Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 966 of 1013.
- CVE-2026-105969 CodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote Disclosure
- CVE-2026-105964 Gitea Actions artifact v4 API unbounded request body
- CVE-2026-105963 Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
- CVE-2026-105960 HMS Networks PEAK-System PCAN Windows drivers Improper Handling of Length Parameter Inconsistency
- CVE-2026-105959 Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation
- CVE-2026-105958 Spice-server: spice: heap oob read/write via unchecked migration data offsets
- CVE-2026-105957 SourceCodester Performance Indicator System view_product.php sql injection
- CVE-2026-105950 getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting
- CVE-2026-10595 Path Traversal Vulnerability in parisneo/lollms
- CVE-2026-105949 Auth bypass in streams for Apache Kafka 2
- CVE-2026-105947 Arbitrary File Read in Innotim Software's Logsign SIEM
- CVE-2026-105946 Out-of-bounds read vulnerability in NTLM authentication handling impacts Qt
- CVE-2026-105945 Path traversal in Apache Pulsar
- CVE-2026-105944 Missing authorization in Apache Pulsar Manager
- CVE-2026-105942 Privilege escalation in Apache Pulsar
- CVE-2026-105941 Server-side request forgery in streams for Apache Kafka 3
- CVE-2026-105938 Missing authorization in Apache Pulsar
- CVE-2026-105937 Missing authorization in Apache Pulsar
- CVE-2026-105936 Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint
- CVE-2026-105935 Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission
- CVE-2026-105934 Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic
- CVE-2026-105933 Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization
- CVE-2026-105932 Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints
- CVE-2026-105931 Missing authorization in Apache Pulsar
- CVE-2026-105930 Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download
- CVE-2026-10593 Remotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handling
- CVE-2026-105927 Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission
- CVE-2026-105926 Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands
- CVE-2026-105923 Null-pointer dereference in QTriangulator reachable through VectorImage
- CVE-2026-105922 vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service
- CVE-2026-105921 Kusalkasilva Learning-Management-System search_class.php sql injection
- CVE-2026-105920 Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection
- CVE-2026-10592 Wildcard DNS SAN bypasses CA name-constraint checks
- CVE-2026-105919 Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection
- CVE-2026-105918 Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection
- CVE-2026-10591 Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths
- CVE-2026-105903 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- CVE-2026-105902 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-105901 ColdFusion | Incorrect Authorization (CWE-863)
- CVE-2026-105900 ColdFusion | Improper Input Validation (CWE-20)
- CVE-2026-10590 Auth bypass in IdeaPad 5 15ABA7 BIOS
- CVE-2026-1059 FeMiner wms chkuser.php sql injection
- CVE-2026-105899 ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)
- CVE-2026-105898 ColdFusion | Incorrect Authorization (CWE-863)
- CVE-2026-105897 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
- CVE-2026-105896 Photoshop Desktop | NULL Pointer Dereference (CWE-476)
- CVE-2026-105895 Adobe Experience Manager | Improper Input Validation (CWE-20)
- CVE-2026-105893 WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability
- CVE-2026-105892 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability
- CVE-2026-105891 WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability
- CVE-2026-105890 WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-10589 Memory corruption in IdeaPad 5 15ABA7 BIOS
- CVE-2026-105889 WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability
- CVE-2026-105888 WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability
- CVE-2026-105887 WordPress Robo Gallery plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105886 WordPress Ultimate Post Kit plugin <= 4.5.5 - Broken Access Control vulnerability
- CVE-2026-105885 WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability
- CVE-2026-105884 WordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105883 WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability
- CVE-2026-105882 WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105881 WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-10588 Information disclosure in IdeaPad 5 15ABA7 BIOS
- CVE-2026-105879 WordPress JetElements For Elementor plugin <= 2.9.2.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105878 WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability
- CVE-2026-105877 WordPress QA Analytics plugin <= 5.3.0.0 - Sensitive Data Exposure vulnerability
- CVE-2026-105876 WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability
- CVE-2026-105875 WordPress Prime Slider – Addons For Elementor plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105874 WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105873 WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105872 WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability
- CVE-2026-105871 WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105870 WordPress WP Associate Post R2 plugin <= 5.0.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-10587 Memory corruption in IdeaPad 5 15ABA7 BIOS
- CVE-2026-105869 Auth bypass in Apache Pulsar
- CVE-2026-105868 Payload: Uploaded XML files could execute same-origin JavaScript
- CVE-2026-105867 Payload: Client uploads could overwrite S3 objects
- CVE-2026-105866 Payload: Unauthenticated account-lockout denial of service
- CVE-2026-105865 Payload: Incomplete validation during the upload file lifecycle
- CVE-2026-105864 Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant
- CVE-2026-105863 Payload authentication token field handling issue
- CVE-2026-105862 Payload: Bypassed sanitization of user uploaded SVGs
- CVE-2026-105861 Payload external upload trust validation issue
- CVE-2026-105860 Payload: Tenant authorization bypass in Multi-Tenant Plugin
- CVE-2026-10586 Server-side request forgery in Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
- CVE-2026-105859 Payload: Unauthorized update to collection documents
- CVE-2026-105858 Payload: Remote Code Execution through first-register
- CVE-2026-105857 Payload: RCE in Payload Form Builder
- CVE-2026-105856 Payload: SQL injection in SQLite/Postgres
- CVE-2026-105855 Payload: Field-level password update restrictions were not enforced
- CVE-2026-105854 Payload: ReDoS in Multipart Content-Type Validation
- CVE-2026-105853 Payload: Token refresh and password reset responses may expose restricted user fields
- CVE-2026-105852 Payload relationship-query authorization bypass
- CVE-2026-105851 Payload: Field access control bypass on auth collections
- CVE-2026-105850 Payload: Order confirmation validation issue in Payload Ecommerce
- CVE-2026-10585 Cross-site scripting in Enterprise Server
- CVE-2026-105849 Payload: API key disclosure through ordinary document reads
- CVE-2026-105848 Payload: Insufficient Access Control in Stripe REST Proxy
- CVE-2026-105847 Payload: Polymorphic join queries could disclose hidden fields
- CVE-2026-105846 Payload: Untrusted redirect URL parameter exploit
- CVE-2026-105845 Payload: SQL Injection in SQLite and Postgres