Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 903 of 1013.
- CVE-2026-116014 open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType
- CVE-2026-116013 OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing
- CVE-2026-116012 Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser
- CVE-2026-116011 Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()
- CVE-2026-116010 RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers
- CVE-2026-11601 WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete
- CVE-2026-116009 Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action
- CVE-2026-116008 DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign
- CVE-2026-116007 Auth bypass in ruoyi-vue-pro
- CVE-2026-116006 YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication
- CVE-2026-116004 onyx-dot-app Onyx PreviewTab.tsx cross site scripting
- CVE-2026-116000 Zylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgery
- CVE-2026-11600 Missing authorization in Envo's Templates & Widgets for Elementor and WooCommerce
- CVE-2026-1160 PHPGurukul Directory Management System Search index.php sql injection
- CVE-2026-115999 mansi-k Restaurant_IMS lsmodal.php mysqli_connect sql injection
- CVE-2026-115998 IDOR: User reads and modifies findings from other people's projects
- CVE-2026-115997 pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection
- CVE-2026-115996 Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation
- CVE-2026-115995 Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection
- CVE-2026-115994 BOLA Allows Cross-Project Target Tampering
- CVE-2026-115993 Stored XSS in the “Notes” field of project checklists
- CVE-2026-115982 phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting
- CVE-2026-115981 phpIPAM index.php cross site scripting
- CVE-2026-11598 Shortcodify <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute
- CVE-2026-115975 Broken access control in JiraController
- CVE-2026-115973 FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery
- CVE-2026-115972 FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization
- CVE-2026-115971 Travisun Opptrix preParsing handler webhook Buffer.concat denial of service
- CVE-2026-115970 Travisun Opptrix Import Endpoint import code injection
- CVE-2026-11597 Cross-site scripting in Surbma | Infusionsoft Shortcode
- CVE-2026-115969 Travisun Opptrix Schedule API setup command injection
- CVE-2026-115968 WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability
- CVE-2026-115967 WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability
- CVE-2026-115966 WordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-115965 WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability
- CVE-2026-115964 WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability
- CVE-2026-115963 WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability
- CVE-2026-115962 WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability
- CVE-2026-115961 WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-115960 WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability
- CVE-2026-11596 Business logic in ScreenConnect
- CVE-2026-115959 WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability
- CVE-2026-115958 WordPress WP Discussion Board plugin <= 2.6.0 - Broken Access Control vulnerability
- CVE-2026-115957 WordPress WP Discussion Board plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-115956 WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-115955 Cross-site scripting in Advanced Post Block - Post Grid for WordPress block editor
- CVE-2026-115954 WordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability
- CVE-2026-115953 WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-115951 WordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-115950 WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-11595 IBM WebSphere Application Server is affected by a Path Traversal vulnerability
- CVE-2026-115949 WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerability
- CVE-2026-115948 WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability
- CVE-2026-115943 Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.
- CVE-2026-115942 Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read
- CVE-2026-11594 IBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilities
- CVE-2026-115938 Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
- CVE-2026-115937 Unauthenticated payment reuse allows unpaid orders to be marked as paid
- CVE-2026-115935 Control panel only API response emulation replaces "securityKey" and reaches server RCE
- CVE-2026-115933 Forged signed tokens let any registered user take over other users and organizations
- CVE-2026-115932 Path traversal in post media lets any registered user read server files
- CVE-2026-115931 Arbitrary file read and backend crash through unrestricted provider method calls
- CVE-2026-115930 MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs
- CVE-2026-115929 MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs
- CVE-2026-115927 Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
- CVE-2026-115924 Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs
- CVE-2026-115923 Backstage catalog rules can be bypassed for URL locations using encoded path segments
- CVE-2026-115922 ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs
- CVE-2026-115921 ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute
- CVE-2026-115920 ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank
- CVE-2026-11592 Missing authorization in Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
- CVE-2026-115919 ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)
- CVE-2026-115918 vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
- CVE-2026-115917 vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
- CVE-2026-115916 vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
- CVE-2026-115915 vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
- CVE-2026-115914 vLLM DeepSeek-OCR image processing vulnerable to denial of service
- CVE-2026-115913 vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine
- CVE-2026-115912 vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
- CVE-2026-115911 vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
- CVE-2026-115910 Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim
- CVE-2026-11591 Cross-site scripting in Widgets for Google Reviews
- CVE-2026-115909 zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
- CVE-2026-115908 zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.
- CVE-2026-115907 zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
- CVE-2026-115906 zip: AES Entry HMAC Authentication Bypass on Premature EOF
- CVE-2026-115905 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
- CVE-2026-115904 Topluyo Desktop for Linux has an OS Command Injection issue
- CVE-2026-11590 WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated SQL Injection via filter[elements] Array Keys
- CVE-2026-1159 itsourcecode Online Frozen Foods Ordering System order_online.php sql injection
- CVE-2026-115897 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
- CVE-2026-115895 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
- CVE-2026-115893 Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
- CVE-2026-115892 Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
- CVE-2026-11589 WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Stored XSS via File Upload
- CVE-2026-115889 Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
- CVE-2026-115887 graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service
- CVE-2026-115886 MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- CVE-2026-115885 LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output
- CVE-2026-115883 LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores