Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 887 of 1013.
- CVE-2026-12202 Intelliants Subrion CMS Blocks Endpoint cross site scripting
- CVE-2026-12201 IObit Malware Fighter DLL permission
- CVE-2026-12200 Ritlabs TinyWeb Server Header libeay32.dll.html stack-based overflow
- CVE-2026-1220 Race condition in Chrome
- CVE-2026-12199 Unauthenticated Denial of Service in nltk.app.wordnet_app
- CVE-2026-12198 Microweber API Endpoint thumbnail_img userfiles_path path traversal
- CVE-2026-12197 Ruijie EG105G-P JSON-RPC Diagnose Endpoint diagnose nslookup command injection
- CVE-2026-12196 HestiaCP Admin Takeover
- CVE-2026-12195 Command injection in vesta
- CVE-2026-12194 PHPIPAM Authenticated LFI
- CVE-2026-12193 VS Revo RevoUninstaller IOCTL RevoDetector.sys IOCtl_Handler heap-based overflow
- CVE-2026-12192 GALAYOU Y4 Web Server buffer overflow
- CVE-2026-12191 Comma AI Openpilot Pickle modeld.py pickle.loads deserialization
- CVE-2026-12190 Genspark AI Workspace App ai.mainfunc.genspark improper authorization in handler for custom url scheme
- CVE-2026-1219 Missing authorization in MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
- CVE-2026-12189 Moovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url scheme
- CVE-2026-12188 Grit42 Grit GritEntityController grit_entity_controller.rb sql injection
- CVE-2026-12187 GL.iNet GL-MT3000 Online Firmware Upgrade one_click_upgrade command injection
- CVE-2026-12186 GL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injection
- CVE-2026-12185 BKS/UBER keystore allocates from untrusted lengths before integrity check
- CVE-2026-12183 Auth bypass in BUK TS-G Gas Station Automation System
- CVE-2026-1218 XML external entity in Zhiyou ERP
- CVE-2026-12176 SourceCodester CET Automated Grading System with AI Predictive Analytics index.php cross site scripting
- CVE-2026-12175 CodeAstro Student Attendance Management System createStudents.php sql injection
- CVE-2026-12174 D-Link DCS-935L HTTP rhea snprintf format string
- CVE-2026-12171 Code injection in auto-changelog
- CVE-2026-12170 AcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute
- CVE-2026-1217 Yoast Duplicate Post has an Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite
- CVE-2026-12168 CVE-2026-12168
- CVE-2026-12167 CVE-2026-12167
- CVE-2026-12166 CVE-2026-12166
- CVE-2026-12165 Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter
- CVE-2026-12164 Privilege Escalation in Fortra File Integrity Monitoring (FIM)
- CVE-2026-12163 Stored XSS in Fortra File Integrity Monitoring (FIM)
- CVE-2026-12162 Information disclosure in Remote Desktop Manager
- CVE-2026-12161 Command injection in Remote Desktop Manager
- CVE-2026-1216 RSS Aggregator <= 5.0.10 - Reflected Cross-Site Scripting via 'template' Parameter
- CVE-2026-12158 Cross-site request forgery in RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- CVE-2026-12157 BetterDocs <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'blockId' Block Attribute
- CVE-2026-12155 IBM MQ Deserialization of Untrusted Data
- CVE-2026-12154 Cross-site scripting in Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations
- CVE-2026-12153 Missing authorization in WP Learn Manager
- CVE-2026-12151 undici WebSocket client vulnerable to denial of service via fragment count bypass
- CVE-2026-12150 IBM MQ queue manager is vulnerable to denial of service
- CVE-2026-1215 MMA Call Tracking <= 2.3.15 - Cross-Site Request Forgery to Plugin Settings Update
- CVE-2026-12148 IBM MQ Deserialization of Untrusted Data
- CVE-2026-12144 Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter
- CVE-2026-12143 form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)
- CVE-2026-12142 NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter
- CVE-2026-12141 Cross-site scripting in Premium Addons for Elementor – Powerful Elementor Templates & Widgets
- CVE-2026-12139 Tanium addressed an information disclosure vulnerability in Connect.
