Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 246 of 1013.
- CVE-2026-92882 Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses
- CVE-2026-92881 vgmstream AWB parser awb.c init_vgmstream_awb_memory divide by zero
- CVE-2026-92880 vgmstream EA SCHl parser vadpcm_decoder.c vadpcm_read_coefs_be out-of-bounds write
- CVE-2026-92879 vgmstream mus_acm.c parse_mus resource consumption
- CVE-2026-92877 XML external entity in jaxb-ri (core)
- CVE-2026-92876 IBM Maximo Application Suite - IoT Component Denial of Service
- CVE-2026-92874 Incorrect Authorization in GitLab
- CVE-2026-92873 Auth bypass in Pgpool-II
- CVE-2026-92872 Information disclosure in Pgpool-II
- CVE-2026-92871 Null dereference in Pgpool-II
- CVE-2026-92870 Memory corruption in Pgpool-II
- CVE-2026-92869 Memory corruption in Pgpool-II
- CVE-2026-92868 Security feature bypass in Pgpool-II
- CVE-2026-92867 Memory corruption in Pgpool-II
- CVE-2026-92862 Other in Ticket Ryutsu Center
- CVE-2026-92861 Hardcoded credentials in Ticket Ryutsu Center
- CVE-2026-92860 rcourtman Pulse Quick Security Setup quick-setup fmt.Sprintf input validation
- CVE-2026-92853 Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure
- CVE-2026-92843 Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure
- CVE-2026-92842 OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
- CVE-2026-9284 Missing authorization in WooCommerce PayPal Payments
- CVE-2026-92839 Other in Canva
- CVE-2026-92838 GeoVision GV-Remote E-Map dll hijacking vulnerability
- CVE-2026-92834 Apache Thrift: C++ WebSocket server transport does not read a full request length
- CVE-2026-92832 IBM Aspera Enterprise Webapps Information Disclosure
- CVE-2026-92829 Missing authorization in Blog2Social: Social Media Auto Post & Scheduler
- CVE-2026-92826 EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key
- CVE-2026-92824 Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts
- CVE-2026-92823 Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml
- CVE-2026-92822 Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml
- CVE-2026-92821 Sssd: sssd: access control bypass via premature ldap access rule evaluation
- CVE-2026-92820 Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload
- CVE-2026-9282 W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter
- CVE-2026-92817 Inductive Automation Ignition Software Incorrect Authorization
- CVE-2026-92816 ComfyUI before 0.30.0 Path Traversal via dataset save nodes
- CVE-2026-92815 changedetection.io through 0.60.6 SSRF via browser-step Goto URL
- CVE-2026-92814 changedetection.io through 0.60.6 Cross-Site Scripting via watch_title
- CVE-2026-92813 Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass
- CVE-2026-92812 Decap CMS < 3.11.0 Path Traversal via Sibling Directory Prefix Matching
- CVE-2026-92811 browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass
- CVE-2026-92810 PrestaShop blockwishlist through 3.0.2 Information Disclosure
- CVE-2026-9281 Cross-site scripting in Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits
- CVE-2026-92809 PrestaShop psgdpr through 1.4.3 GDPR Log Forgery
- CVE-2026-92808 Server-Side Request Forgery in Altium Enterprise Server UnifiedLogin Service Allows Unauthenticated System Compromise
- CVE-2026-92807 Code injection in Save as PDF Plugin by PDFCrowd
- CVE-2026-92806 phpList before 3.6.17 Cross-Site Request Forgery via massremove.php
- CVE-2026-92805 UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard
- CVE-2026-92804 Nango through 0.70.4 Server-Side Request Forgery via Configuration
- CVE-2026-92803 LibreTranslate through 1.9.6 Missing Access Check on the download_file Route
- CVE-2026-92802 kan through 0.6.0 Authorization Bypass via GitHub Project Import
- CVE-2026-92801 cc-connect through 1.5.0 User Allowlist Bypass via Feishu Card Actions
- CVE-2026-92800 Docs before 5.4.1 Stale Collaboration Session After Access Revocation
- CVE-2026-9280 Ad Inserter <= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe Mode
- CVE-2026-92799 Auth bypass in Online Scheduling and Appointment Booking System – Bookly
- CVE-2026-92798 Code injection in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
- CVE-2026-92797 Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter
- CVE-2026-92796 Manticore Search 27.0.0 before 28.4.4 Multi-Statement Authorization Bypass
- CVE-2026-92795 Coze Studio through 0.5.1 Server-Side Request Forgery via Plugin
- CVE-2026-92794 OpenSign through 2.41.3 Information Disclosure via getDocument
- CVE-2026-92793 GoAdmin through 1.2.26 Authorization Bypass via Query Parameter
- CVE-2026-92792 OpenNHP through 1.0.2 Authentication Bypass via Fallback Verifier
- CVE-2026-92791 Uber Kraken through 0.1.29 Path Traversal via tag parameter
- CVE-2026-92790 Higress before 2.2.4 Rate Limit Bypass via Malformed Cookie Header
- CVE-2026-9279 Shell command injection in Logseq
- CVE-2026-92789 Graylog through 7.1.4 Server-Side Request Forgery via HTTP Redirect
- CVE-2026-92788 Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node
- CVE-2026-92787 Feast through 0.66.0 Authentication Bypass via Unverified Token
- CVE-2026-92786 LightGBM through 4.7.0 Out-of-Bounds Write via Crafted Model
- CVE-2026-92785 Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes
- CVE-2026-92784 @refinedev/inferencer through 7.0.0 Code Injection via API Field Names
- CVE-2026-92783 Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion
- CVE-2026-92782 Chroma through 1.5.9 Authorization Bypass via Collection Identifier
- CVE-2026-92781 Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes
- CVE-2026-92780 KnowStreaming through 3.4.1 Missing Authorization on the REST API
- CVE-2026-9278 Form Builder CP < 1.2.47 - Editor+ Stored XSS via form_structure
- CVE-2026-92779 Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings
- CVE-2026-92778 CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes
- CVE-2026-92777 Security feature bypass in Idea Tab Pro (TB373FU)
- CVE-2026-92776 Wiki.js through 2.5.314 Path Prefix Matching Authorization Bypass
- CVE-2026-92775 Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetch
- CVE-2026-92774 Wiki.js through 2.5.314 Authorization Bypass via GraphQL Tag Omission
- CVE-2026-92773 Trigger.dev before 4.6.0 GitHub App Installation Takeover
- CVE-2026-92772 Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX
- CVE-2026-92771 Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query
- CVE-2026-92770 Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter
- CVE-2026-9277 shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`
- CVE-2026-92768 Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments
- CVE-2026-92767 Cross-site scripting in Twenty20 Image Before-After
- CVE-2026-92766 Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter
- CVE-2026-92765 ArcherySec through 2.0.6 Information Disclosure via WebScanVulnList
- CVE-2026-92764 OpenCVE 2.4.0 < 3.1.0 Organization API Ignores Token Scope
- CVE-2026-92763 Rundeck through 6.2.1 Authorization Bypass via Project Import
- CVE-2026-92762 Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup
- CVE-2026-92761 WebVirtCloud Missing Authorization on Instance Control Actions
- CVE-2026-92760 Shlink through 5.1.6 Mercure Token Authorization Bypass
- CVE-2026-92759 SecObserve before 1.59.1 Information Disclosure via API Configuration
- CVE-2026-92758 Logs may collect sensitive information
- CVE-2026-92757 Malformed connection string may disable field level encryption
- CVE-2026-92756 Combining encryption settings may disable encryption
- CVE-2026-92754 PatrowlManager through 1.8.4 Improper Access Control via users API