Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 907 of 1013.
- CVE-2026-115214 Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers
- CVE-2026-11521 Mohammed-eid35 bank-management-system-springboot Transaction Endpoint TransactionController.java improper authorization
- CVE-2026-115207 Patch: filename validation bypass in reversal fallback allows file creation outside the working directory
- CVE-2026-11520 SourceCodester Inventory System header.php cross site scripting
- CVE-2026-1152 technical-laohu mpay QR Code Image unrestricted upload
- CVE-2026-115196 An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic.
- CVE-2026-115195 A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}).
- CVE-2026-115194 A path traversal vulnerability exists in the Mautic Asset API.
- CVE-2026-115193 A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7.
- CVE-2026-115192 An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}).
- CVE-2026-115191 A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax).
- CVE-2026-115190 An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties.
- CVE-2026-11519 SourceCodester Inventory System Account Creation users_handler.php improper authorization
- CVE-2026-115189 A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic.
- CVE-2026-115188 An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7.
- CVE-2026-115183 Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget
- CVE-2026-11518 SourceCodester Inventory System User Management users.php cross site scripting
- CVE-2026-11517 UTT HiPER 2610G formConfigDnsFilterGlobal strcpy buffer overflow
- CVE-2026-11516 UTT HiPER 2610G formNatStaticMap strcpy buffer overflow
- CVE-2026-11515 Hardcoded credentials in Barangay Resident Profiling and Information Management System
- CVE-2026-11514 itsourcecode Hospital Management System addpatient.php sql injection
- CVE-2026-11513 itsourcecode Hospital Management System adminaccount.php sql injection
- CVE-2026-11512 itsourcecode Hospital Management System billing.php cross site scripting
- CVE-2026-11511 Bolt CMS HTML Attribute TextType.php HTML injection
- CVE-2026-11510 CodeAstro Leave Management System add_leave.php sql injection
- CVE-2026-1151 technical-laohu mpay User Center cross site scripting
- CVE-2026-11509 CodeAstro Leave Management System search_staff_for_updation.php sql injection
- CVE-2026-11508 CodeAstro Leave Management System search_staff_to_assign_pc.php sql injection
- CVE-2026-11507 CodeAstro Leave Management System delete_leave_type.php sql injection
- CVE-2026-11506 CodeAstro Leave Management System search_staff_for_deletion.php sql injection
- CVE-2026-11505 GL.iNet XE3000 glnassys hard-coded key
- CVE-2026-11504 Tenda CX12L Wi-Fi Schedule Configuration Endpoint openSchedWifi setSchedWifi stack-based overflow
- CVE-2026-11503 Tenda CX12L Wi-Fi Configuration Endpoint fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflow
- CVE-2026-11502 JeecgBoot Third-Party Login ThirdLoginController.java HttpServletResponse.sendRedirect redirect
- CVE-2026-11501 SourceCodester Hospitals Patient Records Management System Master.php save_patient sql injection
- CVE-2026-11500 Weaviate Static API Key client.go validateConfig authorization
- CVE-2026-1150 Totolink LR350 POST Request cstecgi.cgi setTracerouteCfg command injection
- CVE-2026-11499 Tenda HG7/HG9/HG10 formDOMAINBLK stack-based overflow
- CVE-2026-11498 Tenda HG7/HG9/HG10 Web Management voip_other_set asp_voip_OtherSet stack-based overflow
- CVE-2026-11497 D-Link DCS-5615 Boa Webserver boa.conf least privilege violation
- CVE-2026-11496 Missing authorization in PDF Builder for WooCommerce. Create invoices,packing slips and more
- CVE-2026-11495 CodeAstro Ingredients Stock Management System add_stock.php sql injection
- CVE-2026-11494 TOTOLINK AC1200 T8 vsftpd vsftpd.conf least privilege violation
- CVE-2026-11493 Tenda AC15 Samba smb.conf weak password
- CVE-2026-11492 D-Link DIR-823G vsftpd vsftpd.conf least privilege violation
- CVE-2026-11491 CodeAstro Human Resource Management System Notice Board Management All_notice cross site scripting
- CVE-2026-11490 code-projects Online Music Site Search.php sql injection
- CVE-2026-1149 Totolink LR350 POST Request cstecgi.cgi setDiagnosisCfg command injection
- CVE-2026-11489 code-projects Online Music Site AdminDeleteAlbum.php sql injection
- CVE-2026-11488 code-projects Simple Flight Ticket Booking System POST Parameter checkUser.php sql injection
- CVE-2026-11487 Neovim View Branch secure.lua M.read command injection
- CVE-2026-11486 SourceCodester Class and Exam Timetabling System archive1.php sql injection
- CVE-2026-11485 SourceCodester Class and Exam Timetabling System archive2.php sql injection
- CVE-2026-11484 SourceCodester Class and Exam Timetabling System archive3.php sql injection
- CVE-2026-11483 SourceCodester Class and Exam Timetabling System archive4.php sql injection
- CVE-2026-114820 Weak cryptography in Oracle GraalVM Enterprise Edition
- CVE-2026-11482 SourceCodester Class and Exam Timetabling System archive5.php sql injection
- CVE-2026-11481 yoanbernabeu grepai Postgres Embedding Cache chunker.go PostgresStore.LookupByContentHash weak hash
- CVE-2026-11480 Chengdu Everbrite Network Technology BeikeShop Admin Design Builder Endpoint admin.php sql injection
- CVE-2026-1148 SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System cross-site request forgery
- CVE-2026-11479 yoanbernabeu grepai Qdrant Backend chunker.go weak hash
- CVE-2026-11478 kokke tiny-regex-c Pattern re.c matchstar redos
- CVE-2026-11477 hs-web hsweb-framework OAuth2 Client OAuth2Client.java OAuth2Client redirect
- CVE-2026-11476 Kushan2k student-management-system Profile Update Endpoint AdminController.php edit-admin improper authorization
- CVE-2026-11475 Kushan2k student-management-system Certificate Verification Endpoint GradeController.php getStatus sql injection
- CVE-2026-114743 InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings
- CVE-2026-114742 WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR
- CVE-2026-114741 WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR
- CVE-2026-114740 WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard
- CVE-2026-11474 Kushan2k student-management-system Registration Endpoint RegisterService.php unrestricted upload
- CVE-2026-114732 Auth bypass in Webmail
- CVE-2026-114731 Denial of service in Webmail
- CVE-2026-114730 Server-side request forgery in Webmail
- CVE-2026-11473 jflyfox jfinal_cms AdvicefeedbackController.java list sql injection
- CVE-2026-114729 Security feature bypass in Webmail
- CVE-2026-114728 Security feature bypass in Webmail
- CVE-2026-114727 Code injection in Webmail
- CVE-2026-114726 Other in Webmail
- CVE-2026-114725 Other in Webmail
- CVE-2026-114724 Deserialization in Webmail
- CVE-2026-114723 Denial of service in Webmail
- CVE-2026-114722 Security feature bypass in Webmail
- CVE-2026-114721 Security feature bypass in Webmail
- CVE-2026-114720 Command injection in Webmail
- CVE-2026-11472 SourceCodester Class and Exam Timetabling System index1.php sql injection
- CVE-2026-114719 Cross-site request forgery in Webmail
- CVE-2026-114718 Cross-site scripting in Webmail
- CVE-2026-114717 Other in Webmail
- CVE-2026-114716 Other in Webmail
- CVE-2026-114715 Missing authorization in Webmail
- CVE-2026-114714 Path traversal in Webmail
- CVE-2026-114710 WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-11471 SourceCodester Class and Exam Timetabling System index2.php sql injection
- CVE-2026-114709 WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-114708 WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-114707 WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-114706 WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-114705 WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability
- CVE-2026-114704 WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability
- CVE-2026-114703 WordPress Extensions for Leaflet Map plugin <= 6.0 - Cross Site Scripting (XSS) vulnerability