Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 264 of 1013.
- CVE-2026-90551 WWBN AVideo Missing Authorization via video_from_program API
- CVE-2026-90550 WWBN AVideo Missing Authorization via mediaSession.json.php
- CVE-2026-9055 Privilege escalation in Booking for Appointments and Events Calendar – Amelia
- CVE-2026-90549 WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint
- CVE-2026-90548 WWBN AVideo Missing Authorization in ImageGallery list.json.php
- CVE-2026-90547 WWBN AVideo Missing Authorization via getBookmarks.json.php
- CVE-2026-90546 WWBN AVideo Missing Authorization via like.json.php
- CVE-2026-90545 WWBN AVideo Missing Authorization via commentAddNew.json.php
- CVE-2026-90544 WWBN AVideo Missing Authorization via videoAddViewCount.json.php
- CVE-2026-90543 WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php
- CVE-2026-90542 WWBN AVideo Missing Authorization via remindMe.json.php
- CVE-2026-90541 WWBN AVideo Unauthenticated Information Disclosure via menus.json.php
- CVE-2026-90540 WWBN AVideo Missing Authorization via playListAddVideo.json.php
- CVE-2026-9054 Invalid IP packets cause a kernel panic
- CVE-2026-90539 WWBN AVideo Missing Authentication via menuItems.json.php
- CVE-2026-90538 WWBN AVideo Missing Authorization via playlistsFromUser.json.php
- CVE-2026-90537 WWBN AVideo Scheduler sendEmail Missing Authorization via Token
- CVE-2026-90536 WWBN AVideo Missing Authorization via adsInfo API Endpoint
- CVE-2026-90535 Flowise before 3.1.4 Denial of Service via text-to-speech/abort
- CVE-2026-90534 Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method
- CVE-2026-90533 Flowise before 3.1.4 Broken Access Control via organizationuser
- CVE-2026-90532 Adobe Experience Manager | Incorrect Authorization (CWE-863)
- CVE-2026-90531 Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- CVE-2026-90530 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- CVE-2026-9053 File upload in 9front
- CVE-2026-90529 DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting
- CVE-2026-90528 TDuckApp tduck-platform Form Write View index.vue cross site scripting
- CVE-2026-90527 quequnlong shiyi-blog Add Message API index.vue cross site scripting
- CVE-2026-90526 SourceCodester School Registration and Fee System save_class.php sql injection
- CVE-2026-90525 itsourcecode Sales and Inventory System cust_pos_trans.php sql injection
- CVE-2026-90524 jaychouchannel Tourism-Management-System Update Endpoint missing authentication
- CVE-2026-90523 jaychouchannel Tourism-Management-System User Register Endpoint UsersController.java privileges management
- CVE-2026-90522 jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recovery
- CVE-2026-90521 jaychouchannel Tourism-Management-System CRUD MenpiaodingdanController.java authorization
- CVE-2026-90520 jaychouchannel Tourism-Management-System Authorization Interceptor AuthorizationInterceptor.java improper authorization
- CVE-2026-90519 PHPGurukul Bank Locker Management System add-locker-form.php unrestricted upload
- CVE-2026-90518 PHPGurukul Bank Locker Management System sidebar.php access control
- CVE-2026-90517 PHPGurukul Bank Locker Management System view-assign-locker.php authorization
- CVE-2026-90516 SourceCodester School Registration and Fee System pay_report.php sql injection
- CVE-2026-90515 SourceCodester School Registration and Fee System delete_stud.php sql injection
- CVE-2026-90514 SourceCodester School Registration and Fee System save_stud.php sql injection
- CVE-2026-90513 simalexan api-lambda-send-email-ses API Gateway Endpoint template.yml SES.sendEmail missing authentication
- CVE-2026-90511 GongShengyue OnlineBooks listSplit BooksServlet.java sql injection
- CVE-2026-90510 dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key
- CVE-2026-9051 Authentication Bypass Vulnerability in NI SystemLink Enterprise
- CVE-2026-90509 dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentials
