Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 881 of 1013.
- CVE-2026-1293 Yoast SEO <= 26.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block Attribute
- CVE-2026-12927 Memory corruption in IGSS Definition (Def.exe)
- CVE-2026-12924 Eventin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter
- CVE-2026-12923 Video Gallery <= 4.0.3 - Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter
- CVE-2026-12921 Use after free in AzeoTech DAQFactory
- CVE-2026-12920 Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Administrator+) SQL Injection via 's' Parameter
- CVE-2026-1292 Tanium addressed an insertion of sensitive information into log file vulnerability in Trends.
- CVE-2026-12918 Mail Mint <= 1.24.1 - Authenticated (Administrator+) SQL Injection via 'recipients' Parameter
- CVE-2026-12912 Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image
- CVE-2026-12910 Missing Authentication for Critical Function in GitLab
- CVE-2026-1291 Meow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation
- CVE-2026-12907 RTMKit Addons for Elementor < 2.0.9 - Author+ Site-Wide Theme Builder Template Creation and Activation
- CVE-2026-12906 RTMKit Addons for Elementor < 2.0.9 - Contributor+ Private Post Title Disclosure
- CVE-2026-12905 Missing authorization in Online Scheduling and Appointment Booking System – Bookly
- CVE-2026-12904 Missing authorization in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- CVE-2026-12902 Missing authorization in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- CVE-2026-12901 GetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification
- CVE-2026-12900 Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block
- CVE-2026-1290 [PI141230] Fixed A broken access control issue.
- CVE-2026-12898 All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal
- CVE-2026-12897 Out-of-bounds read in Horner Automation Cscape
- CVE-2026-12895 SQL Injection in Frappe's ERPNext
- CVE-2026-12894 Code injection in Red Hat Build of Apache Camel 3.33.3.SP1
- CVE-2026-12892 Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: 1-byte heap out-of-bounds read in h.264 nal extension slice parser
- CVE-2026-12891 Memory corruption in Red Hat Enterprise Linux 10
- CVE-2026-1289 PDF File Parsing Vulnerabilities in Certain Autodesk Desktop Products
- CVE-2026-12888 HTML injection in the Canarytoken Google Chat notification
- CVE-2026-12887 Code injection in Octopus Server
- CVE-2026-12882 Mattermost Markdown autolink parsing denial of service
- CVE-2026-1288 RFA File Parsing Vulnerability in Autodesk Revit
- CVE-2026-12879 Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy
- CVE-2026-12878 Privilege escalation in Codefresh
- CVE-2026-12877 Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter
- CVE-2026-12872 Webinfos <= 1.2 - Unauthenticated Arbitrary File Upload
- CVE-2026-1287 Potential SQL injection in column aliases via control characters
- CVE-2026-12869 Header Footer Builder for Elementor < 1.2.1 - Contributor+ Stored XSS via Template Import
- CVE-2026-12866 expr-eval vulnerable to Code Execution
- CVE-2026-12865 Photo Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parameters
- CVE-2026-12863 Open redirect
- CVE-2026-12862 XLSX formula injection in exports
- CVE-2026-12860 RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path
- CVE-2026-1286 Deserialization in EcoStruxure™ Foxboro DCS
- CVE-2026-12859 IDOR in Caz Informatics' Advancity ALMS Cloud
- CVE-2026-12858 Local privilege escalation vulnerability in ESET AV Remover
- CVE-2026-12856 Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension
- CVE-2026-12855 H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution.
- CVE-2026-12853 Missing authorization in Flamingo
- CVE-2026-12852 MLS wire decoder allocates attacker-declared opaque length before bounds check
- CVE-2026-12851 GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability
- CVE-2026-12850 GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability
- CVE-2026-1285 Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods
- CVE-2026-12849 GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability
- CVE-2026-12848 GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command
- CVE-2026-12847 GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command
- CVE-2026-12846 GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command
- CVE-2026-12844 List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function
- CVE-2026-12843 LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint
- CVE-2026-1284 Memory corruption in SOLIDWORKS eDrawings
- CVE-2026-1283 Memory corruption in SOLIDWORKS eDrawings
- CVE-2026-12823 Browserbase Skills Autobrowse Trace Artifact default permission
- CVE-2026-12822 langflow-ai langflow Bundle URL Loader code injection
- CVE-2026-12821 FlowiseAI Flowise S3 Document Loader S3.ts path traversal
- CVE-2026-1282 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab
- CVE-2026-12819 DVP-12SE Missing Authentication and Unauthorized Write access Vulnerability
- CVE-2026-12818 DVP-12SE Exposure of Sensitive Information Vulnerability
- CVE-2026-12817 OpenPGP AEAD decryption skips final tag on chunk-aligned data
- CVE-2026-12816 IESEngine stream-mode MAC forgery via length-dependent KDF split
- CVE-2026-12815 coollabsio coolify Image Name os command injection
- CVE-2026-12814 Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection
- CVE-2026-12813 activepieces File URL file.ts handleUrlFile server-side request forgery
- CVE-2026-12812 Radware Cyber Controller HTML Report Generation HTML injection
- CVE-2026-12811 kortix-ai suna Auth Endpoint page.tsx router.push cross site scripting
- CVE-2026-12810 Edimax BR-6478AC V2 POST Request mp command injection
- CVE-2026-1281 Ivanti Endpoint Manager Mobile (EPMM) Code Injection
- CVE-2026-12809 Edimax BR-6478AC V2 POST Request wiz_5in1_redirect command injection
- CVE-2026-12808 Edimax BR-6478AC V2 POST Request stainfo command injection
- CVE-2026-12807 Edimax BR-6478AC V2 POST Request setWAN command injection
- CVE-2026-12806 Edimax BR-6478AC V2 POST Request formWlSiteSurvey buffer overflow
- CVE-2026-12805 OFFIS DCMTK ofxml.cc parseFile heap-based overflow
- CVE-2026-12804 lemonldap-ng SAML Common Domain Cookie Endpoint CDC.pm redirect
- CVE-2026-12803 KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)
- CVE-2026-12802 CMS AuthEnvelopedData fails to enforce tag-length on decryption
- CVE-2026-12801 Cross-site scripting in Ultra Addons for Contact Form 7
- CVE-2026-12800 Premium Packages <= 6.2.0 - Unauthenticated SQL Injection
- CVE-2026-1280 Missing authorization in Frontend File Manager Plugin
- CVE-2026-12799 BerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorization
- CVE-2026-12798 BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery
- CVE-2026-12797 BerriAI litellm Completions banned_keywords.py async_pre_call_hook authorization
- CVE-2026-12796 BerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expiration
- CVE-2026-12795 BerriAI litellm SSO Debug Flow ui_sso.py json.dumps missing authentication
- CVE-2026-12793 JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
- CVE-2026-1279 Cross-site scripting in Employee Directory – Staff Directory and Listing
- CVE-2026-12789 ILIAS Learning Management System Learning Progress Tracking class.ilTrQuery.php executeQueries sql injection
- CVE-2026-12788 zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 XML Parser import xml external entity reference
- CVE-2026-12787 zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testConnection Endpoint deserialization
- CVE-2026-12786 Ezbsystems UltraISO Premium Edition Kernel Driver bootpt64.sys access control
- CVE-2026-12784 IM-Magic Partition Resizer Kernel Driver MDA_NTDRV.sys access control
- CVE-2026-12782 EaseUS Partition Master Kernel Driver EUEDKEPM.sys access control
- CVE-2026-12781 EaseUS Partition Master Kernel Driver epmntdrv.sys access control
- CVE-2026-12780 AOMEI Backupper Kernel Driver amwrtdrv.sys access control