Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 239 of 1013.
- CVE-2026-93684 Apache Impala: Stored XSS in Impala query plans
- CVE-2026-93683 Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou
- CVE-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
- CVE-2026-93681 Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter
- CVE-2026-93680 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-9368 NousResearch hermes-agent Environment Variable code_execution_tool.py execute_code sandbox
- CVE-2026-93679 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-93678 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-93677 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-93676 Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks
- CVE-2026-93675 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-93674 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-9367 NousResearch hermes-agent terminal_tool approval.py detect_dangerous_command os command injection
- CVE-2026-93662 Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter
- CVE-2026-93661 Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR
- CVE-2026-93660 SQLBot through 1.10.1 Improper Access Control via Dashboard Update
- CVE-2026-9366 NousResearch hermes-agent prompt_builder.py _scan_context_content injection
- CVE-2026-93659 Concrete CMS Community Store before 2.7.8 Stored XSS
- CVE-2026-93658 uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid
- CVE-2026-93657 hickory-resolver before 0.26.2 DNSSEC Validation Bypass
- CVE-2026-93656 User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field
- CVE-2026-93655 Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter
- CVE-2026-93654 Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter
- CVE-2026-93653 Denial of service in Red Hat Enterprise Linux 10
- CVE-2026-93652 Integer Overflow or Wraparound in µD3TN
- CVE-2026-93651 WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability
- CVE-2026-93650 Saleor throttling.py get_client_ip excessive authentication
- CVE-2026-9365 Ettercap GG Dissector ec_gg.c FUNC_DECODER heap-based overflow
- CVE-2026-93649 Open redirect in Adoptium Temurin
- CVE-2026-93647 Cross-site scripting in Zimbra Collaboration Suite (ZCS)
- CVE-2026-93643 Path traversal in Zimbra Collaboration Suite (ZCS)
- CVE-2026-93642 Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation
- CVE-2026-93641 Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation
- CVE-2026-93640 Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration
- CVE-2026-9364 projectworlds Online Art Gallery Shop adminHome.php sql injection
- CVE-2026-93639 Missing authorization in Zimbra Collaboration Suite
- CVE-2026-93638 Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter
- CVE-2026-93637 Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting
- CVE-2026-93636 Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name
- CVE-2026-93635 Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution
- CVE-2026-93634 Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records
- CVE-2026-93633 Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters
- CVE-2026-93631 Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking
- CVE-2026-93630 Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization
- CVE-2026-9363 Edimax EW-7438RPn POST Request formEZCHNwlanSetu formEZCHNwlanSetup command injection
- CVE-2026-93629 Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity
- CVE-2026-93628 Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response
- CVE-2026-93627 Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer
- CVE-2026-93624 WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability
- CVE-2026-93623 WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-93622 WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-93621 WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerability
- CVE-2026-93620 WordPress PayPlus Payment Gateway plugin <= 8.2.5 - Broken Access Control vulnerability
- CVE-2026-9362 Edimax EW-7438RPn Setting formConnectionSetting command injection
- CVE-2026-93618 WordPress JetTricks plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-93617 WordPress Sunshine Photo Cart plugin <= 3.7.1 - PHP Object Injection vulnerability
- CVE-2026-93616 Check Point Multiple Products Path Traversal
- CVE-2026-9361 Edimax EW-7438RPn POST Request formAccep formAccept command injection
- CVE-2026-93606 vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species
- CVE-2026-93605 vm2 NodeVM before 3.12.1 Remote Code Execution via child_process
- CVE-2026-93604 vm2 3.11.8 Sandbox Escape via crypto.setFips
- CVE-2026-93603 vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function
- CVE-2026-93602 rustls-webpki before 0.103.10 CRL Revocation Check Bypass
- CVE-2026-93601 rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass
- CVE-2026-93600 rustls webpki Name Constraints URI Validation Bypass
- CVE-2026-9360 Edimax EW-7438RPn POST Request formwlencrypt24g buffer overflow
- CVE-2026-93599 rustls-webpki before 0.103.13 Panic via empty BIT STRING
- CVE-2026-93598 ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle
- CVE-2026-93597 ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses
- CVE-2026-93596 ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect
- CVE-2026-93595 ArcadeDB before 26.9.1 ACL Bypass via query_database Tool
- CVE-2026-93594 ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries
- CVE-2026-93593 ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission
- CVE-2026-93592 vLLM before 0.28.0 Denial of Service via negative token ID
- CVE-2026-93591 SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go
- CVE-2026-93590 ImageMagick before 7.1.2-31 Policy Bypass in UHDR encoder
- CVE-2026-9359 Edimax EW-7438RPn POST Request formHwSet command injection
- CVE-2026-93589 ImageMagick before 7.1.2-31 Division by Zero in FLIF encoder
- CVE-2026-93588 ImageMagick before 7.1.2-31 Null Pointer Dereference via PNM
- CVE-2026-93587 ImageMagick before 7.1.2-31 Policy Bypass via PCD decoder
- CVE-2026-93586 ImageMagick before 7.1.2-31 Use After Free via ImagesToBlob
- CVE-2026-93582 Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication
- CVE-2026-93581 Insufficient Neutralization of Formula Elements in CSV Exports
- CVE-2026-93580 InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook
- CVE-2026-9358 postcss-selector-parser AST Serialization container.js toString recursion
- CVE-2026-93579 Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)
- CVE-2026-93578 Security feature bypass in Red Hat build of Apache Camel for Spring Boot 4
- CVE-2026-93577 Integer Overflow or Wraparound in GitLab
- CVE-2026-93576 Other in Red Hat Fuse 7
- CVE-2026-93575 Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoder
- CVE-2026-93574 Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing
- CVE-2026-93573 Security feature bypass in Red Hat AMQ Broker 7
- CVE-2026-93572 Io.netty/netty-codec-redis: netty: redisarrayaggregator nested resp headers multiply patched preallocation limits
- CVE-2026-93571 Path Traversal in Szafir
- CVE-2026-93570 XML External Entity injection in Szafir and Szafir Weryfikująca
- CVE-2026-9357 vBulletin Login cross site scripting
- CVE-2026-93569 Security feature bypass in Red Hat AMQ Broker 7
- CVE-2026-93568 Security feature bypass in Red Hat AMQ Broker 7
- CVE-2026-93567 Security feature bypass in Red Hat AMQ Broker 7
- CVE-2026-93566 Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line