Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 250 of 1013.
- CVE-2026-9230 Missing authorization in Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- CVE-2026-92299 @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture
- CVE-2026-92298 EspoCRM through 10.0.8 Weak Token Generation via rand()
- CVE-2026-92289 Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode be
- CVE-2026-92288 Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspectio
- CVE-2026-92287 Server-side request forgery in Apache Arrow C++
- CVE-2026-92284 Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS
- CVE-2026-9228 Missing authorization in Timetable and Event Schedule by MotoPress
- CVE-2026-9227 GutenBee <= 2.20.1 - Authenticated (Author+) Arbitrary File Upload via wp_check_filetype_and_ext Filter
- CVE-2026-92263 Command injection in SparkyFitness
- CVE-2026-92262 MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.
- CVE-2026-9226 Auth bypass in Server
- CVE-2026-92259 Integer overflow in Escargot
- CVE-2026-92257 Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Management via eval() Sinks
- CVE-2026-92256 Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd_config_show.cgi Read Handlers
- CVE-2026-92255 Netcore NR255-V 1.5.130703 Out-of-Bounds Read in filter_arp_put_file.cgi via String API Misuse
- CVE-2026-92254 WatchDog Antivirus kernel driver arbitrary file deletion via unauthenticated IOCTL
- CVE-2026-92253 Arbitrary File Write via Directory Junction in WatchDog Anti-Virus Quarantine Restoration
- CVE-2026-92252 Incorrect Default Permissions in WatchDog Anti-Virus Installation Directory
- CVE-2026-9225 Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation
- CVE-2026-92249 Qi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter
- CVE-2026-92248 Gimp: integer overflow when generating a thumbnail preview for a psd file
- CVE-2026-92247 synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload
- CVE-2026-92245 Missing authorization in Simply Schedule Appointments
- CVE-2026-92244 Cross-site scripting in PDF Invoices & Packing Slips for WooCommerce
- CVE-2026-92243 Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter
- CVE-2026-92240 Out-of-bounds read in IMAP response parser
- CVE-2026-9224 Missing authorization in Server
- CVE-2026-92239 Buffer overrun in IMAP
- CVE-2026-92238 Ambiguous parsing of mail headers
- CVE-2026-92237 Information disclosure in PowerShell Universal
- CVE-2026-92235 Code injection in WP Ultimate Review
- CVE-2026-92234 QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors
- CVE-2026-92232 Cross-site scripting in Joomla! CMS
- CVE-2026-92231 Cross-site scripting in Joomla! CMS
- CVE-2026-92230 Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching
- CVE-2026-9223 Missing authorization in Server
- CVE-2026-92229 Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
- CVE-2026-92228 Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
- CVE-2026-92227 Auth bypass in Joomla! CMS
- CVE-2026-92226 Missing authorization in Joomla! CMS
- CVE-2026-92225 Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- CVE-2026-92224 Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- CVE-2026-92223 Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3
- CVE-2026-92222 Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- CVE-2026-92221 gedelumbung HospitalManagement app_global_admin_model.php generate_index_pasien sql injection
- CVE-2026-92220 vllm-project vLLM MoRIIO Acknowledgement moriio_connector.py MoRIIOWrapper._handle_release_message resource consumption
- CVE-2026-9222 Setracker2 Children's Smartwatch Ecosystem Use of password hash instead of password for authentication
- CVE-2026-92217 a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes
- CVE-2026-92216 a2ui-project a2ui Binder generic-binder.ts openUrl redirect
- CVE-2026-92215 a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery
- CVE-2026-92214 a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting
- CVE-2026-92213 a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection
- CVE-2026-92212 Cross-site scripting in JetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-92210 NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability
- CVE-2026-9221 Setracker2 Children's Smartwatch Ecosystem Use of a Broken or Risky Cryptographic Algorithm
- CVE-2026-92209 NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability
- CVE-2026-92208 NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-92207 MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability
- CVE-2026-92206 CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability
- CVE-2026-92205 BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability
- CVE-2026-92204 Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability
- CVE-2026-92203 Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability
- CVE-2026-92202 Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability
- CVE-2026-9220 Setracker2 Children's Smartwatch Ecosystem Use of hard-coded cryptographic key
- CVE-2026-9219 Setracker2 Children's Smartwatch Ecosystem Generation of Predictable Numbers or Identifiers
- CVE-2026-92184 ag-ui-protocol ag-ui Multimodal Content utils.py urllib.request.urlopen server-side request forgery
- CVE-2026-92183 GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-92180 Privilege escalation in PDF Architect
- CVE-2026-9218 Insufficient input validation vulnerability in Certain NETGEAR routers allows unauthorized access
- CVE-2026-92179 pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2026-92178 pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability
- CVE-2026-92177 pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2026-92176 pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability
- CVE-2026-92174 SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter
- CVE-2026-92173 Privilege escalation in Meta Horizon OS
- CVE-2026-92172 Privilege escalation in Meta Horizon OS
- CVE-2026-92171 Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store
- CVE-2026-92164 Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files
- CVE-2026-92162 Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream
- CVE-2026-92161 FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
- CVE-2026-92160 F´: SendPartial Integer Overflow Leading to Assertion DoS
- CVE-2026-9216 Insufficient input validation vulnerability exists in certain NETGEAR RAX Models
- CVE-2026-92159 F´: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetry
- CVE-2026-92158 F´: FpySequencer Integer Overflow in Stack Offset/Size Validation Leading to Out-of-Bounds Write
- CVE-2026-92157 F´: FileDownlink SendPartial integer overflow lets legal startOffset/length values reach a reachable assertion
- CVE-2026-92156 F´: EventManager asserts on legal oversized LogBuffer values delivered over the standard GenericHub event bridge
- CVE-2026-92155 F´: FileUplink Unknown Packet Type Assertion DoS
- CVE-2026-92154 F´: File size bounds bypass in Svc::FileUplink via unsigned integer overflow in DATA packet validation
- CVE-2026-92153 F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath
- CVE-2026-92152 F´: Unvalidated Port Index in GenericHub
- CVE-2026-92151 F´: SpacePacketDeframer Small Packet Assertion DoS
- CVE-2026-92150 F´: GenericHub Malformed Buffer Assertion DoS
- CVE-2026-9215 A CSRF vulnerability exists in certain NETGEAR XR series devices
- CVE-2026-92144 Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter
- CVE-2026-92142 Apache Karaf: Authorization bypass in JMX MBean lifecycle operations
- CVE-2026-92141 Open redirect in Jenkins Keycloak Authentication Plugin
- CVE-2026-92140 Cross-site scripting in Jenkins Gitee Plugin
- CVE-2026-9214 Insufficient input validation in NETGEAR R7000 router allows administrators to tamper with the device.
- CVE-2026-92139 Server-side request forgery in Jenkins Bitbucket Push and Pull Request Plugin