Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 298 of 1013.
- CVE-2026-86509 D-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow
- CVE-2026-86507 Apache Roller: Stored XSS in comment moderation via comment author URL
- CVE-2026-86506 Missing authorization in GoLand
- CVE-2026-86505 Information disclosure in IntelliJ IDEA
- CVE-2026-86504 Code injection in IntelliJ IDEA
- CVE-2026-86503 Server-side request forgery in IntelliJ IDEA
- CVE-2026-86502 Missing authorization in IntelliJ IDEA
- CVE-2026-86501 Information disclosure in IntelliJ IDEA
- CVE-2026-86500 Privilege escalation in YouTrack
- CVE-2026-8650 Authenticated Path Traversal allows MOVEit admins to view arbitrary system files
- CVE-2026-86499 Missing authorization in YouTrack
- CVE-2026-86498 Missing authorization in YouTrack
- CVE-2026-86497 Information disclosure in YouTrack
- CVE-2026-86496 Missing authorization in YouTrack
- CVE-2026-86495 Missing authorization in YouTrack
- CVE-2026-86494 Missing authorization in YouTrack
- CVE-2026-86493 Missing authorization in YouTrack
- CVE-2026-86492 Information disclosure in YouTrack
- CVE-2026-86491 Cross-site scripting in YouTrack
- CVE-2026-86490 Missing authorization in YouTrack
- CVE-2026-8649 Institution scope bypass vulnerability in custom reports
- CVE-2026-86489 Missing authorization in YouTrack
- CVE-2026-86488 Missing authorization in YouTrack
- CVE-2026-86487 Missing authorization in YouTrack
- CVE-2026-86486 Auth bypass in YouTrack
- CVE-2026-86485 Auth bypass in YouTrack
- CVE-2026-86484 Cross-site scripting in YouTrack
- CVE-2026-86483 Cross-site scripting in YouTrack
- CVE-2026-86482 Privilege escalation in YouTrack
- CVE-2026-86481 Information disclosure in YouTrack
- CVE-2026-86480 Auth bypass in Hub
- CVE-2026-86479 Missing authorization in YouTrack
- CVE-2026-86478 Auth bypass in YouTrack
- CVE-2026-86476 Memory corruption in Red Hat Enterprise Linux 10
- CVE-2026-86475 Appointment Hour Booking < 1.5.95 - Unauthenticated Booking Capacity Bypass via Multi-Appointment Submission
- CVE-2026-86474 Improper Certificate Validation in the Firmware Download vulnerability
- CVE-2026-86473 Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry
- CVE-2026-86472 fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
- CVE-2026-86471 Apache CouchDB: Admin credentials leading to code execution as operating system user
- CVE-2026-8647 Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available
- CVE-2026-86469 Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path
- CVE-2026-86467 Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account
- CVE-2026-86466 Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated
- CVE-2026-86465 Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key
- CVE-2026-86464 Hardcoded credentials in Eclipse aeriOS
- CVE-2026-86463 Apache CXF: FIQL Query Parser Denial of Service
- CVE-2026-86462 Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions
- CVE-2026-86461 FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter
- CVE-2026-86460 Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
- CVE-2026-8646 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
- CVE-2026-86452 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding
- CVE-2026-86451 MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects
- CVE-2026-86450 Sensitive Data Exposure in Parla Auto's DetaWix Mobile Web Portal
- CVE-2026-86449 LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API
- CVE-2026-86448 LearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_order
- CVE-2026-86447 LearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax
- CVE-2026-86446 LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint
- CVE-2026-86445 LearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajax
- CVE-2026-86444 LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter
- CVE-2026-86443 Cleartext Storage of Sensitive Information Vulnerability
- CVE-2026-86441 MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data
- CVE-2026-86440 MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs
- CVE-2026-8644 IBM WebSphere Application Server is affected by an identity spoofing vulnerability
- CVE-2026-86439 knowns before 0.30.0 Path Traversal via MCP doc and memory tools
- CVE-2026-86438 Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action
- CVE-2026-86437 Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload
- CVE-2026-86436 Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints
- CVE-2026-86435 commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote
- CVE-2026-86434 commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision
- CVE-2026-86433 commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes
- CVE-2026-86432 commonmark 2.0.0 before 2.8.4 Denial of Service via XML
- CVE-2026-86431 commonmark before 2.9.1 XSS via AttributesExtension form feed bypass
- CVE-2026-86430 league/commonmark before 2.9.1 Denial of Service via parsing
- CVE-2026-8643 pip can extract console_scripts and gui_scripts outside installation directory
- CVE-2026-86429 commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes
- CVE-2026-86428 commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes
- CVE-2026-86427 LibreNMS before 26.8.0 Argument Injection via graph_title
- CVE-2026-86426 LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion
- CVE-2026-86425 ImageMagick before 7.1.2-30 Heap-use-after-free via Layer
- CVE-2026-86424 ImageMagick before 7.1.2-30 Path Traversal via TOCTOU Symlink Race
- CVE-2026-86423 ImageMagick before 7.1.2-30 Heap-use-after-free via GetList
- CVE-2026-86422 ImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink Race
- CVE-2026-86421 ImageMagick before 7.1.2-30 Memory Leak via MSL decoder
- CVE-2026-86420 ImageMagick before 7.1.2-30 Denial of Service Memory Budget
- CVE-2026-86419 MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery
- CVE-2026-86418 MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
- CVE-2026-86417 MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users
- CVE-2026-86416 ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods
- CVE-2026-86415 auto client cert connection reuse mixup
- CVE-2026-86414 leaking host credentials to HTTP proxy
- CVE-2026-86413 Negotiate credentials sent to redirected origin
- CVE-2026-86412 server-set cookie erases cookie jar
- CVE-2026-86411 FTP connection reuse inherits client-certificate
- CVE-2026-86410 redirect to SFTP or SCP bypasses host verification
- CVE-2026-86409 stale SigV4 headers sent unintended
- CVE-2026-86408 MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events
- CVE-2026-86407 User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page
- CVE-2026-86406 User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase
- CVE-2026-86405 Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop
- CVE-2026-86404 Deserialization in Red Hat AMQ Broker 7