Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 286 of 1013.
- CVE-2026-8782 omec-project amf NGAP Message handler.go null pointer dereference
- CVE-2026-87819 GitPython before 3.1.60 Denial of Service via ReDoS
- CVE-2026-87818 GitPython 3.1.59 Local File Content Oracle via --no-index
- CVE-2026-87817 GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
- CVE-2026-87816 PasswordPusher before 2.11.1 Race Condition View Limit Bypass
- CVE-2026-87815 SiYuan before v3.8.2 Path Traversal via removeRiffDeck
- CVE-2026-87814 SiYuan before v3.8.2 Stored XSS via Asset Preview
- CVE-2026-87813 SiYuan before v3.8.2 Stored XSS via unescaped asset filenames
- CVE-2026-87812 SiYuan before v3.8.2 Stored XSS via Bazaar iconURL
- CVE-2026-87811 SiYuan before v3.8.2 Stored XSS via notebook template paths
- CVE-2026-87810 Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock
- CVE-2026-8781 omec-project amf handler.go RANConfiguration null pointer dereference
- CVE-2026-87809 Siyuan before v3.8.2 Information Disclosure via Export Preview
- CVE-2026-87808 SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock
- CVE-2026-87807 siyuan before v3.8.2 SQL Injection via fullTextSearchBlock
- CVE-2026-87806 Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password
- CVE-2026-87803 Missing authorization in countly-server
- CVE-2026-87802 Apache Syncope: SRA OAuth2 JWT signature verification bypass
- CVE-2026-87800 IBM Cyber Fraud includes components with multiple known vulnerabilities
- CVE-2026-8780 omec-project amf NGAP Message dispatcher.go memory corruption
- CVE-2026-87799 Arbitrary file write on LXD host via symlink in migration stream
- CVE-2026-87798 LXD client recursive file pull allows directory escape via malicious VM agent
- CVE-2026-87797 Client Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_note
- CVE-2026-87796 Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload
- CVE-2026-87795 zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress
- CVE-2026-87794 bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination
- CVE-2026-87793 Reflected XSS in WordPress theme design-scuole-wordpress-theme
- CVE-2026-87792 Multiple authorization bypass in WordPress theme design-scuole-wordpress-theme
- CVE-2026-87791 Path traversal vulnerability in WordPress theme design-scuole-wordpress-theme
- CVE-2026-8779 omec-project amf handler.go NGSetupRequest memory corruption
- CVE-2026-87786 Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates
- CVE-2026-87785 Apache Syncope: JWT subject spoofing
- CVE-2026-87782 Koinonia Link 1.1.2 - 1.1.4 - Subscriber+ Privilege Escalation to Administrator
- CVE-2026-87781 LTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipping Rule 'edit_id' Parameter
- CVE-2026-87780 LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping Rules
- CVE-2026-8778 MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload
- CVE-2026-87779 Apache Syncope: AES Secret Key disclosure via log output
- CVE-2026-87777 Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute
- CVE-2026-87776 compression vulnerable to Denial of Service via memory leak on premature response close
- CVE-2026-87775 Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQLi via tzwrs_update_cell
- CVE-2026-87774 Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection via week
- CVE-2026-87771 Product Question and Answer <= 1.1.0 - Unauthenticated SQL Injection via p_id and read
- CVE-2026-87770 Price Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection via product
- CVE-2026-8777 Edimax BR-6428NS POST Request formStaDrvSetup command injection
- CVE-2026-87767 WP Shortcut Link <= 1.2.0 - Unauthenticated SQL Injection via url
- CVE-2026-87766 Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup
- CVE-2026-87765 Improper Input Validation in Kernel APsys DVFS
- CVE-2026-87764 BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message
- CVE-2026-87762 Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Juggling
- CVE-2026-87761 Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings
- CVE-2026-87760 Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored XSS via Tracking Beacon Metric Name
- CVE-2026-8776 Edimax BR-6428NS POST Request formPPTPSetup buffer overflow
- CVE-2026-87759 Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation
- CVE-2026-87752 HTML Injection in Rolantis Information Technologies' Agentis
- CVE-2026-8775 Edimax BR-6428NS POST Request formL2TPSetup buffer overflow
- CVE-2026-87748 Privilege Escalation via Account Takeover in Interprobe's Qorela DC
- CVE-2026-87747 Ragic｜Enterprise Cloud Database - Arbitrary File Read
- CVE-2026-87744 Missing authorization in Exploit Intelligence
- CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security
- CVE-2026-87742 Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering
- CVE-2026-87741 ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter
- CVE-2026-8774 Edimax BR-6228NC POST Request mp command injection
- CVE-2026-87739 PaperCut MF/NG: User permissions are not evaluated on report generation
- CVE-2026-87737 Weak cryptography in mirage-crypto-ec
- CVE-2026-87736 Memory corruption in mirage-crypto-ec
- CVE-2026-87735 Weak cryptography in mirage-crypto-pk
- CVE-2026-87734 Denial of service in utcp
- CVE-2026-87733 Weak cryptography in mirage-crypto-ec
- CVE-2026-87732 Weak cryptography in mirage-crypto
- CVE-2026-8773 linlinjava litemall Database Setting DbUtil.java load argument injection
- CVE-2026-87727 Path traversal in a-blog cms
- CVE-2026-87726 Memory corruption in NxpNfcRdLib
- CVE-2026-87724 Denial of service in Tor
- CVE-2026-87723 Untrusted Search Path (PATH Hijacking) in fuse-archive
- CVE-2026-87722 Regular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter Endpoints in Gerrit Code Review
- CVE-2026-87721 Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review
- CVE-2026-87720 Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review
- CVE-2026-8772 linlinjava litemall Admin Endpoint sql injection
- CVE-2026-87719 Deserialization of Untrusted Data in GitLab
- CVE-2026-87716 Windows Storage Spaces Controller Denial of Service Vulnerability
- CVE-2026-87715 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-87714 WebDAV Security Feature Bypass Vulnerability
- CVE-2026-87713 Windows Bluetooth Port Driver Remote Code Execution
- CVE-2026-87712 Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability
- CVE-2026-87711 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-87710 Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability
- CVE-2026-8771 linlinjava litemall Front-end WeChat API WxGoodsController.java list sql injection
- CVE-2026-87709 Windows Host Guardian Service Tampering Vulnerability
- CVE-2026-87708 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-87707 Windows Fax and Scan Service Elevation of Privilege Vulnerability
- CVE-2026-87706 Windows Storage Spaces Controller Elevation of Privilege Vulnerability
- CVE-2026-87705 Windows Hyper-V Security Feature Bypass Vulnerability
- CVE-2026-87704 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-87702 Windows Resource Management (MRM) Elevation of Privilege Vulnerability
- CVE-2026-87701 Azure Cosmos DB Elevation of Privilege Vulnerability
- CVE-2026-87700 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-8770 continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal
- CVE-2026-87699 Winlogon Elevation of Privilege Vulnerability
- CVE-2026-87698 Windows Remote Access Service Infrastructure Information Disclosure Vulnerability
- CVE-2026-87697 .NET Remote Code Execution Vulnerability