Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 232 of 1013.
- CVE-2026-94653 Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)
- CVE-2026-94652 Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back
- CVE-2026-94651 Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error
- CVE-2026-94650 Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)
- CVE-2026-9465 Tiandy Easy7 Integrated Management Platform GetDBDataEx.jsp sql injection
- CVE-2026-94648 Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound
- CVE-2026-94646 Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)
- CVE-2026-94645 Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound
- CVE-2026-94644 Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound
- CVE-2026-94642 Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception
- CVE-2026-94641 WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-94640 Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service
- CVE-2026-9464 YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery
- CVE-2026-94639 Denial of service in Apache Thrift
- CVE-2026-94638 Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`
- CVE-2026-94637 Apache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frame
- CVE-2026-94636 Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up
- CVE-2026-94635 Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name
- CVE-2026-94634 Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default
- CVE-2026-94633 Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length
- CVE-2026-94632 WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-9463 Edimax EW-7438RPn formLicence stack-based overflow
- CVE-2026-94627 vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision
- CVE-2026-94626 vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size
- CVE-2026-94625 vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders
- CVE-2026-94624 vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions
- CVE-2026-94623 vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure
- CVE-2026-94622 vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata
- CVE-2026-94621 AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction
- CVE-2026-94620 Path traversal in classroom50
- CVE-2026-9462 Edimax EW-7438RPn formWpsProxyEnable stack-based overflow
- CVE-2026-94613 authentik: Denial of Service via Document Type Declarations in SAML Messages
- CVE-2026-94612 authentik: Authentication bypass via assertion confusion in SAML sources
- CVE-2026-94611 authentik: Stored credentials are readable with view permission alone
- CVE-2026-9461 Edimax EW-7438RPn formRadius stack-based overflow
- CVE-2026-94609 authentik: Privilege Escalation to Superuser via Group Hierarchy
- CVE-2026-94606 authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage
- CVE-2026-94603 Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
- CVE-2026-9460 Edimax EW-7438RPn formAccept stack-based overflow
- CVE-2026-94594 Armatura LLC Armatura One Insertion of Sensitive Information into Log File
- CVE-2026-94593 Armatura LLC Armatura One Insertion of Sensitive Information into Log File
- CVE-2026-94592 Armatura LLC Armatura One Use of Hard-coded Credentials
- CVE-2026-94591 Armatura LLC Armatura One Use of Hard-coded Cryptographic Key
- CVE-2026-94590 WordPress Sell Downloads plugin <= 1.2.3 - Broken Access Control vulnerability
- CVE-2026-9459 Edimax EW-7438RPn formConnectionSetting stack-based overflow
- CVE-2026-94589 File upload in Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)
- CVE-2026-94588 Command injection in pmg-api
- CVE-2026-94587 Memory corruption in Fabric OS
- CVE-2026-94586 Command injection in Fabric OS
- CVE-2026-94585 Auth bypass in Fabric OS
- CVE-2026-94584 Race condition in Fabric OS
- CVE-2026-94583 Race condition in Fabric OS
- CVE-2026-94582 Memory corruption in Fabric OS
- CVE-2026-94581 Command injection in Fabric OS
- CVE-2026-94580 Path traversal in Fabric OS
- CVE-2026-9458 Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection
- CVE-2026-94579 Command injection in Fabric OS
- CVE-2026-94578 Privilege escalation in Fabric OS
- CVE-2026-94577 Privilege escalation in Fabric OS
- CVE-2026-94576 Privilege escalation in Fabric OS
- CVE-2026-94575 Privilege escalation in Fabric OS
- CVE-2026-94574 CVE-2026-94574
- CVE-2026-94573 Repeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Value
- CVE-2026-94572 Code injection in Octavia
- CVE-2026-94571 Code injection in Octavia
- CVE-2026-94570 CVE-2026-94570
- CVE-2026-9457 Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection
- CVE-2026-94568 WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability
- CVE-2026-9456 Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCfg os command injection
- CVE-2026-9455 Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection
- CVE-2026-94545 Satori-generated SVG has improper escaping
- CVE-2026-94544 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
- CVE-2026-94543 Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
- CVE-2026-94541 WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter
- CVE-2026-94540 DesktopSMS 1.11.0 Unauthorized Access via Local Service
- CVE-2026-9454 Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injection
- CVE-2026-94539 SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter
- CVE-2026-94538 Missing authorization in WP File Download
- CVE-2026-94536 lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource
- CVE-2026-94535 lamp-cloud through 5.10.0 Unauthorized Notification Deletion
- CVE-2026-94534 lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints
- CVE-2026-94533 lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file
- CVE-2026-94532 lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById
- CVE-2026-9453 FoundDream miniclawd SkillsLoader skills-loader.ts which command injection
- CVE-2026-94520 Microsoft SQL Server Denial of Service Vulnerability
- CVE-2026-9452 FoundDream miniclawd exec.ts ExecTool.execute os command injection
- CVE-2026-94512 SQL Server Remote Code Execution Vulnerability
- CVE-2026-94510 Microsoft Bookings Elevation of Privilege Vulnerability
- CVE-2026-9451 code-projects Employee Management System applyleaveprocess.php sql injection
- CVE-2026-94506 Microsoft Office Access Information Disclosure Vulnerability
- CVE-2026-94505 Missing authorization in Nelio Content – Editorial Calendar & Social Media Auto-Posting
- CVE-2026-94504 Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting
- CVE-2026-94503 WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability
- CVE-2026-94502 Out-of-bounds write in Zigbee Publish Price Matrix handling
- CVE-2026-94501 jshERP through 3.6 Privilege Escalation via userBusiness CRUD
- CVE-2026-94500 WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-9450 code-projects Employee Management System psubmit.php sql injection
- CVE-2026-94499 WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability
- CVE-2026-94498 WordPress AppMySite plugin <= 3.15.4 - Broken Access Control vulnerability
- CVE-2026-94497 jshERP through 3.6 Unauthorized Access via by-id Endpoints