Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 879 of 1013.
- CVE-2026-1317 WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name
- CVE-2026-13169 Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR
- CVE-2026-13168 Eventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API
- CVE-2026-13167 Missing authorization in Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
- CVE-2026-13165 Remote Code Execution in SzafirHost
- CVE-2026-13164 Unauthenticated self-registration in MailerUp allows access to stored email data
- CVE-2026-13163 Lack of input validation in Mailerup input parameter leads to Open Redirect
- CVE-2026-13162 Command injection in CoreTec 4
- CVE-2026-13161 TrueBooker <= 1.2.2 - Unauthenticated SQL Injection
- CVE-2026-1316 Customer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href Parameter
- CVE-2026-13159 Real Estate Papi <= 1.0.5 - Subscriber+ Plugin Installation
- CVE-2026-13158 Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload
- CVE-2026-13157 Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload
- CVE-2026-13156 MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF
- CVE-2026-13154 Essential Blocks < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint
- CVE-2026-13153 Essential Blocks < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint
- CVE-2026-13152 Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation
- CVE-2026-13150 SSRF in Pentestify PDF generation endpoint via Host header
- CVE-2026-1315 Unauthenticated Denial of Service via Firmware Update Endpoint on TP-Link Tapo C220 & C520WS
- CVE-2026-13149 brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
- CVE-2026-13148 Memory leak in scan method
- CVE-2026-13147 Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis
- CVE-2026-13146 WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR
- CVE-2026-13145 WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR
- CVE-2026-13144 WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset
- CVE-2026-13143 WP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN
- CVE-2026-13142 Passwordless Login by VentraConnect < 1.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force
- CVE-2026-13140 Stored Cross-Site Scripting in Canarytokens.org
- CVE-2026-1314 Missing authorization in 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery
- CVE-2026-13138 Improper Authorization in Divasoft Software's Biletiva Ticketing Platform
- CVE-2026-13133 Other in LINE for Windows
- CVE-2026-13132 GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability
- CVE-2026-13131 GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability
- CVE-2026-1313 Server-side request forgery in MimeTypes Link Icons
- CVE-2026-13129 Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
- CVE-2026-13128 Foxit PDF Editor/Reader Doc Object Use-After-Free Remote Code Execution Vulnerability
- CVE-2026-13127 Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
- CVE-2026-13126 Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
- CVE-2026-13125 GeoVision GeoWebPlayer 1.1.1.0 Websocket Server function vulnerability
- CVE-2026-13122 Denial of service in OpenVPN
- CVE-2026-13121 Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability
- CVE-2026-1312 Potential SQL injection via QuerySet.order_by and FilteredRelation
- CVE-2026-13119 Registrations for the Events Calendar <= 3.2 - Authenticated (Contributor+) SQL Injection via 'standard' Parameter
- CVE-2026-13117 Use after free in OpenVPN
- CVE-2026-13116 Missing authorization in PDF Invoices & Packing Slips for WooCommerce
- CVE-2026-13114 Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info
- CVE-2026-13113 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab
- CVE-2026-13110 Missing authorization in StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce
- CVE-2026-1311 Worry Proof Backup <= 0.2.4 - Authenticated (Subscriber+) Path Traversal via Backup Upload
- CVE-2026-13108 Dimension Denial-of-Service
- CVE-2026-13107 Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026
- CVE-2026-13105 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities
- CVE-2026-13104 Privilege escalation in App Store
- CVE-2026-13103 Path traversal in App Store
- CVE-2026-1310 Simple calendar for Elementor <= 1.6.6 - Missing Authorization to Unauthenticated Arbitrary Calendar Entry Deletion
- CVE-2026-13097 Privilege escalation in Red Hat Enterprise Linux 10
- CVE-2026-13094 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities
- CVE-2026-13089 Auth bypass in OIDC::Lite
- CVE-2026-13086 Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint
- CVE-2026-13084 Null Pointer Dereference in WatchGuard Fireware OS iked Process
- CVE-2026-13083 Pen-drive: pen-drive: stored xss via unescaped cluster data in html report
- CVE-2026-13082 GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets
- CVE-2026-13080 WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter
- CVE-2026-13079 WatchGuard Mobile VPN with SSL Windows Client Local Privilege Escalation
- CVE-2026-13078 Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
- CVE-2026-13077 Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data
- CVE-2026-13076 Aggregation Framework Memory Exhaustion Leading to Process Termination
- CVE-2026-13075 $rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation
- CVE-2026-13074 Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service
- CVE-2026-13073 MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination
- CVE-2026-13072 MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption
- CVE-2026-13071 Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination
- CVE-2026-13070 Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination
- CVE-2026-1307 Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token
- CVE-2026-13069 Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion
- CVE-2026-13068 MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse
- CVE-2026-13067 tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket
- CVE-2026-13066 Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure
- CVE-2026-13065 MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination
- CVE-2026-13064 MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service
- CVE-2026-13063 libmongocrypt Improper Input Validation Leading to Process Termination
- CVE-2026-13062 MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters
- CVE-2026-13061 Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage
- CVE-2026-13060 $graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access
- CVE-2026-1306 midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX Action
- CVE-2026-13059 Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass
- CVE-2026-13058 Transaction Command Insufficient Input Validation Leading to Process Termination
- CVE-2026-13057 Missing authorization in MongoDB Server
- CVE-2026-13056 A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM
- CVE-2026-13055 Server crash via aggregation pipeline expression with compound wildcard index specification
- CVE-2026-13054 WatchGuard Firebox Arbitrary File Write via Path Traversal in Management Web UI
- CVE-2026-13053 WatchGuard Firebox Authenticated Out of Bounds Write in Management CLI Command Handler
- CVE-2026-13051 Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustio
- CVE-2026-13050 WatchGuard Firebox networkd Out of Bounds Write Vulnerability
- CVE-2026-1305 Japanized for WooCommerce <= 2.8.4 - Missing Authorization to Unauthenticated Paidy Order Manipulation
- CVE-2026-13048 Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load
- CVE-2026-13046 Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution
- CVE-2026-13043 Auth bypass in Endpoint Security
- CVE-2026-13042 RPB Chessboard <= 8.1.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- CVE-2026-13040 NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter