Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 296 of 1013.
- CVE-2026-86793 CVE-2026-86793
- CVE-2026-86792 Code injection in Apache Airflow Apache Kafka provider
- CVE-2026-86791 iPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation Forgery
- CVE-2026-86790 WP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box Shortcode
- CVE-2026-8679 Missing authorization in AudioIgniter Music Player
- CVE-2026-86789 Information disclosure in Connections Business Directory
- CVE-2026-86788 HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag
- CVE-2026-86787 Affiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via BladeOne @php Directive
- CVE-2026-86786 Slider Pro <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via sliderpro_multiple_images
- CVE-2026-86785 Social Commerce for WooCommerce <= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status Update
- CVE-2026-86784 Visualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source
- CVE-2026-86783 PostX < 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST API
- CVE-2026-86782 Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR
- CVE-2026-86781 SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure
- CVE-2026-86780 Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text
- CVE-2026-8678 Missing authorization in MyParcel
- CVE-2026-86779 Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart
- CVE-2026-86778 Username Enumeration in Maksisoft Technology's Maksisoft Gym
- CVE-2026-86777 AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes
- CVE-2026-86776 KeePass 2.35 through 2.61.1 Memory Exhaustion via KDBX Header Field Size
- CVE-2026-86775 knowns before 0.30.0 Path Traversal via Document API
- CVE-2026-86774 Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy
- CVE-2026-86773 Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints
- CVE-2026-86772 Snipe-IT 8.6.3 Stored XSS via Department Names
- CVE-2026-86771 Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num
- CVE-2026-86770 Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation
- CVE-2026-8677 Prime Elementor Addons <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget HTML Tag Settings
- CVE-2026-86769 Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout
- CVE-2026-86768 Snipe-IT before 8.7.0 Improper Input Validation via API Checkout
- CVE-2026-86767 Snipe-IT before 8.7.0 Cross-Company Read via requested-assets
- CVE-2026-86766 Snipe-IT 8.6.3 Race Condition via Consumable Checkout
- CVE-2026-86765 Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint
- CVE-2026-86764 Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components
- CVE-2026-86763 snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer
- CVE-2026-86762 Snipe-IT before 8.7.0 Authentication Bypass via API Middleware
- CVE-2026-86761 snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints
- CVE-2026-86760 snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag
- CVE-2026-8676 Auth bypass in Simplicity SDK
- CVE-2026-86759 Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer
- CVE-2026-86758 Snipe-IT before 8.7.0 License Key Exposure via CSV Export
- CVE-2026-86757 Snipe-IT before 8.7.0 Information Disclosure via Custom Fields
- CVE-2026-86756 Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState
- CVE-2026-86755 Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth
- CVE-2026-86754 Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients
- CVE-2026-86753 snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint
- CVE-2026-86752 snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints
- CVE-2026-86751 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown
- CVE-2026-86750 snipe-it before 8.7.0 Authorization Bypass via API User Create/Update
- CVE-2026-86749 snipe-it before 8.7.0 Data Loss via Failed Image Write
- CVE-2026-86748 Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive
- CVE-2026-86747 snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User
- CVE-2026-86746 Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay
- CVE-2026-86745 Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export
- CVE-2026-86744 snipe-it before 8.7.0 Race Condition in Asset Checkout
- CVE-2026-86743 Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report
- CVE-2026-86742 Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report
- CVE-2026-86741 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA
- CVE-2026-86740 Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains
- CVE-2026-8674 Assertion failure in the DNS stub resolver with a long search domain
- CVE-2026-86739 Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence
- CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS
- CVE-2026-86737 snipe-it before 8.7.0 Missing Authorization via barcode endpoint
- CVE-2026-86736 snipe-it before 8.7.0 Checkout Request Counter Integrity Failure
- CVE-2026-86735 snipe-it before 8.7.0 SSRF via IPv6 transition address bypass
- CVE-2026-86734 Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field
- CVE-2026-86733 Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore
- CVE-2026-86732 Craft CMS before 5.10.12 Remote Code Execution via element-index
- CVE-2026-86731 Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController
- CVE-2026-86730 Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE
- CVE-2026-8673 Password re-initialization mechanism sends passwords in plain text
- CVE-2026-86729 WWBN AVideo Unrestricted Authentication Attempts via get_api_preauthorize
- CVE-2026-86728 AVideo through 29.0 Unauthenticated Disclosure via epg.json.php
- CVE-2026-86727 AVideo through 29.0 Information Disclosure via stats.json.php
- CVE-2026-86726 AVideo through 29.0 Information Disclosure via restreamsActive.json.php
- CVE-2026-86725 AVideo SocialMediaPublisher Missing Authorization via add.json.php
- CVE-2026-86724 AVideo YPTWallet saveBalance.php Cross-Site Request Forgery
- CVE-2026-86723 AVideo LoginControl PGP Authentication Bypass via verifyChallenge
- CVE-2026-86722 AVideo Authentication Bypass via SQL Cache Invalidation
- CVE-2026-86721 AVideo through c3edcc274c Authorization Bypass via Session Cookie
- CVE-2026-86720 WWBN AVideo Missing Authorization via resendRestreamer.json.php
- CVE-2026-8672 Default credentials for internal DB
- CVE-2026-86719 WWBN AVideo CustomizeUser Cross-Site Request Forgery Session Hijacking
- CVE-2026-86718 WWBN AVideo Cross-Site Request Forgery via deleteHistory.json.php
- CVE-2026-86717 Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup
- CVE-2026-86716 Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow
- CVE-2026-86714 PX4 Autopilot through 1.17.0 Stack Buffer Over-read via netman
- CVE-2026-86713 PX4 Autopilot through 1.17.0 Use-After-Free in load_mon
- CVE-2026-86712 SiYuan before 3.8.2 Remote Code Execution via Clipboard
- CVE-2026-86711 electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge
- CVE-2026-86710 Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter
- CVE-2026-8671 Log Files contain encrypted secrets
- CVE-2026-86709 The Pressengine <= 1.0 - Unauthenticated Authentication Bypass
- CVE-2026-86708 Sensitive data exposure
- CVE-2026-86707 Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter
- CVE-2026-86706 Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Update
- CVE-2026-86701 Missing authorization in ManabiPocket for Parents
- CVE-2026-8670 Insecure session handling on metrics web server
- CVE-2026-86698 Refresh tokens accepted as private repository credentials at the CDN
- CVE-2026-86696 Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion
- CVE-2026-8669 Imager versions through 1.030 for Perl allow a heap out of bounds (OOB) write on crafted multi-frame GIF files