Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 262 of 1013.
- CVE-2026-90822 Command injection in IPVPN
- CVE-2026-90821 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
- CVE-2026-90820 Missing authorization in a2a-java
- CVE-2026-9082 Drupal Core SQL Injection
- CVE-2026-90819 Other in a2a-java
- CVE-2026-90818 Server-side request forgery in LobsterAI
- CVE-2026-90817 Code injection in REDCap
- CVE-2026-90816 FFmpeg Duration hlsproto.c parse_playlist denial of service
- CVE-2026-90815 FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-bounds
- CVE-2026-90814 cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery
- CVE-2026-90813 cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize
- CVE-2026-90812 cosmicstack-labs mercury-agent Shell Command Permission permissions.ts checkShellCommand privileges assignment
- CVE-2026-90811 Information disclosure in mercury-agent
- CVE-2026-90810 Missing authorization in mercury-agent
- CVE-2026-9081 Langflow OSS is affected by server-side request forgery in provider validation and API request functionality
- CVE-2026-90809 HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection
- CVE-2026-90808 HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist
- CVE-2026-90807 nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link following
- CVE-2026-90806 DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization
- CVE-2026-90805 subhajitkhan online-clinic-management-system doctorlogin.php sql injection
- CVE-2026-90804 GNU Binutils Eh Frame Section elf-eh-frame.c _bfd_elf_write_section_eh_frame buffer overflow
- CVE-2026-90803 GNU Binutils ld elf64-x86-64.c elf_x86_64_relocate_section buffer overflow
- CVE-2026-90802 GNU Binutils ld libbfd.c bfd_putl64 null pointer dereference
- CVE-2026-90801 GNU Binutils ld cache.c cache_bwrite buffer overflow
- CVE-2026-90800 Apache CouchDB: Auth bypass in prefixed _users and _replicator databases
- CVE-2026-9080 UAF after pause in socket callback
- CVE-2026-90799 Deserialization in Apache CouchDB
- CVE-2026-90798 Apache CouchDB: Replicator follows redirects indefinitely
- CVE-2026-90797 Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
- CVE-2026-90796 itsourcecode Leave Management System index.php sql injection
- CVE-2026-90795 itsourcecode Loan Management System navbar.php cross site scripting
- CVE-2026-90794 GPAC MP4Box vrml_tools.c gf_sg_script_load use after free
- CVE-2026-90793 GPAC MP4Box base_scenegraph.c gf_node_get_name use after free
- CVE-2026-90792 GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereference
- CVE-2026-90791 GPAC MP4Box base_scenegraph.c gf_node_unregister use after free
- CVE-2026-90790 Server-side request forgery in a2a-python
- CVE-2026-9079 stale proxy password leak
- CVE-2026-90789 itsourcecode Leave Management System login.php sql injection
- CVE-2026-90788 magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection
- CVE-2026-90787 Soarkey StudentManagement Registration Workflow register.html RegisterServlet.doPost privileges management
- CVE-2026-90786 Dvidelabs flatcc Duplicate Symbol semantics.c align_order_members assertion
- CVE-2026-90785 Dvidelabs flatcc Struct Analysis semantics.c analyze_struct assertion
- CVE-2026-90784 Dvidelabs flatcc semantics.c fb_clear_parser memory leak
- CVE-2026-90783 MKVToolNix through 101.0 Heap Buffer Overflow via avilib ODML Superindex Integer Wraparound
- CVE-2026-90782 S2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items()
- CVE-2026-90781 alsa-lib through 1.2.16.1 Off-by-One Stack Buffer Overflow in __snd_ctl_ascii_elem_id_parse()
- CVE-2026-90780 SIPp through 3.7.7 Buffer Overflow via Oversized SIP Header Content
- CVE-2026-9078 Firefox iOS RTL Domain Rendering Issue in Link Preview
- CVE-2026-90779 SIPp through 3.7.7 Stack Buffer Overflow via createAuthHeader Algorithm Parameter
- CVE-2026-90778 SIPp through 3.7.7 Buffer Overflow via SIP To Header Tag
- CVE-2026-90777 ESPnet before 202609 Remote Code Execution via Unsafe Deserialization
- CVE-2026-90776 Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing
- CVE-2026-90775 PostGIS address_standardizer through 3.7.0 Out-of-Bounds Read via Unvalidated Rule Weight
- CVE-2026-90774 rustypaste before 0.18.1 Path Traversal via filename header
- CVE-2026-90773 procs through 0.14.12 Terminal Escape Sequence Injection via Command
- CVE-2026-90772 Amundsen Frontend through 4.3.0 Stored XSS via Description
- CVE-2026-90771 joi before 17.13.8 and 18.2.9 Prototype Pollution via messages
- CVE-2026-90770 Spug through 3.4.0 Remote Code Execution via ping_check
- CVE-2026-9077 Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Protocol features
- CVE-2026-90769 Open Notebook before 1.11.0 Server-Side Request Forgery via link-source
- CVE-2026-90768 CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check
- CVE-2026-90767 Froxlor before 2.3.12 SSH Key Injection via authorized_keys
- CVE-2026-9076 Out-of-Bounds Read in CMS Password-Based Decryption
- CVE-2026-9074 IBM API Connect SQL Injection
- CVE-2026-90732 Memory corruption in PowerProtect Data Domain
- CVE-2026-90731 Memory corruption in PowerProtect Data Domain
- CVE-2026-90730 Missing authorization in PowerProtect Data Domain
- CVE-2026-9073 Foreman-mcp-server: mcp server: insecure sensitive http header sanitization
- CVE-2026-90729 Privilege escalation in PowerProtect Data Domain
- CVE-2026-90728 Privilege escalation in PowerProtect Data Domain
- CVE-2026-90727 Path traversal in PowerProtect Data Domain
- CVE-2026-90726 Path traversal in PowerProtect Data Domain
- CVE-2026-90725 Memory corruption in PowerProtect Data Domain
- CVE-2026-90724 SQL injection in PowerProtect Data Domain Management Center
- CVE-2026-90723 SQL injection in PowerProtect Data Domain Management Center
- CVE-2026-90721 Path traversal in PowerProtect Data Domain
- CVE-2026-90720 Security feature bypass in PowerProtect Data Domain
- CVE-2026-9072 WebSphere Application Server Remote Code Execution
- CVE-2026-90719 SQL injection in PowerProtect Data Domain Management Center
- CVE-2026-90717 Auth bypass in PowerProtect Data Domain Management Center
- CVE-2026-90716 marcobambini Gravity Number gravity_parser.c parse_number_expression out-of-bounds
- CVE-2026-90715 marcobambini Gravity udp json-parser gravity_json.c integer overflow
- CVE-2026-90714 marcobambini Gravity JSON parser gravity_json.c memory corruption
- CVE-2026-90713 vllm-project vLLM tiktoken vocab File mod.rs new denial of service
- CVE-2026-90712 Gitlawb openclaude xAI OAuth Callback xaiOAuthCallback.ts waitForCallback denial of service
- CVE-2026-90711 proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
- CVE-2026-90710 taisan tarzan-cms Theme Download Function ThemeService.java openConnection server-side request forgery
- CVE-2026-9071 Denial of service in WebSphere Application Server
- CVE-2026-90709 Yot CMS Admin Console admin.php eval code injection
- CVE-2026-90708 Yot CMS Cookie global.php login sql injection
- CVE-2026-90707 Open5GS Old AMF Discovery Fallback nnrf-handler.c amf_nnrf_try_old_amf_discovery_fallback use after free
- CVE-2026-90706 D-Link DWR-M921 formWsc os command injection
- CVE-2026-90705 D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection
- CVE-2026-90704 D-Link DWR-M921 formDiskPartition system command injection
- CVE-2026-90703 D-Link DWR-M921 formDiskCreateShare system os command injection
- CVE-2026-90702 D-Link DWR-M921 formDiskFormat system os command injection
- CVE-2026-90701 subhajitkhan online-clinic-management-system listdoctor.php sql injection
- CVE-2026-90700 itsourcecode Sales and Inventory System pro_edit1.php sql injection
- CVE-2026-90699 D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection
- CVE-2026-90698 memcached mcmc Tokenizer proto_text.c try_read_command_asciiauth out-of-bounds