Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 954 of 1013.
- CVE-2026-107886 Memory corruption in CUPS
- CVE-2026-107885 Denial of service in CUPS
- CVE-2026-107870 WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-10787 Missing authorization in Server
- CVE-2026-107869 WordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability
- CVE-2026-107867 WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-107866 WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-107865 WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-107864 WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-107863 WordPress Products Restricted Users for WooCommerce plugin <= 0.7 - Broken Access Control vulnerability
- CVE-2026-107862 WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-107861 Kiloview E3 NDI Encoder OS Command Injection
- CVE-2026-10786 Information disclosure in Server
- CVE-2026-107858 Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server
- CVE-2026-107857 Mindwtr: Cloud token and WebDAV password stored in plaintext on mobile
- CVE-2026-107856 CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email
- CVE-2026-107854 Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check)
- CVE-2026-107852 Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)
- CVE-2026-107851 Contao: Improper access control in the table access voter
- CVE-2026-107850 Contao: Improper access control in the preview links module
- CVE-2026-107848 Contao: Cross-site request forgery in custom backend actions
- CVE-2026-107845 Contao: Cross-site scripting in the comments bundle
- CVE-2026-107844 Contao: Path traversal in the images controller
- CVE-2026-107843 Contao: The registration module re-sends activation mails
- CVE-2026-107842 Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
- CVE-2026-107841 pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents
- CVE-2026-107840 yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels
- CVE-2026-107839 ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service
- CVE-2026-107838 RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion
- CVE-2026-107837 RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling
- CVE-2026-107836 RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size
- CVE-2026-107835 OWASP Coraza WAF: Cookie Parser Confusion
- CVE-2026-107834 OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor
- CVE-2026-107833 OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion
- CVE-2026-107832 fastify vulnerable to header validation bypass via case-sensitive propertyNames
- CVE-2026-107831 Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions
- CVE-2026-107830 Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint
- CVE-2026-10783 gradio-app gradio Audio Cache Key save_audio_to_cache weak hash
- CVE-2026-107829 Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql
- CVE-2026-107828 Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login
- CVE-2026-107826 Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
- CVE-2026-107825 Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations
- CVE-2026-107824 x64dbg-MCP Server exposes debugger operations to unauthenticated network clients
- CVE-2026-107823 MariaDB: privilege escalation via incorrect view frm parsing
- CVE-2026-107822 MariaDB: database privilege escalation via user / role name collision in the acl cache
- CVE-2026-107821 MariaDB: insufficient validation of binary frm data when opening a table
- CVE-2026-107820 x64dbg-MCP Server vulnerable to pre-authentication denial of service through Content-Length integer overflow
- CVE-2026-10782 Missing authorization in RealHomes Memberships
- CVE-2026-107819 MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure
- CVE-2026-107818 MariaDB: environment injection via wsrep bootstrap in the mariadb.service file
- CVE-2026-107817 MariaDB: mysql_json plugin OOB reads
- CVE-2026-107816 MariaDB: `qc_info` plugin can do OOB reads if query contains \0
- CVE-2026-107815 MariaDB: one byte OOB write in DOS tables of the CONNECT engine
- CVE-2026-107814 MariaDB: Insecure $HOME in MariaDB rpm packages
- CVE-2026-107813 Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up
- CVE-2026-107812 Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM
- CVE-2026-107811 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser
- CVE-2026-107810 Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied
- CVE-2026-107809 Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs
- CVE-2026-107808 Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
- CVE-2026-107807 Nginx UI: Node Secret Credential Exposure via URL Query Parameter
- CVE-2026-107806 Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
- CVE-2026-107805 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
- CVE-2026-107804 Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
- CVE-2026-107803 ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter
- CVE-2026-107802 SumatraPDF — Windows command-line argument injection in AI selection-translate
- CVE-2026-107801 Jivejdon through 5.0 Stored XSS via Attachment Upload Content-Type
- CVE-2026-107800 Jivejdon through 5.0 Stored XSS via Private Short Messages
- CVE-2026-10780 Missing authorization in Static Block
- CVE-2026-1078 Other in Pega Robot Studio
- CVE-2026-107799 Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering
- CVE-2026-107798 Jivejdon through commit ee67a65e Stored XSS via Markdown Links in TextStyle Rendering Filter
- CVE-2026-107797 Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters
- CVE-2026-107796 Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Parameters
- CVE-2026-107795 Improper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management API
- CVE-2026-107794 ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list
- CVE-2026-107793 Jivejdon through 5.0 IDOR via subSaveAction Subscription Delete
- CVE-2026-107792 Jivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thread Move
- CVE-2026-107791 WP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Deletion via nav_delete_all_comment
- CVE-2026-107790 WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title
- CVE-2026-10779 Missing authorization in Classified Listing – AI-Powered Classified ads & Business Directory
- CVE-2026-107789 SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR
- CVE-2026-107788 SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion
- CVE-2026-107785 Crux Agent silently fails SKA preshared key rotation when SHA-512 peering is negotiated
- CVE-2026-107783 Insertion of sensitive information into log file in AWS Tools for PowerShell
- CVE-2026-107782 System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port
- CVE-2026-107781 Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById
- CVE-2026-107780 Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter
- CVE-2026-107779 Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE
- CVE-2026-107778 MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()
- CVE-2026-107777 Thermo Fisher Torrent Suite Software Path Traversal
- CVE-2026-107770 Missing authorization in Photo Engine (Media Organizer & Lightroom)
- CVE-2026-10777 ealpha072 Student-Management-System Administrative Backend config.php improper authentication
- CVE-2026-107768 Cross-site scripting in TranslatePress – Translate Multilingual sites with AI Translation
- CVE-2026-107764 Cross-site scripting in SiteOrigin CSS
- CVE-2026-107763 Missing authorization in Fastcache by Host.it
- CVE-2026-107762 Missing authorization in Kirki – Freeform Page Builder, Website Builder & Customizer
- CVE-2026-107761 Channel tokens and organization API key exposed in API responses
- CVE-2026-107758 Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments
- CVE-2026-107757 Cross-site scripting in Gallery Custom Links