- CVE-2026-90508 Chengdu Qilu Technology Ludashi Message Dispatch ProtectFilter64.sys MessageNotifyCallback authorization
- CVE-2026-90507 vvbbnn00 WARP-Clash-API Subscription subscription.py get_surge_subscription access control
- CVE-2026-90506 vvbbnn00 WARP-Clash-API Save Account Job race condition
- CVE-2026-90505 vvbbnn00 WARP-Clash-API doUpdateLicenseKey race condition
- CVE-2026-90504 vvbbnn00 WARP-Clash-API authorized missing authentication
- CVE-2026-90503 Chengdu Qilu Technology Ludashi ComputerZ_x64.sys sub_11008 information disclosure
- CVE-2026-90502 stilleshan ServerStatus Stats Generation main.cpp cross site scripting
- CVE-2026-90501 lenve vhr HrMapper.xml HrInfoController.updateHr privileges management
- CVE-2026-90500 lenve vhr Avatar Upload userface FastDFSUtils.upload unrestricted upload
- CVE-2026-9050 Missing authorization in Slider Revolution
- CVE-2026-90499 lenve vhr Password Update pass HrInfoController.updatePass improper authorization
- CVE-2026-90498 lenve vhr vhr.sql default credentials
- CVE-2026-90497 Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting
- CVE-2026-90496 Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection
- CVE-2026-90495 Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection
- CVE-2026-90494 restify node-restify static.js serveStatic path traversal
- CVE-2026-90493 Tonec Internet Download Manager Kernel Driver idmwfp.sys access control
- CVE-2026-90492 webgjc web_robot web.py controller_recover os command injection
- CVE-2026-90491 sanjevirau gsubs Electron index.js showQuerySuccessPage code injection
- CVE-2026-90490 lenve vhr MailReceiver deserialization
- CVE-2026-90489 Xuxueli xxl-job insert cross site scripting
- CVE-2026-90488 Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection
- CVE-2026-90487 Xuxueli xxl-job JobGroupController.java privileges management
- CVE-2026-90486 openstatusHQ openstatus resolve-custom-domain-rewrite.ts server-side request forgery
- CVE-2026-90485 IOBit Uninstaller IOCTL Dispatch IURegistryFilter.sys sub_11838 null pointer dereference
- CVE-2026-90484 Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash
- CVE-2026-90481 Auth bypass in Burp Suite DAST
- CVE-2026-9048 Missing authorization in Slider Revolution
- CVE-2026-90474 MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass
- CVE-2026-90473 msgpack-java through 0.9.12 Integer Overflow via MAP32
- CVE-2026-90472 msgpack-java through 0.9.12 Stack Overflow via Nested Arrays
- CVE-2026-9047 Auth bypass in Server
- CVE-2026-90467 aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses
- CVE-2026-90466 Apache Impala: Path traversal executes JARs outside trusted paths
- CVE-2026-90465 Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation
- CVE-2026-90464 Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root
- CVE-2026-90463 Memory corruption in Red Hat Enterprise Linux 10
- CVE-2026-90462 Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization
- CVE-2026-90461 Information disclosure in Ironic
- CVE-2026-90460 Missing authorization in Keystone
- CVE-2026-9046 Misconfiguration in App Store
- CVE-2026-90458 Missing authorization in Ironic
- CVE-2026-90457 Weak cryptography in Malcolm
- CVE-2026-90456 Use of default credentials in Malcolm
- CVE-2026-90455 Dependency on vulnerable third-party component in Malcolm
- CVE-2026-90454 Missing authorization in Malcolm
- CVE-2026-90453 Open Redirect in Malcolm
- CVE-2026-90452 Improper certificate validation in Malcolm
- CVE-2026-90451 Use of Default Credentials in Malcolm
- CVE-2026-90450 Incorrect Authorization in Malcolm
- CVE-2026-9045 Privilege escalation in Accessories and Display Manager for Enterprise
- CVE-2026-90449 Missing Authentication for Critical Function in Malcolm
- CVE-2026-90448 Missing Authorization in Malcolm
- CVE-2026-90447 Authentication Bypass by Spoofing in Malcolm