Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 233 of 1013.
- CVE-2026-94496 jshERP through 3.6 Privilege Escalation via Role Management
- CVE-2026-94495 jshERP through 3.6 Missing Authorization via systemConfig
- CVE-2026-94494 jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info
- CVE-2026-94493 Gigatech PDV5701 WebSocket Service index.html missing authentication
- CVE-2026-94492 Yonyou U8cloud OpenAPI so.saleorder.sendaudit sql injection
- CVE-2026-94491 Yonyou KSOA search_list.jsp sql injection
- CVE-2026-9449 code-projects Employee Management System changepassemp.php sql injection
- CVE-2026-94488 Cross-site scripting in Telegram Desktop
- CVE-2026-94487 WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint
- CVE-2026-94485 Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
- CVE-2026-94484 Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
- CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
- CVE-2026-94482 Next.js: Denial of Service in App Router using Server Actions
- CVE-2026-9448 code-projects Employee Management System applyleave.php cross site scripting
- CVE-2026-9447 SourceCodester Simple POS and Inventory System search.php sql injection
- CVE-2026-94462 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
- CVE-2026-94461 WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-9446 SourceCodester Simple POS and Inventory System edit_customer.php sql injection
- CVE-2026-94457 WordPress Captcha Code plugin <= 3.32 - Bypass Vulnerability vulnerability
- CVE-2026-94456 Weak cryptography in postiz-app
- CVE-2026-94455 Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key
- CVE-2026-94453 IKEv2 Use-After-Free bug when using IKE-over-TCP
- CVE-2026-94451 Other in Exploit Intelligence
- CVE-2026-94450 Potential denial of service when configured to send Retry packets in s2n-quic
- CVE-2026-9445 SourceCodester Simple POS and Inventory System File Extension addproduct.php unrestricted upload
- CVE-2026-94449 Denial of service in Exploit Intelligence
- CVE-2026-94448 Reset context tracking on consecutive template expressions in html/template
- CVE-2026-94447 Checksum database bypass for golang.org/toolchain in cmd/go
- CVE-2026-94445 Malicious user input may lead to RCE in golang.org/x/playground
- CVE-2026-94444 Checksum bypass for golang.org/fips140 in cmd/go
- CVE-2026-94440 Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
- CVE-2026-9444 SourceCodester Simple POS and Inventory System GET Parameter deleteproduct.php delete sql injection
- CVE-2026-94439 HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
- CVE-2026-94432 Missing authorization in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
- CVE-2026-9443 Edimax BR-6478AC POST Request formL2TPSetup buffer overflow
- CVE-2026-94426 xuxueli xxl-job insert cross site scripting
- CVE-2026-94425 Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140006F0C privileges management
- CVE-2026-94424 Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140001000 heap-based overflow
- CVE-2026-94423 Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts.
- CVE-2026-94422 xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape
- CVE-2026-94421 Church Admin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter
- CVE-2026-9442 Edimax BR-6478AC POST Request formiNICSiteSurvey buffer overflow
- CVE-2026-94419 Client session cache reference poisoning allows resumption with wrong server
- CVE-2026-94418 Signature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFY
- CVE-2026-94417 CRL check skipped when OCSP enabled and certificate has no OCSP URL
- CVE-2026-94416 Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery
- CVE-2026-94415 WordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-94414 jshERP through 3.6 Missing Authorization via updateBtnStr
- CVE-2026-94413 jshERP through 3.6 Password Hash Disclosure via /user/info
- CVE-2026-94412 jshERP through 3.6 Authorization Bypass via resetPwd
- CVE-2026-94411 jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType
- CVE-2026-94410 Exposure of Role List to Low-Privileged Remote Users in Bender Custom&Partner Service
- CVE-2026-9441 Edimax BR-6478AC POST Request formiNICbasic command injection
- CVE-2026-94408 Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
- CVE-2026-94405 WordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerability
- CVE-2026-94404 MISP CSRF vulnerability allows unauthorized attribute modification
- CVE-2026-94403 ColorFul iGameCenter IOCTL ene.sys sub_140001AF0 untrusted pointer dereference
- CVE-2026-94402 IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation
- CVE-2026-94401 MISP Arbitrary Local File Read and SSRF via MISP Export Upload
- CVE-2026-94400 Uncontrolled Resource Consumption in Kibana Leading to denial of service
- CVE-2026-9440 Edimax BR-6478AC POST Request formAccept command injection
- CVE-2026-94399 Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
- CVE-2026-94398 Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
- CVE-2026-94397 Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
- CVE-2026-94396 Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
- CVE-2026-94394 Missing authorization in MISP
- CVE-2026-94393 MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport
- CVE-2026-94391 WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-94390 WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability
- CVE-2026-9439 Edimax BR-6675nD stainfo command injection
- CVE-2026-94389 WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability
- CVE-2026-94388 WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability
- CVE-2026-94387 Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log
- CVE-2026-94386 Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache
- CVE-2026-94384 Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda
- CVE-2026-94383 MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension
- CVE-2026-94382 Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts
- CVE-2026-94381 MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime
- CVE-2026-94380 Host Header Injection in HAVELSAN's Liman MYS
- CVE-2026-9438 yashpokharna2555 StudentManagementSystem courseDel.php resource injection
- CVE-2026-94379 MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)
- CVE-2026-94378 SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter
- CVE-2026-94377 Cross-site scripting in Verified Reviews (Avis Vérifiés)
- CVE-2026-94376 Better Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name
- CVE-2026-94375 Information disclosure in Order Export & Order Import for WooCommerce
- CVE-2026-94374 Missing authorization in MISP
- CVE-2026-94373 MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu
- CVE-2026-94372 Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index
- CVE-2026-94370 Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs
- CVE-2026-9437 DTStack Taier REST API Runtime.exec os command injection
- CVE-2026-94368 Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source header
- CVE-2026-94367 Command injection in Apex Network Video Recorder (NVR)
- CVE-2026-94360 Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks
- CVE-2026-9436 Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injection
- CVE-2026-9435 Totolink A8000RU Web Management cstecgi.cgi setQosCfg os command injection
- CVE-2026-94348 SQL injection in PowerScale InsightIQ
- CVE-2026-94347 Security feature bypass in PowerProtect Data Domain Virtual Edition
- CVE-2026-94346 Path traversal in PowerProtect Data Domain Virtual Edition
- CVE-2026-9434 Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection