Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 882 of 1013.
- CVE-2026-1278 Mandatory Field <= 1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Fields
- CVE-2026-12779 AOMEI Dynamic Disk Manager Kernel Driver ddmdrv.sys access control
- CVE-2026-12778 AOMEI Partition Assistant Kernel Driver ampa10.sys access control
- CVE-2026-12776 Montodel House-Rental-Management index.php houses sql injection
- CVE-2026-12775 Montodel House-Rental-Management login.php sql injection
- CVE-2026-12774 BerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with_mcp_client server-side request forgery
- CVE-2026-12773 BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication
- CVE-2026-12772 BerriAI litellm PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expiration
- CVE-2026-12771 BerriAI litellm M2M JWT user_api_key_auth.py improper authorization
- CVE-2026-12770 BerriAI litellm Admin Key key_management_endpoints.py improper authorization
- CVE-2026-1277 URL Shortify <= 1.12.1 - Unauthenticated Open Redirect via 'redirect_to' Parameter
- CVE-2026-12767 Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches
- CVE-2026-12766 Server-side request forgery in Langflow OSS
- CVE-2026-12765 Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components
- CVE-2026-12763 Langflow is vulnerable to authentication bypass and insufficient session expiration
- CVE-2026-12762 Insertion of Sensitive Information into Externally-Accessible File in IBM Business Automation Insights
- CVE-2026-12761 Auth bypass in miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)
- CVE-2026-12760 Denial-of-Service Vulnerability via Malformed IPv4 Fragmentation Handling in TP-Link Tapo C200
- CVE-2026-1276 IBM QRadar SIEM Cross-Site Scripting
- CVE-2026-12759 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
- CVE-2026-12758 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
- CVE-2026-12757 Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field
- CVE-2026-12756 Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026
- CVE-2026-12755 Server-side request forgery in Server
- CVE-2026-12754 VikBooking Hotel Booking Engine & PMS <= 1.8.12 - Reflected Cross-Site Scripting via 'layoutstyle' Parameter
- CVE-2026-12753 SQL injection in Advance Product Search- Voice & Ajax Search for WooCommerce
- CVE-2026-12752 Multiple security vulnerabilities addressed with IBM Business Automation Workflow August 2026
- CVE-2026-12751 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
- CVE-2026-12750 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
- CVE-2026-1275 Cross-site scripting in Multi Post Carousel by Category
- CVE-2026-12749 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
- CVE-2026-12747 Cross-site scripting in Frontend Admin by DynamiApps
- CVE-2026-12746 Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter
- CVE-2026-12745 Deserialization in Neurons for ITSM
- CVE-2026-12744 Deserialization in Neurons for ITSM
- CVE-2026-12743 affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
- CVE-2026-12742 Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026
- CVE-2026-12741 WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection
- CVE-2026-12740 Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter
- CVE-2026-1274 IBM Guardium Data Protection is affected by multiple vulnerabilities
- CVE-2026-12739 WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
- CVE-2026-12738 Missing authorization in WP Easy Pay – Payment and Donation form Builder for Square
- CVE-2026-12736 Privilege escalation in WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce
- CVE-2026-12734 Cross-site scripting in weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
- CVE-2026-12733 IBM DataPower Gateway affected by denial of service
- CVE-2026-12732 Cross-site scripting in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- CVE-2026-12731 Cross-site scripting in weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
- CVE-2026-12730 Improper Validation of Certificate with Host Mismatch in IBM Business Automation Workflow containers
- CVE-2026-1273 PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints
- CVE-2026-12729 Missing authorization in weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
- CVE-2026-12728 IBM MQ Java messaging is vulnerable to remote code execution
- CVE-2026-12727 IBM MQ Buffer Overflow
- CVE-2026-12726 Server-side request forgery in Red Hat Ansible Automation Platform 2
- CVE-2026-12725 Dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported ds/dnskey replies
- CVE-2026-12724 Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password
- CVE-2026-12723 Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library
- CVE-2026-12722 Authentication Bypass in FTC Software's E-Commerce Management Panel
- CVE-2026-12721 Kirki < 6.0.13 - Unauthenticated SQL Injection
- CVE-2026-12720 Kirki < 6.0.13 - Unauthenticated PHP Object Injection
- CVE-2026-1272 IBM Guardium Data Protection is affected by multiple vulnerabilities
- CVE-2026-12718 SQLi in Karel Electronics' KarelIPS
- CVE-2026-12717 Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection
- CVE-2026-12715 Missing Authorization in Firebase Studio allows Cross-Tenant Source Code Theft
- CVE-2026-12713 WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number
- CVE-2026-12710 Missing Authorization in Application Integration QueryEngineTask
- CVE-2026-1271 Missing authorization in ProfileGrid – User Profiles, Groups and Communities
- CVE-2026-12707 Unbounded path event queue growth in quiche via peer-driven source connection ID rotation
- CVE-2026-12706 Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move()
- CVE-2026-12705 Integrity mechanism of KNX-device FW-files can be bypassed in ABB Update Tool
- CVE-2026-12704 SAML assertion replay via skipped InResponseTo validation
- CVE-2026-12703 Bypass of 2FA for Connections via Unattended Access in TeamViewer for macOS
- CVE-2026-12702 Missing authorization in Octopus Server
- CVE-2026-12701 Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport
- CVE-2026-12698 wpForo Forum < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment
- CVE-2026-12697 wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR
- CVE-2026-12696 wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field
- CVE-2026-12695 miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret
- CVE-2026-12694 Missing Authorization in Vimesoft's Enterprise Video Platform
- CVE-2026-12693 IDOR in Vimesoft's Enterprise Video Platform
- CVE-2026-12692 Improper Authentication in Vimesoft's Enterprise Video Platform
- CVE-2026-12691 Authentication Bypass in Vimesoft's Enterprise Video Platform
- CVE-2026-12690 ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization
- CVE-2026-12689 ProfileGrid < 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing Authorization
- CVE-2026-12688 ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery
- CVE-2026-12687 ProfileGrid < 5.9.9.8 - Unauthenticated Privilege Escalation via Unrestricted Group ID
- CVE-2026-12686 Incorrect authorisation in Adiss’s Biloop
- CVE-2026-12685 EscortWP <= 3.6.2 - Content Deletion via Vendor-Authored Backdoor
- CVE-2026-12684 Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media
- CVE-2026-12683 Stored XSS Yönetim panel in Ankaref's LIBRID/LIBREF
- CVE-2026-12682 Stored XSS in Ankaref's LIBRID/LIBREF
- CVE-2026-12681 Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()
- CVE-2026-1268 Dynamic Widget Content <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content Field
- CVE-2026-12673 Privilege escalation in liquidfiles
- CVE-2026-12670 IBM MQ Denial of Service
- CVE-2026-1267 IBM Planning Analytics Information Disclosure
- CVE-2026-12669 IBM MQ Out-of-bounds Read
- CVE-2026-12667 IBM MQ .NET client is vulnerable to XML external entity injection
- CVE-2026-12666 IBM MQ Java messaging is vulnerable to XML external entity injection
- CVE-2026-12665 IBM MQ Buffer Overflow
- CVE-2026-12664 Incorrect Authorization in GitLab