Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 975 of 1013.
- CVE-2026-104448 YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler
- CVE-2026-104447 YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction
- CVE-2026-104446 YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler
- CVE-2026-104445 YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing
- CVE-2026-104444 YesWiki before 4.6.7 Authorization Bypass via Comments API editComment
- CVE-2026-104443 YesWiki before 4.6.7 Scope Bypass via Triples Delete API
- CVE-2026-104442 YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action
- CVE-2026-104441 YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action
- CVE-2026-104440 YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter
- CVE-2026-104439 YesWiki before 4.6.7 User Enumeration via Lost-Password Flow
- CVE-2026-104438 YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions
- CVE-2026-104437 Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling
- CVE-2026-104436 Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length
- CVE-2026-104435 Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output
- CVE-2026-104434 Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC
- CVE-2026-104433 Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString
- CVE-2026-104432 Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response
- CVE-2026-104431 Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification
- CVE-2026-104430 Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount
- CVE-2026-104429 Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages
- CVE-2026-104428 Zebra before 11.0.0 Denial of Service via getblock Verbosity 2
- CVE-2026-104427 Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry
- CVE-2026-104426 Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check
- CVE-2026-104425 Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions
- CVE-2026-104424 Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate
- CVE-2026-104423 Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification
- CVE-2026-104422 Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite
- CVE-2026-104421 Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout
- CVE-2026-104420 Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks
- CVE-2026-104419 Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes
- CVE-2026-104418 Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files
- CVE-2026-104417 Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting
- CVE-2026-104416 Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API
- CVE-2026-104415 Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API
- CVE-2026-104414 Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses
- CVE-2026-104413 Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images
- CVE-2026-104412 Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment
- CVE-2026-104411 Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads
- CVE-2026-104410 SiYuan before 3.8.5 Information Disclosure via /api/export/preview
- CVE-2026-104409 WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.13 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-104408 WordPress Groundhogg plugin <= 4.8.3 - SQL Injection vulnerability
- CVE-2026-104407 WordPress PowerPress Podcasting plugin <= 11.17.9 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-104406 WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability
- CVE-2026-104405 WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability
- CVE-2026-104404 WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-104403 WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-104402 WordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerability
- CVE-2026-104401 WordPress Memberful - Membership Plugin plugin <= 1.81.2 - Sensitive Data Exposure vulnerability
- CVE-2026-104400 WordPress B Blocks plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-1044 Cross-site scripting in Tennis Court Bookings
- CVE-2026-104399 WordPress Motors plugin <= 1.4.124 - Sensitive Data Exposure vulnerability
- CVE-2026-104398 WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability
- CVE-2026-104397 WordPress Name Directory plugin <= 1.34.2 - Arbitrary Shortcode Execution vulnerability
- CVE-2026-104396 WordPress Name Directory plugin <= 1.34.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-104395 WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-104394 WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-104393 WordPress Happy Addons for Elementor plugin <= 3.50.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-104392 WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability
- CVE-2026-104391 WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-104390 WordPress Booktics plugin <= 1.0.27 - Broken Access Control vulnerability
- CVE-2026-104389 WordPress Sirv plugin <= 8.2.5 - SQL Injection vulnerability
- CVE-2026-104388 WordPress PowerPress Podcasting plugin <= 11.17.9 - Sensitive Data Exposure vulnerability
- CVE-2026-104387 WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability
- CVE-2026-104386 WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability
- CVE-2026-104385 WordPress Groundhogg plugin <= 4.8.3 - Sensitive Data Exposure vulnerability
- CVE-2026-104384 Insufficiently protected credentials in EagleCloud Aquila on-premises version
- CVE-2026-104383 Code injection in EagleCloud Aquila on-premises version
- CVE-2026-104381 Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service
- CVE-2026-104380 Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one.
- CVE-2026-104364 IBM® Db2® Denial of Service
- CVE-2026-104356 PictShare < 3.7.1 Predictable Delete Code via rand()
- CVE-2026-104355 Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces
- CVE-2026-104354 SQL injection in Adobe Campaign Classic
- CVE-2026-104353 Command injection in Adobe Campaign Classic
- CVE-2026-104351 Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- CVE-2026-104350 Adobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79)
- CVE-2026-104349 Creative Cloud Desktop | Uncontrolled Search Path Element (CWE-427)
- CVE-2026-104348 Photoshop Desktop | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-104347 Photoshop Desktop | Out-of-bounds Write (CWE-787)
- CVE-2026-104346 Photoshop Desktop | Out-of-bounds Write (CWE-787)
- CVE-2026-104345 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-104344 Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-104343 Adobe Framemaker | NULL Pointer Dereference (CWE-476)
- CVE-2026-104342 Adobe Framemaker | Use After Free (CWE-416)
- CVE-2026-104341 Adobe Framemaker | Out-of-bounds Write (CWE-787)
- CVE-2026-104340 Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-104339 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-104335 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-104334 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-104332 IBM® Db2® Denial of Service
- CVE-2026-104331 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-104328 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-104324 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-104317 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-104316 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-104315 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-104314 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-104313 WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via 'rule_data' Parameter
- CVE-2026-104312 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-104310 Langflow OSS is affected by multiple vulnerabilities