Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 884 of 1013.
- CVE-2026-12536 Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title
- CVE-2026-12535 Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048
- CVE-2026-12530 Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
- CVE-2026-1253 Missing authorization in Group Chat & Video Chat by AtomChat
- CVE-2026-12529 Missing authorization in CET Automated Grading System with AI Predictive Analytics
- CVE-2026-12528 389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt()
- CVE-2026-12527 Auth bypass in V380 IP Camera / AppFHE1 V1.0.6.0
- CVE-2026-12526 Missing authorization in Advanced Custom Fields: Extended
- CVE-2026-12525 Redux Framework < 4.5.13 - Subscriber+ Privilege Escalation to Administrator
- CVE-2026-12523 Resource exhaustion in quiche HTTP/3 and QPACK layers
- CVE-2026-12522 Stack buffer overflow in Zephyr hl7800 modem driver parsing network-supplied +CGCONTRDP address fields
- CVE-2026-12520 Stack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlers
- CVE-2026-1252 Events Listing Widget <= 1.3.4 - Authenticated (Author+) Stored Cross-Site Scripting via Event URL Field
- CVE-2026-12519 Out-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsing
- CVE-2026-12518 Local privilege escalation in the Logi Options+ updater service on Windows
- CVE-2026-12517 Fediverse Embeds < 1.5.8 - Unauthenticated SSRF via Site Info Endpoint
- CVE-2026-12516 Fediverse Embeds < 1.5.8 - Unauthenticated SSRF via Media Proxy
- CVE-2026-12515 Katello: missing repository authorization in content_uploads exposes cross-product content existence
- CVE-2026-12514 Shared Files < 1.7.70 - Unauthenticated Limited File Upload
- CVE-2026-12513 Shared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path Traversal
- CVE-2026-12512 Quotes Llama < 3.1.6 - Unauthenticated SQL Injection via sc Parameter
- CVE-2026-12511 AI Engine < 3.5.5 - Editor+ Arbitrary File Write via Path Traversal
- CVE-2026-12510 AI Engine < 3.5.5 - Subscriber+Chatbot Discussion Disclosure and Takeover via IDOR
- CVE-2026-1251 Missing authorization in SupportCandy – Helpdesk & Customer Support Ticket System
- CVE-2026-12505 Cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall
- CVE-2026-12504 Loytec LINX firmware: Improper Authentication in PAM configuration
- CVE-2026-12503 Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter
- CVE-2026-12502 Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo
- CVE-2026-12501 WP Travel Engine < 6.8.2 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver and Amount Verification
- CVE-2026-12500 WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update
- CVE-2026-1250 Court Reservation – Manage Your Court Bookings Online <= 1.10.11 - Unauthenticated SQL Injection
- CVE-2026-12497 ProfilePress < 4.16.18 - Unauthenticated Privilege Escalation via Registration Role Selection
- CVE-2026-12496 Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server
- CVE-2026-12495 Stack-Based Buffer Overflow in the Mercusys MB115-4G
- CVE-2026-12493 Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order
- CVE-2026-12492 Happy Coders OTP Login for WooCommerce < 2.8 - Unauthenticated Account Takeover via hcotp_auto_login_user
- CVE-2026-12491 vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations
- CVE-2026-12490 Bypass of client certificate verification with transfer over TLS
- CVE-2026-1249 Server-side request forgery in MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
- CVE-2026-12489 Privilege escalation in EX3501-T0 firmware
- CVE-2026-12488 GeoVision GV-VMS V20 GV-Cloud memory corruption vulnerability
- CVE-2026-12486 GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability
- CVE-2026-12485 GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command
- CVE-2026-12484 Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_config
- CVE-2026-12483 LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler
- CVE-2026-12482 Path Traversal via Symlink Name Validation Bypass in keras-team/keras
- CVE-2026-12481 Deserialization of Untrusted Data in keras-team/keras
- CVE-2026-12480 Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/keras
- CVE-2026-1248 IBM Business Automation Workflow information leak
- CVE-2026-12479 Path Traversal in keras-team/keras
- CVE-2026-12478 Libsoup: incomplete fix for cve-2026-0716: out-of-bounds read in libsoup websocket frame processing (unmasked path)
- CVE-2026-12477 Gravity Booster <= 5.26 - Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' Parameter
- CVE-2026-12476 Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter
- CVE-2026-12473 OHIF Viewers DICOM Server-Side request forgery
- CVE-2026-12472 Missing authorization in Kirki – Freeform Page Builder, Website Builder & Customizer
- CVE-2026-12471 Spexo <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation
- CVE-2026-12470 Privilege escalation in CMP – Coming Soon & Maintenance Plugin by NiteoThemes
- CVE-2026-1247 Survey <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
- CVE-2026-12469 Information disclosure in Chrome
- CVE-2026-12468 Race condition in Chrome
- CVE-2026-12467 Use after free in Chrome
- CVE-2026-12466 Memory corruption in Chrome
- CVE-2026-12465 Security feature bypass in Chrome
- CVE-2026-12464 Use after free in Chrome
- CVE-2026-12463 Cross-site scripting in Chrome
- CVE-2026-12462 Use after free in Chrome
- CVE-2026-12461 Memory corruption in Chrome
- CVE-2026-12460 Security feature bypass in Chrome
- CVE-2026-1246 ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter
- CVE-2026-12459 Cross-site scripting in Chrome
- CVE-2026-12458 Information disclosure in Chrome
- CVE-2026-12457 Security feature bypass in Chrome
- CVE-2026-12456 Security feature bypass in Chrome
- CVE-2026-12455 Use after free in Chrome
- CVE-2026-12454 Race condition in Chrome
- CVE-2026-12453 Security feature bypass in Chrome
- CVE-2026-12452 Use after free in Chrome
- CVE-2026-12451 Use after free in Chrome
- CVE-2026-12450 Information disclosure in Chrome
- CVE-2026-1245 CVE-2026-1245
- CVE-2026-12449 Use after free in Chrome
- CVE-2026-12448 Privilege escalation in Chrome
- CVE-2026-12447 Memory corruption in Chrome
- CVE-2026-12446 Information disclosure in Chrome
- CVE-2026-12445 Use after free in Chrome
- CVE-2026-12444 Memory corruption in Chrome
- CVE-2026-12443 Use after free in Chrome
- CVE-2026-12442 Use after free in Chrome
- CVE-2026-12441 Use after free in Chrome
- CVE-2026-12440 Use after free in Chrome
- CVE-2026-1244 Forms Bridge <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
- CVE-2026-12439 Use after free in Chrome
- CVE-2026-12438 Security feature bypass in Chrome
- CVE-2026-12437 Use after free in Chrome
- CVE-2026-12436 Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab
- CVE-2026-12435 Missing authorization in Motors – Car Dealership & Classified Listings Plugin
- CVE-2026-12434 Missing authorization in List category posts
- CVE-2026-12433 Missing authorization in Hydra Booking — Appointment Scheduling & Booking Calendar
- CVE-2026-12432 Missing authorization in Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions
- CVE-2026-12430 Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter