Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 981 of 1013.
- CVE-2026-103281 Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API
- CVE-2026-103280 Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint
- CVE-2026-103279 Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass
- CVE-2026-103278 Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe
- CVE-2026-103277 Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed
- CVE-2026-103276 Ghost before 6.20.0 File Read via URL Encoding Bypass
- CVE-2026-103275 Ghost 5.42.2 before 6.58.0 Password Hash Disclosure
- CVE-2026-103274 Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read
- CVE-2026-103273 Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token
- CVE-2026-103272 Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API
- CVE-2026-103271 Ghost 4.0.0 before 6.63.0 Restricted Content Bypass
- CVE-2026-103270 LightLLM through 1.2.0 Missing Authentication on RL Control Routes
- CVE-2026-103269 Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts
- CVE-2026-103268 Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset
- CVE-2026-103267 Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite
- CVE-2026-103266 Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification
- CVE-2026-103265 Fleet before 4.89.0 Information Disclosure via MDM Command Results
- CVE-2026-103264 Fleet before 4.87.0 Authentication Bypass via Device Identifiers
- CVE-2026-103263 Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink
- CVE-2026-103262 Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient
- CVE-2026-103261 Tornado before 6.5.9 Denial of Service via Query String
- CVE-2026-103260 n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node
- CVE-2026-103259 n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials
- CVE-2026-103258 n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation
- CVE-2026-103257 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node
- CVE-2026-103256 n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook
- CVE-2026-103255 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase
- CVE-2026-103254 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation
- CVE-2026-103253 n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table
- CVE-2026-103252 n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint
- CVE-2026-103251 n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub
- CVE-2026-103250 n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory
- CVE-2026-103249 n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator
- CVE-2026-103248 n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase
- CVE-2026-103247 n8n before 1.123.80 Credential Tampering via Duplicate Node IDs
- CVE-2026-103246 n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection
- CVE-2026-103245 n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification
- CVE-2026-103244 ground-station before 0.8.0 Authentication Bypass via setup.restore
- CVE-2026-103243 LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints
- CVE-2026-103242 Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag
- CVE-2026-103241 vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service
- CVE-2026-103239 MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection
- CVE-2026-103237 MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows
- CVE-2026-103235 MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events
- CVE-2026-103234 WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email
- CVE-2026-103233 AdithyaYelloju Restaurant-Management-System Admin Area admin authorization
- CVE-2026-103232 AdithyaYelloju Restaurant-Management-System table_booking.php mysqli_query sql injection
- CVE-2026-103231 AdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mysqli_query sql injection
- CVE-2026-103230 AdithyaYelloju Restaurant-Management-System Order Placement ord.php mysqli_query sql injection
- CVE-2026-103229 AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injection
- CVE-2026-103227 GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow
- CVE-2026-103226 Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow
- CVE-2026-103224 Denial of service in Eclipse Vert.x
- CVE-2026-103223 Denial of service in Eclipse Vert.x
- CVE-2026-103222 Blosc C-Blosc2 blosclz Decompression blosclz.c blosclz_decompress integer overflow
- CVE-2026-103220 Memory corruption in affinity
- CVE-2026-1032 Conditional Menus <= 1.2.6 - Cross-Site Request Forgery to Menu Options Update
- CVE-2026-103119 Apache Tomcat: AJP response mix-up
- CVE-2026-103118 GraphicsMagick WPG File wpg.c ExtractPostscript recursion
- CVE-2026-103117 OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection
- CVE-2026-103116 OS4ED openSIS-Classic Student List Search Endpoint GetStuListFnc.php DBQuery sql injection
- CVE-2026-103115 OS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injection
- CVE-2026-103114 OS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injection
- CVE-2026-103113 OS4ED openSIS-Classic General Information Tab Student.php save action sql injection
- CVE-2026-103111 Memory corruption in PCRE2
- CVE-2026-103110 Memory corruption in Infinity
- CVE-2026-103109 Memory corruption in Infinity
- CVE-2026-103108 Denial of service in Infinity
- CVE-2026-103106 Privilege escalation in Infinity
- CVE-2026-103105 Missing authorization in Infinity
- CVE-2026-103104 Denial of service in Infinity
- CVE-2026-103102 Denial of service in Infinity
- CVE-2026-103101 Denial of service in Infinity
- CVE-2026-103100 Denial of service in Infinity
- CVE-2026-1031 Cross-site scripting in Common Licensing
- CVE-2026-103099 Denial of service in Infinity
- CVE-2026-103098 GV-Eye Sensitive information exposure in URL query parameter Vulnerability
- CVE-2026-103097 GV-Eye Relay Payment API Key Vulnerability
- CVE-2026-103096 GV-Eye Hardcoded API Key Vulnerability
- CVE-2026-103094 Cleartext Storage of OAuth Credentials in ServiceNow AI Platform
- CVE-2026-103093 Sandbox Escape via Table Rotation in ServiceNow AI Platform
- CVE-2026-103092 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-103091 Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)
- CVE-2026-103090 Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)
- CVE-2026-103088 Path traversal in handlebars.java
- CVE-2026-103087 Denial of service in gosub-engine
- CVE-2026-103086 WordPress UsersWP plugin <= 1.2.74 - Broken Access Control vulnerability
- CVE-2026-103085 WordPress WP User Manager plugin <= 2.9.20 - Privilege Escalation vulnerability
- CVE-2026-103084 WordPress Premium Addons for Elementor plugin <= 4.11.109 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-103083 Missing authorization in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes
- CVE-2026-103082 WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-103081 WordPress Salevo plugin <= 1.3.0 - Content Injection vulnerability
- CVE-2026-103080 WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability
- CVE-2026-103079 WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-103078 WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-103076 WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-103075 WordPress Hustle plugin <= 7.8.14.2 - Broken Access Control vulnerability
- CVE-2026-103072 WordPress VillaTheme Core plugin <= 1.0.5 - Broken Access Control vulnerability
- CVE-2026-103071 WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability
- CVE-2026-103070 WordPress ShortPixel Image Optimizer plugin <= 6.5.6 - Cross Site Scripting (XSS) vulnerability