Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 1007 of 1013.
- CVE-2026-0857 Weak cryptography in Meona Client
- CVE-2026-0856 Privilege escalation in Meona Client
- CVE-2026-0855 Merit LILIN｜IP Camera - OS Command Injection
- CVE-2026-0854 Merit LILIN｜NVR - OS Command Injection
- CVE-2026-0853 A-Plus Video Technologies｜NVR - Sensitive Data Exposure
- CVE-2026-0852 code-projects Online Music Site AdminUpdateUser.php sql injection
- CVE-2026-0851 code-projects Online Music Site AdminAddUser.php sql injection
- CVE-2026-0850 code-projects Intern Membership Management System delete_activity.php sql injection
- CVE-2026-0849 crypto: ATAES132A response length allows stack buffer overflow
- CVE-2026-0848 Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading
- CVE-2026-0847 Path Traversal in nltk/nltk
- CVE-2026-0846 Arbitrary File Read via Absolute Path Input in nltk.util.filestring()
- CVE-2026-0845 WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update
- CVE-2026-0844 Simple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_field
- CVE-2026-0843 jiujiujia/victor123/wxw850227 jjjfood/jjjshop_food index sql injection
- CVE-2026-0842 Flycatcher Toys smART Sketcher Bluetooth Low Energy missing authentication
- CVE-2026-0841 UTT 进取 520W formPictureUrl strcpy buffer overflow
- CVE-2026-0840 UTT 进取 520W formConfigNoticeConfig strcpy buffer overflow
- CVE-2026-0839 UTT 进取 520W APSecurity strcpy buffer overflow
- CVE-2026-0838 UTT 进取 520W ConfigWirelessBase strcpy buffer overflow
- CVE-2026-0837 UTT 进取 520W formFireWall strcpy buffer overflow
- CVE-2026-0836 UTT 进取 520W formConfigFastDirectionW strcpy buffer overflow
- CVE-2026-0835 Cross-site scripting in Sterling B2B Integrator
- CVE-2026-0834 Logic Vulnerability on TP-Link Archer C20, Archer AX53 and TL-WR841N v13
- CVE-2026-0833 Team Section Block <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network Link
- CVE-2026-0832 Missing authorization in New User Approve
- CVE-2026-0831 Templately <= 3.4.8 - Unauthenticated Limited Arbitrary JSON File Write
- CVE-2026-0830 Command Injection in Kiro GitLab Merge Request Helper
- CVE-2026-0829 Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending
- CVE-2026-0828 Kernel driver vulnerability in Safetica Endpoint Client
- CVE-2026-0827 Privilege escalation in Diagnostics
- CVE-2026-0826 Poly Voice – Possible Remote Control of Certain Poly Devices
- CVE-2026-0825 Missing authorization in Database for Contact Form 7, WPforms, Elementor forms
- CVE-2026-0824 questdb ui Web Console cross site scripting
- CVE-2026-0822 quickjs-ng quickjs quickjs.c js_typed_array_sort heap-based overflow
- CVE-2026-0821 quickjs-ng quickjs quickjs.c js_typed_array_constructor heap-based overflow
- CVE-2026-0820 Missing authorization in RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress
- CVE-2026-0819 Stack buffer overflow in PKCS7 SignedData encoding with custom signed attributes
- CVE-2026-0818 CSS-based exfiltration of the content from partially encrypted emails when allowing remote content
- CVE-2026-0817 CampaignEvents API missing authorization exposes meeting and chat URLs
- CVE-2026-0816 All push notification for WP <= 1.5.3 - Authenticated (Administrator+) SQL Injection via 'delete_id' Parameter
- CVE-2026-0815 Category Image <= 2.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'tag-image' Parameter
- CVE-2026-0814 Advanced CF7 DB <= 2.0.9 - Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel Export
- CVE-2026-0813 Short Link <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Administration Settings Page
- CVE-2026-0812 LinkedIn SC <= 1.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Page
- CVE-2026-0811 Advanced CF7 DB <= 2.0.9 - Cross-Site Request Forgery to Form Entry Deletion
- CVE-2026-0810 Gix-date: gix-date: undefined behavior due to invalid string generation
- CVE-2026-0809 Weak KSeF token encoding in Streamsoft Prestiż
- CVE-2026-0808 Spin Wheel <= 2.1.0 - Unauthenticated Client-Side Prize Manipulation via 'prize_index' Parameter
- CVE-2026-0807 Frontis Blocks <= 1.1.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter
- CVE-2026-0806 WP-ClanWars <= 2.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
- CVE-2026-0805 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller
- CVE-2026-0804 Path traversal in AXIS OS
- CVE-2026-0803 PHPGurukul Online Course Registration System enroll.php sql injection
- CVE-2026-0802 Command injection in AXIS OS
- CVE-2026-0800 Cross-site scripting in User Submitted Posts – Enable Users to Submit Posts from the Front End
- CVE-2026-0799 OOBR and OOBW in libpcap before 1.10.7
- CVE-2026-0798 Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation
- CVE-2026-0797 GIMP ICO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-0796 ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability
- CVE-2026-0795 ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability
- CVE-2026-0794 ALGO 8180 IP Audio Alerter SIP Use-After-Free Remote Code Execution Vulnerability
- CVE-2026-0793 ALGO 8180 IP Audio Alerter InformaCast Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-0792 ALGO 8180 IP Audio Alerter SIP INVITE Alert-Info Stack-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-0791 ALGO 8180 IP Audio Alerter SIP INVITE Replaces Stack-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-0790 ALGO 8180 IP Audio Alerter Web UI Direct Request Information Disclosure Vulnerability
- CVE-2026-0789 Information disclosure in 8180 IP Audio Alerter
- CVE-2026-0788 ALGO 8180 IP Audio Alerter Web UI Persistent Cross-Site Scripting Vulnerability
- CVE-2026-0787 ALGO 8180 IP Audio Alerter SAC Command Injection Remote Code Execution Vulnerability
- CVE-2026-0786 ALGO 8180 IP Audio Alerter SCI Command Injection Remote Code Execution Vulnerability
- CVE-2026-0785 ALGO 8180 IP Audio Alerter API Command Injection Remote Code Execution Vulnerability
- CVE-2026-0784 ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability
- CVE-2026-0783 ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability
- CVE-2026-0782 ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability
- CVE-2026-0781 ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability
- CVE-2026-0780 ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability
- CVE-2026-0779 ALGO 8180 IP Audio Alerter Ping Command Injection Remote Code Execution Vulnerability
- CVE-2026-0778 Enel X JuiceBox 40 Telnet Service Missing Authentication Remote Code Execution Vulnerability
- CVE-2026-0777 Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability
- CVE-2026-0776 Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
- CVE-2026-0775 npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability
- CVE-2026-0774 WatchYourLAN Configuration Page Argument Injection Remote Code Execution Vulnerability
- CVE-2026-0773 Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2026-0772 Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2026-0771 Langflow PythonFunction Code Injection Remote Code Execution Vulnerability
- CVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere
- CVE-2026-0769 Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability
- CVE-2026-0768 Langflow code Code Injection Remote Code Execution Vulnerability
- CVE-2026-0764 GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2026-0763 GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2026-0762 GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2026-0761 Foundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution Vulnerability
- CVE-2026-0760 Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2026-0759 Katana Network Development Starter Kit executeCommand Command Injection Remote Code Execution Vulnerability
- CVE-2026-0758 mcp-server-siri-shortcuts shortcutName Command Injection Privilege Escalation Vulnerability
- CVE-2026-0757 MCP Manager for Claude Desktop execute-command Command Injection Sandbox Escape Vulnerability
- CVE-2026-0756 github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability
- CVE-2026-0755 gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability
- CVE-2026-0754 SIP Service Providers – Possible Impersonation of Poly Voice Device
- CVE-2026-0753 Super Simple Contact Form <= 1.6.2 - Reflected Cross-Site Scripting via 'sscf_name' Parameter