Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 986 of 1013.
- CVE-2026-10242 itsourcecode Content Management System instructions.php sql injection
- CVE-2026-102414 pbkdf2 rehashes long passwords on every iteration, enabling denial of service
- CVE-2026-102413 Uncaught Exception in Elastic Endpoint Leading to Denial of Service
- CVE-2026-102412 Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure
- CVE-2026-102411 Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
- CVE-2026-102410 Missing Authorization in Kibana Leading to Information Disclosure
- CVE-2026-10241 Server-side request forgery in The server processes these URLs
- CVE-2026-102409 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-102408 Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service
- CVE-2026-102407 Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification
- CVE-2026-102406 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception
- CVE-2026-102404 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
- CVE-2026-102402 Cross-site scripting in Team – Team Members Showcase Plugin
- CVE-2026-102401 Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
- CVE-2026-10240 JeecgBoot test server-side request forgery
- CVE-2026-102399 WordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-102398 WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-102397 WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability
- CVE-2026-102396 WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-102395 WordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-102394 WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-102393 WordPress Starter Templates plugin <= 4.7.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-102392 Deserialization in Extra Product Options For WooCommerce | Custom Product Addons and Fields
- CVE-2026-102391 WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-102390 WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.9 - Broken Access Control vulnerability
- CVE-2026-10239 JeecgBoot edit WordUtil.addImage server-side request forgery
- CVE-2026-102389 WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability
- CVE-2026-102388 WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-102387 WordPress Xserver Migrator plugin <= 1.6.6 - Sensitive Data Exposure vulnerability
- CVE-2026-102386 WordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-102385 WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-102384 WordPress Supreme Modules Lite plugin <= 2.5.63 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-102383 WordPress Lookzy plugin <= 1.1.14 - Broken Access Control vulnerability
- CVE-2026-102382 WordPress Majestic Support plugin <= 1.2.0 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-102381 WordPress Majestic Support plugin <= 1.2.0 - Broken Access Control vulnerability
- CVE-2026-102379 WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability
- CVE-2026-102378 WordPress Parallax Section block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-102377 WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability
- CVE-2026-102376 WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-102375 WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability
- CVE-2026-102374 GestSup before 3.2.62 Stored XSS via Double-Decoded Email Subject in OAuth IMAP Connector
- CVE-2026-102373 GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter
- CVE-2026-102372 GestSup before 3.2.61 Stored XSS via Email Body in LOGIN IMAP Connector
- CVE-2026-102371 wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments
- CVE-2026-102370 Physical UART Access Leading to an Unauthenticated Root Shell in TP-Link Kasa EC70 and EC71
- CVE-2026-10237 SourceCodester Water Billing Management System User Management manage_user sql injection
- CVE-2026-102369 Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200
- CVE-2026-102368 Plaintext Storage of a Device-Specific Private Key in Tapo S505 Firmware
- CVE-2026-102367 mall4j through 4.0 Insufficient Session Expiration via Token Refresh
- CVE-2026-102366 mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints
- CVE-2026-102365 mall4j through 4.0 Missing Authorization in Admin User Address Endpoints
- CVE-2026-102364 mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API
- CVE-2026-102363 mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number
- CVE-2026-102362 mall4j through 4.0 Missing Authentication in Product Review Deletion
- CVE-2026-102361 mall4j through 4.0 Missing Authentication in Password Update Endpoint
- CVE-2026-102360 lib0 `readUint8Array` performs an unbounded read past the end of the decoder’s view, disclosing adjacent process memory
- CVE-2026-10236 SourceCodester Water Billing Management System User Management Endpoint Users.php save improper authorization
- CVE-2026-102354 BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker
- CVE-2026-10235 CodeAstro Ingredients Stock Management System stock_manager.php sql injection
- CVE-2026-102342 ammonia allows stored XSS through unsanitized SVG animate and set attributes
- CVE-2026-10234 Mettle sendportal Campaign webview cross site scripting
- CVE-2026-102335 Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config
- CVE-2026-102334 Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection
- CVE-2026-102333 httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL
- CVE-2026-102332 Dozzle before 11.1.2 Path Traversal via Log ZIP Download
- CVE-2026-102331 Memory corruption in Chrome
- CVE-2026-102330 Security feature bypass in Chrome
- CVE-2026-10233 Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_sequence_infos out-of-bounds
- CVE-2026-102329 Cross-site scripting in Chrome
- CVE-2026-102328 Memory corruption in Chrome
- CVE-2026-102327 Missing authorization in Chrome
- CVE-2026-102326 Memory corruption in Chrome
- CVE-2026-102325 Information disclosure in Chrome
- CVE-2026-102324 Use after free in Chrome
- CVE-2026-102323 Memory corruption in Chrome
- CVE-2026-102322 Security feature bypass in Chrome
- CVE-2026-102321 Memory corruption in Chrome
- CVE-2026-102320 Missing authorization in Chrome
- CVE-2026-10232 Assimp ASE File scene.cpp ~aiNode use after free
- CVE-2026-102319 Information disclosure in Chrome
- CVE-2026-102318 Memory corruption in Chrome
- CVE-2026-102317 Privilege escalation in Chrome
- CVE-2026-102316 Use after free in Chrome
- CVE-2026-102315 Information disclosure in Chrome
- CVE-2026-102314 Other in Chrome
- CVE-2026-102313 Information disclosure in Chrome
- CVE-2026-102312 Other in Chrome
- CVE-2026-102311 Information disclosure in Chrome
- CVE-2026-102310 Missing authorization in Chrome
- CVE-2026-10231 Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp extract_anim_value heap-based overflow
- CVE-2026-102309 Use after free in Chrome
- CVE-2026-102308 Use after free in Chrome
- CVE-2026-102307 Information disclosure in Chrome
- CVE-2026-102306 Use after free in Chrome
- CVE-2026-102305 Other in Chrome
- CVE-2026-102304 Use after free in Chrome
- CVE-2026-102303 Information disclosure in Chrome
- CVE-2026-102302 Memory corruption in Chrome
- CVE-2026-102301 Memory corruption in Chrome
- CVE-2026-102300 Information disclosure in Chrome