Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 1004 of 1013.
- CVE-2026-100294 Use of Hard-coded Credentials in Anjvision YSSD-RTMP-H5
- CVE-2026-100293 Improper verification of cryptographic signature in Anjvision YSSD-RTMP-H5
- CVE-2026-100292 Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5
- CVE-2026-100291 Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5
- CVE-2026-10029 Missing authorization in Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets
- CVE-2026-100289 Missing authorization in Server
- CVE-2026-100288 Information disclosure in Server
- CVE-2026-100287 Missing authorization in Server
- CVE-2026-100286 Missing authorization in Server
- CVE-2026-100280 Missing authorization in YouTrack
- CVE-2026-10028 Denial of service in Red Hat Enterprise Linux 10
- CVE-2026-100279 Information disclosure in YouTrack
- CVE-2026-100278 Missing authorization in YouTrack
- CVE-2026-100277 Auth bypass in YouTrack
- CVE-2026-100276 Missing authorization in YouTrack
- CVE-2026-100275 Cross-site scripting in YouTrack
- CVE-2026-100274 Denial of service in YouTrack
- CVE-2026-100273 Missing authorization in YouTrack
- CVE-2026-100272 Missing authorization in YouTrack
- CVE-2026-100271 Missing authorization in YouTrack
- CVE-2026-100270 Missing authorization in YouTrack
- CVE-2026-10027 IBM MQ queue manager is vulnerable to unauthenticated remote code execution
- CVE-2026-100269 Missing authorization in YouTrack
- CVE-2026-100268 Missing authorization in YouTrack
- CVE-2026-100267 Denial of service in YouTrack
- CVE-2026-100266 Missing authorization in Hub
- CVE-2026-100265 Supply chain in Rider
- CVE-2026-100264 Information disclosure in YouTrack
- CVE-2026-100263 Cross-site scripting in YouTrack
- CVE-2026-100262 Missing authorization in YouTrack
- CVE-2026-100261 Missing authorization in YouTrack
- CVE-2026-100260 Auth bypass in YouTrack
- CVE-2026-10026 CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution
- CVE-2026-100259 Missing authorization in YouTrack
- CVE-2026-100258 Missing authorization in YouTrack
- CVE-2026-100257 Server-side request forgery in YouTrack
- CVE-2026-100256 Code injection in IntelliJ IDEA
- CVE-2026-100255 Auth bypass in TeamCity
- CVE-2026-100254 Command injection in TeamCity
- CVE-2026-100253 Code injection in TeamCity
- CVE-2026-100251 Wormhole.app SSRF
- CVE-2026-10025 IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability
- CVE-2026-100248 Business logic in Cosmowarp Contract
- CVE-2026-100245 Stored XSS on Wikibase Special:SetSiteLink via unescaped system message
- CVE-2026-100244 Information disclosure in Mediawiki - CentralAuth Extension
- CVE-2026-100243 Stored XSS in WikiSEO author and image properties on action=info
- CVE-2026-100242 DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)
- CVE-2026-100241 Private change tags exposed to anonymous users via revision-tags-change events
- CVE-2026-100240 TemplateSandbox does not check read permissions for the page being previewed
- CVE-2026-10024 Cross-site scripting in TinyMCE shortcode Addon
- CVE-2026-100238 Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS
- CVE-2026-100237 Stored i18n XSS in the Flow integration of Thanks
- CVE-2026-100236 Dpdk: dpdk: heap out-of-bounds read/write in gso header copy
- CVE-2026-100232 Command injection in Network Security Manager (NSM)
- CVE-2026-100231 Memory corruption in Red Hat Enterprise Linux 10
- CVE-2026-100230 Path traversal in Input Leap
- CVE-2026-10023 Missing authorization in Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
- CVE-2026-100229 Memory corruption in Red Hat Enterprise Linux 10
- CVE-2026-100227 Apache CXF: XML Signature wrapping in JAX-RS XML Security
- CVE-2026-100225 Windows Storage Elevation of Privilege Vulnerability
- CVE-2026-100222 Network Policy Server (NPS) Remote Code Execution Vulnerability
- CVE-2026-100220 Windows Media Video Decoder Remote Code Execution Vulnerability
- CVE-2026-10022 Memory corruption in Chrome
- CVE-2026-100219 Microsoft QUIC Remote Code Execution Vulnerability
- CVE-2026-100218 Remote Desktop Gateway Service Remote Code Execution Vulnerability
- CVE-2026-100217 Windows Group Policy Elevation of Privilege Vulnerability
- CVE-2026-100216 Windows Storage Elevation of Privilege Vulnerability
- CVE-2026-100215 Microsoft Graphics Component Remote Code Execution Vulnerability
- CVE-2026-100214 Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
- CVE-2026-100212 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-100211 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-100210 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-10021 Other in Chrome
- CVE-2026-100209 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-100208 Microsoft Office Outlook Remote Code Execution Vulnerability
- CVE-2026-100207 Azure CycleCloud Remote Code Execution Vulnerability
- CVE-2026-100205 SysInternals Elevation of Privilege Vulnerability
- CVE-2026-100203 Windows Update Service Elevation of Privilege Vulnerability
- CVE-2026-100202 Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
- CVE-2026-100201 Windows Client License Service Elevation of Privilege Vulnerability
- CVE-2026-100200 Windows Update Service Elevation of Privilege Vulnerability
- CVE-2026-10020 Security feature bypass in Chrome
- CVE-2026-1002 Eclipse Vert.x Web static handler file access denial
- CVE-2026-100196 LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- CVE-2026-100193 Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter
- CVE-2026-100192 X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint
- CVE-2026-100190 Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Page
- CVE-2026-10019 Integer overflow in Chrome
- CVE-2026-100187 AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation
- CVE-2026-100186 User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field
- CVE-2026-100185 Cross-site scripting in Directorist: AI-Powered Business Directory, Listings & Classified Ads
- CVE-2026-100184 Cross-site scripting in Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
- CVE-2026-100182 Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor
- CVE-2026-100180 Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comment
- CVE-2026-10018 Integer overflow in Chrome
- CVE-2026-100179 Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()
- CVE-2026-100178 WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter
- CVE-2026-100177 Ail Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar Attachment
- CVE-2026-100176 Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip
- CVE-2026-100175 Postie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink