Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 261 of 1013.
- CVE-2026-90931 LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload
- CVE-2026-90930 File Browser through 2.63.23 Path Traversal via Symlink Alias
- CVE-2026-9093 CVE-2026-9093
- CVE-2026-90929 File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup
- CVE-2026-90928 File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint
- CVE-2026-90927 filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message
- CVE-2026-90926 Code Injection in Innotim Software's Logsign SIEM
- CVE-2026-90925 Path Traversal in Innotim Software's Logsign SIEM
- CVE-2026-90924 Default Admin Credentials in Innotim Software's Logsign SIEM
- CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion
- CVE-2026-90922 Business logic in Paid Membership Subscriptions
- CVE-2026-90921 Maximo AI Service Denial of Service
- CVE-2026-90920 Maximo AI Service Code Injection
- CVE-2026-9092 CVE-2026-9092
- CVE-2026-90919 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization
- CVE-2026-90918 Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- CVE-2026-90917 Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- CVE-2026-90916 Missing authorization in Joomla! CMS
- CVE-2026-90915 Path traversal in Joomla! CMS
- CVE-2026-90914 Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- CVE-2026-90913 Missing authorization in Joomla! CMS
- CVE-2026-90912 Maximo AI Service Denial of Service
- CVE-2026-90911 Maximo AI Service Denial of Service
- CVE-2026-90910 Apache Answer: Reaction API authorization bypass for restricted content
- CVE-2026-9091 CVE-2026-9091
- CVE-2026-90907 Missing authorization in Joomla! CMS
- CVE-2026-90906 Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
- CVE-2026-90905 Cross-site request forgery in Easy Store extension for Joomla
- CVE-2026-90904 Missing authorization in Easy Store extension for Joomla
- CVE-2026-90903 Cross-site request forgery in Easy Store extension for Joomla
- CVE-2026-90902 SQL injection in Easy Store extension for Joomla
- CVE-2026-90901 SQL injection in Easy Store extension for Joomla
- CVE-2026-90900 Cross-site request forgery in Easy Store extension for Joomla
- CVE-2026-9090 CVE-2026-9090
- CVE-2026-90899 Missing authorization in Easy Store extension for Joomla
- CVE-2026-90898 Bifrost unauthenticated remote code execution via MCP stdio client registration
- CVE-2026-90896 Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII
- CVE-2026-90895 MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection
- CVE-2026-90894 Parallels Desktop local privilege escalation via appliance extract argument injection
- CVE-2026-90893 MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints
- CVE-2026-90891 ASRock｜ASRock Polychrome SYNC/RGB software utility - Improper Access Control
- CVE-2026-90890 ASRock｜ASRock Polychrome SYNC/RGB software utility - Untrusted Pointer Dereference
- CVE-2026-9089 Security feature bypass in Automate
- CVE-2026-90887 WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-90885 XML external entity in Apache Camel
- CVE-2026-90884 Cross-site scripting in WP Recipe Maker
- CVE-2026-90882 Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data
- CVE-2026-90881 D-Link DIR-882 CGI Binary dllog.cgi main information disclosure
- CVE-2026-90880 D-Link DSL-3782 Diagnostics Diagnostics.asp system command injection
- CVE-2026-9088 Keycloak: keycloak: information disclosure due to user profile permission bypass
- CVE-2026-90879 zyx0814 FilePress Publish search.php sql injection
- CVE-2026-90878 vllm-project vLLM Jinja Template Rendering completions resource consumption
- CVE-2026-90877 SourceCodester Online Faculty Clearance System update_requirement_status.php sql injection
- CVE-2026-90876 SourceCodester Online Faculty Clearance System delete_requirement.php sql injection
- CVE-2026-90872 Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server
- CVE-2026-90871 Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server
- CVE-2026-90870 Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server
- CVE-2026-9087 Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login
- CVE-2026-90869 Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server
- CVE-2026-90868 OS Command Injection in Progress WS_FTP Server
- CVE-2026-90867 Improper Access Control of Web Admin Console in Progress WS_FTP Server
- CVE-2026-90866 Virtual Folder Path Confinement Bypass in Progress WS_FTP Server
- CVE-2026-90865 Command Injection via FTP Notification Variables in Progress WS_FTP Server
- CVE-2026-90864 Host Administrator Path Containment Bypass in Progress WS_FTP Server
- CVE-2026-90863 Privilege Escalation via Missing Authorization in WS_FTP Manager
- CVE-2026-90862 Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server
- CVE-2026-90861 Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server
- CVE-2026-90860 Information disclosure in Canva
- CVE-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass
- CVE-2026-90858 subhajitkhan online-clinic-management-system adminappview.php session_start authorization
- CVE-2026-90857 SourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted upload
- CVE-2026-90856 SourceCodester College Notes Gallery Management System Registration Flow signup.php privileges management
- CVE-2026-90855 SourceCodester/katojkalemba Online Food Ordering System order.php sql injection
- CVE-2026-90854 SourceCodester/katojkalemba Online Food Ordering System category-foods.php sql injection
- CVE-2026-90852 luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free
- CVE-2026-90851 PHPGurukul Hostel Management System checklogin.php access control
- CVE-2026-90850 PHPGurukul Hostel Management System manage-students.php cross site scripting
- CVE-2026-9085 DNS Hijacking in TUBITAK BILGEM's Pardus-Parental-Control
- CVE-2026-90849 SourceCodester College Notes Gallery Management System login.php sql injection
- CVE-2026-90848 Governikus AusweisApp StartPAOSResponse cross site scripting
- CVE-2026-90847 EFM ipTIME C200E System Setup iux_set.cgi os command injection
- CVE-2026-90846 PHPGurukul Daily Expense Tracker System forgot-password.php sql injection
- CVE-2026-90845 PHPGurukul Daily Expense Tracker System sidebar.php cross site scripting
- CVE-2026-90844 PHPGurukul Daily Expense Tracker System Login index.php sql injection
- CVE-2026-90843 SabyasachiRana WebMap New Nmap Scan functions_nmap.py nmap_newscan os command injection
- CVE-2026-90842 PHPGurukul Blood Donor Management System Login_Model.php cleartext storage in file
- CVE-2026-90841 PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection
- CVE-2026-90840 PHPGurukul Blood Donor Management System Admin Controllers Dashboard.php __construct improper authentication
- CVE-2026-9084 MISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurations
- CVE-2026-90835 michaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross site scripting
- CVE-2026-90831 GNU Binutils ELF String Table elf-strtab.c _bfd_elf_strtab_delref memory corruption
- CVE-2026-90830 GNU Binutils Section Merge merge.c _bfd_write_merged_section null pointer dereference
- CVE-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing
- CVE-2026-90829 GNU Binutils SHT_GROUP Section elf.c bfd_elf_set_group_contents null pointer dereference
- CVE-2026-90828 GNU Binutils ELF Orphan Section ldelf.c elf_orphan_compatible null pointer dereference
- CVE-2026-90827 GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free
- CVE-2026-90826 GPAC MP4Box base_scenegraph.c gf_node_del out-of-bounds
- CVE-2026-90825 GPAC MP4Box base_scenegraph.c gf_node_unregister use after free
- CVE-2026-90824 GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflow
- CVE-2026-90823 Memory corruption in IPVPN