Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 293 of 1013.
- CVE-2026-87141 Missing authorization in Oracle Hyperion Data Relationship Management
- CVE-2026-87140 Privilege escalation in Oracle Hyperion Data Relationship Management
- CVE-2026-8714 Denial-of-Service Vulnerability in RTSP Input Handling on TP-Link's Tapo C520WS
- CVE-2026-87139 Privilege escalation in Oracle Hyperion Data Relationship Management
- CVE-2026-87138 Denial of service in Oracle Hyperion Data Relationship Management
- CVE-2026-87137 Missing authorization in Oracle Hyperion Data Relationship Management
- CVE-2026-87136 Missing authorization in Oracle Hyperion Data Relationship Management
- CVE-2026-87135 Missing authorization in Oracle Hyperion Data Relationship Management
- CVE-2026-87134 Missing authorization in Oracle Hyperion Data Relationship Management
- CVE-2026-87133 Missing authorization in Oracle Hyperion Data Relationship Management
- CVE-2026-87132 Cross-site request forgery in Oracle Hyperion Data Relationship Management
- CVE-2026-87131 Missing authorization in Oracle Hyperion Data Relationship Management
- CVE-2026-87130 Missing authorization in Oracle Hyperion Data Relationship Management
- CVE-2026-8713 Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value
- CVE-2026-87129 Auth bypass in Oracle Hyperion Data Relationship Management
- CVE-2026-87128 Auth bypass in Oracle Hyperion Data Relationship Management
- CVE-2026-87127 Information disclosure in Oracle Purchasing
- CVE-2026-87126 Denial of service in Oracle Report Manager
- CVE-2026-87125 Missing authorization in Oracle Financials for Asia/Pacific
- CVE-2026-87124 Missing authorization in Oracle iRecruitment
- CVE-2026-87123 hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping
- CVE-2026-87121 Out-of-bounds write in lwIP TCP/IP Stack MQTT Client Application
- CVE-2026-8712 Wyoming < 1.10.2 SSRF via uri Query Parameter
- CVE-2026-87119 Auth bypass in mpp
- CVE-2026-87118 Botslab G980H Dashcams Out-of-bounds Write
- CVE-2026-87117 Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec
- CVE-2026-87116 Tanium addressed a server-side request forgery vulnerability in Threat Response.
- CVE-2026-87115 Path traversal in VikAppointments Services Booking Calendar
- CVE-2026-87114 Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo
- CVE-2026-87113 Tanium addressed an improper access controls vulnerability in Threat Response.
- CVE-2026-87111 User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header
- CVE-2026-87110 Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints
- CVE-2026-8711 NGINX JavaScript vulnerability
- CVE-2026-87109 Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings
- CVE-2026-87108 Ops Manager Improper Authorization in Daily Host Monitoring Retrieval
- CVE-2026-87107 Consul vulnerable to an authorization bypass in the catalog deregistration path
- CVE-2026-87106 Consul vulnerable to a denial of service in the native RPC listener
- CVE-2026-87105 Tanium addressed a SQL injection vulnerability in Threat Response.
- CVE-2026-87103 Security feature bypass in Acronis Cyber Protect 17
- CVE-2026-87102 Security feature bypass in Acronis Cyber Protect 17
- CVE-2026-87101 Security feature bypass in Acronis Cyber Protect 17
- CVE-2026-87100 Security feature bypass in Acronis Cyber Protect 17
- CVE-2026-87099 Cross-site scripting in Acronis Cyber Protect 17
- CVE-2026-87098 Missing authorization in Acronis Cyber Protect 17
- CVE-2026-87097 Information disclosure in Acronis Cyber Protect 17
- CVE-2026-87096 Missing authorization in Acronis Cyber Infrastructure
- CVE-2026-87095 Missing authorization in Acronis Cyber Infrastructure
- CVE-2026-87093 MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation
- CVE-2026-87091 Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters
- CVE-2026-87090 Consul vulnerable to an authorization bypass in the catalog node-write path
- CVE-2026-8709 Privilege escalation in Progress MarkLogic Server REST document patch operation
- CVE-2026-87088 Tanium addressed an unauthorized code execution vulnerability in Enforce.
- CVE-2026-87086 Tanium addressed a denial of service vulnerability in Provision.
- CVE-2026-87085 Tanium addressed a SQL injection vulnerability in Provision.
- CVE-2026-87084 Tanium addressed a server-side request forgery vulnerability in Enforce.
- CVE-2026-87083 tile-ai tilelang Kernel Cache kernel_cache.py KernelCache._load_kernel_from_disk deserialization
- CVE-2026-87082 Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode.
- CVE-2026-87081 Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii.
- CVE-2026-87080 Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode.
- CVE-2026-8708 Genzel breadcrumbs <= 1.2 - Cross-Site Request Forgery to Settings Update via Plugin Settings Page
- CVE-2026-87079 Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode.
- CVE-2026-87078 Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode.
- CVE-2026-87076 Tanium addressed an information disclosure vulnerability in Discover.
- CVE-2026-87075 Tanium addressed an improper access controls vulnerability in Comply.
- CVE-2026-87074 Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link
- CVE-2026-87073 Tanium addressed an improper access controls vulnerability in Comply.
- CVE-2026-87072 Tanium addressed an improper access controls vulnerability in Comply.
- CVE-2026-87071 Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts
- CVE-2026-87070 Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing
- CVE-2026-8707 NS Product icon badge <= 1.2.4 - Reflected Cross-Site Scripting via PHP_SELF
- CVE-2026-87069 Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe
- CVE-2026-87068 Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import
- CVE-2026-87067 Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection
- CVE-2026-8706 Sensitive user data could be leaked to other applications through Reader mode
- CVE-2026-8705 ClearSale Total <= 3.4.2 - Unauthenticated SQL Injection
- CVE-2026-87048 Tanium addressed an improper access controls vulnerability in Comply.
- CVE-2026-87047 Tanium addressed an improper access controls vulnerability in Comply.
- CVE-2026-87046 Tanium addressed an improper access controls vulnerability in Comply.
- CVE-2026-8704 Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified
- CVE-2026-87037 Tanium addressed an improper access controls vulnerability in Comply.
- CVE-2026-87036 Tanium addressed an improper access controls vulnerability in Comply.
- CVE-2026-87035 Tanium addressed an information disclosure vulnerability in Comply.
- CVE-2026-87034 Tanium addressed a SQL injection vulnerability in Comply.
- CVE-2026-87033 Tanium addressed an improper access controls vulnerability in Comply.
- CVE-2026-87032 Tanium addressed an information disclosure vulnerability in Tanium Server.
- CVE-2026-87031 Missing authorization in Concrete CMS
- CVE-2026-87030 Tanium addressed a path traversal vulnerability in Comply.
- CVE-2026-8703 Endless Scroll <= 1.0.0 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]
- CVE-2026-87029 undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor
- CVE-2026-87028 Missing authorization in Concrete CMS
- CVE-2026-87026 Tanium addressed an improper access controls vulnerability in Threat Response.
- CVE-2026-87025 Tanium addressed an improper access controls vulnerability in Comply.
- CVE-2026-87024 Tanium addressed a SQL injection vulnerability in Asset.
- CVE-2026-87023 Tanium addressed a path traversal vulnerability in Comply.
- CVE-2026-87022 Apache Tomcat: WebSocket message smuggling with per-message-deflate
- CVE-2026-87021 Tanium addressed an unauthorized code execution vulnerability in Comply.
- CVE-2026-87020 Orthanc DICOM Server Integer Overflow or Wraparound
- CVE-2026-8702 GBI To Print <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'div' Shortcode Attribute
- CVE-2026-87019 Tanium addressed an improper access controls vulnerability in Comply.
- CVE-2026-87018 undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation