Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 281 of 1013.
- CVE-2026-88621 OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php.
- CVE-2026-88620 SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint.
- CVE-2026-8862 Vulnerabilities exists in IBM Netezza Software
- CVE-2026-88619 1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module.
- CVE-2026-88618 1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality.
- CVE-2026-88617 SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint.
- CVE-2026-88616 An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTas
- CVE-2026-8861 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-88593 kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint.
- CVE-2026-88592 kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF).
- CVE-2026-8859 Path Traversal in APIRequest Component via Content-Disposition Header
- CVE-2026-8858 WebSphere Application Server Remote Code Execution
- CVE-2026-8857 Full RCE using EasyTimeline Extension
- CVE-2026-8856 IBM HTTP Server is affected by multiple vulnerabilities
- CVE-2026-8855 IBM HTTP Server is affected by multiple vulnerabilities
- CVE-2026-8854 IBM HTTP Server is affected by multiple vulnerabilities
- CVE-2026-8853 MW WP Form <= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'memo' Parameter
- CVE-2026-8852 IBM HTTP Server is affected by multiple vulnerabilities
- CVE-2026-88514 An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information.
- CVE-2026-8851 SOGo < 5.12.8 SQL Injection via addUserInAcls endpoint
- CVE-2026-8850 IBM HTTP Server is affected by multiple vulnerabilities
- CVE-2026-8849 Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation.
- CVE-2026-8848 Missing authorization in Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
- CVE-2026-8847 Dideo <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-88467 CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors
- CVE-2026-8846 Tuxquote <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-8845 Islamic Database <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-8844 Responsive Check <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-8843 Calling createIndex with certain index types can crash mongod
- CVE-2026-88424 FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter().
- CVE-2026-88421 Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to vie
- CVE-2026-88420 A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0 allows authen
- CVE-2026-8842 Google+ Link Name <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-88419 An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of Wuzh
- CVE-2026-88418 CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin reques
- CVE-2026-88416 MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature.
- CVE-2026-88415 MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS).
- CVE-2026-88414 MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do).
- CVE-2026-88412 An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) of FalkorDB (Redis module) v4.20.1 allows attackers to cause
- CVE-2026-88411 Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Ser
- CVE-2026-88410 The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application.
- CVE-2026-8841 Cross-site scripting in Extra Settings for RocketChat
- CVE-2026-88409 FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c).
- CVE-2026-88408 FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/op_aggregate.c).
- CVE-2026-88407 An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers
- CVE-2026-88406 FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_validations.c).
- CVE-2026-88405 A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of U
- CVE-2026-88404 A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of U
- CVE-2026-88403 A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resou
- CVE-2026-88402 A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via inje
- CVE-2026-8840 Missing authorization in Booking calendar, Appointment Booking System
- CVE-2026-88397 ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.
- CVE-2026-88396 ApiAdmin v5.0 and before is vulnerable to Directory Traversal.
- CVE-2026-88395 GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.
- CVE-2026-88394 WookTeam v1.6.6 and before is vulnerable to a Directory Traversal.
- CVE-2026-88393 WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export.
- CVE-2026-88392 Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local().
- CVE-2026-88391 Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar
- CVE-2026-88390 An out-of-bounds write vulnerability in jslGetTokenValueAsString() in Espruino 2v29 (commit bffc6d0) allows crafted JavaScript input contain
- CVE-2026-8839 MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints
- CVE-2026-88389 Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c.
- CVE-2026-88388 Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-bit builds.
- CVE-2026-88387 LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType).
- CVE-2026-88386 libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks.
- CVE-2026-88385 Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing.
- CVE-2026-88384 OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path.
- CVE-2026-88383 libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind().
- CVE-2026-88382 hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser.
- CVE-2026-8838 Remote Code Execution via eval() Injection in amazon-redshift-python-driver
- CVE-2026-88378 QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag().
- CVE-2026-88377 Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers.
- CVE-2026-88376 Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create().
- CVE-2026-88373 libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path.
- CVE-2026-88372 libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files.
- CVE-2026-88371 ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function.
- CVE-2026-88370 libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled load_ini_buffer.h utility and strip_ini_cache().
- CVE-2026-8837 Cross-site scripting in WP Iframe Geo Style for Amazon affiliates
- CVE-2026-88369 zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump().
- CVE-2026-88368 NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function.
- CVE-2026-88367 NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization.
- CVE-2026-88366 NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__pathArcTo() when parsing SVG arc commands.
- CVE-2026-88365 minimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_skip_id3v1() when parsing the APEv2 tag-size field.
- CVE-2026-88362 MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c.
- CVE-2026-88361 SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries.
- CVE-2026-88360 libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images.
- CVE-2026-8836 lwIP snmpv3 USM snmp_msg.c snmp_parse_inbound_frame stack-based overflow
- CVE-2026-88359 libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format().
- CVE-2026-88358 simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse_unpadded().
- CVE-2026-88357 nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code.
- CVE-2026-88355 An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in new_expr().
- CVE-2026-88351 An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms.
- CVE-2026-88350 An integer overflow vulnerability exists in MPack 1.1.1 in mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc().
- CVE-2026-8835 IBM HTTP Server is affected by multiple vulnerabilities
- CVE-2026-88345 An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e.
- CVE-2026-88344 An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e.
- CVE-2026-88341 A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files.
- CVE-2026-88340 An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files.
- CVE-2026-8834 IBM HTTP Server is affected by multiple vulnerabilities
- CVE-2026-88339 A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV).
- CVE-2026-8833 XSS in urls