Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 297 of 1013.
- CVE-2026-86689 Cleartext Transmission of Sensitive Information in Bransys ELD
- CVE-2026-86688 Session id is not renewed on authentication in ash_authentication, allowing session fixation
- CVE-2026-86684 Gitea push mirror local path check uses the repository owner
- CVE-2026-86683 Broken Authentication Vulnerability
- CVE-2026-86681 Broken Access Control vulnerability
- CVE-2026-8668 Hardcoded credentials in embedded content
- CVE-2026-86679 Broken Access Control vulnerability
- CVE-2026-86678 Broken Authentication vulnerability
- CVE-2026-86677 Broken Authentication vulnerability
- CVE-2026-86675 itsourcecode Sales and Inventory System us_edit.php sql injection
- CVE-2026-86674 ningzichun Student Management System login.php session_start session fixiation
- CVE-2026-86673 ningzichun Student Management System Database Connection database.php mysqli_connect hard-coded credentials
- CVE-2026-86672 ningzichun Student Management System Backup example.7z information disclosure
- CVE-2026-86671 Server-side request forgery in Eclipse Che
- CVE-2026-86670 aircheng-org iWebShop-5 Authentication Storage admin.php weak password hash
- CVE-2026-8667 Incorrect Authorization in GitLab
- CVE-2026-86669 aircheng-org iWebShop-5 systemseller.php login improper authentication
- CVE-2026-86668 aircheng-org iWebShop-5 pic.php uploadFile cross site scripting
- CVE-2026-86667 aircheng-org iWebShop-5 member.php member_list sql injection
- CVE-2026-86666 aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload
- CVE-2026-86665 aircheng-org iWebShop-5 update.php index authorization
- CVE-2026-8666 OS Command Injection in Rapid7 InsightConnect Traceroute Plugin
- CVE-2026-8665 OS Command Injection in Rapid7 InsightConnect Translate Plugin
- CVE-2026-86644 star7th showdoc API Page Save Endpoint editormd.js cross site scripting
- CVE-2026-8664 OS Command Injection in Rapid7 InsightConnect Finger Plugin
- CVE-2026-8663 OS Command Injection in Rapid7 InsightConnect RPM Plugin
- CVE-2026-8662 Path Traversal in Rapid7 InsightConnect Compression Plugin
- CVE-2026-86612 Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data Source
- CVE-2026-86611 Download Manager (Free & Pro) - Privacy Settings Update via CSRF
- CVE-2026-86610 Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon
- CVE-2026-8661 Server-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF Plugin
- CVE-2026-86609 Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription
- CVE-2026-86608 WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion
- CVE-2026-86607 Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator
- CVE-2026-86604 GTranslate < 5.0.1 - Unauthenticated Arbitrary Shortcode Execution via Email Translation
- CVE-2026-86603 WP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm_search_lists
- CVE-2026-86602 WP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_preview
- CVE-2026-86601 WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content
- CVE-2026-86600 Workload identity attestation generated before login host validation in Snowflake drivers
- CVE-2026-8660 OS Command Injection in Rapid7 InsightConnect Ping Plugin
- CVE-2026-86597 Sensitive information written to logs by Snowflake drivers
- CVE-2026-86595 SQLi in Iron Mountain's enVision
- CVE-2026-86591 Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route
- CVE-2026-86590 Server-side request forgery in Eclipse Che
- CVE-2026-8659 OS Command Injection in Rapid7 InsightConnect SQLmap Plugin
- CVE-2026-86589 Apache Answer: User Center integration does not revoke first-login sessions after central account suspension
- CVE-2026-86585 Improper Verification of the Firmware Signature vulnerability
- CVE-2026-86583 Privilege escalation in Import and export users and customers
- CVE-2026-8658 OS Command Injection in Rapid7 InsightConnect Tcpdump Plugin
