Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 914 of 1013.
- CVE-2026-11360 SQL injection in Advanced Order Export For WooCommerce
- CVE-2026-1136 lcg0124 BootDo ContentController save cross site scripting
- CVE-2026-113599 Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation
- CVE-2026-113598 Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete
- CVE-2026-113597 Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures
- CVE-2026-113596 Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds
- CVE-2026-113595 Sharkord before 0.0.26 Missing Authorization via changeLogo tRPC Route
- CVE-2026-113594 Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route
- CVE-2026-11359 Missing authorization in Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration
- CVE-2026-113583 Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js
- CVE-2026-113582 Apache Abdera: XML external entity expansion in Atom document parsing
- CVE-2026-11358 Cross-site scripting in Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
- CVE-2026-113576 Adobe Digital Editions | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- CVE-2026-11357 Information disclosure in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- CVE-2026-11356 Cross-site scripting in Ivory Search – WordPress Search Plugin
- CVE-2026-11355 Missing authorization in DT LMS – elearning, WordPress LMS Plugin
- CVE-2026-11354 Missing authorization in Participants Database
- CVE-2026-11352 QUIC zero-length UDP datagrams busy-loop
- CVE-2026-11351 ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure
- CVE-2026-113507 aaPanel common.py GetClientIp access control
- CVE-2026-113506 aaPanel File Manager common.py ExecShell os command injection
- CVE-2026-113505 aaPanel Download Endpoint v2.py send_file path traversal
- CVE-2026-113501 LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal
- CVE-2026-113500 LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization
- CVE-2026-1135 itsourcecode Society Management System activity.php cross site scripting
- CVE-2026-113499 LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting
- CVE-2026-113496 Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments
- CVE-2026-113495 Cockpit-machines: rhsm access-token disclosure through image helper command-line arguments
- CVE-2026-113494 GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode
- CVE-2026-113493 GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute
- CVE-2026-113492 GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action
- CVE-2026-113491 GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal
- CVE-2026-113490 GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint
- CVE-2026-11349 Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more
- CVE-2026-113489 GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR
- CVE-2026-113488 GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' Attribute
- CVE-2026-113487 GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' Attribute
- CVE-2026-113486 Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF
- CVE-2026-113485 Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF
- CVE-2026-11348 Authentication Bypass in HAVELSAN's Open Source Project Liman MYS
- CVE-2026-113472 Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload
- CVE-2026-113470 Cryptographic issue in the Security Block-lists, Allow-lists, and other State component
- CVE-2026-11347 Hardcoded Cryptographic Keys and Weak IV Generation in linqi
- CVE-2026-113469 Improper Signature Verification of Active Update Files
- CVE-2026-113468 Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
- CVE-2026-113466 MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key
- CVE-2026-113465 Possible DOM XSS in SNS Web Administration Portal
- CVE-2026-113461 mk-oracle: Local privilege escalation via insecure Oracle Home library loading
- CVE-2026-11346 Server-Side Request Forgery (SSRF) allowing Internal Network Probing in linqi
- CVE-2026-113459 Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)
- CVE-2026-11345 Improper Authentication Bypass in linqi CDN File Access
- CVE-2026-113442 Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
- CVE-2026-113440 HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
- CVE-2026-11344 code-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted upload
- CVE-2026-113438 Auth bypass in Pleasanter
- CVE-2026-113436 Quadratic bignum parsing of Content-Length and Host port values in Bandit
- CVE-2026-11342 code-projects Hotel and Tourism Reservation System details.php sql injection
- CVE-2026-113411 Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url scheme
- CVE-2026-11341 D-Link DWR-M920 formIMEISetup sub_412DA0 os command injection
- CVE-2026-113409 Cross-site scripting in ortto
- CVE-2026-113407 YS-infoware｜BA-Workflow - SQL Injection
- CVE-2026-113406 YS-infoware｜BA-Workflow - SQL Injection
- CVE-2026-113405 YS-infoware｜BA-Workflow - SQL Injection
- CVE-2026-113404 Uniong｜WebITR - Insecure Deserialization
- CVE-2026-113403 ArmorX Global Technology｜ArmorX Spam - Command Injection
- CVE-2026-113402 ArmorX Global Technology｜ArmorX Spam - Local File Inclusion
- CVE-2026-113401 Denial-of-service in the PDF Viewer component
- CVE-2026-113400 Uninitialized memory in the Audio/Video: cubeb component
- CVE-2026-11340 Authorization Bypass in HAVELSAN's Open Source Project Liman MYS
- CVE-2026-1134 itsourcecode Society Management System expenses.php cross site scripting
- CVE-2026-113399 Incorrect boundary conditions in the SVG component
- CVE-2026-113397 DrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injection
- CVE-2026-113396 DrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection
- CVE-2026-113395 DrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversal
- CVE-2026-113394 DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal
- CVE-2026-113393 DrayTek Vigor2960 commonupload mainfunction.cgi unrestricted upload
- CVE-2026-113392 DrayTek Vigor2960 Apmupload mainfunction.cgi path traversal
- CVE-2026-113391 DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection
- CVE-2026-113390 DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection
- CVE-2026-11339 D-Link DWR-M920 formUSSDSetup sub_41CF20 command injection
- CVE-2026-113389 DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection
- CVE-2026-113388 opensource-socialnetwork Cache Settings dynamic.php input code injection
- CVE-2026-113387 Missing authorization in ortto
- CVE-2026-113386 Command injection in Webmail
- CVE-2026-113385 LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components
- CVE-2026-113384 Optimal IdM OptimalCloud social redirect
- CVE-2026-113383 Optimal IdM OptimalCloud Login cross site scripting
- CVE-2026-113382 arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload
- CVE-2026-113381 Osclass Item Model Item.php findUserItems sql injection
- CVE-2026-113380 Denial of service in RingRTC
- CVE-2026-11338 SourceCodester Ship Ferry Ticket Reservation System manage_user cross site scripting
- CVE-2026-113378 mcollina mcp-ripgrep Advanced Search Tool index.ts os command injection
- CVE-2026-11337 tittuvarghese CollegeManagementSystem fetch.php cross site scripting
- CVE-2026-11336 tittuvarghese CollegeManagementSystem Admin admin_page.php improper authorization
- CVE-2026-113359 Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint
- CVE-2026-113358 LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes
- CVE-2026-113357 @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker
- CVE-2026-113356 DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition
- CVE-2026-113355 Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links
- CVE-2026-113354 Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content