Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 905 of 1013.
- CVE-2026-115609 WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-115608 WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability
- CVE-2026-115607 WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability
- CVE-2026-115606 WordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-115605 WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability
- CVE-2026-115603 WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability
- CVE-2026-115602 WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-115601 WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability
- CVE-2026-1156 Totolink LR350 cstecgi.cgi setWiFiBasicCfg buffer overflow
- CVE-2026-115599 WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
- CVE-2026-115598 WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
- CVE-2026-115597 WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
- CVE-2026-115596 WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-115595 WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability
- CVE-2026-115594 WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerability
- CVE-2026-115593 Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- CVE-2026-115592 WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-115591 WordPress Contact Form by Supsystic plugin <= 1.10.5 - Sensitive Data Exposure vulnerability
- CVE-2026-115590 WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability
- CVE-2026-11559 CodeAstro Payroll System view_account.php sql injection
- CVE-2026-115586 virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
- CVE-2026-115585 pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
- CVE-2026-115580 pypdf: Possible long runtimes for large xref table header limits
- CVE-2026-11558 CodeAstro Payroll System home_salary.php sql injection
- CVE-2026-115572 pypdf: Possible long runtimes for repeated references to the same missing object
- CVE-2026-115570 Electron: Mitigation for compromised eMudhra intermediate certificates
- CVE-2026-11557 Tenda F451 Web Management Natlimit fromNatlimit stack-based overflow
- CVE-2026-115569 Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
- CVE-2026-115567 Tokio: Race condition in `tokio::time::Interval`
- CVE-2026-11556 Tenda F451 Web Management WriteFacMac formWriteFacMac os command injection
- CVE-2026-115557 Distrust compromised intermediate certificates in ssl module
- CVE-2026-11555 D-Link DGS-1100-08PD Web boa.conf least privilege violation
- CVE-2026-115547 Command Execution via Admin Console Input in Okta Access Gateway
- CVE-2026-115546 Authentication Source Verification Issue in Okta Access Gateway
- CVE-2026-11554 TOTOLINK CP450 vsftpd vsftpd.conf least privilege violation
- CVE-2026-115537 gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect
- CVE-2026-115536 gedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross site scripting
- CVE-2026-115535 gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting
- CVE-2026-115534 gedelumbung HospitalManagement Contact Form contact.php kirim cross site scripting
- CVE-2026-115533 CVE-2026-115533
- CVE-2026-11553 Tenda HG7/HG9/HG10 formPPPEdit stack-based overflow
- CVE-2026-115522 Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python
- CVE-2026-11552 SourceCodester Onlne Examination & Learning Management System import_users.php hard-coded password
- CVE-2026-115519 Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub
- CVE-2026-115517 Unrestricted network access between execution contexts in KNIME Business Hub
- CVE-2026-115513 OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel
- CVE-2026-11551 Auth bypass in Branda – White Label & Branding, Free Login Page Customizer
- CVE-2026-115509 Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API
- CVE-2026-115508 Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields
- CVE-2026-115507 Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header
- CVE-2026-115506 libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay
- CVE-2026-115505 libsmb2 before 6.3 Integer Overflow in DCE/RPC NDR Decoder via NetrShareEnum
- CVE-2026-115504 CFITSIO through 4.7.0 Out-of-Bounds Write via ffgcls2 in getcols.c
- CVE-2026-115503 Ghidra before 12.2 Denial of Service via Compressed Extension Archive
- CVE-2026-115502 DataApp links without login expose job information to other user in KNIME Business Hub
- CVE-2026-1155 Totolink LR350 cstecgi.cgi setWiFiEasyGuestCfg buffer overflow
- CVE-2026-115497 Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter
- CVE-2026-115496 Workflow names may be leaked to unauthenticated users in KNIME Business Hub
- CVE-2026-115495 Mobile VPN with SSL Client for Windows: Cleartext Transmission of VPN Credentials over Local Management Socket
- CVE-2026-115494 CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub
- CVE-2026-11549 IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Improper Access Control
- CVE-2026-115486 Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning
- CVE-2026-115485 Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio
- CVE-2026-115484 Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg
- CVE-2026-115482 Denial of service in lsquic
- CVE-2026-115481 File upload in basercms
- CVE-2026-115480 baserCMS: Public Web API mail-form submission bypasses image CAPTCHA
- CVE-2026-11548 IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling
- CVE-2026-115479 baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients
- CVE-2026-115478 obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
- CVE-2026-115477 obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
- CVE-2026-11546 IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability
- CVE-2026-115457 baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments
- CVE-2026-115454 Large tables in data apps can bring down execution services in KNIME Hub
- CVE-2026-115453 Missing authorization in Ecommerce Template
- CVE-2026-115450 Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier
- CVE-2026-11545 IBM WebSphere Application Server is affected by a privilege escalation
- CVE-2026-115449 Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest
- CVE-2026-115425 Multiple cross-site scripting (XSS) in OPNsense
- CVE-2026-115424 Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination
- CVE-2026-115419 Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server
- CVE-2026-115418 SQL injection in aws-cdk/aws-redshift-alpha
- CVE-2026-115417 Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
- CVE-2026-115416 Incorrect authorization checks in Amazon Athena engine version 3 query processing
- CVE-2026-115415 Secret masking bypass in the environment tool in Strands Agents Tools
- CVE-2026-115414 OS command injection in the Terraform hook in AWS SAM CLI
- CVE-2026-115413 AWS API MCP Server OAuth Token Audience Validation Bypass
- CVE-2026-115411 crawlseo before 0.2.4 Server-Side Request Forgery via Crawler
- CVE-2026-11541 Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms.
- CVE-2026-115408 ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets
- CVE-2026-115402 Race condition in ovpn-dco-win
- CVE-2026-115400 crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens
- CVE-2026-11540 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- CVE-2026-1154 SourceCodester E-Learning System Lesson index.php cross site scripting
- CVE-2026-115398 Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount
- CVE-2026-115397 Ghidra before 12.2 Denial of Service via Extension Archive Install
- CVE-2026-115396 Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive
- CVE-2026-115395 Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()
- CVE-2026-115394 Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation
- CVE-2026-115393 Memory corruption in wasmtime