- CVE-2026-86577 Out-of-bounds Write Vulnerability in JP1 Products
- CVE-2026-86576 Heap-based Buffer Overflow Vulnerability in JP1 Products
- CVE-2026-86575 Stack-based Buffer Overflow Vulnerability in JP1 Products
- CVE-2026-86574 Heap-based Buffer Overflow Vulnerability in JP1/Base
- CVE-2026-86573 Memory corruption in Hitachi Disk Array Driver for AIX
- CVE-2026-8657 jsondiffpatch patch APIs are vulnerable to prototype pollution
- CVE-2026-86567 Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap
- CVE-2026-86566 Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings)
- CVE-2026-86565 Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write
- CVE-2026-86564 Dpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handler
- CVE-2026-86563 Dpdk: dpdk: double offset bug in vhost log mapping calculation
- CVE-2026-86562 Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse)
- CVE-2026-86561 Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup
- CVE-2026-8656 Cross-site scripting in jsondiffpatch
- CVE-2026-86556 An information disclosure vulnerability in ZTE U30 Air product
- CVE-2026-86555 Hardcoded Key Vulnerability in ZTE SmartLife APP
- CVE-2026-86554 Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP
- CVE-2026-86553 A password reset vulnerability in ZTE SmartLife APP
- CVE-2026-86552 A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP
- CVE-2026-86551 Wi-Fi MAC Address Obtainment by Non-privileged Program Vulnerability in ZTE Z80Ultra (NX741J) product
- CVE-2026-86550 UXSS vulnerability in ZTE browser products
- CVE-2026-8655 Multiple Memory overflow vulnerabilities leading to unpredictable or erroneous behavior and Denial of Service
- CVE-2026-86547 mrubyc through 4.0.0 NULL Pointer Dereference via OP_ENTER
- CVE-2026-86544 knowns before 0.30.0 Authorization Bypass via Misclassified Code Actions
- CVE-2026-86543 knowns before 0.30.0 Unauthenticated Management API Exposure
- CVE-2026-86542 knowns before 0.30.0 Path Traversal via Import Name
- CVE-2026-86541 knowns before 0.30.0 Path Traversal via code.replace MCP action
- CVE-2026-86540 knowns before 0.30.0 Arbitrary Code Execution via LSP Binary
- CVE-2026-8654 Command injection in Cassandra Connector
- CVE-2026-86539 knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint
- CVE-2026-86538 knowns before 0.30.0 Path Traversal via templateFile parameter
- CVE-2026-86537 Denial of service in Apache Thrift
- CVE-2026-86536 Code injection in Apache Thrift
- CVE-2026-86535 Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely
- CVE-2026-86533 Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
- CVE-2026-86530 Command injection in WEX-G300
- CVE-2026-8653 MasterStudy LMS Pro Plus <= 4.8.20 - Authenticated (Instructor+) SQL Injection via 'columns' Parameter
- CVE-2026-86522 Log injection via an unescaped password reset identity in AshAuthentication
- CVE-2026-86520 Use of Hard-coded Credentials in Bransys ELD
- CVE-2026-8652 Command injection in Aterm CM51FD
- CVE-2026-86519 code-projects Student Crud Operation Backup File card_activation.sql information disclosure
- CVE-2026-86518 code-projects Student Crud Operation edit.php sql injection
- CVE-2026-86517 itsourcecode Sales and Inventory System us_searchfrm.php mysqli_query sql injection
- CVE-2026-86516 Privilege escalation in mocknest-serverless
- CVE-2026-86515 vgmstream txtp txtp_parser.c add_entry resource consumption
- CVE-2026-86514 vgmstream txth-txtp txth.c sscanf stack-based overflow
- CVE-2026-86513 Denial of service in jackson-coreutils
- CVE-2026-86512 java-json-tools json-patch Copy Move Operations CopyOperation.java MoveOperation.apply access control
- CVE-2026-86511 java-json-tools jackson-coreutils JacksonUtils.java BigDecimal.toPlainString resource consumption
- CVE-2026-86510 D-Link DIR-822A L2TP Control Message tunnel_set_params out-of-bounds write
- CVE-2026-8651 IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer