Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 253 of 1013.
- CVE-2026-91929 Flowise before 3.1.4 Cross-Tenant Authorization Bypass
- CVE-2026-91928 Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms
- CVE-2026-91926 Gss-ntlmssp: gss-ntlmssp: memory leak in ntlm_decode_target_info via duplicated av_pair entries in ntlm challenge
- CVE-2026-91925 Polyaxon through 2.16.4 Server-Side Template Injection via Unsandboxed Jinja2 Engine
- CVE-2026-91924 pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint
- CVE-2026-91923 KubeSphere through 4.1.3 SSRF via git credential verification endpoint
- CVE-2026-91922 Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render
- CVE-2026-91921 Cross-Site Scripting (XSS) in 1millionbot’s AI chatbot platform
- CVE-2026-9192 Authentication bypass in Progress MarkLogic Server ODBC App Server
- CVE-2026-9191 Insufficient isolation of user-supplied code in Progress MarkLogic Server
- CVE-2026-9190 HTTP request smuggling in Progress MarkLogic Server
- CVE-2026-9189 Business logic in Contact Form 7 – PayPal & Stripe Add-on
- CVE-2026-91883 Information disclosure in Terraform Provider for OME
- CVE-2026-91882 Information disclosure in Terraform Provider for OME
- CVE-2026-91881 Security feature bypass in Terraform Provider for Redfish
- CVE-2026-9188 Auth bypass in Appointment Bookings for Zoom GoogleMeet and more – Wappointment
- CVE-2026-9187 Missing authorization in Abandoned Contact Form 7
- CVE-2026-91867 Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely
- CVE-2026-91866 Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service
- CVE-2026-91865 Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service
- CVE-2026-91864 Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion
- CVE-2026-91863 Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service
- CVE-2026-91862 Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'
- CVE-2026-91860 Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge
- CVE-2026-9186 Security feature bypass in Langflow OSS
- CVE-2026-91859 MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass
- CVE-2026-91858 XML external entity in Apache Camel
- CVE-2026-91857 MISP: State-changing actions accessible via GET request enabling CSRF
- CVE-2026-91855 Open5GS PFCP Message handler.c denial of service
- CVE-2026-91854 code-projects Record Management System reg.php cross site scripting
- CVE-2026-91853 TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection
- CVE-2026-91852 Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl
- CVE-2026-91851 MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison
- CVE-2026-9185 Missing authorization in 6Storage Rentals
- CVE-2026-91849 WuzhiCMS Avatar Upload index.php setAvatar unrestricted upload
- CVE-2026-91848 WuzhiCMS index.php getDataOfJson sql injection
- CVE-2026-91847 Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection via IDOR
- CVE-2026-91846 MISP Collection Element Add Missing Authorization on Referenced Object UUID
- CVE-2026-91844 Remote Code Execution via Unrestricted File Upload in İzometri Informatics' eimzamip
- CVE-2026-91843 Stack overflow in login process to the Security Management and Log Servers
- CVE-2026-91842 OpenBankProject OBP-API Kryo Redis.scala KryoInjection.invert deserialization
- CVE-2026-91841 Command injection in NetworkManager-vpnc
- CVE-2026-91840 Networkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline injection in vpn username
- CVE-2026-9184 Missing authorization in 24liveblog – live blog tool
- CVE-2026-91839 Command injection in NetworkManager-fortisslvpn
- CVE-2026-91838 Networkmanager-sstp: networkmanager-sstp: local privilege escalation to root via shell injection in vpn profile fields
- CVE-2026-91837 Networkmanager-iodine: networkmanager-iodine: local privilege escalation to root via nameserver option injection
- CVE-2026-91836 OpenClaw ClawScan Static Scanner static_scanner.go incomplete comparison with missing factors
- CVE-2026-91835 OpenClaw ClawScan File Classifier static_scanner.go IsBinaryFile interpretation conflict
- CVE-2026-91833 WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter
- CVE-2026-91832 WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF
- CVE-2026-91831 Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting
- CVE-2026-91830 Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment Cookie
- CVE-2026-9183 24liveblog <= 2.2 - Authenticated (Contributor+) Exposure of Sensitive Information via Block Editor Script Localization
- CVE-2026-91829 Subscribe to Comments < 2.3.3 - Reflected XSS via 'ref' Parameter
- CVE-2026-91828 OMGF < 6.3.11 - Unauthenticated DoS via do_optimize
- CVE-2026-91827 Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export
- CVE-2026-91826 Memory corruption in rLottie
- CVE-2026-91825 MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit
- CVE-2026-9182 Unvalidated File Upload vulnerability in ArcGIS Server.
- CVE-2026-91819 MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent
- CVE-2026-91818 Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
- CVE-2026-91817 Foxit PDF Editor/Reader AcroForm Out-of-Bounds Read Remote Code Execution Vulnerability
- CVE-2026-91816 Foxit PDF Editor/Reader AcroForm Use-After-Free Remote Code Execution Vulnerability
- CVE-2026-91815 Foxit PDF Editor/Reader JPEG2000 Parsing Memory Corruption Remote Code Execution Vulnerability
- CVE-2026-91814 Security feature bypass in Foxit PDF Editor
- CVE-2026-91813 Foxit PDF Editor/Reader FoxitUpdater Race Condition Local Privilege Escalation Vulnerability
- CVE-2026-91812 Foxit PDF Editor/Reader FoxitUpdater Improper Certificate Validation Local Privilege Escalation Vulnerability
- CVE-2026-91811 Foxit PDF Editor/Reader PRC Stream Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2026-91810 Foxit PDF Editor/Reader Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability
- CVE-2026-9181 Directory Traversal in ArcGIS Server
- CVE-2026-91809 Foxit PDF Editor/Reader Annotation Use-After-Free Information Disclosure Vulnerability
- CVE-2026-91808 Foxit PDF Editor/Reader JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
- CVE-2026-91807 Foxit PDF Editor/Reader PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
- CVE-2026-91806 Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability
- CVE-2026-91805 Use-after-free Vulnerability in Foxit PDF Editor/Reader Page-tree Handling
- CVE-2026-91804 Foxit PDF Editor/Reader Out-of-bounds Write Vulnerability While Rendering
- CVE-2026-91803 Security Vulnerability Report – Foxit PDF Editor/Reader Updater DLL Search Path Hijacking
- CVE-2026-91802 Foxit PDF Editor/Reader — Heap Buffer Overflow in WebP Image Decoding via Bitmap Stride Confusion
- CVE-2026-91801 Foxit PDF Editor/Reader RichMedia Annotation Directory Traversal Remote Code Execution Vulnerability
- CVE-2026-91800 Foxit PDF Editor installer local privilege escalation
- CVE-2026-9180 Missing authorization in MotoPress Appointment Booking
- CVE-2026-91799 Foxit Editor/Reader Array resetForm Use-After-Free Vulnerability
- CVE-2026-91798 Foxit PDF Editor/Reader Updater Privilege Escalation
- CVE-2026-91797 Foxit PDF Editor/Reader Portfolio Directory Traversal Remote Code Execution Vulnerability
- CVE-2026-91796 Foxit PDF Editor/Reader importIcon NTLM Response Information Disclosure Vulnerability
- CVE-2026-91795 Foxit PDF Editor/Reader FileOpen Uninitialized Variable Remote Code Execution Vulnerability
- CVE-2026-91794 Foxit PDF Editor/Reader DeviceN Colorspace Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2026-91793 Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability
- CVE-2026-91792 Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
- CVE-2026-91791 Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
- CVE-2026-91790 Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability
- CVE-2026-9179 WP Forms Connector <= 1.8 - Unauthenticated SQL Injection via 'order' Parameter
- CVE-2026-91789 Foxit PDF Editor/Reader U3D File Parsing Integer Overflow Remote Code Execution Vulnerability
- CVE-2026-91788 Foxit PDF Editor/Reader Missing Authorization Information Disclosure Vulnerability
- CVE-2026-91786 Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size
- CVE-2026-91784 Argument Injection leading to arbitrary process termination in gotop
- CVE-2026-91782 GNU Binutils Dynamic Relocation Allocation elfxx-x86.c elf_x86_allocate_dynrelocs null pointer dereference
- CVE-2026-91781 GNU Binutils ELF Section elf64-x86-64.c elf_x86_64_common_section_index null pointer dereference
- CVE-2026-91780 GNU Binutils elflink.c elf_link_add_object_symbols null pointer dereference