Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 227 of 1013.
- CVE-2026-9605 GNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based overflow
- CVE-2026-96044 Microsoft Office SharePoint Elevation of Privilege Vulnerability
- CVE-2026-9604 JeecgBoot AiragModelController access control
- CVE-2026-96039 BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter
- CVE-2026-9603 SourceCodester eDoc Doctor Appointment System delete-session.php authorization
- CVE-2026-9602 Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods
- CVE-2026-96012 IBM Db2 Mirror for i Privilege Escalation
- CVE-2026-9599 Tectite Forms <= 1.3 - Cross-Site Request Forgery to Settings Update
- CVE-2026-95985 Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces
- CVE-2026-9597 Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint
- CVE-2026-95958 JusticeRage Manalyze PE Parser pe.cpp _parse_relocations integer underflow
- CVE-2026-95957 Cross-site scripting in Smart Attendance System with QR Code Scanner
- CVE-2026-9595 webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
- CVE-2026-95943 Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability
- CVE-2026-9594 WP Maps <= 4.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter
- CVE-2026-95930 iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery
- CVE-2026-9593 iDTM FDI Unauthorized Debug Interface Enablement
- CVE-2026-95929 iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection
- CVE-2026-95928 recommenders-team recommenders Dict Loading mind_iterator.py pickle.load deserialization
- CVE-2026-95927 SourceCodester Online Reviewer Management System exam-delete.php sql injection
- CVE-2026-95926 SourceCodester Online Reviewer Management System btn_functions.php update sql injection
- CVE-2026-95925 SourceCodester Online Reviewer Management System btn_functions.php update sql injection
- CVE-2026-95924 SourceCodester Online Reviewer Management System btn_functions.php add sql injection
- CVE-2026-9592 Sensitive Information Disclosure in HTTP header
- CVE-2026-9591 Cross-Site Request Forgery (CSRF) in SimplCommerce News Module
- CVE-2026-95904 Windows Event Logging Service Information Disclosure Vulnerability
- CVE-2026-9590 Missing authorization in Server
- CVE-2026-95897 Dask Loader core.py from_npy_stack deserialization
- CVE-2026-9589 Unblu Spark Authorization Bypass in Configuration Cascade Operations
- CVE-2026-9588 Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal
- CVE-2026-9587 Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal
- CVE-2026-95868 AdithyaYelloju Restaurant-Management-System Search Form display_menu.php mysqli_query sql injection
- CVE-2026-95866 User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field
- CVE-2026-95865 Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter
- CVE-2026-95864 Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter
- CVE-2026-95862 Memory corruption in Cloud Gateways
- CVE-2026-95861 Denial of service in Cloud Gateways
- CVE-2026-9586 Sangoma Switchvox SQL Injection
- CVE-2026-95859 libp2p-rust: Gossipsub GRAFT topics unbounded growth
- CVE-2026-9585 Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal
- CVE-2026-95848 Moquette fails open when configured authentication or authorization classes cannot load
- CVE-2026-95847 Moquette client IDs can cause cross-session H2 durable-queue corruption
- CVE-2026-95846 Moquette publishes Last-Will messages without enforcing write authorization
- CVE-2026-95845 Moquette unbounded per-session message queues allow memory exhaustion
- CVE-2026-95844 Moquette deeply nested MQTT topics can cause stack exhaustion
- CVE-2026-95843 Moquette malformed shared subscriptions can crash command processing
- CVE-2026-95842 Moquette uncaught MQTT command exceptions can terminate shared session event loops
- CVE-2026-9584 code-projects Project Management System Login chk.php sql injection
- CVE-2026-95838 containerd: Unpack DoS via repeated opaque whiteouts
- CVE-2026-95837 containerd CRI plugin: Checkpoint restore bypasses destination security context
- CVE-2026-95835 Missing ownership check on the shared memory object named by the kitty askpass escape code
- CVE-2026-95834 Use after free in the kitty drag and drop protocol when a drag source item is aborted mid-transfer
- CVE-2026-95833 itsourcecode Leave Management System index.php sql injection
- CVE-2026-95832 Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell
- CVE-2026-95831 Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL.
- CVE-2026-95830 theRealSain Pixtream post_upload.php unrestricted upload
- CVE-2026-9583 SourceCodester CET Automated Grading System with AI Predictive Analytics SQL index.php information exposure
- CVE-2026-95829 SQL injection in tduck-platform
- CVE-2026-95828 Mstfakts College-Management-System Authentication server.php session_start session fixiation
- CVE-2026-95820 anirbandutta9 College-Notes-Gallery userprofile.php admin1 unrestricted upload
- CVE-2026-9582 SourceCodester CET Automated Grading System with AI Predictive Analytics cross-site request forgery
- CVE-2026-95819 anirbandutta9 College-Notes-Gallery login.php sql injection
- CVE-2026-95818 AT_SECURE program buffer overflow via $ORIGIN processing
- CVE-2026-95817 DoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- CVE-2026-95816 Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter
- CVE-2026-95815 OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging
- CVE-2026-95814 Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check
- CVE-2026-95813 e621ng before 26.09.16 Open Redirect via URL Parameters
- CVE-2026-95812 ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters
- CVE-2026-95811 Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent
- CVE-2026-9581 JeecgBoot add access control
- CVE-2026-95809 Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter
- CVE-2026-95808 Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter
- CVE-2026-95807 FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
- CVE-2026-95806 MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths
- CVE-2026-95805 MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction
- CVE-2026-9580 JeecgBoot selectDepart LoginController.selectDepart access control
- CVE-2026-9579 JeecgBoot SysUser userEdit user.getUsername access control
- CVE-2026-9577 Post Status Notifier Lite < 1.13.0 - Reflected XSS via mod Parameter
- CVE-2026-9576 Fluent Booking < 2.1.2 - Calendar Manager+ Sensitive Information Disclosure via Attendee Export
- CVE-2026-95754 MISP: Disabled-user check ineffective in pre-authentication TOTP login branch
- CVE-2026-9575 itsourcecode Student Transcript Processing System index.php sql injection
- CVE-2026-9574 itsourcecode Student Transcript Processing System trans.php sql injection
- CVE-2026-9573 itsourcecode Student Transcript Processing System index.php sql injection
- CVE-2026-95721 Authenticated Local Memory Corruption Vulnerability in AOS-8 Web-Based Management Interface
- CVE-2026-95720 Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8
- CVE-2026-9572 GPAC MP4Box media.c Media_GetSample memory leak
- CVE-2026-95719 Authenticated Arbitrary File Deletion Vulnerability leads to Denial-of-Service in AOS-10
- CVE-2026-95718 Authentication Bypass Vulnerability in the PAPI Protocol of AOS-8
- CVE-2026-95717 Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface
- CVE-2026-95716 Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration Changes
- CVE-2026-95715 Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line Interface
- CVE-2026-95714 Authenticated Adjacent Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10
- CVE-2026-95713 Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8 Command Line Interface
- CVE-2026-95712 Unauthenticated Adjacent Sensitive Information Disclosure and Denial-of-Service in AOS-8 via the PAPI Protocol
- CVE-2026-95711 Authentication Bypass Leading to Remote Code Execution in AOS-10 Web-Based Management Interface
- CVE-2026-95710 Unauthenticated Adjacent Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-10 or AOS-8
- CVE-2026-9571 Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost
- CVE-2026-95709 Authenticated Command Injection Vulnerabilities in AOS-10
- CVE-2026-95708 Authenticated File Write leads to Command Injection Vulnerabilities in AOS-10