Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 951 of 1013.
- CVE-2026-108506 Unauthorized access vulnerability in ZTE Z80 Ultra product
- CVE-2026-108505 Information disclosure vulnerability in ZTE Z80 Ultra product
- CVE-2026-108504 Unauthorized information retrieval vulnerability in ZTE Z80 Ultra product
- CVE-2026-108503 Unauthorized information acquisition vulnerability in ZTE Z80 Ultra product
- CVE-2026-108502 Information disclosure vulnerability in ZTE Z80 Ultra product
- CVE-2026-108501 Unauthorized access vulnerability in ZTE Z80 Ultra product
- CVE-2026-10850 Plane 1.3.1 - Stored XSS in intake issue description_html
- CVE-2026-1085 True Ranker <= 2.2.9 - Cross-Site Request Forgery to Unauthorized True Ranker Disconnection
- CVE-2026-108499 WordPress Knowledge Base plugin <= 3.2.0 - Broken Access Control vulnerability
- CVE-2026-108498 WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-108497 WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability
- CVE-2026-108496 WordPress WP User Manager plugin <= 2.9.24 - Broken Access Control vulnerability
- CVE-2026-108495 WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-108494 WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-108493 WordPress Pay for Payment for WooCommerce plugin <= 3.0.1 - Broken Access Control vulnerability
- CVE-2026-108492 WordPress Quick Paypal Payments plugin <= 6.0.3 - Broken Access Control vulnerability
- CVE-2026-108491 WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-108490 WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-10849 Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body
- CVE-2026-108489 WordPress Active Products Tables for WooCommerce plugin <= 2.1.3 - Sensitive Data Exposure vulnerability
- CVE-2026-108488 WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-108487 WordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-108486 WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability
- CVE-2026-108485 WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-108484 WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-108483 WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-108482 WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-108481 WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-108480 WordPress Skydropx plugin <= 2.1.4 - Broken Access Control vulnerability
- CVE-2026-10848 Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)
- CVE-2026-108479 WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-108478 WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-108477 WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability
- CVE-2026-108476 WordPress Paid Videochat Turnkey Site plugin <= 7.5.13 - Broken Access Control vulnerability
- CVE-2026-108475 WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability
- CVE-2026-108474 SQL injection in Exposed
- CVE-2026-108473 Improper Authentication and Credential Exposure in Multiple TP-Link Kasa Devices
- CVE-2026-108471 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
- CVE-2026-10847 Local Privilege Escalation vulnerability in Check Point Identity Agent Full for Windows OS
- CVE-2026-108468 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-108467 Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
- CVE-2026-108466 Windows Kernel Denial of Service Vulnerability
- CVE-2026-108465 Windows Update Delivery Optimization Elevation of Privilege Vulnerability
- CVE-2026-108464 Software Protection Platform (SPP) Elevation of Privilege Vulnerability
- CVE-2026-108463 Windows SmartScreen Security Feature Bypass Vulnerability
- CVE-2026-108462 Windows Kernel Information Disclosure Vulnerability
- CVE-2026-108461 Windows Broadcast DVR User Service Elevation of Privilege Vulnerability
- CVE-2026-108460 Windows Message Queuing Remote Code Execution Vulnerability
- CVE-2026-10846 Insufficient verification that responses belong to a query
- CVE-2026-108458 Remote Desktop Client Remote Code Execution Vulnerability
- CVE-2026-108457 Microsoft Windows PDF Remote Code Execution Vulnerability
- CVE-2026-108456 Azure AI Foundry Elevation of Privilege Vulnerability
- CVE-2026-108455 Microsoft Office PowerPoint Information Disclosure Vulnerability
- CVE-2026-108454 Microsoft Office PowerPoint Information Disclosure Vulnerability
- CVE-2026-108453 Microsoft Office PowerPoint Information Disclosure Vulnerability
- CVE-2026-108452 Microsoft Office SharePoint Remote Code Execution Vulnerability
- CVE-2026-108451 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-108450 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-10845 IBM WebSphere Application Server is affected by an authentication bypass vulnerability
- CVE-2026-108449 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-108448 Microsoft Office Outlook Remote Code Execution Vulnerability
- CVE-2026-108447 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-108446 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-108445 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-108444 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-108443 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-108442 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-108441 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-108440 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-108439 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-108438 Microsoft Office Word Information Disclosure Vulnerability
- CVE-2026-108437 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-108436 Microsoft Office Word Information Disclosure Vulnerability
- CVE-2026-108435 Microsoft Office Word Information Disclosure Vulnerability
- CVE-2026-108434 Microsoft Office Word Information Disclosure Vulnerability
- CVE-2026-108433 Microsoft Office Word Security Feature Bypass Vulnerability
- CVE-2026-108432 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-108431 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-108430 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-10843 Misconfiguration in Red Hat OpenShift Container Platform 4
- CVE-2026-108429 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-108428 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-108427 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-108426 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-10842 Security feature bypass in WebSphere Application Server
- CVE-2026-10841 IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling
- CVE-2026-108400 HEVC Video Extensions Remote Code Execution Vulnerability
- CVE-2026-10840 Misconfiguration in OpenShift Pipelines
- CVE-2026-1084 Cross-site scripting in Cookie consent for developers
- CVE-2026-108399 Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2026-108398 .NET Framework Security Feature Bypass Vulnerability
- CVE-2026-108396 Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability
- CVE-2026-108395 Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies
- CVE-2026-108390 HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking
- CVE-2026-10839 Open redirection vulnerability in Password Manager
- CVE-2026-108388 Indico legacy contribution export cache poisoning discloses restricted metadata
- CVE-2026-108385 dataclasses-avroschema enum symbols can inject statements through generated member names
- CVE-2026-108384 dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bare string
- CVE-2026-108383 dataclasses-avroschema enum field defaults can inject statements into generated modules
- CVE-2026-108382 dataclasses-avroschema allows code injection through generated enum-symbol string literals