Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 977 of 1013.
- CVE-2026-104005 Incorrect authorization in MongoDB Server router for bulk writes to system namespaces
- CVE-2026-104004 Collection validators using collation-accepting expressions can crash MongoDB Server on insert
- CVE-2026-104003 Code injection in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- CVE-2026-104002 Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)
- CVE-2026-104001 Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta
- CVE-2026-104000 Cross-site scripting in Simply Schedule Appointments
- CVE-2026-103999 Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload
- CVE-2026-103998 Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Array Key
- CVE-2026-103996 Cross-site scripting in If-So Dynamic Content – Elementor & All Page Builders Personalization
- CVE-2026-103995 Lenient parsing of integers for response body and chunk framing
- CVE-2026-103994 Junos OS: A crafted OVSDB message crashes vgd and allows remote code execution
- CVE-2026-103993 Memory corruption in Junos OS
- CVE-2026-103988 FileRise renameFolder omits destination-parent authorization
- CVE-2026-103977 FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts
- CVE-2026-103975 Appium: Symlink based Zip Slip in @appium/support ZIP extraction
- CVE-2026-103974 lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies
- CVE-2026-103967 Adobe Framemaker | Out-of-bounds Write (CWE-787)
- CVE-2026-103966 Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-103965 Fixed values in MongoDB Server $bucket stage may be misread as field references
- CVE-2026-103964 Information disclosure in Download Manager
- CVE-2026-103958 Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS
- CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS
- CVE-2026-103956 Missing authentication for critical function in Loom for AWS
- CVE-2026-103946 SQL Injection
- CVE-2026-103937 Misskey: Denial of service resulting from insufficient cleanup processing during file uploads
- CVE-2026-103936 libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners
- CVE-2026-103930 cpp-httplib open_stream serializes CRLF in request target into HTTP request line
- CVE-2026-103929 mise permits untrusted local configuration to override default shell arguments
- CVE-2026-103928 Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions
- CVE-2026-103923 KaTeX: Existing prototype pollution can bypass trust restrictions
- CVE-2026-103922 Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
- CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
- CVE-2026-103918 @orpc/zod: Prototype injection in smart coercion
- CVE-2026-103913 GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
- CVE-2026-103912 Cross-site scripting in JetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-103911 Code injection in Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- CVE-2026-103909 Cross-site scripting in Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
- CVE-2026-103907 Missing authorization in Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
- CVE-2026-103905 Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop
- CVE-2026-103904 Stored XSS Vulnerability in JTL-Shop
- CVE-2026-103903 MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation
- CVE-2026-103902 DigiDoc improper signature verification
- CVE-2026-103899 Cross-site scripting in EU VAT Assistant for WooCommerce
- CVE-2026-103897 Cross-site scripting in Responsive Lightbox & Gallery
- CVE-2026-103896 Path traversal in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer
- CVE-2026-103895 Auth bypass in miniOrange OTP Login, Verification and SMS Notifications
- CVE-2026-103889 3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter
- CVE-2026-103888 WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter
- CVE-2026-103885 Apache Directory LDAP API: Denial of service via crafted telephone number values
- CVE-2026-103884 Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read
- CVE-2026-103880 Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords
- CVE-2026-103878 Apache Directory LDAP API: Injection of plaintext responses during StartTLS
- CVE-2026-103877 Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements
- CVE-2026-103875 Cross-site scripting in Media Library Assistant
- CVE-2026-103870 Pulp-rpm: distribution tree publish creates directories from .treeinfo ids
- CVE-2026-103869 Pulp-ansible: bearer tokens are reused across remotes in a worker
- CVE-2026-103868 Pulp-container: registry credentials are reused across remotes in a worker
- CVE-2026-103858 MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions
- CVE-2026-103857 Adobe Framemaker | Out-of-bounds Read (CWE-125)
- CVE-2026-103856 Adobe Framemaker | Out-of-bounds Read (CWE-125)
- CVE-2026-103855 Dimension | NULL Pointer Dereference (CWE-476)
- CVE-2026-103854 Dimension | Stack-based Buffer Overflow (CWE-121)
- CVE-2026-103853 Dimension | Out-of-bounds Read (CWE-125)
- CVE-2026-103852 Substance3D - Stager | NULL Pointer Dereference (CWE-476)
- CVE-2026-103851 Substance3D - Stager | Stack-based Buffer Overflow (CWE-121)
- CVE-2026-103850 Substance3D - Stager | Out-of-bounds Read (CWE-125)
- CVE-2026-103849 Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
- CVE-2026-103848 Command injection in Adobe Experience Manager 6.5
- CVE-2026-103847 Dimension | Untrusted Search Path (CWE-426)
- CVE-2026-103846 Dimension | Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting) (CWE-79)
- CVE-2026-103845 Dimension | Uncontrolled Search Path Element (CWE-427)
- CVE-2026-103844 Dimension | Out-of-bounds Write (CWE-787)
- CVE-2026-103843 Substance3D - Stager | Use After Free (CWE-416)
- CVE-2026-103842 Substance3D - Stager | Out-of-bounds Read (CWE-125)
- CVE-2026-103841 Substance3D - Stager | Out-of-bounds Read (CWE-125)
- CVE-2026-103840 Substance3D - Stager | Out-of-bounds Read (CWE-125)
- CVE-2026-103839 Substance3D - Stager | Out-of-bounds Write (CWE-787)
- CVE-2026-103838 Substance3D - Stager | Out-of-bounds Write (CWE-787)
- CVE-2026-103837 Substance3D - Stager | Out-of-bounds Write (CWE-787)
- CVE-2026-103836 Substance3D - Stager | Out-of-bounds Write (CWE-787)
- CVE-2026-103835 Substance3D - Stager | Out-of-bounds Write (CWE-787)
- CVE-2026-103834 Substance3D - Stager | Out-of-bounds Write (CWE-787)
- CVE-2026-103833 Substance3D - Stager | Out-of-bounds Write (CWE-787)
- CVE-2026-103832 Substance3D - Stager | Out-of-bounds Write (CWE-787)
- CVE-2026-103831 Insecure deserialization in the TrueLayer Magento 2 plugin
- CVE-2026-103830 Substance3D - Stager | Stack-based Buffer Overflow (CWE-121)
- CVE-2026-103829 Substance3D - Designer | NULL Pointer Dereference (CWE-476)
- CVE-2026-103828 Substance3D - Designer | NULL Pointer Dereference (CWE-476)
- CVE-2026-103827 Substance3D - Designer | Stack-based Buffer Overflow (CWE-121)
- CVE-2026-103826 Substance3D - Designer | NULL Pointer Dereference (CWE-476)
- CVE-2026-103825 Substance3D - Designer | Out-of-bounds Read (CWE-125)
- CVE-2026-103824 Substance3D - Designer | NULL Pointer Dereference (CWE-476)
- CVE-2026-103823 Substance3D - Designer | Stack-based Buffer Overflow (CWE-121)
- CVE-2026-103822 Substance3D - Designer | Out-of-bounds Read (CWE-125)
- CVE-2026-103821 Substance3D - Designer | Out-of-bounds Write (CWE-787)
- CVE-2026-103820 CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- CVE-2026-103799 Missing authorization in PowerProtect Data Domain Management Center
- CVE-2026-103792 SQL injection in PowerProtect Data Domain Management Center
- CVE-2026-103780 Memory corruption in PowerProtect Data Domain
- CVE-2026-103779 Auth bypass in PowerProtect Data Domain