Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 241 of 1013.
- CVE-2026-93442 IBM QRadar SIEM Out-of-bounds Read
- CVE-2026-93441 IBM QRadar SIEM HTTP Receiver protocol is vulnerable to a denial of service
- CVE-2026-9344 Edimax EW-7438RPn webs formWpsStart stack-based overflow
- CVE-2026-93436 vLLM through 0.29.0 Memory Exhaustion via Rejected Requests
- CVE-2026-93435 redis-parser through 3.0.0 Denial of Service via Unbounded Recursion
- CVE-2026-93434 Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets
- CVE-2026-93433 Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd page parsing
- CVE-2026-93432 Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus
- CVE-2026-93430 Cross-site scripting in GD Rating System
- CVE-2026-9343 Edimax EW-7438RPn webs formWpsStart os command injection
- CVE-2026-93428 Missing authorization in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
- CVE-2026-93426 SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Names
- CVE-2026-93425 Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root
- CVE-2026-93421 Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
- CVE-2026-9342 SourceCodester Hospitals Patient Records Management System view_history.php sql injection
- CVE-2026-9341 Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter
- CVE-2026-93405 Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)
- CVE-2026-93399 Missing authorization in Online Scheduling and Appointment Booking System – Bookly
- CVE-2026-93395 Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()
- CVE-2026-93394 libmongoc SCRAM client nonce-validation bypass
- CVE-2026-93393 Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream
- CVE-2026-93388 File upload in Printcart Store – Web to Print Product Designer for WooCommerce
- CVE-2026-93387 Information disclosure in Chrome
- CVE-2026-93386 Other in Chrome
- CVE-2026-93385 Information disclosure in Chrome
- CVE-2026-93384 Server-side request forgery in Chrome
- CVE-2026-93383 Information disclosure in Chrome
- CVE-2026-93382 Use after free in Chrome
- CVE-2026-93381 Memory corruption in Chrome
- CVE-2026-93380 Race condition in Chrome
- CVE-2026-9338 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- CVE-2026-93379 Security feature bypass in Chrome
- CVE-2026-93378 Missing authorization in Chrome
- CVE-2026-93377 Memory corruption in Chrome
- CVE-2026-93376 Memory corruption in Chrome
- CVE-2026-93375 Other in Chrome
- CVE-2026-93374 Use after free in Chrome
- CVE-2026-93373 Use after free in Chrome
- CVE-2026-93372 Memory corruption in Chrome
- CVE-2026-93371 marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection
- CVE-2026-93368 Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter
- CVE-2026-93367 Cross-site scripting in Visitor Traffic Real Time Statistics pro
- CVE-2026-93366 Bludit CMS 3.22.0 Authorization Bypass via list-images/delete-image AJAX Endpoints
- CVE-2026-93365 Bludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpoint
- CVE-2026-93364 Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit()
- CVE-2026-93363 Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route
- CVE-2026-9336 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- CVE-2026-93355 LiteLLM Weak JWT Authentication via Email-Based User Lookup
- CVE-2026-93354 Taskview Community Missing Authentication via OAuth Dynamic Client Registration
- CVE-2026-93353 copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlers
- CVE-2026-93352 Laravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File Upload
- CVE-2026-9335 Improper Handling of HDF5 ExternalLinks in keras-team/keras
- CVE-2026-93349 Frictionless OS Command Injection via explore Console Command
- CVE-2026-93348 Unsloth Zoo Code Injection via model_type in config.json
- CVE-2026-93347 Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file
- CVE-2026-93346 Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition
- CVE-2026-93345 MikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRI
- CVE-2026-93344 MarketKing < 2.1.72 Missing Authorization via marketking_get_page_content AJAX
- CVE-2026-93343 MarketKing < 2.1.72 Missing Authorization via marketking_admin_vendors_ajax
- CVE-2026-93342 MarketKing < 2.1.72 Missing Authorization via marketking_duplicate_product AJAX
- CVE-2026-93341 MarketKing < 2.1.72 Missing Authorization via marketking_send_refund AJAX
- CVE-2026-93340 Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint
- CVE-2026-9334 Memory corruption in Cpanel::JSON::XS
- CVE-2026-93339 Ditty < 3.1.70 Stored XSS via Layout Tag Wrapper Attribute
- CVE-2026-93338 Grandstream GWN7660ELR < 1.0.27.6 Information Disclosure via SNMP Default Community String
- CVE-2026-93337 NetworkManager-l2tp Privilege Escalation via pppd Plugin Injection
- CVE-2026-93336 Missing authorization in the unit resources download route in Juju controllers
- CVE-2026-93332 Missing authorization in Server
- CVE-2026-93331 GPAC RTP Depacketizer rtp_depacketizer.c gf_rtp_parse_ttxt out-of-bounds
- CVE-2026-93330 Security feature bypass in Server
- CVE-2026-93328 Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
- CVE-2026-93326 Crafted Git build source can bypass certain policy validation
- CVE-2026-93323 Oversized Dockerfile or .dockerignore can exhaust buildkitd memory
- CVE-2026-93322 Malformed MergeOp can crash the BuildKit daemon
- CVE-2026-93321 Malformed LLB file operation can crash buildkitd
- CVE-2026-93320 BuildKit improperly handles special files in build snapshots
- CVE-2026-93319 A malicious frontend can cause a daemon panic
- CVE-2026-93318 Cache poisoning via unvalidated image layer DiffIDs
- CVE-2026-93317 Container blob cache can accept unverified content
- CVE-2026-93316 Starting daemon with --cdi-disabled flag can lead to panic on specific builds
- CVE-2026-93315 BuildKit proxy CA cleanup can be disrupted by build steps
- CVE-2026-93314 Freedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflow
- CVE-2026-93313 Freedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflow
- CVE-2026-93312 Freedesktop Poppler JBIG2Stream.cc rewind null pointer dereference
- CVE-2026-93311 Freedesktop Poppler SampledFunction Function.cc integer overflow
- CVE-2026-93310 O-RAN-SC SMO OAM VES Collector allocation of resources
- CVE-2026-9331 Missing authorization in EDD Product Catalog Feed by PixelYourSite
- CVE-2026-93309 O-RAN-SC SMO OAM VES Collector allocation of resources
- CVE-2026-93308 O-RAN-SC SMO OAM VES Collector allocation of resources
- CVE-2026-93307 O-RAN-SC SMO OAM VES Collector memory allocation
- CVE-2026-93306 This Power System update is being released to address
- CVE-2026-93304 (D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange
- CVE-2026-93303 Cross-site scripting in HT Contact Form – Drag & Drop Form Builder for WordPress
- CVE-2026-93302 Trusted peer certificate match ignores public key, allowing forged CA clones
- CVE-2026-93300 EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter
- CVE-2026-9330 IBM WebSphere Application Server is affected by remote code execution
- CVE-2026-93296 MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends
- CVE-2026-93295 MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution
- CVE-2026-93294 Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
- CVE-2026-93293 Cross-site scripting in Password Protected – Protect Your Site Content With a Password