Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 973 of 1013.
- CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing
- CVE-2026-104932 Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption
- CVE-2026-104915 Missing authorization in Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
- CVE-2026-104914 MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View
- CVE-2026-104912 MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data
- CVE-2026-104910 MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization
- CVE-2026-104909 Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter
- CVE-2026-104908 MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging
- CVE-2026-104907 MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler
- CVE-2026-104906 MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output
- CVE-2026-104905 FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect
- CVE-2026-104901 MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server
- CVE-2026-104900 MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index
- CVE-2026-1049 LigeroSmart index.pl cross site scripting
- CVE-2026-104899 GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter
- CVE-2026-104898 Privilege escalation in Online Scheduling and Appointment Booking System – Bookly
- CVE-2026-104895 Denial of service in jackson-dataformat-smile
- CVE-2026-104894 Plane: Cross-Tenant Module Issue Linking via IDOR
- CVE-2026-104893 Plane: Improper validation allows arbitrary modification of API token rate limits
- CVE-2026-104892 Plane: Plaintext logging of API token
- CVE-2026-104891 mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
- CVE-2026-104890 Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution
- CVE-2026-104875 Ente: Accepted emergency contact can bypass the recovery notice period
- CVE-2026-104874 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
- CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators
- CVE-2026-104872 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
- CVE-2026-104871 Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
- CVE-2026-104861 probe-image-size: Quadratic-time Denial of Service in the SVG Parser
- CVE-2026-104859 Nx: OS command injection in the @nx/docker release pipeline
- CVE-2026-104855 Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state
- CVE-2026-104854 Nx daemon and plugin worker sockets are accessible to other local users
- CVE-2026-104853 Nx: Path traversal in nx migrate package-migrations extraction
- CVE-2026-104852 GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
- CVE-2026-104851 fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
- CVE-2026-104850 MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
- CVE-2026-104849 Tinypool: Prototype Pollution Gadget to RCE in run() options
- CVE-2026-104848 Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
- CVE-2026-104847 ProseMirror: XSS vulnerability in prosemirror-view's paste handling
- CVE-2026-104846 Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)
- CVE-2026-104845 Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
- CVE-2026-104844 PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
- CVE-2026-104843 uv: Path traversal on Windows through wheel extraction
- CVE-2026-104828 HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encode
- CVE-2026-104827 react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS
- CVE-2026-104817 Misskey: Lack of rate limiting and size restrictions in RSS fetching API
- CVE-2026-104816 Misskey: Cross-site scripting in RSS feed item links
- CVE-2026-104814 WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-104811 Mitel MiVoice Office 400 Music on Hold WAV File Upload Code Execution
- CVE-2026-104810 Mitel MiVoice Office 400 File Management File Browser path traversal vulnerability
- CVE-2026-104809 Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution
- CVE-2026-104808 Mitel MiVoice Office 400 stored Cross-Site Scripting
- CVE-2026-104807 Mitel MiVoice Office 400 stored Cross-Site Scripting
- CVE-2026-104806 Mitel MiVoice Office 400 System Logs Path Traversal Information Disclosure
- CVE-2026-104805 Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution
- CVE-2026-104803 Auth bypass in WPCOM Member
- CVE-2026-104801 PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter
- CVE-2026-104800 Code injection in AGE-GATE
- CVE-2026-1048 LigeroSmart index.pl cross site scripting
- CVE-2026-104798 Code injection in My Calendar – Accessible Event Manager
- CVE-2026-104797 Auth bypass in Advanced Form Integration — Connect Forms to 300+ Apps
- CVE-2026-104795 Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution
- CVE-2026-104774 OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass
- CVE-2026-104769 Path traversal in Debloat – Remove Unused CSS, Optimize JS
- CVE-2026-104767 Privilege escalation in Membership & User Roles for WooCommerce (Automatic Role Changer)
- CVE-2026-104766 Privilege escalation in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
- CVE-2026-104764 Deserialization in Post Export Import with Media
- CVE-2026-104763 Path traversal in Post Export Import with Media
- CVE-2026-104762 Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute
- CVE-2026-104761 Mang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter
- CVE-2026-104759 Auth bypass in WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
- CVE-2026-104757 WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability
- CVE-2026-104755 WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint
- CVE-2026-104754 Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL
- CVE-2026-104753 Rank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter
- CVE-2026-104752 Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import
- CVE-2026-104751 Rank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion
- CVE-2026-104749 Privilege escalation in Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
- CVE-2026-104748 Privilege escalation in SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications
- CVE-2026-104747 WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability
- CVE-2026-104745 Weak cryptography in Customer Email Verification for WooCommerce
- CVE-2026-104743 Path traversal in Tainacan
- CVE-2026-104742 Missing authorization in AI Puffer – AI Chatbot, AI Writer & Automation
- CVE-2026-104741 Missing authorization in AI Puffer – AI Chatbot, AI Writer & Automation
- CVE-2026-104740 Cross-site scripting in If-So Dynamic Content – Elementor & All Page Builders Personalization
- CVE-2026-104736 LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
- CVE-2026-104735 Cross-site scripting in RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
- CVE-2026-104734 Deserialization in Kirki – Freeform Page Builder, Website Builder & Customizer
- CVE-2026-104733 User Impersonation/Authorization Bypass in XMPP Server ejabberd
- CVE-2026-104732 Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler
- CVE-2026-104730 Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter
- CVE-2026-104729 Cross-site scripting in Avada (Fusion) Builder
- CVE-2026-104728 Missing authorization in AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
- CVE-2026-104727 Cross-site scripting in Sequential Order Numbers for WooCommerce
- CVE-2026-104726 Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute
- CVE-2026-104725 Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter
- CVE-2026-104724 FireBox <= 3.1.13 - Authenticated (Author+) SQL Injection via FireBox Form Display Condition
- CVE-2026-104723 LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data
- CVE-2026-104722 Path traversal in Listdom: AI-powered Business Directory with Classifieds Ads Listings
- CVE-2026-104721 Logback: Incomplete protection against CVE-2026-19880
- CVE-2026-104715 Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass