Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 888 of 1013.
- CVE-2026-12082 Missing authorization in Praison AI SEO
- CVE-2026-12081 Deserialization in Database for Contact Form 7, WPforms, Elementor forms
- CVE-2026-12080 Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys
- CVE-2026-1208 Friendly Functions for Welcart <= 1.2.5 - Cross-Site Request Forgery to Settings Update
- CVE-2026-12079 Dokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter
- CVE-2026-12077 Dokan Pro <= 5.0.4 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters
- CVE-2026-12076 SQL Injection in Raytha CMS
- CVE-2026-12073 Auth bypass in ProfileGrid – User Profiles, Groups and Communities
- CVE-2026-12071 TeamDavid: Header Injection leading to Open Redirect via URL-encoded characters
- CVE-2026-12070 TeamDavid: Arbitrary File Deletion via form field 'scjob'
- CVE-2026-1207 Potential SQL injection via raster lookups on PostGIS
- CVE-2026-12068 Avira Password Manager credential disclosure via cross-origin autofill in Firefox
- CVE-2026-12066 PbootCMS Password MemberController.php retrieve password recovery
- CVE-2026-12065 Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme
- CVE-2026-12064 proto-default skips SSH verification
- CVE-2026-12060 Hepta Platforms｜Heptabase - Exposed Dangerous
- CVE-2026-1206 Missing authorization in Elementor Website Builder – more than just a page builder
- CVE-2026-12059 Cellopoint｜CelloOS - Improper Access Control
- CVE-2026-12058 Security feature bypass in PcSuite
- CVE-2026-12057 DoS + Remote Code Execution via PDF JavaScript in Foxit AI
- CVE-2026-12054 Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
- CVE-2026-12053 Insertion of Sensitive Information into Log File in GitLab
- CVE-2026-12052 Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response
- CVE-2026-12051 NULL pointer dereference in USB DFU device_next download handler (handle_download)
- CVE-2026-12050 pgAdmin 4: SQL injection in named restore point endpoint
- CVE-2026-12049 pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameter
- CVE-2026-12048 pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser
- CVE-2026-12047 pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception text
- CVE-2026-12046 Deserialization in pgAdmin 4
- CVE-2026-12045 pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution
- CVE-2026-12044 pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates
- CVE-2026-12043 Heap double-free in AWS Common Runtime aws-c-http
- CVE-2026-12042 WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter
- CVE-2026-12041 Cross-site scripting in Chatra Live Chat + ChatBot + Cart Saver
- CVE-2026-12039 Docker Sandboxes network egress allowlist bypass via unfiltered DNS resolution
- CVE-2026-12037 Server-side request forgery in Asset CleanUp: Page Speed Booster
- CVE-2026-12036 Privilege escalation in Vantage
- CVE-2026-12035 Use after free in Chrome
- CVE-2026-12034 Security feature bypass in Chrome
- CVE-2026-12033 Memory corruption in Chrome
- CVE-2026-12032 Security feature bypass in Chrome
- CVE-2026-12031 Security feature bypass in Chrome
- CVE-2026-12030 Memory corruption in Chrome
- CVE-2026-1203 CRMEB JSON Token LoginServices.php remoteRegister improper authentication
- CVE-2026-12029 Use after free in Chrome
- CVE-2026-12028 Use after free in Chrome
- CVE-2026-12027 Security feature bypass in Chrome
- CVE-2026-12026 Memory corruption in Chrome
- CVE-2026-12025 Information disclosure in Chrome
- CVE-2026-12024 Security feature bypass in Chrome
- CVE-2026-12023 Use after free in Chrome
- CVE-2026-12022 Race condition in Chrome
- CVE-2026-12020 Use after free in Chrome
- CVE-2026-1202 CRMEB LoginController.php appleLogin improper authentication
- CVE-2026-12019 Memory corruption in Chrome
- CVE-2026-12018 Privilege escalation in Chrome
- CVE-2026-12017 Security feature bypass in Chrome
- CVE-2026-12016 Security feature bypass in Chrome
- CVE-2026-12015 Use after free in Chrome
- CVE-2026-12014 Use after free in Chrome
- CVE-2026-12012 Use after free in Chrome
- CVE-2026-12011 Use after free in Chrome
- CVE-2026-12010 Memory corruption in Chrome
- CVE-2026-1201 Authorization Bypass Through User-Controlled Key in Hubitat Elevation Hubs
- CVE-2026-12009 Security feature bypass in Chrome
- CVE-2026-12008 Use after free in Chrome
- CVE-2026-12007 Use after free in Chrome
- CVE-2026-12005 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-12004 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-12003 CPython >3.11 Insecure Input Validation resulting in privilege escalation
- CVE-2026-12002 Cross-site request forgery in Smash Balloon Social Photo Feed – Easy Social Feeds Plugin
- CVE-2026-12001 Hardcoded Credential Vulnerability in Multiple TP-Link Router Models
- CVE-2026-12000 Missing authorization in Page and Post Restriction
- CVE-2026-1200 Remote code execution via segmentation fault in increasebufferto function
- CVE-2026-11999 X.509 trust-chain bypass via path-depth exhaustion in wolfSSL_X509_verify_cert()
- CVE-2026-11998 AngularJS XSS via SCE resource URL sanitization bypass
- CVE-2026-11997 Bulk SEO Image <= 1.1 - Cross-Site Request Forgery to Settings Update
- CVE-2026-11996 Advanced Popups <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field
- CVE-2026-11995 Missing authorization in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder
- CVE-2026-11994 Akaunting 3.1.21 - Authenticated stored XSS in report description rendering
- CVE-2026-11993 Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion
- CVE-2026-11992 Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation
- CVE-2026-11990 Missing authorization in KiviCare – Clinic & Patient Management System (EHR)
- CVE-2026-1199 API and Frontend login lockout race condition
- CVE-2026-11989 Bit integrations <= 2.8.7 - Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping
- CVE-2026-11988 Missing authorization in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- CVE-2026-11987 Missing authorization in Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
- CVE-2026-11986 Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks
- CVE-2026-11985 Cross-thread FPU register leak on ARM when FPU enabled without register sharing
- CVE-2026-11984 Missing authorization in Ad Inserter – Ad Manager & AdSense Ads
- CVE-2026-11983 Ad Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajax
- CVE-2026-11982 Stored XSS via missing XSS safety check in Admin2 Pages API partial validation
- CVE-2026-11981 GiveWP <= 4.15.3 - Cross-Site Request Forgery
- CVE-2026-11980 Code execution in IBM Desktop App
- CVE-2026-1198 SQL Injection in SIMPLE.ERP
- CVE-2026-11979 Stack-Based Buffer Overflow in libxml2
- CVE-2026-11977 WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection
- CVE-2026-11976 MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise
- CVE-2026-11975 Stored Cross-Site Scripting (XSS) in SimplCommerce News Module Admin Interface
- CVE-2026-11974 Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download