Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 874 of 1013.
- CVE-2026-13780 Security feature bypass in Chrome
- CVE-2026-1378 WP Posts Re-order <= 1.0 - Cross-Site Request Forgery to Settings Update
- CVE-2026-13779 Use after free in Chrome
- CVE-2026-13778 Use after free in Chrome
- CVE-2026-13777 Memory corruption in Chrome
- CVE-2026-13776 Memory corruption in Chrome
- CVE-2026-13775 Use after free in Chrome
- CVE-2026-13774 Use after free in Chrome
- CVE-2026-13773 IBM WebSphere eXtreme Scale is affected by server side request forgery when ORB is used as Transport Protocol
- CVE-2026-13772 IBM WebSphere eXtreme Scale's OQL is affected by remote code execution
- CVE-2026-13771 Cross-site scripting in Customer Reviews for WooCommerce
- CVE-2026-13770 AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler
- CVE-2026-1377 imwptip <= 1.1 - Cross-Site Request Forgery to Settings Update
- CVE-2026-13769 Overly permissive File Permissions in AWS CLI
- CVE-2026-13768 Gardyn IoT Hub Use of Hard-coded Credentials
- CVE-2026-13767 Quiz and Survey Master (QSM) <= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter
- CVE-2026-13766 DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers
- CVE-2026-13765 Missing authorization in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- CVE-2026-13763 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in AWS Application Load Balancer with AWS WAF
- CVE-2026-13762 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF
- CVE-2026-13761 Denial of service in Pega Infinity
- CVE-2026-13760 OS Command Injection in aws-cdk-lib Docker Bundling
- CVE-2026-1376 IBM i Denial of Service
- CVE-2026-13759 IBM WebSphere eXtreme Scale is affected by Insecure Deserilization
- CVE-2026-13758 Weak cryptography in CryptX
- CVE-2026-13757 P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing
- CVE-2026-13756 WP Grid Builder <= 2.3.3 - Authenticated (Subscriber+) Privilege Escalation via 'key' Parameter
- CVE-2026-13755 Tickera <= 3.6.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute
- CVE-2026-13754 Tickera <= 3.6.0.0 - Authenticated (Staff+) SQL Injection via 's' Parameter
- CVE-2026-13753 Certain HP DeskJet All in One – Potential Information Disclosure
- CVE-2026-13752 SQL injection in Snowflake CLI
- CVE-2026-13751 Snowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/!load
- CVE-2026-13750 Snowflake CLI Sensitive Credential Exposure Through Debug Logging
- CVE-2026-1375 Missing authorization in Tutor LMS – eLearning and online course solution
- CVE-2026-13749 Snowflake CLI Arbitrary Code Execution via Snowpark Annotation Processor Template Injection
- CVE-2026-13748 Snowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path Restriction
- CVE-2026-13746 Snowflake CLI SQL Injection Through Improper Neutralization of Local CLI Parameters
- CVE-2026-13745 Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOME
- CVE-2026-13744 Snowflake CLI SQL Injection Through Improper Neutralization of User-Controlled Input
- CVE-2026-13743 Improper verification of cryptographic signature in CubeSpace CW0057 Reaction Wheel
- CVE-2026-13742 Lack of signature verification before execution of downloaded content
- CVE-2026-13741 Privilege escalation in Digits: WordPress Mobile Number Signup and Login
- CVE-2026-13739 Server-Side Request Forgery (SSRF)
- CVE-2026-13738 Improper Authorization Validation
- CVE-2026-13737 Command Restriction Bypass
- CVE-2026-13736 NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API
- CVE-2026-13735 WireGuard keepalive transport-data messages accepted without Poly1305 authentication
- CVE-2026-13734 Zephyr WireGuard mutates peer state before anti-replay check, enabling capture-replay endpoint hijack
- CVE-2026-13733 Cross-site scripting in Download Manager
- CVE-2026-13732 Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf
- CVE-2026-13731 WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
- CVE-2026-1373 Easy Author Image <= 1.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Picture URL
- CVE-2026-13729 Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF
- CVE-2026-13728 WatchGuard Firebox Hardcoded Fallback Encryption Key in Access Portal Resource Credential Database
- CVE-2026-13726 Multiple Page Generator Plugin – MPG < 4.1.8 - Reflected XSS via mpg_shortcode
- CVE-2026-13725 Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjax
- CVE-2026-13724 Business Logic Bypass in Gobito's Corporate Training Management System
- CVE-2026-13723 Develar's electron-builder allows arbitrary file overwrite
- CVE-2026-13722 WatchGuard Firebox Firmware Image Validation Bypass in WatchGuard Fireware OS
- CVE-2026-13720 Editor can forge file-provisioning provenance on dashboards via the dashboard API
- CVE-2026-1372 Missing authorization in Tutor LMS Elementor Addons
- CVE-2026-13719 Alert rules in restricted folders disclosed via the alert rules list API
- CVE-2026-13718 Tabs Responsive <= 2.5 - Shop Manager+ Stored XSS via WooCommerce Product Tab Content
- CVE-2026-13717 Misconfiguration in Red Hat OpenShift AI (RHOAI)
- CVE-2026-13716 Path Traversal: '.../...//' in Crafty Controller
- CVE-2026-13714 Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
- CVE-2026-13713 Use after free in YAML::Syck
- CVE-2026-13712 Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL
- CVE-2026-13710 Cross-site scripting in Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
- CVE-2026-1371 Missing authorization in Tutor LMS – eLearning and online course solution
- CVE-2026-13709 Cross-site scripting in Graphina – Charts and Graphs For Elementor
- CVE-2026-13708 Denial of service in Imager::File::JPEG
- CVE-2026-13707 Session fixation attacks on improperly configured OAuth 1.0a tools
- CVE-2026-13706 UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG
- CVE-2026-13705 Memory corruption in Imager
- CVE-2026-13704 GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form
- CVE-2026-13703 SEO Redirection Plugin – 301 Redirect Manager < 9.19 - Subscriber+ Redirect Rule Disclosure
- CVE-2026-13701 Advanced Excerpt < 4.5 - Admin+ Stored XSS via Ellipsis Setting
- CVE-2026-13700 WooMS <= 9.14 - Unauthenticated Server-Side Request Forgery and Sensitive Information Disclosure
- CVE-2026-1370 SIBS - WooCommerce <= 2.2.0 - Authenticated (Admin+) SQL Injection via 'referencedId' Parameter
- CVE-2026-13699 Databroker 0.6.1 PublishValue missing data_point panic
- CVE-2026-13698 Denial of service in OpenVPN
- CVE-2026-13697 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
- CVE-2026-13696 LDAP Injection in HAVELSAN's Liman MYS
- CVE-2026-13695 SQL Injection in the Integratec Application
- CVE-2026-13694 Bit Form < 3.1.0 - Unauthenticated Workflow Trigger via Authentication Bypass
- CVE-2026-13693 Bit Form < 3.1.0 - Unauthenticated Arbitrary File Read via Path Traversal
- CVE-2026-13692 PayU CommercePro < 3.9.0 - Unauthenticated Order Tampering
- CVE-2026-13690 UsersWP < 1.2.67 - Two-Factor Authentication Bypass
- CVE-2026-1369 Conditional CAPTCHA <= 4.0.0 - Open Redirect
- CVE-2026-13684 Other in DiskStation Manager (DSM)
- CVE-2026-13683 SQL injection in DiskStation Manager (DSM)
- CVE-2026-1368 Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation
- CVE-2026-13676 fast-uri vulnerable to host confusion via failed IDN canonicalization
- CVE-2026-13673 Misconfiguration in DiskStation Manager (DSM)
- CVE-2026-1367 SQL Injection
- CVE-2026-13666 Other in DiskStation Manager (DSM)
- CVE-2026-1365 Information Disclosure in Sayax's OSOS
- CVE-2026-1364 JNC｜IAQS and I6 - Missing Authentication
- CVE-2026-13639 Weak cryptography in DiskStation Manager (DSM)