Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 885 of 1013.
- CVE-2026-1243 IBM Content Navigator is affected by , a Cross-Site Scripting (XSS) vulnerability
- CVE-2026-12428 Missing authorization in Blocks for ACF Fields — Display Custom Fields in the Block Editor
- CVE-2026-12426 Members <= 3.2.22 - Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel
- CVE-2026-12425 Reflected / DOM cross-site scripting (XSS) in PowerSchool ERP / Employee Access Center 23.10
- CVE-2026-12423 Foreman: unauthenticated information disclosure via provisioning token validation flaw
- CVE-2026-12421 ARforms <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'password' Field Values
- CVE-2026-1242 Missing authorization in BlockSpare – Gutenberg Blocks for News, Magazine, Blog & Business Websites
- CVE-2026-12418 Missing authorization in User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration
- CVE-2026-12417 Auth bypass in SignUp & SignIn
- CVE-2026-12416 Auth bypass in Invoice Generator
- CVE-2026-12415 Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter
- CVE-2026-12413 IKEv2 Denial of Service via malformed fragmentation
- CVE-2026-12411 Broken Access Control in Canonical LXD DevLXD API
- CVE-2026-12410 CCleaner local privilege escalation via link following on uninstall
- CVE-2026-1241 Authentication Bypass Using an Alternate Path or Channel in Pelco, Inc. Sarix Pro 3 Series IP Cameras
- CVE-2026-12409 Landing Page Builder <= 1.5.3.6 - Cross-Site Request Forgery to ulpb_admin_data AJAX Action
- CVE-2026-12408 Missing authorization in Slim SEO – A Fast & Automated SEO Plugin For WordPress
- CVE-2026-12407 Missing authorization in E2Pdf – Export Pdf Tool for WordPress
- CVE-2026-12406 Missing authorization in User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration
- CVE-2026-12405 Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter
- CVE-2026-12404 NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class
- CVE-2026-12402 Cross-site scripting in OTP Login & Register Woocommerce
- CVE-2026-12400 Missing authorization in FlowForms – Conversational Form Builder
- CVE-2026-12399 Gutenverse <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' Parameter
- CVE-2026-12398 Galaxy_ng: shell injection in legacy role import via unsanitized git ref names
- CVE-2026-12397 WP Job Portal < 2.5.5 - Subscriber+ Employer Email Disclosure via IDOR
- CVE-2026-12396 WP Job Portal < 2.5.5 - Subscriber+ Arbitrary Job Approval, Featuring and Rejection
- CVE-2026-12395 WP Job Portal < 2.5.5 - Subscriber+ SQL Injection via Applied Resumes 'ta' Parameter
- CVE-2026-12394 MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to Administrator
- CVE-2026-12393 WPS Bookings for WooCommerce < 3.11.7 - Subscriber+ Arbitrary Booking Order Cancellation via IDOR
- CVE-2026-12392 RPC secret disclosure via vendor data endpoint in Canonical MAAS
- CVE-2026-12391 ubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logs
- CVE-2026-12390 Access of resource using incompatible type ('type confusion') in AzeoTech DAQFactory
- CVE-2026-1239 Missing authorization in Ninja Forms – The Contact Form Builder That Grows With You
- CVE-2026-12388 Privilege escalation in Red Hat Build of Keycloak
- CVE-2026-12387 Mali GPU Kernel Driver allows access to already freed memory
- CVE-2026-12386 Buffer Overflow in TUBITAK BILGEM's Pardus Pen
- CVE-2026-12385 Missing authorization in Smart Slider 3
- CVE-2026-12384 Broken Access Control in TECHIN2B Application
- CVE-2026-12383 Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn
- CVE-2026-12382 Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing
- CVE-2026-12380 Reflected XSS in Akıllı Ticaret's E-Commerce Pack
- CVE-2026-1238 SlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh'
- CVE-2026-12379 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the Dashboard OAuth/OIDC implementation of Axivion
- CVE-2026-12378 BookingPress <= 1.1.28 - Unauthenticated PHP Object Injection
- CVE-2026-12376 Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint
