Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 228 of 1013.
- CVE-2026-95707 Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8
- CVE-2026-95706 Authenticated Command Injection Vulnerabilities in AOS-8
- CVE-2026-95705 Authenticated Command Injection Vulnerabilities in AOS-8
- CVE-2026-95704 Authenticated Remote Code Execution allows Unauthorized System Control in Wireless Network Management Interface
- CVE-2026-95703 MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name
- CVE-2026-95702 Code Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFile
- CVE-2026-95701 MISP Path Traversal via Organization Name in Org-Statistics Logo Check
- CVE-2026-9570 Taskbuilder < 5.0.8 - Reflected XSS via Shortcode
- CVE-2026-95699 MrSteam iSteamX Improper Isolation or Compartmentalization
- CVE-2026-95698 MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name
- CVE-2026-95697 MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata
- CVE-2026-95696 IBM WebSphere Application Server Liberty Denial of Service
- CVE-2026-95695 IBM WebSphere Application Server Liberty Incorrect Authorization
- CVE-2026-95693 MISP Information Disclosure via Forged Upload Path
- CVE-2026-95687 Privilege escalation in WPC Shop as a Customer for WooCommerce
- CVE-2026-95686 Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter
- CVE-2026-95685 MISP Missing Authorization on replaceSuggestionInReport Event Report Action
- CVE-2026-95684 Cross-site scripting in VikBooking Hotel Booking Engine & PMS
- CVE-2026-95683 MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
- CVE-2026-95682 MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View
- CVE-2026-95680 IBM WebSphere Application Server is affected by an authorization bypass
- CVE-2026-9568 ThingsBoard YAML provision getGatewayDockerComposeFile code injection
- CVE-2026-95679 MISP Unauthenticated Blind SSRF via XML Body Processing
- CVE-2026-95676 AuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Authentication Bypass
- CVE-2026-95675 D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface
- CVE-2026-95674 MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation
- CVE-2026-95671 MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add
- CVE-2026-95670 No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect
- CVE-2026-9567 GPAC MP4Box isom_intern.c MergeFragment null pointer dereference
- CVE-2026-95667 MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials
- CVE-2026-95666 Unbounded post ID array in the bulk reactions endpoint allows denial of service
- CVE-2026-95665 MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON
- CVE-2026-95664 Code injection in Apache Camel
- CVE-2026-95663 Auth bypass in Apache Camel
- CVE-2026-95662 Multiple vulnerabilities in the Repasat application
- CVE-2026-95661 MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List
- CVE-2026-95660 Moonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injection
- CVE-2026-9566 teableio teable Sign-up LoginPage.tsx cross site scripting
- CVE-2026-95659 MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread
- CVE-2026-95658 MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules
- CVE-2026-95657 dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting
- CVE-2026-95656 dgtlmoon changedetection.io Preview Endpoint __init__.py add_watch_ui_snapshot server-side request forgery
- CVE-2026-95655 Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel
- CVE-2026-95654 Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token
- CVE-2026-95653 Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token
- CVE-2026-9565 haojing8312 WorkClaw Blacklist bash.rs is_dangerous os command injection
- CVE-2026-95641 Photoshop Desktop | Out-of-bounds Write (CWE-787)
- CVE-2026-95640 Photoshop Desktop | NULL Pointer Dereference (CWE-476)
- CVE-2026-9564 SourceCodester/oretnom23 Hospitals Patient Records Management System view_patient cross site scripting
- CVE-2026-95639 Photoshop Desktop | Incorrect Authorization (CWE-863)
- CVE-2026-95638 Photoshop Desktop | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-95637 Photoshop Desktop | Out-of-bounds Write (CWE-787)
- CVE-2026-95636 Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-95635 Photoshop Desktop | Double Free (CWE-415)
- CVE-2026-95634 CAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918)
- CVE-2026-95633 CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)
- CVE-2026-95632 CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)
- CVE-2026-95631 Adobe Commerce | Improper Input Validation (CWE-20)
- CVE-2026-95630 Adobe Commerce | Improper Input Validation (CWE-20)
- CVE-2026-9563 Denial of service in Eclipse Parsson
- CVE-2026-95629 Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory
- CVE-2026-95628 Path traversal in Apache Camel
- CVE-2026-95627 Tauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlled recursion
- CVE-2026-95626 Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains
- CVE-2026-95625 Tauri framework v2 missing updater signature version number validation can be exploited into forced downgrade
- CVE-2026-95624 Tauri framework v2 malicious downgrade via allow_downgrades from frontend code
- CVE-2026-95623 Tauri framework v2 SSRF Protection Bypass via HTTP Redirects
- CVE-2026-95620 Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt
- CVE-2026-9562 sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard access control
- CVE-2026-95619 Gcc: libstdc++ integer overflow in `new` operator
- CVE-2026-95616 Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions
- CVE-2026-95610 WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability
- CVE-2026-9561 Security feature bypass in Eclipse Kura
- CVE-2026-95609 WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-95608 WordPress HUSKY plugin <= 1.4.3.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-95607 WordPress WPLMS theme <= 4.973 - SQL Injection vulnerability
- CVE-2026-95606 WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability
- CVE-2026-95605 WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability
- CVE-2026-95604 WordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerability
- CVE-2026-95603 WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability
- CVE-2026-95602 WordPress YITH WooCommerce Request A Quote plugin < 4.46.1 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-95601 WordPress Product Filter by WBW plugin <= 3.1.7 - SQL Injection vulnerability
- CVE-2026-95600 WordPress TrustedLogin Connector plugin <= 2.0.3 - Sensitive Data Exposure vulnerability
- CVE-2026-9560 Privilege escalation in OpenVPN Connect
- CVE-2026-95599 WordPress Taskbuilder plugin <= 6.0.5 - SQL Injection vulnerability
- CVE-2026-95598 WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-95597 WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability
- CVE-2026-95596 WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-95595 Cross-site scripting in Disable and Remove Google Fonts | GDPR & DSGVO friendly
- CVE-2026-95594 WordPress SMS Alert Order Notifications plugin <= 4.0.0 - Privilege Escalation vulnerability
- CVE-2026-95593 WordPress Ultimeter plugin <= 3.0.8 - SQL Injection vulnerability
- CVE-2026-95592 WordPress Team plugin <= 6.0.0 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-95591 WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-95590 WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability
- CVE-2026-9559 Mautic vulnerable to Path Traversal via Campaign Import
- CVE-2026-95589 WordPress Deposits and Partial Payments for WooCommerce plugin <= 4.0.1 - Broken Access Control vulnerability
- CVE-2026-95588 WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deletion vulnerability
- CVE-2026-95587 WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability
- CVE-2026-95586 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-9558 Mautic has Server-Side Template Injection (SSTI) in Theme Templates