Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 893 of 1013.
- CVE-2026-118272 a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure
- CVE-2026-118271 a2ui-project a2ui data-context Resolver data-context.ts resource consumption
- CVE-2026-11827 Insufficiently Protected Credentials in GitLab
- CVE-2026-118266 Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
- CVE-2026-118265 Echo: X-Real-IP extractor trusts the header value instead of the sending peer
- CVE-2026-118264 Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
- CVE-2026-118263 Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests
- CVE-2026-118262 Echo: WebSocket proxy can retain connections and handlers after client disconnect
- CVE-2026-118261 Echo: Decompress permits unbounded gzip expansion in v4
- CVE-2026-118260 Echo: BodyDump captures request and response bodies without size limits in v4
- CVE-2026-11826 OpenPLC_v3 Heap-Based Buffer Overflow in Modbus Master getData()
- CVE-2026-118259 opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing
- CVE-2026-118258 i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string
- CVE-2026-118257 Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
- CVE-2026-118256 Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list
- CVE-2026-118255 Highcharts Grid: javascript: URL in credits.href runs script on click
- CVE-2026-118254 Highcharts Grid: pagination language options are parsed as HTML
- CVE-2026-118253 Highcharts Dashboards: fullscreen labels are parsed as HTML
- CVE-2026-118252 Highcharts Dashboards: sidebar component labels are parsed as HTML
- CVE-2026-118251 Highcharts: javascript: URL in credits.href runs script on click
- CVE-2026-118250 Highcharts: dotted series.keys paths write to Object.prototype
- CVE-2026-118249 Highcharts: series column construction writes to Object.prototype
- CVE-2026-118248 Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype
- CVE-2026-118247 Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.
- CVE-2026-118246 Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
- CVE-2026-118245 Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace
- CVE-2026-118244 Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print
- CVE-2026-118243 Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`
- CVE-2026-118242 Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`
- CVE-2026-11824 SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate
- CVE-2026-11823 BookingPress Appointment Booking Pro <= 5.7.1 - Unauthenticated SQL Injection via 'store_service_date' Parameter
- CVE-2026-11822 SQLite before 3.53.2 Memory Corruption in FTS5 Extension
- CVE-2026-11821 Missing authorization in Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
- CVE-2026-11820 Information disclosure in Red Hat Enterprise Linux 10
- CVE-2026-1182 Improper Removal of Sensitive Information Before Storage or Transfer in GitLab
- CVE-2026-118192 JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute
- CVE-2026-11819 Community.general: community.general keyring_info — os keyring passphrase returned in plaintext
- CVE-2026-118180 Matrix homeserver could redirect the chat session to a local file or network share
- CVE-2026-11818 WPCafe <= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST API
- CVE-2026-118179 Request forgery via news: links
- CVE-2026-118178 RSS feed could redirect its subscription to a local file or network share
- CVE-2026-118177 Calendar discovery accepted local file and remote network share locations
- CVE-2026-118176 Bypass of remote UNC path restriction in mailbox: URLs
- CVE-2026-118175 Content of other messages could be included when replying to a crafted message
- CVE-2026-118174 Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment
- CVE-2026-118173 MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement
- CVE-2026-118172 CVE-2026-118172
- CVE-2026-118171 CVE-2026-118171
- CVE-2026-118170 CVE-2026-118170
- CVE-2026-11817 CVE-2026-11817 CVE Record
- CVE-2026-118169 Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter
- CVE-2026-118164 If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter
- CVE-2026-11816 Path Traversal in keras-team/keras
- CVE-2026-11815 Insecure Deserialization via MITM in Layer 7 Policy Manager
- CVE-2026-11814 Command injection vulnerability in certain NETGEAR Nighthawk and Orbi routers
- CVE-2026-118132 CVE-2026-118132
- CVE-2026-118131 CVE-2026-118131
- CVE-2026-11813 Privilege escalation in FileZ Client
- CVE-2026-118129 jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication
- CVE-2026-118128 a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition
- CVE-2026-11812 UpdateHub: race condition on shared context causes out-of-bounds write and DoS
- CVE-2026-11811 Socket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoS
- CVE-2026-11810 NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS)
- CVE-2026-1181 Altium 365 Over-Permissive CORS Configuration Allows Credentialed Cross-Origin Workspace Access
- CVE-2026-118097 WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-118095 WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-118094 WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-118093 WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability
- CVE-2026-118092 WordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability
- CVE-2026-118091 WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability
- CVE-2026-11809 UpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadata
- CVE-2026-118088 WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability
- CVE-2026-118087 WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-118085 WordPress GlobalPayments WooCommerce plugin <= 1.23.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-118084 WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-118083 WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability
- CVE-2026-118082 WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability
- CVE-2026-118081 WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability
- CVE-2026-118080 WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability
- CVE-2026-118079 WordPress FV Flowplayer Video Player plugin <= 8.3.4 - PHP Object Injection vulnerability
- CVE-2026-118078 WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability
- CVE-2026-118077 WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability
- CVE-2026-118076 WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability
- CVE-2026-118075 WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability
- CVE-2026-118074 WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability
- CVE-2026-118073 WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability
- CVE-2026-11807 Eda-server: websocket missing authorization allows credential theft via activation_id spoofing
- CVE-2026-11806 IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability
- CVE-2026-118040 Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing
- CVE-2026-11804 Program Module Vulnerability
- CVE-2026-118039 XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing
- CVE-2026-118038 Path Traversal in Telerik Document Processing Libraries AI Agent Tools
- CVE-2026-118037 Denial of service in Telerik Document Processing Libraries
- CVE-2026-118036 Denial of service in Telerik Document Processing Libraries
- CVE-2026-118035 Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing
- CVE-2026-118030 Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins
- CVE-2026-11803 PDF File Parsing Vulnerabilities in Certain Autodesk Desktop Products
- CVE-2026-118029 Unverified ownership of the default Athena query result location in AWS SDK for pandas
- CVE-2026-118027 Frame poisoning in the Layout component
- CVE-2026-118026 Invalid pointer in the JavaScript: GC component