Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 240 of 1013.
- CVE-2026-93565 Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte
- CVE-2026-93564 Denial of service in Red Hat AMQ Broker 7
- CVE-2026-93563 Denial of service in Red Hat Fuse 7
- CVE-2026-93562 Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling
- CVE-2026-93561 Other in Red Hat Fuse 7
- CVE-2026-93560 Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos
- CVE-2026-9356 SourceCodester Hospitals Patient Records Management System manage_history.php sql injection
- CVE-2026-93559 Forget-C Jellyfish AI Short Drama Studio FastAPI dependencies.py missing authentication
- CVE-2026-93558 Denial of service in Red Hat AMQ Broker 7
- CVE-2026-93556 Direct references to unsafe objects (IDOR) in Tankuam Places by Kompini
- CVE-2026-93550 Veeqo for WooCommerce <= 2.2.8 - Subscriber+ Arbitrary File Upload via start_veeqo_connection_process
- CVE-2026-9355 SourceCodester Hospitals Patient Records Management System Master.php save_patient_history sql injection
- CVE-2026-93549 CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass
- CVE-2026-93548 FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation
- CVE-2026-93547 Missing authorization in vaadin
- CVE-2026-93546 Apache HTTP Server: mod_dav_fs namespace overflow
- CVE-2026-93545 Out-of-bounds read in libXi's XListInputDevices()
- CVE-2026-93544 Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing
- CVE-2026-93543 Out-of-bounds read in libXi's XI2 class parser
- CVE-2026-93542 Out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes()
- CVE-2026-93541 Out-of-bounds read in libXi's XQueryDeviceState()
- CVE-2026-93540 Fleet applies namespace labels and annotations without the bundle's service account privileges
- CVE-2026-9354 NousResearch hermes-agent Slack Agent/Mattermost Agent escape output
- CVE-2026-93539 Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver
- CVE-2026-93538 Missing authorization in Rancher
- CVE-2026-93537 Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory
- CVE-2026-93536 X.Org Server GestureBuildSprite Use-After-Free
- CVE-2026-93535 Cross-site scripting in Dark Mode – Improve Accessibility with AI Powered Dark Theme
- CVE-2026-93534 spatie Scotty Self Update SelfUpdater.php update code download
- CVE-2026-93533 spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection
- CVE-2026-93532 gedelumbung HospitalManagement Password Change password.php simpan improper authentication
- CVE-2026-93531 gedelumbung HospitalManagement cross-site request forgery
- CVE-2026-9353 NousResearch hermes-agent Skills Guard Multi-Word Prompt skills_guard.py injection
- CVE-2026-93529 WordPress WSP MCP - AI Agents Connector plugin <= 2.7.0 - Broken Access Control vulnerability
- CVE-2026-93528 NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page
- CVE-2026-93527 WordPress Live Copy Paste for Elementor plugin <= 1.5.10 - SQL Injection vulnerability
- CVE-2026-93526 WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-93524 X.Org Server XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read
- CVE-2026-93523 X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Write
- CVE-2026-93522 X.Org Server Glamor CopyArea Heap Buffer Overflow
- CVE-2026-93521 X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow
- CVE-2026-93520 X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write
- CVE-2026-9352 NousResearch hermes-agent Messaging Gateway local.py _make_run_env information disclosure
- CVE-2026-93519 X.Org Server XFixes Pointer Barrier Event List Buffer Overflow
- CVE-2026-93518 X.Org Server XKB ResizeKeyType Numeric Truncation
- CVE-2026-93517 X.Org Server GLX RenderLarge Heap Buffer Overflow
- CVE-2026-93516 .Org Server XInput Passive Grab Use-After-Free
- CVE-2026-93515 .Org Server Present Extension Use-After-Free
- CVE-2026-93514 WordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-93513 WordPress SiteSkite plugin <= 2.1.7 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-93512 WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-93511 Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass
- CVE-2026-93510 Missing authorization in Points and Rewards for WooCommerce
- CVE-2026-9351 NousResearch hermes-agent read_file Tool file_tools.py _is_blocked_device path traversal
- CVE-2026-93509 Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer Amount
- CVE-2026-93508 WC Fields Factory < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX
- CVE-2026-93507 WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure
- CVE-2026-93506 SveltyCMS File Upload Endpoint upload-media server-side request forgery
- CVE-2026-93505 SveltyCMS SVG Media Upload media-service.server.ts cross site scripting
- CVE-2026-93504 SveltyCMS User Attribute Update Endpoint +server.ts access control
- CVE-2026-9350 NousResearch hermes-agent Batch Runner approval.py check_all_command_guards authorization
- CVE-2026-93495 Memory corruption in Motherboard(PRIME Z390-A )
- CVE-2026-93494 Io.netty/netty-codec-stomp: netty: bytebuf leak in stompsubframedecoder when a frame body is never terminated
- CVE-2026-93493 Security feature bypass in Red Hat build of Apache Camel for Spring Boot 4
- CVE-2026-93492 Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size
- CVE-2026-93491 Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue
- CVE-2026-9349 calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure
- CVE-2026-93489 Auth bypass in Router
- CVE-2026-93488 Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams
- CVE-2026-93485 WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-93484 SQL injection in Znuny
- CVE-2026-93483 Auth bypass in Znuny
- CVE-2026-9348 Edimax EW-7438RPn webs mp stack-based overflow
- CVE-2026-93479 NGINX map directive and regex matching vulnerability
- CVE-2026-93477 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash
- CVE-2026-93475 Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509
- CVE-2026-93474 Monta monta.app Insufficiently Protected Credentials
- CVE-2026-93471 Unbounded SAML message decompression in esaml allows memory exhaustion
- CVE-2026-9347 Edimax EW-7438RPn webs formWizSurvey os command injection
- CVE-2026-93468 HGiga｜OAKlouds - Arbitrary File Read
- CVE-2026-93467 HGiga｜OAKlouds - Insecure Deserialization
- CVE-2026-93464 Cross-site scripting in baserCMS
- CVE-2026-93463 Cross-site scripting in baserCMS
- CVE-2026-93462 Missing authorization in baserCMS
- CVE-2026-93460 Cross-site scripting in baserCMS
- CVE-2026-9346 Edimax EW-7438RPn webs formWirelessTbl buffer overflow
- CVE-2026-93456 django-page-cms through 2.0.13 CSRF via admin mutation views
- CVE-2026-93455 django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account
- CVE-2026-93454 Aureus ERP through 1.6.0 Stored XSS via Payment Term Note
- CVE-2026-93453 SOGo before 5.12.11 Password Reset Token Interception via Origin Header
- CVE-2026-93452 snappy-java through 1.1.10.8 Buffer Overflow in Snappy.compress
- CVE-2026-93451 snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods
- CVE-2026-93450 go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal
- CVE-2026-9345 Edimax EW-7438RPn webs formWizSurvey buffer overflow
- CVE-2026-93449 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-93448 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-93447 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-93446 Apache Tomcat: Possible TLS 1.3 connection failures
- CVE-2026-93445 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-93443 Langflow OSS is affected by multiple vulnerabilities