Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 982 of 1013.
- CVE-2026-103068 WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability
- CVE-2026-103067 WordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-103066 WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability
- CVE-2026-103065 WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability
- CVE-2026-103064 WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-103063 WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-103062 WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-103061 Path traversal in Gleam via unvalidated package application names
- CVE-2026-103060 Path traversal in rebar3 via unvalidated dependency app names
- CVE-2026-103059 Gitea built-in SSH server authentication bypass through key case folding
- CVE-2026-103057 AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints
- CVE-2026-103056 AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR
- CVE-2026-103055 AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret
- CVE-2026-103054 AiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSP
- CVE-2026-103053 AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API
- CVE-2026-103051 Stored i18n XSSs in CentralNotice
- CVE-2026-103050 Stored i18n XSS in MassMessage
- CVE-2026-10305 Memory corruption in rlottie
- CVE-2026-103049 XSS in Cargo's Special:CargoQuery page due to unsanitized table headers
- CVE-2026-103048 Open Redirect in Special:Book
- CVE-2026-103047 XSS through i18n message in CentralAuth
- CVE-2026-103046 WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML
- CVE-2026-103045 XSS in Refreshed skin
- CVE-2026-103044 EasyTimeline should not serve image maps as application/xml
- CVE-2026-103043 anchorme through 3.0.8 Regular Expression Denial of Service
- CVE-2026-103042 LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value
- CVE-2026-103041 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service
- CVE-2026-103040 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service
- CVE-2026-103038 PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host
- CVE-2026-103036 @orpc/json-schema: Prototype injection in smart coercion
- CVE-2026-103030 Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`
- CVE-2026-10303 ServerCo getssl ACME shell script path injection
- CVE-2026-103028 SFTPGo source-side file-pattern filter bypass during copy operations
- CVE-2026-10302 itsourcecode Fees Management System manage_fee.php sql injection
- CVE-2026-103012 Security feature bypass in @anthropic-ai/claude-code
- CVE-2026-103011 Heap-based Buffer Overflow in hMailServer
- CVE-2026-103010 Heap-based Buffer Overflow in hMailServer
- CVE-2026-10301 itsourcecode Fees Management System index.php cross site scripting
- CVE-2026-103009 Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure
- CVE-2026-103008 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-103007 Incorrect Authorization in Elasticsearch Leading to Privilege Escalation
- CVE-2026-103006 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-103005 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
- CVE-2026-103004 next.js cache leak on warm `use cache` handlers accessing root param
- CVE-2026-103001 PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse
- CVE-2026-103000 pypdf: Possible large memory usage when retrieving alphabetical page labels
- CVE-2026-10300 SGLang Inference HTTP Endpoint lora_manager.py assertion
- CVE-2026-1030 Information disclosure in Common Licensing
- CVE-2026-102999 pypdf: Possible long runtimes with large amount of embedded files
- CVE-2026-102998 pypdf: Possible long runtimes when generating appearance streams
- CVE-2026-102997 pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)
- CVE-2026-102996 pypdf: Possible large memory usage when parsing font data
- CVE-2026-102995 pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)
- CVE-2026-102994 pypdf: Possible long runtimes/large memory usage when parsing indirect objects
- CVE-2026-102993 pypdf: Possible large memory usage when retrieving Roman page labels
- CVE-2026-102992 piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
- CVE-2026-102991 Mako: Path traversal via drive-letter URI on Windows in TemplateLookup
- CVE-2026-102990 basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
- CVE-2026-10299 code-projects Online Hospital Management System viewdoctortimings.php resource injection
- CVE-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
- CVE-2026-102988 Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)
- CVE-2026-102986 Missing authorization in plane
- CVE-2026-102985 Plane: Any project member can modify (deactivate) other members' records
- CVE-2026-102984 Astro: Malformed port in the Host header can crash the Node adapter
- CVE-2026-102983 Astro: Netlify Image CDN allowlist bypass enables SSRF
- CVE-2026-102982 Plane: XSS in work item comments
- CVE-2026-102981 Plane: Unauthenticated Workspace Invitation Token Leakage
- CVE-2026-102980 Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope
- CVE-2026-10298 ggml-org whisper.cpp ggml.c whisper_model_load null pointer dereference
- CVE-2026-10297 itsourcecode Fees Management System manage_course.php sql injection
- CVE-2026-10296 itsourcecode Fees Management System ajax.php sql injection
- CVE-2026-10295 SourceCodester Customer Review App review_app.py get_all_reviews denial of service
- CVE-2026-102946 joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json
- CVE-2026-102944 cpp-httplib: Cookie header leaked on cross-origin redirect
- CVE-2026-102941 gomarkdown/markdown IsSafeURL panics on short URLs
- CVE-2026-10294 PackageKit API pk-transaction.c g_file_test improper authorization
- CVE-2026-102938 virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection
- CVE-2026-102937 virtualenv: Command injection via --prompt in activate.bat (batch activator)
- CVE-2026-102930 virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
- CVE-2026-10293 UTT HiPER 1200GW formFireWall strcpy stack-based overflow
- CVE-2026-102925 virtualenv bash and fish activation scripts execute commands embedded in paths
- CVE-2026-102923 SparkyFitness: SSRF via unvalidated custom_url in AI service settings
- CVE-2026-10292 UTT HiPER 1200GW formTaskEdit strcpy stack-based overflow
- CVE-2026-102917 IBM i is Affected By An Improper Privilege Management Vulnerability
- CVE-2026-102916 Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host
- CVE-2026-102915 WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability
- CVE-2026-102914 WordPress Presto Player plugin <= 4.5.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-102913 SourceCodester Car Driving School Management System Master.php save_enrollment sql injection
- CVE-2026-102912 SourceCodester Online Leave Management System page reports sql injection
- CVE-2026-102911 zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection
- CVE-2026-102910 SourceCodester Online Reviewer Management System exam-delete.php sql injection
- CVE-2026-10291 Enderfga claw-orchestrator Session Grep Endpoint embedded-server.ts validateRegex redos
- CVE-2026-102909 SourceCodester Online Reviewer Management System btn_functions.php sql injection
- CVE-2026-102908 SourceCodester Online Reviewer Management System questions-view.php sql injection
- CVE-2026-102906 0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection
- CVE-2026-102904 JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs
- CVE-2026-10290 code-projects Hotel and Tourism Reservation System GET Parameter tour.php sql injection
- CVE-2026-1029 Cross-site scripting in Common Licensing
- CVE-2026-102899 Sentry: Improper authentication on SAML SSO process allows user identity linking
- CVE-2026-102893 Zulip: OpenID Connect authentication ignores the email_verified claim