Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 245 of 1013.
- CVE-2026-92993 Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection
- CVE-2026-92992 Dromara mayfly-go AI Assistant ai.go authorization
- CVE-2026-92991 Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API
- CVE-2026-92990 SendPress <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure via Hardcoded Token
- CVE-2026-9299 omec-project amf handler.go PDUSessionResourceModifyIndication memory corruption
- CVE-2026-92989 SendPress Newsletters <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing
- CVE-2026-92987 roxmltree through 0.21.1 Denial of Service via Quadratic Parsing
- CVE-2026-92986 SiYuan before 3.8.4 Cross-Site Scripting via Document Title
- CVE-2026-92985 SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels
- CVE-2026-92984 HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier
- CVE-2026-92983 InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch
- CVE-2026-92982 Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection
- CVE-2026-92980 HortusFox-Web < 6.1 Remote Code Execution via Import/Export
- CVE-2026-9298 omec-project amf PathSwitchRequest memory corruption
- CVE-2026-92978 User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()
- CVE-2026-92977 Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment
- CVE-2026-92976 Stored Cross-Site Scripting (XSS) in T-Systems’ TAO 2.0
- CVE-2026-92975 Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion
- CVE-2026-92974 Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter
- CVE-2026-92973 ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 8
- CVE-2026-92972 SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint
- CVE-2026-92971 InternLM LMDeploy through 0.17.0 Assertion Denial of Service
- CVE-2026-92970 HUBzero CMS through 2.2.32 Path Traversal via File Upload
- CVE-2026-9297 Edimax BR-6428NS POST Request formWlbasic command injection
- CVE-2026-92969 Code injection in HUSKY – Products Filter for WooCommerce Professional
- CVE-2026-92967 Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter
- CVE-2026-92966 Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field
- CVE-2026-92965 TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption
- CVE-2026-92963 vm2 before 3.11.2 Information Disclosure via Internal State
- CVE-2026-92962 vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js
- CVE-2026-92961 vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass
- CVE-2026-92960 vm2 before 3.11.6 Process-wide State Exposure via os and dns
- CVE-2026-9296 Edimax BR-6428NS POST Request formWlanM system command injection
- CVE-2026-92959 vm2 before 3.11.8 allowAsync Bypass via Promise Thenable
- CVE-2026-92958 vm2 before 3.11.7 Denylist Bypass via fs/promises
- CVE-2026-92957 vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix
- CVE-2026-92956 vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
- CVE-2026-92955 vm2 before 3.11.8 Sandbox Escape via NodeVM
- CVE-2026-92954 vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise
- CVE-2026-92953 vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray
- CVE-2026-92952 vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass
- CVE-2026-92951 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
- CVE-2026-92950 vm2 before 3.11.7 Sandbox Escape via CLI require
- CVE-2026-9295 Edimax BR-6428NS POST Request formWirelessTbl buffer overflow
- CVE-2026-92949 vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor
- CVE-2026-92948 vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test
- CVE-2026-92947 vm2 before 3.11.7 Memory Disclosure via Buffer Pool
- CVE-2026-92946 vm2 before 3.11.7 Remote Code Execution via require.external
- CVE-2026-92945 vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching
- CVE-2026-92944 vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector
- CVE-2026-92943 Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python
- CVE-2026-92942 vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry
- CVE-2026-92941 vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation
- CVE-2026-92940 vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent
- CVE-2026-9294 Edimax BR-6428NS POST Request formWanTcpipSetup buffer overflow
- CVE-2026-92939 vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine
- CVE-2026-92938 vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite
- CVE-2026-92937 vm2 3.11.6 Remote Code Execution via Promise call/apply
- CVE-2026-92936 vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack
- CVE-2026-92935 vm2 NodeVM Remote Code Execution via Array-Shaped Require
- CVE-2026-92934 vm2 before 3.11.8 Sandbox Escape RCE via AggregateError
- CVE-2026-92933 vm2 before 3.11.8 Information Disclosure via util.getCallSites
- CVE-2026-92932 MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled
- CVE-2026-92931 CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK
- CVE-2026-92930 Weak cryptography in Apex Network Video Recorder (NVR)
- CVE-2026-92929 Auth bypass in Apex Network Video Recorder (NVR)
- CVE-2026-92928 Hardcoded credentials in Apex Network Video Recorder (NVR)
- CVE-2026-92927 SourceCodester Drug Recommendation System drug_recommendor.sql information disclosure
- CVE-2026-92926 code-projects Matrimonial System partner_preference.php writepartnerprefs sql injection
- CVE-2026-92925 Redis: redis: out-of-bounds read via crafted cluster bus packets
- CVE-2026-92924 Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution via get_addon_output_data
- CVE-2026-92923 Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_addon_output_data
- CVE-2026-92922 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-92921 admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5
- CVE-2026-92920 admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled
- CVE-2026-9292 Rockwell Automation FactoryTalk® DataMosaix™ Private Cloud - Stored Cross-Site Scripting
- CVE-2026-92919 admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename
- CVE-2026-92918 admin3 through 3.0.0 Session Token Disclosure via Audit Log
- CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r
- CVE-2026-92916 Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork
- CVE-2026-92915 WWBN AVideo userVerifyEmail.php Unauthenticated Access Control
- CVE-2026-92914 AVideo LoginControl PGP Second Factor Authentication Bypass
- CVE-2026-92913 AVideo Weak PRNG Activation Code Authentication Bypass
- CVE-2026-92912 AVideo Cryptographically Weak PRNG via uniqid Stream Key
- CVE-2026-92911 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-92910 Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-9291 Insecure Deserialization in Amazon Braket SDK Job Results Processing
- CVE-2026-92909 Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-92908 Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-92905 Denial of Service Vulnerability
- CVE-2026-92904 Rubygem-foreman_remote_execution: job output readable without object-level view_job_invocations check
- CVE-2026-92903 SQL injection in Snowflake CLI
- CVE-2026-9290 WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter
- CVE-2026-92899 Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce
- CVE-2026-92894 Rubygem-foreman_ansible: unscoped lookupvalue deletion allows cross-model override value destruction
- CVE-2026-92893 Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parameters
- CVE-2026-92892 Potential command execution on the host running JFrog CLI.
- CVE-2026-9289 WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints
- CVE-2026-92885 Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login
- CVE-2026-92883 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab