Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 980 of 1013.
- CVE-2026-103406 Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.
- CVE-2026-103405 Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting
- CVE-2026-103404 Session Smart Conductor: Insecure file permissions cause unauthorized access to sensitive routing credentials
- CVE-2026-103403 Command injection in Session Smart Conductor
- CVE-2026-103402 Security feature bypass in Session Smart Conductor
- CVE-2026-103401 Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root
- CVE-2026-103400 Path traversal in Session Smart Conductor
- CVE-2026-103399 Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body
- CVE-2026-103398 OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path
- CVE-2026-103397 OpenSave before 2.4.0-beta.1 Authentication Bypass via Spoofed Relay Sender
- CVE-2026-103396 bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount
- CVE-2026-103395 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service
- CVE-2026-103394 Weak cryptography in Session Smart Router
- CVE-2026-103393 Session Smart Router: An attacker can cause an out-of-bounds read during VRRP packet processing
- CVE-2026-103392 Memory corruption in Session Smart Router
- CVE-2026-103391 Session Smart Router: An attacker-controlled TCP option causes an out-of-bounds write when using the TCP proxy feature
- CVE-2026-103390 Memory corruption in Session Smart Conductor
- CVE-2026-103389 MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph
- CVE-2026-103388 MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field
- CVE-2026-103387 garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception
- CVE-2026-103382 Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation
- CVE-2026-103381 Mintpay <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation via Callback Forgery
- CVE-2026-103380 Information disclosure in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
- CVE-2026-103378 Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File
- CVE-2026-103377 Reflected cross-site scripting in the video library of the Regional Parliament of Castile-La Mancha
- CVE-2026-103376 PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check
- CVE-2026-103372 Payconiq for WooCommerce <= 1.0.4 - Unauthenticated Order Key Disclosure
- CVE-2026-103371 Apache Geode: Management REST API: Insertion of Sensitive Information into Log File
- CVE-2026-103370 Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion
- CVE-2026-103369 Cross-site scripting in Social Share Buttons & Analytics Plugin – GetSocial.io
- CVE-2026-103367 ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter
- CVE-2026-103366 Missing authorization in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
- CVE-2026-103365 Information disclosure in Online Scheduling and Appointment Booking System – Bookly
- CVE-2026-103360 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-103359 PayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook Forgery
- CVE-2026-103358 WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability
- CVE-2026-103357 WordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerability
- CVE-2026-103356 WordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability
- CVE-2026-103355 SQL injection in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- CVE-2026-103354 WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-103353 WordPress FluentForm plugin <= 6.2.14 - Broken Access Control vulnerability
- CVE-2026-103352 WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability
- CVE-2026-103351 WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.1 - Other vulnerability Type vulnerability
- CVE-2026-103350 WordPress Booking and Rental Manager plugin <= 2.8.0 - Other vulnerability Type vulnerability
- CVE-2026-103349 WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability
- CVE-2026-103348 WordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object Injection vulnerability
- CVE-2026-103347 WordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerability vulnerability
- CVE-2026-103346 WordPress Payflex Payment Gateway plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-103345 WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability
- CVE-2026-103344 Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- CVE-2026-103343 WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-103342 Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- CVE-2026-103341 Missing authorization in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- CVE-2026-103340 WordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability
- CVE-2026-103339 WordPress Metform plugin <= 4.3.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-103338 SQL injection in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- CVE-2026-103337 WordPress WC Ukraine Shipping plugin <= 1.23.2 - Broken Access Control vulnerability
- CVE-2026-103336 WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability
- CVE-2026-103335 WordPress Video Conferencing with Zoom plugin <= 4.6.10 - Sensitive Data Exposure vulnerability
- CVE-2026-103334 WordPress Five Star Restaurant Reservations plugin <= 2.7.24 - Sensitive Data Exposure vulnerability
- CVE-2026-103332 Auth bypass in Payex Payment Gateway for Woocommerce
- CVE-2026-103331 UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Order Payment Forgery via Empty IPN Secret
- CVE-2026-103330 Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass
- CVE-2026-103329 Super Payments < 1.43.1 - Unauthenticated Payment Confirmation Forgery via Webhook Signature
- CVE-2026-103325 TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass
- CVE-2026-103324 Security feature bypass in Cardinity Payment Gateway for WooCommerce
- CVE-2026-103323 Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Unauthenticated Action Scheduler Queue Disclosure
- CVE-2026-103321 MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image
- CVE-2026-103319 Auth bypass in OPay Payment Gateway for WooCommerce
- CVE-2026-103316 The macOS version of the DigiD app is not signed with Hardened Runtime
- CVE-2026-103314 Stackrox: stackrox: saml response replay allows multiple central authentication tokens
- CVE-2026-103313 BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler
- CVE-2026-103312 Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN Callback
- CVE-2026-103311 Security feature bypass in Coinbase Commerce Payment Gateway for WooCommerce
- CVE-2026-103309 GPTranslate < 2.34.14 - Unauthenticated Stored XSS via REST API Translation Storage
- CVE-2026-103308 Auth bypass in Visma Pay for WooCommerce
- CVE-2026-103307 Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook
- CVE-2026-103306 iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback
- CVE-2026-103305 Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update
- CVE-2026-103304 eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update
- CVE-2026-103302 Payment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret
- CVE-2026-103301 Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret
- CVE-2026-103300 Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback
- CVE-2026-103299 nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret
- CVE-2026-103298 CCAvenue Payment Gateway for WooCommerce <= 3.1 - Unauthenticated Order Payment Completion via Webhook Forgery
- CVE-2026-103297 CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)
- CVE-2026-103296 CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)
- CVE-2026-103294 CAI Content Credentials | Improper Certificate Validation (CWE-295)
- CVE-2026-103293 MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import
- CVE-2026-103292 Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head
- CVE-2026-103291 Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch
- CVE-2026-103290 Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize
- CVE-2026-103289 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments
- CVE-2026-103288 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like
- CVE-2026-103287 Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook
- CVE-2026-103286 Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications
- CVE-2026-103285 Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery
- CVE-2026-103284 Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback
- CVE-2026-103283 Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling
- CVE-2026-103282 Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token