- CVE-2026-12375 Uncanny Automator Pro 7.3.0.5 - Backdoor via Compromised Vendor Update Server
- CVE-2026-12374 Improper XPC caller certificate validation and TOCTOU race condition in macOS PrivilegedHelperTool
- CVE-2026-12372 Server-Side Request Forgery (SSRF) in nltk/nltk
- CVE-2026-12370 Remote Code Execution Vulnerability
- CVE-2026-1237 Juju has broken CMR authorization
- CVE-2026-12366 Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposal
- CVE-2026-12365 Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race
- CVE-2026-12364 Memory corruption in zephyr
- CVE-2026-12363 Out-of-bounds write in LoRaWAN fragmented transport from a fragment index of 0
- CVE-2026-12360 JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint
- CVE-2026-1236 Cross-site scripting in Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
- CVE-2026-12359 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-12358 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-12357 Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability
- CVE-2026-12355 IBM MQ Resource Adapter IVT servlet is vulnerable to unauthenticated remote code execution
- CVE-2026-12354 IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injection
- CVE-2026-12353 Rhcs: memory leak during https connection leads to denial of service
- CVE-2026-12352 Incorrect Authorization
- CVE-2026-12351 IBM MQ is vulnerable to unauthenticated remote code execution via JNDI injection
- CVE-2026-12350 IBM MQ Deserialization of Untrusted Data
- CVE-2026-1235 WP eCommerce <= 3.15.1 - Unauthenticated PHP Object Injection
- CVE-2026-12349 Missing authorization in Premium Addons for KingComposer
- CVE-2026-12348 Address Bar Spoofing in Arc Search for Android (window.open race condition)
- CVE-2026-12345 Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
- CVE-2026-12343 IBM MQ Denial of Service
- CVE-2026-12342 SailPoint IdentityIQ Improper Form Validation Vulnerability
- CVE-2026-12341 SailPoint IdentityIQ Improper Bearer Token Validation Vulnerability
- CVE-2026-12340 Out-of-bounds heap read in SM2/SM3 certificate Subject Key Identifier computation
- CVE-2026-12339 Authenticated Arbitrary File Write Vulnerability in multiple devices
- CVE-2026-12330 Incorrect boundary conditions in the Internationalization component
- CVE-2026-1233 Text to Speech (TTS) by Mementor <= 1.9.8 - Use of Hardcoded Password to Unauthenticated Remote Database Access
- CVE-2026-12329 Memory safety bug fixed in Thunderbird ESR 140.12
- CVE-2026-12328 Memory corruption in Firefox
- CVE-2026-12327 Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152
- CVE-2026-12326 Memory safety bugs fixed in Firefox 152 and Thunderbird 152
- CVE-2026-12325 Denial-of-service in the Graphics: ImageLib component
- CVE-2026-12324 Incorrect boundary conditions in the Graphics: CanvasWebGL component
- CVE-2026-12323 Spoofing issue in the DOM: Core & HTML component
- CVE-2026-12322 Clickjacking issue in the Widget: Gtk component
- CVE-2026-12321 JIT miscompilation in the JavaScript: WebAssembly component
- CVE-2026-12320 Information disclosure in the Password Manager component
- CVE-2026-1232 Anti-Tamper Bypass in BeyondTrust Privilege Management for Windows
- CVE-2026-12319 Denial-of-service in the Audio/Video: Playback component
- CVE-2026-12318 Incorrect boundary conditions in the Libraries component in NSS
- CVE-2026-12317 Memory safety bug fixed in Thunderbird 152
- CVE-2026-12316 Mitigation bypass in the DOM: Security component
- CVE-2026-12315 Mitigation bypass in the DOM: Security component
- CVE-2026-12314 Memory safety bug fixed in Thunderbird 152
- CVE-2026-12313 Information disclosure, sandbox escape in the Security: Process Sandboxing component
- CVE-2026-12312 Memory safety bug fixed in Thunderbird 152
- CVE-2026-12311 Information disclosure, sandbox escape in the Security: Process Sandboxing component
- CVE-2026-12310 Memory safety bug fixed in Thunderbird 152
- CVE-2026-1231 Cross-site scripting in Beaver Builder Page Builder – Drag and Drop Website Builder
- CVE-2026-12309 Memory safety bug fixed in Thunderbird 152