Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 877 of 1013.
- CVE-2026-1341 Missing Authentication for Critical Function in Avation Light Engine Pro
- CVE-2026-13407 Royal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails
- CVE-2026-13406 Royal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure
- CVE-2026-13405 Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder
- CVE-2026-13404 Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init
- CVE-2026-13402 Royal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template Disclosure
- CVE-2026-13401 XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes
- CVE-2026-13400 Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information
- CVE-2026-1340 Ivanti Endpoint Manager Mobile (EPMM) Code Injection
- CVE-2026-13399 Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order
- CVE-2026-13397 HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes
- CVE-2026-13395 Bookly < 27.8 - Unauthenticated SQL Injection via staff_id
- CVE-2026-13393 ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)
- CVE-2026-13392 ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)
- CVE-2026-13390 The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation
- CVE-2026-13389 Missing authorization in webtoffee-cookie-consent
- CVE-2026-13385 Security feature bypass in Router
- CVE-2026-13384 WatchGuard Firebox wgagent Out of Bounds Write Vulnerability
- CVE-2026-13383 WatchGuard Firebox ikestubd Out of Bounds Write Vulnerability
- CVE-2026-13381 VSee Clinic and API Insecure Direct Object Reference in File API Allows Unauthorized File Access and Deletion
- CVE-2026-13380 VSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP Responses
- CVE-2026-1338 Authorization Bypass Through User-Controlled Key in GitLab
- CVE-2026-13379 Memory corruption in OpenVPN
- CVE-2026-13378 Form Vibes <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form 7 Form Field
- CVE-2026-13377 WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in SIP Proxy Configuration
- CVE-2026-13376 WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in spamBlocker Module
- CVE-2026-13375 WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Autotask Technology Integration Configuration
- CVE-2026-13374 WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in ConnectWise Technology Integration Configuration
- CVE-2026-13373 WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Tigerpaw Technology Integration Configuration
- CVE-2026-13372 Code injection in Remote Desktop Manager
- CVE-2026-13371 WatchGuard Firebox Management Web UI Denial of Service via Unsafe Deserialization
- CVE-2026-1337 Insufficient escaping of unicode characters in query log
- CVE-2026-13369 Path traversal in Ninja Forms - File Uploads
- CVE-2026-13368 WatchGuard Firebox Race Condition and Use-After-Free in Mobile VPN with IKEv2 LDAP Authentication
- CVE-2026-13367 IBM Informix Dynamic Server Privilege Escalation Vulnerability in oninit Utility
- CVE-2026-13365 IBM Planning Analytics Local is affected by security vulnerabilities
- CVE-2026-13362 Cross-site scripting in SendPulse Email Marketing Newsletter
- CVE-2026-13361 IBM Informix Server Vulnerability in SQL Interface Handler Could Allow Remote Code Execution
- CVE-2026-13360 Cross-site scripting in WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
- CVE-2026-1336 Missing authorization in AI ChatBot with ChatGPT and Content Generator by AYS
- CVE-2026-13359 Cross-site scripting in Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress
- CVE-2026-13358 Missing authorization in Simply Schedule Appointments
- CVE-2026-13357 Houzez Property Feed <= 2.5.46 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
- CVE-2026-13356 Interrupted navigation could allow address bar origin spoofing in Firefox for iOS
- CVE-2026-13355 Privilege escalation in Meta Box Frontend Submission
- CVE-2026-13354 Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- CVE-2026-13353 Code injection in WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel
- CVE-2026-13352 File upload in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- CVE-2026-13351 net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets
- CVE-2026-13350 Missing authorization in Venueless
- CVE-2026-1335 Memory corruption in SOLIDWORKS eDrawings
- CVE-2026-13348 Auth bypass in PowerChute™ Serial Shutdown
- CVE-2026-13347 Hide My WP Lite <= 1.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'he_wrapper_js' Parameter
- CVE-2026-13346 pip absolute path traversal during download from malicious package indexes
- CVE-2026-13345 Missing authorization in Essential Addons for Elementor
- CVE-2026-13344 Essential Addons for Elementor - Lite < 6.6.10 - Contributor+ Stored XSS via Pricing Table Title Tag
- CVE-2026-13343 Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder
- CVE-2026-13342 Security Optimizer – The All-In-One Protection Plugin < 1.6.5 - Login Access IP Allowlist Bypass via post_password
- CVE-2026-13341 Prompt Injection and Credential Exposure via Untrusted Analytics Data in Kong Konnect MCP
- CVE-2026-13340 SVG Support < 2.5.17 - Author+ Stored XSS via .svgz Sanitization Bypass
- CVE-2026-1334 Memory corruption in SOLIDWORKS eDrawings
- CVE-2026-13339 CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter
- CVE-2026-13337 SQL injection in NetBotz 5 - 750/755
- CVE-2026-13336 Command injection in NetBotz 5 - 750/755
- CVE-2026-13335 Cross-site scripting in CodePeople Post Map for Google Maps
- CVE-2026-13334 Mang Board WP <= 2.3.4 - Reflected Cross-Site Scripting via 'stag' Parameter
- CVE-2026-13333 Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter
- CVE-2026-13332 Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)
- CVE-2026-13331 Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter
- CVE-2026-13330 Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload
- CVE-2026-1333 Memory corruption in SOLIDWORKS eDrawings
- CVE-2026-13329 WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund
- CVE-2026-13328 TLP Food Menu < 6.0.2 - Unauthenticated Reservation Status Modification
- CVE-2026-13327 Security feature bypass in Server
- CVE-2026-13326 Out-of-bounds read and integer underflow vulnerability in QNdefNfcTextRecord impacts Qt NFC module
- CVE-2026-13323 Cross-site scripting in Eclipse Open VSX
- CVE-2026-13322 Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service
- CVE-2026-13321 DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field
- CVE-2026-13320 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-1332 HAMASTAR Technology｜MeetingHub - Missing Authentication
- CVE-2026-13319 Authorization Bypass Through User-Controlled Key in GitLab
- CVE-2026-13318 Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip
- CVE-2026-13316 Foreman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config
- CVE-2026-13314 Stored XSS in pretix-digital
- CVE-2026-13313 Security feature bypass in Router
- CVE-2026-13311 shell-quote parse() is quadratic in token count, enabling denial of service
- CVE-2026-1331 AMASTAR Technology｜MeetingHub - Arbitrary File Upload
- CVE-2026-13309 Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability
- CVE-2026-13308 Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability
- CVE-2026-13307 Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability
- CVE-2026-13306 Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability
- CVE-2026-13305 Security feature bypass in MaxiCharger AC Elite Home
- CVE-2026-13303 Boundary vulnerable to server-side request forgery in Vault credential store
- CVE-2026-1330 HAMASTAR Technology｜MeetingHub - Arbitrary File Read
- CVE-2026-13297 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-13295 Cross-site scripting in Page Builder by SiteOrigin
- CVE-2026-13293 IBM MQ Java messaging is vulnerable to remote code execution
- CVE-2026-1329 Tenda AX1803 WifiGuestSet fromGetWifiGuestBasic stack-based overflow
- CVE-2026-13287 IBM MQ Managed File Transfer is vulnerable to XML external entity injection
- CVE-2026-13285 IBM MQ Managed File Transfer is vulnerable to XML external entity injection