Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 880 of 1013.
- CVE-2026-1304 Cross-site scripting in Membership Plugin – Restrict Content
- CVE-2026-13039 Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API
- CVE-2026-13038 Use after free in Chrome
- CVE-2026-13037 Use after free in Chrome
- CVE-2026-13036 Use after free in Chrome
- CVE-2026-13035 Use after free in Chrome
- CVE-2026-13034 Security feature bypass in Chrome
- CVE-2026-13033 Memory corruption in Chrome
- CVE-2026-13032 Use after free in Chrome
- CVE-2026-13031 Use after free in Chrome
- CVE-2026-13030 Information disclosure in Chrome
- CVE-2026-1303 MailChimp Campaigns <= 3.2.4 - Missing Authorization to Authenticated (Subscriber+) MailChimp App Disconnection
- CVE-2026-13029 Use after free in Chrome
- CVE-2026-13028 Use after free in Chrome
- CVE-2026-13027 Use after free in Chrome
- CVE-2026-13026 Use after free in Chrome
- CVE-2026-13025 Race condition in Chrome
- CVE-2026-13024 Security feature bypass in Chrome
- CVE-2026-13023 Information disclosure in Chrome
- CVE-2026-13022 Security feature bypass in Chrome
- CVE-2026-13021 Security feature bypass in Chrome
- CVE-2026-13020 Weak Password Recovery Mechanism in Portal for ArcGIS
- CVE-2026-1302 Meta-box GalleryMeta <= 3.0.1 - Authenticated (Editor+) Stored Cross-Site Scripting via Image Caption
- CVE-2026-13019 Missing Authentication
- CVE-2026-13018 Memory corruption in Chrome
- CVE-2026-13016 Unauthenticated SQL Injection in ServiceNow AI Platform
- CVE-2026-13015 WP Google Review Slider <= 18.1 - Reflected Cross-Site Scripting via 'place' Parameter
- CVE-2026-13014 Remote Code Execution vulnerability in "Suspicious" application
- CVE-2026-13011 SQL injection in ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
- CVE-2026-13010 JoomSport <= 5.7.9 - Authenticated (Contributor+) SQL Injection via 'event' Shortcode Attribute
- CVE-2026-1301 Out-of-bounds Write in o6 Automation GmbH Open62541
- CVE-2026-13009 AI Copilot <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'order[0][dir]' Parameter
- CVE-2026-13007 Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure
- CVE-2026-13006 Incomplete protection against CVE-2025-11226
- CVE-2026-13005 MxChat <= 3.2.10 - Authenticated (Admin+) Stored Cross-Site Scripting via 'intro_message' Setting
- CVE-2026-13002 Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsing
- CVE-2026-13001 Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter
- CVE-2026-1300 Responsive Header Plugin <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters
- CVE-2026-12999 Infineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustion
- CVE-2026-12998 Missing authorization in Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- CVE-2026-12997 Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter
- CVE-2026-12996 Use after free in OpenVPN
- CVE-2026-12995 Missing authorization in Custom Field Template
- CVE-2026-12994 Missing authorization in WCFM – Frontend Manager for WooCommerce
- CVE-2026-12993 Apicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subset
- CVE-2026-12992 Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validation
- CVE-2026-12991 Multiple vulnerabilities in Ghost Robotics' Vision 60
- CVE-2026-12990 Multiple vulnerabilities in Ghost Robotics' Vision 60
- CVE-2026-1299 email BytesGenerator header injection due to unquoted newlines
- CVE-2026-12989 Multiple vulnerabilities in Ghost Robotics' Vision 60
- CVE-2026-12988 WP 2FA < 3.1.1.2 - Account Takeover via 2FA Setup Email Binding
- CVE-2026-12987 Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration
- CVE-2026-12986 Payara Server Full has a Cross-Site Request Forgery vulnerability
- CVE-2026-12985 Mattermost DCR redirect URI allowlist bypass via improper URL component validation
- CVE-2026-12984 Exposure of Sensitive Information to an Unauthorized Actor in Zyxel's WAH7601
- CVE-2026-12983 Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection
- CVE-2026-12982 Document Gallery < 5.1.1 - Reflected XSS via dg_generate_gallery
- CVE-2026-12981 CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset
- CVE-2026-12980 Post Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet Variable
- CVE-2026-1298 Easy Replace Image <= 3.5.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Attachment Replacement
- CVE-2026-12979 FunnelKit < 3.15.0.6 - Admin+ Arbitrary File Deletion via Path Traversal in Template Importer
- CVE-2026-12978 FunnelKit < 3.15.0.6 - Reflected XSS via Divi Optin Form
- CVE-2026-12976 LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant
- CVE-2026-12975 XML external entity in Red Hat build of Apicurio Registry 3.3.1
- CVE-2026-12974 Security Policy Bypass in Forcepoint Security Engine (NGFW)
- CVE-2026-12973 PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification
- CVE-2026-12972 PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata Tampering
- CVE-2026-12971 LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature
- CVE-2026-12970 LearnPress < 4.4.1 - Reflected XSS via c_search
- CVE-2026-12969 Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation
- CVE-2026-12968 Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload
- CVE-2026-12966 Direct Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering via digages AJAX Actions
- CVE-2026-12965 Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking
- CVE-2026-12962 Misconfiguration in Armoury Crate
- CVE-2026-12960 Other in Router app
- CVE-2026-1296 Frontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameter
- CVE-2026-12958 Arbitrary file write in Language Servers for AWS
- CVE-2026-12957 Arbitrary Code Execution in Language Servers for AWS
- CVE-2026-12956 Missing authorization in Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
- CVE-2026-12955 Missing authorization in Cookie Banner for GDPR / CCPA – WPLP Cookie Consent
- CVE-2026-12954 Missing authorization in Mapster WP Maps
- CVE-2026-12951 MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter
- CVE-2026-1295 Buy Now Plus <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-12949 Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter
- CVE-2026-12948 Stored Cross-Site Scripting (XSS)
- CVE-2026-12947 IBM App Connect Enterprise is vulnerable to Confidentiality disclosure on Discovery Connector nodes
- CVE-2026-12946 Remote Code Execution in CUGA Component CodeAgent
- CVE-2026-12945 Langflow is affected by exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
- CVE-2026-12944 Incomplete Security Scanner Blocklist Enables Network-Based Code Execution
- CVE-2026-12943 This Power Hardware Management Console update is being released to address
- CVE-2026-12942 Langflow is affected by path traversal due to multiple unauthenticated and insufficiently authorized API endpoints
- CVE-2026-12941 MultiVendorX <= 5.0.9 - Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter
- CVE-2026-12940 Command injection in Langflow OSS
- CVE-2026-1294 All In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint
- CVE-2026-12939 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute
- CVE-2026-12938 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
- CVE-2026-12937 Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter
- CVE-2026-12936 Recurio <= 1.1.3 - Authenticated (Shop Manager+) SQL Injection via 'data' Parameter
- CVE-2026-12935 Unauthenticated Remote Code Execution in TP-Link TL-WR940N RTSP Conntrack Feature
- CVE-2026-12932 Denial of service in OpenVPN