-2026-14335 Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters
- CVE-2026-14334 Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload
- CVE-2026-14333 Information disclosure in Demi
- CVE-2026-14332 Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' Action
- CVE-2026-14331 Subscribe2 < 10.46 - Reflected XSS via email Parameter
- CVE-2026-14330 Pipewire: pulse server alloca stack overflow
- CVE-2026-1433 Information disclosure in uniFLOW ULM (Universal Login Manager) Standalone
- CVE-2026-14328 Privilege escalation in Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress
- CVE-2026-14327 AR for WordPress <= 8.40 - Unauthenticated Arbitrary File Read via 'file' Parameter
- CVE-2026-14326 Timetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR
- CVE-2026-14325 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting
- CVE-2026-14324 Pipewire: raop rtsp null deref
- CVE-2026-14323 Path traversal in Printcart Store – Web to Print Product Designer for WooCommerce
- CVE-2026-14322 Timetics < 1.0.57 - Unauthenticated Booking Auto-Approval via Arbitrary payment_method
- CVE-2026-14321 Divi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing
- CVE-2026-1432 SQL injection (SQLi) on the Buroweb platform
- CVE-2026-14319 GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure
- CVE-2026-14318 GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings
- CVE-2026-14317 GiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction Bypass
- CVE-2026-14316 Heap buffer overflow in boks_sshd revoked-key error handling
- CVE-2026-14315 Pixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event Submission
- CVE-2026-14314 PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR
- CVE-2026-14313 PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR
- CVE-2026-14311 Missing authorization in Booking for Appointments and Events Calendar – Amelia
- CVE-2026-14310 Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection
- CVE-2026-1431 Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure
- CVE-2026-14309 Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypass
- CVE-2026-14308 Insufficient Signature Validation
- CVE-2026-14307 Geotargeting WP < 3.5.6.2 - Reflected XSS
- CVE-2026-14306 Tutor LMS < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass
- CVE-2026-14305 WP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likes
- CVE-2026-14304 XML external entity in Eclipse Accessibility Tools Framework (ACTF)
- CVE-2026-14300 miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover
- CVE-2026-1430 WP Lightbox 2 < 3.0.7 - Admin+ Stored XSS
- CVE-2026-14298 Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost
- CVE-2026-14297 Memory corruption in nRF Connect SDK
- CVE-2026-14296 nRF54H20: MCUBoot can be tricked to executing unauthenticated code
- CVE-2026-14293 Autopay / Blue Media for WooCommerce < 5.0.1 - Unauthenticated Stored XSS via CSS Editor
- CVE-2026-14292 WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title
- CVE-2026-14291 Security Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa
- CVE-2026-14290 Embed Google Photos Album Easily <= 2.2.1 - Contributor+ Stored XSS via link Shortcode Attribute
- CVE-2026-1429 WellChoose｜Single Sign-On Portal System - Reflected Cross-site Scripting
- CVE-2026-14289 WP FacturaONE < 5.37 - Unauthenticated Remote Code Execution
- CVE-2026-14288 Use of Incorrectly-Resolved Name or Reference in GitLab
- CVE-2026-14287 TenWeb Speed Optimizer < 2.33.5 - Unauthenticated Stored XSS via Critical CSS Token Bypass
- CVE-2026-14282 GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field
- CVE-2026-14281 Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
- CVE-2026-14280 Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys
- CVE-2026-1428 WellChoose｜Single Sign-On Portal System - OS Command Injection
- CVE-2026-14279 Wholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter
- CVE-2026-14277 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities
- CVE-2026-14276 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities
- CVE-2026-14275 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities
- CVE-2026-14273 IBM DataPower Gateway Incorrect Authorization
- CVE-2026-14270 File upload in Extra Checkout Options - addon for Extra Product Options plugin
- CVE-2026-1427 WellChoose｜Single Sign-On Portal System - OS Command Injection
- CVE-2026-14269 IBM DataPower Gateway Buffer Overflow
- CVE-2026-14266 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-14265 RCE via Deserialization in AWS Advanced JDBC Wrapper
- CVE-2026-14262 Auth bypass in Simple JWT Login – Allows you to use JWT on REST endpoints.
- CVE-2026-14261 CVE-2026-14261
- CVE-2026-1426 Advanced AJAX Product Filters <= 3.1.9.6 - Authenticated (Author+) PHP Object Injection via Live Composer Compatibility