- CVE-2026-12137 SysBasics Customize My Account for WooCommerce <= 4.3.6 - Reflected Cross-Site Scripting via 'tab' Parameter
- CVE-2026-12136 Cross-site scripting in SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager
- CVE-2026-12135 Cross-site scripting in FV Flowplayer Video Player
- CVE-2026-12134 Missing authorization in JoomSport – for Sports: Team & League, Football, Hockey & more
- CVE-2026-12133 Missing authorization in JoomSport – for Sports: Team & League, Football, Hockey & more
- CVE-2026-12131 CodeAstro Human Resource Management System Payroll Invoice Payroll.php sql injection
- CVE-2026-12130 CodeAstro Human Resource Management System Projects Management Add_Projects cross site scripting
- CVE-2026-1213 Askbot 0.12.2 - Insecure Direct Object Reference (IDOR)
- CVE-2026-12129 CodeAstro Human Resource Management System Dashboard add_tod cross site scripting
- CVE-2026-12128 Business logic in Pinpoint Booking System – Version 2
- CVE-2026-12127 Other in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
- CVE-2026-12126 WCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'
- CVE-2026-12124 PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter
- CVE-2026-12123 All-in-One Video Gallery <= 4.8.5 - Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter
- CVE-2026-12122 Missing authorization in Kirki – Freeform Page Builder, Website Builder & Customizer
- CVE-2026-12120 FireBox Popups <= 3.1.7 - Unauthenticated Sensitive Information Exposure in 'form_id' Parameter
- CVE-2026-12119 Missing authorization in Simple File List
- CVE-2026-12118 Deserialization in webMethods Integration (on prem)
- CVE-2026-12117 Missing authorization in Devolutions Server
- CVE-2026-12116 CVE-2026-12116
- CVE-2026-12115 Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import
- CVE-2026-12114 Team Members <= 8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_css' Parameter
- CVE-2026-12113 Missing authorization in Appointment Booking Calendar
- CVE-2026-12112 Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse
- CVE-2026-12111 Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter
- CVE-2026-12110 Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter
- CVE-2026-12109 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-12108 Highlighting Code Block <= 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'font_family' Setting
- CVE-2026-12106 Server-side request forgery in Auto Upload Images
- CVE-2026-12105 Missing authorization in Devolutions Server
- CVE-2026-12104 Authenticated OS Command Injection in Bondix
- CVE-2026-12103 Missing authorization in Wallet for WooCommerce
- CVE-2026-12102 Missing authorization in UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
- CVE-2026-12101 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-12100 URL Preview <= 1.0 - Unauthenticated Server-Side Request Forgery via 'url' Parameter
- CVE-2026-1210 Cross-site scripting in Happy Addons for Elementor
- CVE-2026-12098 Cross-site scripting in PowerPress Podcasting plugin by Blubrry
- CVE-2026-12097 User Management <= 1.2 - Missing Authorization to Unauthenticated Plugin Settings Modification
- CVE-2026-12095 Kargo Takip <= 1.2 - Unauthenticated Server-Side Request Forgery via 'api_url' Parameter
- CVE-2026-12094 Missing authorization in Advanced Contact Form 7 – Compact DB
- CVE-2026-12093 Missing authorization in Simple Membership
- CVE-2026-12091 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-12090 Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'wppm_proj_filter' Parameter
- CVE-2026-12089 WS Optimize – All-in-One Speed Booster & Cache Tools <= 3.3.19 - Authenticated (Editor+) Arbitrary File Read
- CVE-2026-12087 Socket versions before 2.041 for Perl have an out-of-bounds heap read
- CVE-2026-12086 Information disclosure in UCD - IBM DevOps Deploy
- CVE-2026-12085 Information disclosure in UCD - IBM DevOps Deploy
- CVE-2026-12084 Misconfiguration in UCD - IBM DevOps Deploy
- CVE-2026-12083 Admin and Site Enhancements < 8.8.4 - Unauthenticated Administrator-Role Restoration via reset-for Parameter