Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 972 of 1013.
- CVE-2026-105099 Omega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting
- CVE-2026-105098 Omega Solution CoinEx Crypto Support Ticket API customer information disclosure
- CVE-2026-105097 Omega Solution CoinEx Crypto Customer Information API customer-currency authorization
- CVE-2026-105096 Omega Solution CoinEx Crypto Customer Profile API customer authorization
- CVE-2026-105090 Missing authorization in Formbricks
- CVE-2026-105089 WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates
- CVE-2026-105086 WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title
- CVE-2026-105083 ImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy Bypass via policy.xml DOCTYPE
- CVE-2026-105081 ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName
- CVE-2026-105080 Code injection in ConvertX
- CVE-2026-105079 WordPress MasterStudy LMS plugin <= 3.7.52 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105078 WordPress WP Store Locator plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105076 WordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability
- CVE-2026-105073 WordPress WP Event Solution plugin <= 4.1.25 - Sensitive Data Exposure vulnerability
- CVE-2026-105072 WordPress FluentBooking Pro plugin < 2.5.0 - Broken Access Control vulnerability
- CVE-2026-105071 WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.17 - Sensitive Data Exposure vulnerability
- CVE-2026-105070 WordPress Salon booking system plugin <= 10.31.7 - Privilege Escalation vulnerability
- CVE-2026-105069 WordPress QR Redirector plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105068 WordPress Events Manager plugin <= 7.4.5 - Sensitive Data Exposure vulnerability
- CVE-2026-105067 WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability
- CVE-2026-105066 WordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105065 WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105064 Code injection in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- CVE-2026-105062 WordPress WP Admin Audit plugin <= 1.2.17 - Broken Access Control vulnerability
- CVE-2026-105061 WordPress WP Mailster plugin <= 1.9.0.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105060 WordPress Logo Showcase plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105059 WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerability
- CVE-2026-105058 WordPress WP User Profiles plugin <= 2.7.3 - Privilege Escalation vulnerability
- CVE-2026-105057 WordPress Zero Spam plugin <= 5.7.11 - Bypass vulnerability vulnerability
- CVE-2026-105056 WordPress eCommerce Product Catalog plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105055 WordPress WP Mailster plugin <= 1.9.0.0 - Broken Access Control vulnerability
- CVE-2026-105052 IBM Maximo Application Suite Information Disclosure
- CVE-2026-105051 Security feature bypass in Denuvo Anti-Tamper
- CVE-2026-105050 Command injection in PeaZip
- CVE-2026-105049 Server-side request forgery in Attu
- CVE-2026-105048 Server-side request forgery in Attu
- CVE-2026-105046 Missing authorization in Xperience
- CVE-2026-105044 OS Command Injection in Qingteng Host Adaptive Security Platform Security Toolbox
- CVE-2026-105043 Code injection in Simulink
- CVE-2026-105042 Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash
- CVE-2026-105040 EnergizeLab Eilik User-ID Mass Assignment Account Takeover
- CVE-2026-105039 EnergizeLab Station Middleware Admin APIs Missing Role Checks
- CVE-2026-105038 EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching
- CVE-2026-105037 EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read
- CVE-2026-105036 EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks
- CVE-2026-105035 EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key
- CVE-2026-105034 EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers
- CVE-2026-105033 EnergizeLab AI Station Default Root Credentials with SSH Enabled
- CVE-2026-105032 EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write
- CVE-2026-105031 Security feature bypass in Apache Qpid Proton C
- CVE-2026-105030 Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API
- CVE-2026-105029 UVdesk support-center-bundle before 1.1.3.3 IDOR via rateTicket Ticket Rating Endpoint
- CVE-2026-105016 Microsoft QUIC Remote Code Execution Vulnerability
- CVE-2026-105014 Azure Pipelines Remote Code Execution Vulnerability
- CVE-2026-105013 Microsoft Office SharePoint Remote Code Execution Vulnerability
- CVE-2026-105010 Microsoft Windows Search Component Elevation of Privilege Vulnerability
- CVE-2026-105009 Windows Server Update Service Elevation of Privilege Vulnerability
- CVE-2026-105008 Windows Schannel Spoofing Vulnerability
- CVE-2026-105007 Windows NDIS Elevation of Privilege Vulnerability
- CVE-2026-105006 HID Class Driver Elevation of Privilege Vulnerability
- CVE-2026-105005 Windows Schannel Remote Code Execution Vulnerability
- CVE-2026-105004 Windows Overlay Filter Elevation of Privilege Vulnerability
- CVE-2026-105003 HID Class Driver Elevation of Privilege Vulnerability
- CVE-2026-1050 risesoft-y9 Digital-Infrastructure REST Authenticate Endpoint Y9PlatformUtil.java sql injection
- CVE-2026-104995 Code injection in BP Profile Search
- CVE-2026-104994 Path traversal in Trivy
- CVE-2026-104993 GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field
- CVE-2026-104991 Phproject < 1.8.7 Missing Authorization via Issues REST API
- CVE-2026-104988 Auth bypass in Red Hat Certificate System 10
- CVE-2026-104983 Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal
- CVE-2026-104982 Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal
- CVE-2026-104979 Plane: Cross-tenant stored XSS in intake enables account takeover
- CVE-2026-104978 Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance
- CVE-2026-104977 Server-side request forgery in plane
- CVE-2026-104976 Plane: SSRF in Gitea OAuth
- CVE-2026-104975 Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints
- CVE-2026-104974 Plane: Disabled User Auto-Reactivation on Login
- CVE-2026-104973 Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery
- CVE-2026-104971 Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization
- CVE-2026-104970 Race condition in plane
- CVE-2026-104969 Plane: Cross-Tenant Cycle Issue Hijack via IDOR
- CVE-2026-104968 Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/
- CVE-2026-104967 Missing authorization in plane
- CVE-2026-104966 Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces
- CVE-2026-104965 Plane: Cross-Tenant Issue Relation Creation via IDOR
- CVE-2026-104964 Plane: Cross-Workspace Project Modification via Unscoped Project Lookup
- CVE-2026-104963 Missing authorization in plane
- CVE-2026-104962 Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)
- CVE-2026-104961 Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access
- CVE-2026-104960 Missing authorization in plane
- CVE-2026-104956 Denial of service in plane
- CVE-2026-104955 Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)
- CVE-2026-104953 MPG < 4.2.3 - Editor+ SQLi via Project Import
- CVE-2026-104949 Missing authorization in WarehousePG
- CVE-2026-104948 Missing authorization in WarehousePG
- CVE-2026-104947 Missing authorization in WarehousePG
- CVE-2026-104945 Authenticated ONVIF PTZ Out-of-Bounds Stack Write Denial of Service in TP-Link Tapo C500
- CVE-2026-104944 Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500
- CVE-2026-104939 NGINX Ingress Controller vulnerability
- CVE-2026-104937 CVE-2026-104937