Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 226 of 1013.
- CVE-2026-96277 Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception
- CVE-2026-96276 Flatpak: flatpak: arbitrary write in host context via flatpak build-init
- CVE-2026-96275 Flatpak: flatpak: arbitrary write access as root via extra-data extraction
- CVE-2026-96274 Uncaught exception in Baicells Nova 430H
- CVE-2026-96273 Ghidra before 12.1.4 Denial of Service via Unreleased Lock in OptionsDB
- CVE-2026-96272 ClipBucket v5 before 5.5.3-#182 SQL Injection via search_result.php
- CVE-2026-96271 Photoview through 2.4.0 Authorization Bypass via shareAlbum
- CVE-2026-96270 Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter
- CVE-2026-9627 UTT HiPER 1200GW Web Management setSysAdm strcpy buffer overflow
- CVE-2026-96269 Code injection in Emacs
- CVE-2026-96268 Cross-site scripting in Awesome Support – WordPress HelpDesk & Support Plugin
- CVE-2026-96267 WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameter
- CVE-2026-96266 IBM Power Systems Firmware Buffer Overflow
- CVE-2026-96265 IBM Power Systems Firmware Improper Memory Buffer Restriction
- CVE-2026-96264 IBM Power Systems Firmware Buffer Overflow
- CVE-2026-96263 IBM Power Systems Firmware Buffer Overflow
- CVE-2026-96262 IBM Power Systems Firmware Buffer Overflow
- CVE-2026-96261 IBM Power Systems Firmware Buffer Overflow
- CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user
- CVE-2026-9626 JSON API User <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter
- CVE-2026-96259 Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator
- CVE-2026-96258 onSite internet GmbH Auktion NG Auktionssoftware Public Password Reset Endpoint forgotpasswd.html cross site scripting
- CVE-2026-96257 Fast FAC1203R Gigabit Edition Device Discovery Service copy_msg_element stack-based overflow
- CVE-2026-96256 Gutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute
- CVE-2026-96255 Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug Log
- CVE-2026-96254 Windows USB Print Driver Elevation of Privilege Vulnerability
- CVE-2026-96253 Windows USB Print Driver Elevation of Privilege Vulnerability
- CVE-2026-96252 Active Directory Federation Services (AD FS) Spoofing Vulnerability
- CVE-2026-96251 Microsoft PowerShell Remote Code Execution Vulnerability
- CVE-2026-96250 Windows USB Print Driver Elevation of Privilege Vulnerability
- CVE-2026-9625 RSLinx Classic® - Multiple Vulnerabilities
- CVE-2026-96249 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
- CVE-2026-96248 Windows Host Guardian Service Denial of Service Vulnerability
- CVE-2026-96247 Windows Kernel-Mode Drivers Information Disclosure Vulnerability
- CVE-2026-96246 Network Policy Server (NPS) Information Disclosure Vulnerability
- CVE-2026-96245 Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
- CVE-2026-96244 Windows Internal System User Profile Elevation of Privilege Vulnerability
- CVE-2026-96243 Windows WalletService Elevation of Privilege Vulnerability
- CVE-2026-9624 RSLinx Classic® - Multiple Vulnerabilities
- CVE-2026-96238 .NET Security Feature Bypass Vulnerability
- CVE-2026-96237 .NET Remote Code Execution Vulnerability
- CVE-2026-96236 ASP.NET Core Denial of Service Vulnerability
- CVE-2026-96235 .NET Remote Code Execution Vulnerability
- CVE-2026-96234 .NET Information Disclosure Vulnerability
- CVE-2026-96233 ASP.NET Core Denial of Service Vulnerability
- CVE-2026-96232 .NET Information Disclosure Vulnerability
- CVE-2026-96231 .NET Elevation of Privilege Vulnerability
- CVE-2026-96230 ASP.NET Core Remote Code Execution Vulnerability
- CVE-2026-96229 .NET Information Disclosure Vulnerability
- CVE-2026-96228 SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover
- CVE-2026-96227 Piotnet Forms <= 1.0.30 - Unauthenticated Stored XSS via File Upload
- CVE-2026-96225 .NET Elevation of Privilege Vulnerability
- CVE-2026-96224 .NET Remote Code Execution Vulnerability
- CVE-2026-96223 Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2026-96222 Active Directory Federation Services (AD FS) Spoofing Vulnerability
- CVE-2026-96220 Windows Assigned Access Elevation of Privilege Vulnerability
- CVE-2026-9622 RSLinx Classic® - Multiple Vulnerabilities
- CVE-2026-96219 Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability
- CVE-2026-96218 Windows Update Stack Tampering Vulnerability
- CVE-2026-96217 Windows NTFS Elevation of Privilege Vulnerability
- CVE-2026-96216 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-96215 Windows Autopilot Elevation of Privilege Vulnerability
- CVE-2026-9621 RSLinx Classic® - Multiple Vulnerabilities
- CVE-2026-96209 Windows Network File System Elevation of Privilege Vulnerability
- CVE-2026-96207 Microsoft Partner Center Elevation of Privilege Vulnerability
- CVE-2026-96206 Windows Subsystem for Linux Information Disclosure Vulnerability
- CVE-2026-96204 Azure Arc Elevation of Privilege Vulnerability
- CVE-2026-96203 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- CVE-2026-96202 Windows Raw Image Extension Remote Code Execution Vulnerability
- CVE-2026-96200 Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback
- CVE-2026-9620 WP Latest Posts <= 5.0.11 - Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attribute
- CVE-2026-96199 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-96198 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-96196 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- CVE-2026-96192 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-9619 Missing authorization in Reviews and Rating – Docplanner
- CVE-2026-96188 Microsoft PowerToys Elevation of Privilege Vulnerability
- CVE-2026-96187 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- CVE-2026-96186 Microsoft Windows Media Foundation Elevation of Privilege Vulnerability
- CVE-2026-96185 Microsoft Exchange Online Remote Code Execution Vulnerability
- CVE-2026-96183 Windows Health and Optimized Experiences Service Information Disclosure Vulnerability
- CVE-2026-9618 PeachPay <= 1.120.46 - Cross-Site Request Forgery to Stripe Unlink
- CVE-2026-96173 Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR
- CVE-2026-9617 PostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k_anonymity() function
- CVE-2026-9616 Missing authorization in Generate Security.txt
- CVE-2026-9615 Missing authorization in Flex Import
- CVE-2026-9614 Missing authorization in Neurons for ITSM (Cloud)
- CVE-2026-9613 Missing authorization in Datalogics Ecommerce Delivery – Datalogics
- CVE-2026-9612 WhatsOrder <= 1.0.1 - Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs
- CVE-2026-96119 IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI
- CVE-2026-96118 Windows Graphics Kernel Elevation of Privilege Vulnerability
- CVE-2026-96113 Windows Domain Name Service Remote Code Execution Vulnerability
- CVE-2026-96108 Desktop Window Manager Elevation of Privilege Vulnerability
- CVE-2026-9610 Multiple Vulnerabilities in IBM Datacap
- CVE-2026-96096 Windows Media Player Remote Code Execution Vulnerability
- CVE-2026-9609 QianFox FoxCMS Admin.php edit password recovery
- CVE-2026-9608 QianFox FoxCMS Administrator Backend edit cross site scripting
- CVE-2026-96071 Windows Media Remote Code Execution Vulnerability
- CVE-2026-9607 itsourcecode Courier Management System parcel_list.php sql injection
- CVE-2026-9606 itsourcecode Courier Management System manage_user.php sql injection