Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 236 of 1013.
- CVE-2026-94054 Memory corruption in Exim
- CVE-2026-94053 Apache MINA SSHD: LDAP injection in sshd-ldap
- CVE-2026-94052 Apache MINA SSHD: LDAP password authentication ineffective
- CVE-2026-94051 0717376 cowork_bench pdf-tools-mcp server.py ControlFlowNode server-side request forgery
- CVE-2026-94050 D-Link DIR-X1860Z ubus JSON-RPC interface routerd.get_rand_key information disclosure
- CVE-2026-9405 Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection
- CVE-2026-94049 06ketan slideshot renderer.ts render_slides path traversal
- CVE-2026-94048 CodeAstro QR Code Attendance Management System UserController.php save privileges management
- CVE-2026-94047 samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management
- CVE-2026-94046 0215AndrewFeng ACE-MCP MCP Tool getFileSnippet.ts get_file_snippet path traversal
- CVE-2026-94045 newbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scripting
- CVE-2026-94044 03-lovepreetSingh MCP route.ts create_file path traversal
- CVE-2026-94043 Free5GC Gmm handler.go race condition
- CVE-2026-94042 AdithyaYelloju Restaurant Management System add_table.php mysqli_query sql injection
- CVE-2026-94041 AdithyaYelloju Restaurant-Management-System add_menu.php sql injection
- CVE-2026-94040 vas3k TaxHacker actions.ts testLLMProviderAction server-side request forgery
- CVE-2026-9404 Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection
- CVE-2026-94039 vas3k TaxHacker Invoice PDF Renderer actions.ts generateInvoicePDF server-side request forgery
- CVE-2026-94038 NonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery
- CVE-2026-94037 00Kisumi00 mcp-file-analyzer analyze_csv_data MCP tool main.py ControlFlowNode path traversal
- CVE-2026-94036 D-Link DIR-X1860/DIR-X1860Z routerd ubus access control
- CVE-2026-94035 SourceCodester Drug Recommendation System index.php cross site scripting
- CVE-2026-94034 SourceCodester Drug Recommendation System Password Change change_password cross site scripting
- CVE-2026-94033 SourceCodester Drug Recommendation System User Management add_user cross site scripting
- CVE-2026-94032 itsourcecode Leave Management System index.php sql injection
- CVE-2026-94031 0-Gaurav-0 nexus-mcp nexus_reauth MCP tool browser.ts child_process.exec command injection
- CVE-2026-94030 SerenityOS LibGfx BMPLoader.cpp decode_bmp_pixel_data integer overflow
- CVE-2026-9403 Edimax BR-6675nD POST Request formWlSiteSurvey buffer overflow
- CVE-2026-94029 Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension
- CVE-2026-94028 Server-side request forgery in Mealie
- CVE-2026-94024 Module Manager object lookup validates one byte of a module's search name
- CVE-2026-94023 Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion
- CVE-2026-9402 Edimax BR-6675nD POST Request formWlanMP command injection
- CVE-2026-94018 NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path
- CVE-2026-94016 SourceCodester Drug Recommendation System add_symptom cross site scripting
- CVE-2026-94015 SourceCodester Drug Recommendation System edit_user.php sql injection
- CVE-2026-9401 Edimax BR-6675nD POST Request formWanTcpipSetup buffer overflow
- CVE-2026-94004 DedeCMS mytag_js.php code injection
- CVE-2026-94003 Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow
- CVE-2026-94002 Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies
- CVE-2026-94001 Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission
- CVE-2026-94000 Privilege escalation in Red Hat Build of Keycloak
- CVE-2026-9400 Edimax BR-6675nD POST Request formUSBStorage command injection
- CVE-2026-93999 Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients
- CVE-2026-93997 SourceCodester Drug Recommendation System edit_symptom.php sql injection
- CVE-2026-93996 Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read
- CVE-2026-93995 Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server
- CVE-2026-93994 Apache MINA SSHD: Repeated-publickey policy bypass on server
- CVE-2026-93993 Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout
- CVE-2026-93992 Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversal
- CVE-2026-93991 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector
- CVE-2026-93990 Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate
- CVE-2026-9399 Edimax BR-6675nD POST Request formsetPPPoE buffer overflow
- CVE-2026-93989 vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words
- CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
- CVE-2026-93987 rclone serve docker Path Traversal via Volume Name
- CVE-2026-93986 rclone before 1.75.1 Path Traversal via Directory Listing Names
- CVE-2026-93985 OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE
- CVE-2026-93984 OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret
- CVE-2026-93983 OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key Filter
- CVE-2026-93982 OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext
- CVE-2026-93981 hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings
- CVE-2026-93980 code-projects Internship Management System Admin Login Form login.php sql injection
- CVE-2026-9398 Besen BS20 EV Charging Station BLE/WiFi authentication replay
- CVE-2026-93979 code-projects Internship Management System login.php sql injection
- CVE-2026-93978 code-projects Internship Management System login.php sql injection
- CVE-2026-93977 code-projects Assessment Management add-single-mark.php cross site scripting
- CVE-2026-93976 code-projects Assessment Management add-user.php cross site scripting
- CVE-2026-93975 code-projects Assessment Management User Editing edit-user.php cross site scripting
- CVE-2026-93974 SourceCodester Online Reviewer Management System btn_functions.php remove sql injection
- CVE-2026-93973 SourceCodester Online Reviewer Management System btn_functions.php remove sql injection
- CVE-2026-93972 SourceCodester Online Reviewer Management System btn_functions.php sql injection
- CVE-2026-93971 aiyiyi121 SxDevOps settings.py information disclosure
- CVE-2026-93970 aiyiyi121 SxDevOps Settings settings.py hard-coded credentials
- CVE-2026-9397 Besen BS20 EV Charging Station OTA Update Installation improper authorization
- CVE-2026-93969 aiyiyi121 SxDevOps services.py ensure_default_superuser hard-coded credentials
- CVE-2026-93968 aiyiyi121 SxDevOps UserSerializer serializers.py update privileges management
- CVE-2026-93967 aiyiyi121 SxDevOps Command services.py generate_host_task command injection
- CVE-2026-93966 aiyiyi121 SxDevOps TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command command injection
- CVE-2026-93965 aiyiyi121 SxDevOps MCP STDIO Server Management services.py subprocess.Popen command injection
- CVE-2026-93964 NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication
- CVE-2026-93963 itsourcecode Leave Management System controller.php sql injection
- CVE-2026-93962 Kamailio CDP Diameter Receiver receiver.c shm_malloc heap-based overflow
- CVE-2026-93961 Dromara UJCMS UserController UserController.java usernameExist improper authorization
- CVE-2026-93960 Pixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication
- CVE-2026-9396 Besen BS20 EV Charging Station Firmware Version Check ui layer
- CVE-2026-93959 SourceCodester Online Reviewer Management System btn_functions.php sql injection
- CVE-2026-93958 D-Link R95 DHMAPI ssi system os command injection
- CVE-2026-93957 olivier-ls PHP-FTS Filter Matching SearchEngine.php matchesSingleFilter comparison
- CVE-2026-93956 olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting
- CVE-2026-93955 grimmory-tools grimmory Download Endpoint KoboController.java streamFileToResponse authorization
- CVE-2026-93954 Missing authorization in grimmory
- CVE-2026-93953 Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation
- CVE-2026-93952 Arista VeloCloud Orchestrator Improper Input Validation
- CVE-2026-93951 WordPress Zeinet theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-93950 WordPress Motors theme <= 1.4.108 - Broken Access Control vulnerability
- CVE-2026-9395 Besen BS20 EV Charging Station BLE/UDP insufficiently protected credentials
- CVE-2026-93949 WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerability
- CVE-2026-93947 WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability
- CVE-2026-93945 WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability