Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 263 of 1013.
- CVE-2026-90697 SourceCodester Inventory Management System invoice.php authorization
- CVE-2026-90696 SourceCodester Inventory Management System Product Management products_handler.php cross site scripting
- CVE-2026-90695 SourceCodester Inventory Management System Vendor Management vendors_handler.php cross site scripting
- CVE-2026-90694 SourceCodester Inventory Management System Customer Management customers_handler.php cross site scripting
- CVE-2026-90693 D-Link DIR-878 WAN Settings SetWan3Settings stack-based overflow
- CVE-2026-90692 D-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflow
- CVE-2026-90691 0x4m4 HexStrike AI API Files Endpoint hexstrike_server.py FileOperationsManager path traversal
- CVE-2026-90690 0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection
- CVE-2026-90689 Tenda W20E formDelWebAuthWhiteUser stack-based overflow
- CVE-2026-90688 Tenda W20E HTTP formIPMacBindAdd stack-based overflow
- CVE-2026-90687 GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free
- CVE-2026-90686 GPAC MP4Box loader_bt.c gf_bt_report memory corruption
- CVE-2026-90685 GPAC MP4Box lsr_dec.c lsr_exec_command_list assertion
- CVE-2026-90684 GPAC MP4Box base_scenegraph.c gf_node_get_field_count assertion
- CVE-2026-90683 GPAC MP4Box base_scenegraph.c gf_node_unregister assertion
- CVE-2026-90682 Matthias-Wandel jhead WebP EXIF gpsinfo.c ProcessGpsInfo heap-based overflow
- CVE-2026-90681 Matthias-Wandel jhead EXIF Parsing exif.c Get16u out-of-bounds
- CVE-2026-90680 D-Link DIR-823G HNAP1 SetStaticRouteSettings strcpy stack-based overflow
- CVE-2026-90679 Security feature bypass in Forgejo
- CVE-2026-90678 Other in HAProxy
- CVE-2026-9067 Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload
- CVE-2026-90668 Denial of service in UnrealIRCd
- CVE-2026-9066 WP Compress < 7.10.04 - Reflected XSS via test_zone
- CVE-2026-90651 Security feature bypass in Socket Firewall
- CVE-2026-90650 MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'
- CVE-2026-9065 Surecart - SQL Injection
- CVE-2026-90648 Memory corruption in wabt
- CVE-2026-90647 Security feature bypass in ASE2000 V2 Communication Test Set
- CVE-2026-9064 Denial of service in Red Hat Directory Server 11.5 E4S for RHEL 8
- CVE-2026-90623 andreashappe cochise SSH Host Key ssh_connection.py asyncssh.connect certificate validation
- CVE-2026-90622 GNU libredwg Layer Encoding dwg.spec DWG_TABLE null pointer dereference
- CVE-2026-90621 ipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injection
- CVE-2026-90620 0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication
- CVE-2026-9062 Agile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path Traversal
- CVE-2026-90619 0x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injection
- CVE-2026-90618 GH05TCREW PentestAgent LocalRuntime runtime.py LocalRuntime.execute_command os command injection
- CVE-2026-90617 GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injection
- CVE-2026-90616 Path traversal in Flatpak
- CVE-2026-90615 SourceCodester Class and Exam Timetabling System subject1.php cross site scripting
- CVE-2026-90614 FedML-AI FedML MQTT+S3 Communication Backend remote_storage.py S3Storage.read_model deserialization
- CVE-2026-90613 GPAC MP4Box stbl_read.c stbl_GetSampleInfos assertion
- CVE-2026-90612 GPAC MP4Box scene_dump.c gf_sm_dump_command_list assertion
- CVE-2026-90611 GPAC MP4Box loader_xmt.c xmt_parse_element assertion
- CVE-2026-90610 GPAC MP4Box svg_attributes.c gf_svg_attributes_copy buffer over-read
- CVE-2026-9061 Agile Store Locator < 1.6.9 - Admin+ Stored XSS via logo_name
- CVE-2026-90609 GPAC MP4Box vrml_tools.c null pointer dereference
- CVE-2026-90608 Totolink A3002MU boa formPortFw buffer overflow
- CVE-2026-90607 Totolink A3002MU boa formNewSchedule buffer overflow
- CVE-2026-90606 Totolink A3002MU boa formIpv6Setup buffer overflow
- CVE-2026-90605 Totolink A3002MU boa formFilter buffer overflow
- CVE-2026-90604 Totolink A3002MU Anchor Tag cross site scripting
- CVE-2026-90603 Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload
- CVE-2026-90602 Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting
- CVE-2026-90601 getzep graphiti REST API main.py improper authentication
- CVE-2026-90600 itsourcecode Sales and Inventory System inv_edit1.php sql injection
- CVE-2026-9060 Agile Store Locator < 1.6.6 - Admin+ Stored XSS via map_style
- CVE-2026-90599 Rizwan17 inventory-management-system process.php cross-site request forgery
- CVE-2026-90598 jaygajera17 E-commerce-project-springBoot UserController.java UserController.updateUser authorization
- CVE-2026-90597 itsourcecode Sales and Inventory System sup_edit1.php sql injection
- CVE-2026-90596 embedded-graphics image_raw.rs new/bytes_per_row integer overflow
- CVE-2026-90595 wxiaoqi Spring-Cloud-Platform OnlineController.java OnlineController.getOnlineInfo authorization
- CVE-2026-90594 Missing authorization in Spring-Cloud-Platform
- CVE-2026-90593 embedded-graphics image_raw.rs draw_sub_image integer overflow
- CVE-2026-9059 NextGEN Gallery - SQL Injection
- CVE-2026-90584 TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resources
- CVE-2026-90583 kagisearch smallweb Query String Rendering sw.py index cross site scripting
- CVE-2026-90582 evanchiu serverless-todo API Todo Endpoint index.js saveTodos resource consumption
- CVE-2026-90581 cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection
- CVE-2026-90580 FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery
- CVE-2026-9058 Improper Certificate Verification in Szafir SDK
- CVE-2026-90579 cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication
- CVE-2026-90578 GPAC MP4Box list.c gf_list_count use after free
- CVE-2026-90577 GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based overflow
- CVE-2026-90576 GPAC MP4Box base_scenegraph.c gf_node_list_add_child null pointer dereference
- CVE-2026-90575 PHPGurukul Small CRM Login Success login.php unserialize deserialization
- CVE-2026-90574 itsourcecode Sales and Inventory System emp_transac.php add sql injection
- CVE-2026-90573 GPAC MP4Box vrml_tools.c gf_sg_mfurl_del null pointer dereference
- CVE-2026-90572 davenardella snap7 s7_micro_client.cpp opUpload memory corruption
- CVE-2026-90571 Exrick xmall Order Printing order-print.jsp cross site scripting
- CVE-2026-90570 linlinjava litemall Product Detail index.vue AdminGoodsService.validate cross site scripting
- CVE-2026-9057 Security fix for Qlik Talend Administration Center URL access control vulnerability
- CVE-2026-90569 linlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scripting
- CVE-2026-90568 moxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort cross site scripting
- CVE-2026-90567 quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting
- CVE-2026-90566 Rizwan17 inventory-management-system Registration register.php createUserAccount improper authorization
- CVE-2026-90565 Rizwan17 inventory-management-system dashboard.php access control
- CVE-2026-90564 quequnlong shiyi-blog chat sendMsg Endpoint index.vue SysChatMsgMapper.getChatMsgList cross site scripting
- CVE-2026-90563 maliangnansheng bbs-springboot ArticleController.java utils.toToc cross site scripting
- CVE-2026-90562 LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key
- CVE-2026-90561 Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG
- CVE-2026-90560 zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompress
- CVE-2026-9056 Security fix for Qlik Talend Administration Center cross-site scripting vulnerability
- CVE-2026-90559 snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress
- CVE-2026-90558 sngrep through 1.8.4 Stack Buffer Overflow via SIP Headers
- CVE-2026-90557 Freeciv 3.1.0 through 3.2.5 Out-of-Bounds Read via Savegame
- CVE-2026-90556 Freeciv before 3.2.6 Heap Buffer Overflow via worklist_load
- CVE-2026-90555 vLLM before 0.28.0 Denial of Service via Audio Header
- CVE-2026-90554 vLLM before 0.28.0 Denial of Service via audio extraction
- CVE-2026-90553 vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor
- CVE-2026-90552 WWBN AVideo Missing Authorization via Playlists_schedules list.json.php