Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 1006 of 1013.
- CVE-2026-0972 HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT
- CVE-2026-0971 GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout
- CVE-2026-0969 Arbitrary code execution in React server-side rendering of untrusted MDX content
- CVE-2026-0968 Libssh: libssh: denial of service due to malformed sftp message
- CVE-2026-0967 Libssh: libssh: denial of service via inefficient regular expression processing
- CVE-2026-0966 Libssh: libssh: denial of service via zero-length input in ssh_get_hexa()
- CVE-2026-0965 Libssh: libssh: denial of service via improper configuration file handling
- CVE-2026-0964 Libssh: improper sanitation of paths received from scp servers
- CVE-2026-0963 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller
- CVE-2026-0962 Out-of-bounds Write in Wireshark
- CVE-2026-0961 Out-of-bounds Write in Wireshark
- CVE-2026-0960 Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
- CVE-2026-0959 Out-of-bounds Write in Wireshark
- CVE-2026-0958 Interpretation Conflict in GitLab
- CVE-2026-0957 Out-Of-Bounds Write in Digilent DASYLab
- CVE-2026-0956 Out-Of-Bounds Read in Digilent DASYLab
- CVE-2026-0955 Out-Of-Bounds Read When Opening a Corrupt File in Digilent DASYLab
- CVE-2026-0954 Out-Of-Bounds Write When Opening a Corrupt DSB File in Digilent DASYLab
- CVE-2026-0953 Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login
- CVE-2026-0950 Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data
- CVE-2026-0949 Cross-site scripting in Postgres Enterprise Manager (PEM)
- CVE-2026-0948 Microsoft Entra ID SSO Login - Critical - Access bypass - SA-CONTRIB-2026-005
- CVE-2026-0947 AT Internet Piano Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-004
- CVE-2026-0946 AT Internet SmartTag - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-003
- CVE-2026-0945 Role Delegation - Moderately critical - Access bypass - SA-CONTRIB-2026-002
- CVE-2026-0944 Group invite - Moderately critical - Access bypass - SA-CONTRIB-2026-001
- CVE-2026-0943 Null dereference in HarfBuzz::Shaper
- CVE-2026-0942 Missing authorization in Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit
- CVE-2026-0940 Other in ThinkPad P14s Gen 5 BIOS
- CVE-2026-0939 Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.2 - Unauthenticated Order Status Manipulation
- CVE-2026-0936 Insertion of Sensitive Information into Logfile
- CVE-2026-0934 Incorrect Authorization in GitLab
- CVE-2026-0933 OS Command Injection in `wrangler pages deploy`
- CVE-2026-0932 Server-side request forgery in M-Files Server
- CVE-2026-0931 Denial-of-service vulnerability in M-Files Server
- CVE-2026-0930 Potential wolfSSHd Buffer out-of-bounds Read on Windows Handling Terminal Resize
- CVE-2026-0929 RegistrationMagic < 6.0.7.2 - Subscriber+ Form Creation
- CVE-2026-0927 File upload in KiviCare – Clinic & Patient Management System (EHR)
- CVE-2026-0926 Prodigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]
- CVE-2026-0925 Tanium addressed an improper input validation vulnerability in Discover.
- CVE-2026-0924 BuhoCleaner 1.15.2 - Local Privilege Escalation via PID reuse attack
- CVE-2026-0920 Privilege escalation in LA-Studio Element Kit for Elementor
- CVE-2026-0919 Unauthenticated Denial of Service via Oversized URL in HTTP Parser on TP-Link Tapo C210, C220 & C520WS
- CVE-2026-0918 Null Pointer Dereference in Tapo SmartCam HTTP Service on TP-Link Tapo C220 & C520WS
- CVE-2026-0916 Cross-site scripting in Related Posts by Taxonomy
- CVE-2026-0915 getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler
- CVE-2026-0914 Cross-site scripting in WP DSGVO Tools (GDPR)
- CVE-2026-0913 User Submitted Posts <= 20260110 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' Shortcode
- CVE-2026-0912 Toret Manager <= 1.2.7 - Authenticated (Subscriber+) Arbitrary Options Update via AJAX actions
- CVE-2026-0911 Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import
- CVE-2026-0910 wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection
- CVE-2026-0909 Missing authorization in WP ULike – Like & Dislike Buttons for Engagement and Feedback
- CVE-2026-0908 Use after free in Chrome
- CVE-2026-0907 Other in Chrome
- CVE-2026-0906 Other in Chrome
- CVE-2026-0905 Information disclosure in Chrome
- CVE-2026-0904 Security feature bypass in Chrome
- CVE-2026-0903 Security feature bypass in Chrome
- CVE-2026-0902 Memory corruption in Chrome
- CVE-2026-0901 Other in Chrome
- CVE-2026-0900 Memory corruption in Chrome
- CVE-2026-0899 Memory corruption in Chrome
- CVE-2026-0898 Other in Pega Robot Studio
- CVE-2026-0897 Denial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata
- CVE-2026-0895 Insecure Deserialization in extension "Mailqueue" (mailqueue)
- CVE-2026-0894 Cross-site scripting in Content Blocks (Custom Post Widget)
- CVE-2026-0893 Uncleared Password Keystrokes Vulnerability
- CVE-2026-0892 Memory safety bugs fixed in Firefox 147 and Thunderbird 147
- CVE-2026-0891 Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147
- CVE-2026-0890 Spoofing issue in the DOM: Copy & Paste and Drag & Drop component
- CVE-2026-0889 Denial-of-service in the DOM: Service Workers component
- CVE-2026-0888 Information disclosure in the XML component
- CVE-2026-0887 Clickjacking issue, information disclosure in the PDF Viewer component
- CVE-2026-0886 Incorrect boundary conditions in the Graphics component
- CVE-2026-0885 Use-after-free in the JavaScript: GC component
- CVE-2026-0884 Use-after-free in the JavaScript Engine component
- CVE-2026-0883 Information disclosure in the Networking component
- CVE-2026-0882 Use-after-free in the IPC component
- CVE-2026-0881 Sandbox escape in the Messaging System component
- CVE-2026-0880 Sandbox escape due to integer overflow in the Graphics component
- CVE-2026-0879 Sandbox escape due to incorrect boundary conditions in the Graphics component
- CVE-2026-0878 Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- CVE-2026-0877 Mitigation bypass in the DOM: Security component
- CVE-2026-0875 MODEL File Parsing Out-of-Bounds Write
- CVE-2026-0874 CATPART File Parsing Out-of-Bounds Write
- CVE-2026-0873 Privilege Elevation in Ercom Cryptobox administration console
- CVE-2026-0872 Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon
- CVE-2026-0871 Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators
- CVE-2026-0870 GIGABYTE｜MacroHub - Local Privilege Escalation
- CVE-2026-0869 Application User custom defined accounts are not properly password protected in Brocade ASCG 3.4.0
- CVE-2026-0868 EMC Scheduling Manager <= 4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via calendly Shortcode
- CVE-2026-0867 Essential Widgets <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
- CVE-2026-0865 wsgiref.headers.Headers allows header newline injection
- CVE-2026-0864 Configuration Injection via Carriage Return (\r) in write() method
- CVE-2026-0863 Sandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host.
- CVE-2026-0862 Save as PDF Plugin by PDFCrowd <= 4.5.5 - Reflected Cross-Site Scripting via options
- CVE-2026-0861 Integer overflow in memalign leads to heap corruption
- CVE-2026-0860 Mali GPU Kernel Driver allows access to sensitive kernel information
- CVE-2026-0859 TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
- CVE-2026-0858 PlantUML is vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams