Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 247 of 1013.
- CVE-2026-92753 PatrowlManager through 1.8.4 Authorization Bypass via Events API
- CVE-2026-92752 metasfresh Unauthorized Access via Document Attachments and Comments Endpoints
- CVE-2026-92751 CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter
- CVE-2026-92750 Harness through 3.3.0 Missing Access Control via infraproviders endpoint
- CVE-2026-92749 SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret
- CVE-2026-92748 BC Security Empire before 6.7.1 Path Traversal File Upload RCE
- CVE-2026-92747 Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list
- CVE-2026-92746 Cross-site scripting in Gutenverse – WordPress Blocks, Page Builder & Site Editor
- CVE-2026-92745 Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments
- CVE-2026-92744 Delinea Privilege Manager agent unauthenticated remote code execution vulnerability
- CVE-2026-9274 Information Exposure Vulnerability in CP-Plus Wi-Fi Camera
- CVE-2026-92730 LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name
- CVE-2026-9273 Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover
- CVE-2026-92729 SigNoz 0.88.0 through 0.141.0 - Missing Authentication on Trace Funnel Analytics Endpoints
- CVE-2026-92727 EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute
- CVE-2026-92720 Kubero through 3.1.1 Unauthenticated Notifications API Access
- CVE-2026-9272 Possibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADS
- CVE-2026-92719 Quickwit through 0.9.0 SSRF via SQS queue_url Parameter
- CVE-2026-92718 Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache
- CVE-2026-92717 Covenant through 0.6 Missing Authentication on the CovenantHub SignalR Hub
- CVE-2026-92716 Shuffle through 2.2.1 API Key Reset Cross-Tenant Privilege Escalation
- CVE-2026-92715 Missing authorization in Tutor LMS – eLearning and online course solution
- CVE-2026-92714 Missing authorization in Download Manager
- CVE-2026-92713 Missing authorization in Modula Image Gallery – Photo Grid & Video Gallery
- CVE-2026-92712 ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter
- CVE-2026-9271 KeepInMind - Dashboard Notes < 0.8.4.2 - Contributor+ Stored XSS
- CVE-2026-92709 Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE
- CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers
- CVE-2026-92707 MessagePack: Nested arrays can blow past buffer length limits
- CVE-2026-92706 Dark Reader: Ability to request icon-like bitmap data from certain local web servers
- CVE-2026-92705 Aegisub executes arbitrary code through automatically loaded Automation scripts
- CVE-2026-92702 Security feature bypass in cocos
- CVE-2026-92701 Security feature bypass in cocos
- CVE-2026-92700 Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation
- CVE-2026-9270 DataDog::DogStatsd versions through 0.07 for Perl allow metric injections
- CVE-2026-92692 Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
- CVE-2026-9269 Secure Copy Content Protection and Content Locking < 5.1.5 - Admin+ Stored XSS via ays_sccp_sub_icon_image Parameter
- CVE-2026-92682 @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier
- CVE-2026-92681 @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields
- CVE-2026-92680 Araxis Merge insufficiently protected credentials
- CVE-2026-9268 Incorrect Authorization in GitLab
- CVE-2026-9267 Memory corruption in Eclipse tinydtls
- CVE-2026-92665 Denial of service in PowerProtect Data Domain
- CVE-2026-9266 Weak cryptography in UC-1200A Series
- CVE-2026-9265 Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path
- CVE-2026-9264 Cross-Site Scripting in SketchUp Dynamic Components
- CVE-2026-9263 Out-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packets
- CVE-2026-92629 Missing authorization in Baiying PC Client
- CVE-2026-92628 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab
- CVE-2026-92627 Heap Use-After-Free in H5T__conv_f_f
- CVE-2026-92626 Control iD iDSecure Unauthenticated Denial of Service
- CVE-2026-92625 Control iD iDSecure Unauthenticated Denial of Service
- CVE-2026-92622 Cross-site scripting in Strong Testimonials
- CVE-2026-9262 Misconfiguration in EOS Network Setting Tool for Windows
- CVE-2026-92619 Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter
- CVE-2026-92616 FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritance
- CVE-2026-92615 Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed
- CVE-2026-92612 Memory corruption in Eclipse iceoryx™
- CVE-2026-92611 Auth bypass in Eclipse Ankaios
- CVE-2026-9261 Weak cryptography in EOS Network Setting Tool for Windows
- CVE-2026-92609 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
- CVE-2026-92608 Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10
- CVE-2026-92605 IRIS through 2.4.29 Unauthorized Comment Access via Object ID
- CVE-2026-92604 Scirius through 3.8.0 Arbitrary File Write via PCAP Upload
- CVE-2026-92603 ContiNew Admin through 4.1.0 Unauthorized Message Deletion via UserMessageController
- CVE-2026-92602 TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL
- CVE-2026-92601 Guns through 8.3.5 Improper Access Control via SysNoticeController
- CVE-2026-92600 Guns through 8.3.5 Information Disclosure via Missing Permission Check
- CVE-2026-9260 Hardcoded credentials in EOS Network Setting Tool for Windows
- CVE-2026-92599 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate
- CVE-2026-92598 Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass
- CVE-2026-92597 Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment
- CVE-2026-92596 Nodemailer before 9.1.0 Denial of Service via addressparser
- CVE-2026-92595 Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent
- CVE-2026-92594 Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL
- CVE-2026-92593 Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution
- CVE-2026-92592 Craft CMS before 4.18.6 Remote Code Execution via signed cookie
- CVE-2026-92591 Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer
- CVE-2026-92590 Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields
- CVE-2026-9259 Security feature bypass in EOS Network Setting Tool for Windows
- CVE-2026-92589 Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder
- CVE-2026-92588 n8n before 1.123.76 Improper Authorization via Source Control Push
- CVE-2026-92587 n8n before 1.123.76 Sandbox Escape via Git Relative URL
- CVE-2026-92586 AVideo through 29.0 Missing Authorization via comment API endpoint
- CVE-2026-92585 AVideo through 29.0 Missing Authorization Check via API Like Endpoint
- CVE-2026-92584 AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header
- CVE-2026-92583 AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment
- CVE-2026-92582 AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass
- CVE-2026-92581 AVideo through 29.0 Like Counter Desynchronization via Array Parameter
- CVE-2026-92580 AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF
- CVE-2026-9258 Security feature bypass in EOS Network Setting Tool for Windows
- CVE-2026-92579 AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision
- CVE-2026-92578 WWBN AVideo through 29.0 Authentication Bypass via Stored Password Hash
- CVE-2026-92577 AVideo through 29.0 API get_api_video Broken Access Control via clean_title
- CVE-2026-92576 HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool
- CVE-2026-92574 Cri-o: cri-o checkpoint restore bypasses destination security context
- CVE-2026-92573 Denial of service in Apache Qpid Broker-J
- CVE-2026-92570 reNgine through 2.2.0 Unauthorized Configuration File Read
- CVE-2026-92569 Hippo4j through 1.5.0 SSRF via clientAddress Parameter
- CVE-2026-92568 MLRun through 1.11.0 Server-Side Request Forgery via Webhook