Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 908 of 1013.
- CVE-2026-114702 WordPress ND Shortcodes For Visual Composer plugin <= 7.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-114701 WordPress Waitlist Woocommerce ( Back in stock notifier ) plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-114700 Cross-site scripting in Restaurant Menu – Food Ordering System – Table Reservation
- CVE-2026-11470 hs-web hsweb-framework File Upload FileUploadProperties.java denied path traversal
- CVE-2026-1147 Cross-site scripting in Patients Waiting Area Queue Management System
- CVE-2026-114699 WordPress ЮKassa для WooCommerce plugin <= 2.17.3 - Broken Access Control vulnerability
- CVE-2026-114698 WordPress myCred plugin <= 4.0.0-beta.1 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-114697 WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-114696 WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerability
- CVE-2026-114695 WordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-114694 WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-114693 WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-11469 Server-side request forgery in jshERP
- CVE-2026-11468 SourceCodester Hospitals Patient Records Management System page room_types cross site scripting
- CVE-2026-11467 jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal
- CVE-2026-114665 Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare
- CVE-2026-114664 Frappe before 16.33.0 Blind SQL Injection via get_events
- CVE-2026-114663 Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments
- CVE-2026-114662 Obot before 0.26.0 API Key Theft via CLI Login Token Request
- CVE-2026-114661 OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints
- CVE-2026-114660 Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives
- CVE-2026-11466 zilliztech deep-searcher collection_router.py CollectionRouter.invoke access control
- CVE-2026-114659 Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes
- CVE-2026-114658 Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite
- CVE-2026-114657 Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri
- CVE-2026-114656 Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher
- CVE-2026-114655 KMS request injection via unsanitized key vault and provider values in libmongocrypt
- CVE-2026-114654 BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
- CVE-2026-114653 Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder
- CVE-2026-114652 Update operator injection via single-element list rewriting in the update builder
- CVE-2026-114651 Cross-document data leak via malformed BSON array parsing in reused thread buffer
- CVE-2026-114650 Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
- CVE-2026-11465 songquanpeng one-api Redemption Code Top-Up Endpoint redemption.go Redeem logic error
- CVE-2026-114649 Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
- CVE-2026-114648 NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys
- CVE-2026-114647 NoSQL operator injection via unvalidated replacement document in findOneAndReplace
- CVE-2026-114646 NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire
- CVE-2026-114645 Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping
- CVE-2026-114644 Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
- CVE-2026-114643 Duplicate geometry fields via unvalidated GeoJSON extra members
- CVE-2026-114642 Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper
- CVE-2026-114641 Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper
- CVE-2026-114640 Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router
- CVE-2026-11464 JeecgBoot User List Endpoint SysUserController.java queryPageList information disclosure
- CVE-2026-114639 Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool
- CVE-2026-114638 Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision
- CVE-2026-114637 Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak
- CVE-2026-114636 Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router
- CVE-2026-114635 Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme
- CVE-2026-114634 WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect
- CVE-2026-114633 WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php
- CVE-2026-11463 USCiLab Cereal Shared Pointer type confusion
- CVE-2026-114629 Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters.
- CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection
- CVE-2026-114624 baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity
- CVE-2026-114623 baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure
- CVE-2026-114622 baserCMS: Encoded path traversal bypass in the theme file API
- CVE-2026-114621 baserCMS: SQL injection in the admin panel and admin API
- CVE-2026-114620 Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
- CVE-2026-11462 Chengdu Everbrite Network Technology BeikeShop Stripe Plugin StripeController.php callback improper authorization
- CVE-2026-114619 Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
- CVE-2026-114618 Authlib: Default JWT bearer grant accepts assertions for the wrong audience
- CVE-2026-114617 Authlib: ID token can disable its own nonce validation via the nonce_supported claim
- CVE-2026-114616 Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
- CVE-2026-114615 Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
- CVE-2026-114614 Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
- CVE-2026-114613 MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
- CVE-2026-114612 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
- CVE-2026-114611 Auth bypass in OCO-Server
- CVE-2026-114610 fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'
- CVE-2026-11461 NousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorization
- CVE-2026-114609 fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content
- CVE-2026-114608 Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME
- CVE-2026-114607 better-auth: OAuth state can be used as a Magic Link to sign in as another user
- CVE-2026-114606 draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)
- CVE-2026-114605 dnspython dns.name.from_wire_parser() excessive CPU use
- CVE-2026-114603 OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
- CVE-2026-11460 Boost Serialization improper validation of specified type of input
- CVE-2026-1146 Cross-site scripting in Patients Waiting Area Queue Management System
- CVE-2026-114598 Access of resource using incompatible type ('type confusion') in EPICS Base
- CVE-2026-114597 Improper handling of length parameter inconsistency in EPICS Base
- CVE-2026-114596 Integer overflow or wraparound in EPICS Base
- CVE-2026-114595 Integer overflow or wraparound in EPICS Base
- CVE-2026-11459 SecureAge CatchPulse IOCTL saappctl.sys information disclosure
- CVE-2026-114583 tar filter allows writing outside destination via empty-named symlink
- CVE-2026-11458 erzhongxmu JeeWMS Boot Actuator Endpoint actuator information disclosure
- CVE-2026-114577 oretnom23 php-travel-agency-system Insertion insert.php sql injection
- CVE-2026-114576 Linksys RE6250 Web Management strcmp random values
- CVE-2026-114575 TOTOLINK A950RG product.so UploadCustomModule command injection
- CVE-2026-114574 massCodeIO massCode Local HTTP Service index.ts information disclosure
- CVE-2026-114570 WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit
- CVE-2026-11457 erzhongxmu JeeWMS JimuReport test-connection Endpoint testConnection injection
- CVE-2026-11456 Chanjet CRM HTTP GET Request jxf_dump_systable.php sql injection
- CVE-2026-11455 FoundationAgents MetaGPT common.py check_cmd_exists command injection
- CVE-2026-11454 Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference
- CVE-2026-11453 Tiobon Employee Self-Service System Login Endpoint BlogSearch.aspx sql injection
- CVE-2026-11452 GL.iNet GL-MT3000 SET_USER_PWD glc FUN_0042e200 command injection
- CVE-2026-114519 Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts
- CVE-2026-114515 OCO-Server: Self-Service Portal uninstall-job authorization bypass
- CVE-2026-114510 Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content