Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 299 of 1013.
- CVE-2026-86401 SQL injection in PowerProtect Data Domain Management Center
- CVE-2026-86400 Auth bypass in PowerProtect Data Domain
- CVE-2026-86399 Command injection in PowerProtect Data Domain
- CVE-2026-86398 Path traversal in PowerProtect Data Domain
- CVE-2026-86397 Missing authorization in PowerProtect Data Domain
- CVE-2026-86396 Command injection in PowerProtect Data Domain
- CVE-2026-86395 Command injection in PowerProtect Data Domain Virtual Edition
- CVE-2026-86394 Command injection in PowerProtect Data Domain
- CVE-2026-86393 Privilege escalation in PowerProtect Data Domain
- CVE-2026-86392 Memory corruption in PowerProtect Data Domain
- CVE-2026-86391 Auth bypass in PowerProtect Data Domain Management Center
- CVE-2026-86390 Missing authorization in PowerProtect Data Domain
- CVE-2026-86389 Integer overflow in PowerProtect Data Domain
- CVE-2026-86388 Path traversal in PowerProtect Data Domain
- CVE-2026-86386 SQL injection in PowerProtect Data Domain Management Center
- CVE-2026-86385 Privilege escalation in PowerProtect Data Domain
- CVE-2026-86384 Hardcoded credentials in PowerProtect Data Domain
- CVE-2026-86383 Path traversal in PowerProtect Data Domain
- CVE-2026-86380 Integer overflow in PowerProtect Data Domain
- CVE-2026-86379 Command injection in PowerProtect Data Domain Management Center
- CVE-2026-86378 Memory corruption in PowerProtect Data Domain
- CVE-2026-86377 Memory corruption in PowerProtect Data Domain
- CVE-2026-86375 Information disclosure in Application Installer,
- CVE-2026-8637 Privilege escalation in LanSchool Classic
- CVE-2026-86362 Privilege escalation in System Update
- CVE-2026-86361 Privilege escalation in System Update
- CVE-2026-86360 Path traversal in System Update
- CVE-2026-8636 Multiple Vulnerabilities in IBM Datacap
- CVE-2026-86359 Misconfiguration in Repository Manager
- CVE-2026-86358 Memory corruption in Update Package Framework
- CVE-2026-86351 MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL
- CVE-2026-86350 Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up
- CVE-2026-8635 Arbitrary Code Execution in Python Interpreter Component
- CVE-2026-86349 Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting
- CVE-2026-86348 MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process
- CVE-2026-86347 MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion
- CVE-2026-86345 Security feature bypass in Red Hat Directory Server 11
- CVE-2026-86344 Denial of service in Red Hat Directory Server 11
- CVE-2026-86342 MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information
- CVE-2026-86341 Access Control Check Implemented After Asset is Accessed in GitLab
- CVE-2026-8634 Crabbox < v0.12.0 Environment Variable Information Disclosure
- CVE-2026-86338 Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle
- CVE-2026-86335 LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse
- CVE-2026-86334 CLI Path Traversal via Content-Disposition in LXD Image Export/Copy
- CVE-2026-86332 Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user
- CVE-2026-86330 Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal
- CVE-2026-8633 Code injection in Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty
- CVE-2026-86326 Security feature bypass in MGate MB3170 Series
- CVE-2026-86325 Memory corruption in MGate MB3170 Series
- CVE-2026-86321 java-json-tools jackson-coreutils URL Validation JsonLoader.java JsonLoader.fromURL server-side request forgery
- CVE-2026-86320 Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)
- CVE-2026-8632 HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution
- CVE-2026-86319 java-json-tools json-patch Patch Operation JsonPatch.java JsonPatch.apply resource consumption
- CVE-2026-86318 java-json-tools json-patch JsonMergePatchDeserializer.java JsonMergePatch.fromJson stack-based overflow
- CVE-2026-86317 ggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertion
- CVE-2026-86315 Integer overflow in Escargot
- CVE-2026-86314 Integer overflow in Walrus
- CVE-2026-86313 Memory corruption in Walrus
- CVE-2026-86311 Cross-site scripting in Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2026-86310 itsourcecode Sales and Inventory System cust_edit1.php sql injection
- CVE-2026-8631 HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution
- CVE-2026-86309 itsourcecode Sales and Inventory System pro_searchfrm.php sql injection
- CVE-2026-86308 light0011 cms Debug Mode config.php information disclosure
- CVE-2026-86307 light0011 cms cross-site request forgery
- CVE-2026-86306 light0011 cms Cookie Helper UserModel.class.php improper authentication
- CVE-2026-86305 light0011 cms Upload.class.php upload unrestricted upload
- CVE-2026-86304 MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::PO
- CVE-2026-86303 92181 markdown md.c lds out-of-bounds
- CVE-2026-86302 code-projects Hospital Information System SQL Database Backup File his.sql information disclosure
- CVE-2026-86301 code-projects Hospital Information System Patient Management editPatient.php cross site scripting
- CVE-2026-86300 Tenda AC9 Web Management R7WebsSecurityHandler improper authentication
- CVE-2026-8630 justhtml before 1.12.0 Mutation XSS via Raw Text Elements
- CVE-2026-86299 Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection
- CVE-2026-86298 SourceCodester Class and Exam Timetabling System delete_subject.php sql injection
- CVE-2026-86297 D-Link DIR-605 L2TP Control Message tunnel.c tunnel_set_params off-by-one
- CVE-2026-86296 D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow
- CVE-2026-86295 D-Link DIR-895L udhcpcd serverpacket.c sendACK command injection
- CVE-2026-86294 SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting
- CVE-2026-86293 SourceCodester Simple Traffic Offense System Deletion Endpoint delete-user.php missing authentication
- CVE-2026-86292 SourceCodester Simple Traffic Offense System User Creation saveuser.php missing authentication
- CVE-2026-86291 itsourcecode Sales and Inventory System us_edit1.php sql injection
- CVE-2026-86290 SourceCodester Online Voting System ajax.php save_category sql injection
- CVE-2026-8629 Crabbox < v0.12.0 Privilege Escalation via Agent Ticket Endpoints
- CVE-2026-86289 Ollama GGUF Decoder gguf.go readGGUFV1String integer overflow
- CVE-2026-86288 ModelCloud GPTQModel Triton dequantization kernel tritonv2.py out-of-bounds
- CVE-2026-86287 Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths
- CVE-2026-86285 BookStack Attachment Edit Endpoint AttachmentController.php getUpdateForm access control
- CVE-2026-86284 jaychouchannel Tourism-Management-System CommonController.java getOption information disclosure
- CVE-2026-86283 MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data
- CVE-2026-86282 jaychouchannel Tourism-Management-System CommonDao CommonController.java sql injection
- CVE-2026-86281 SourceCodester Syllabus-Aligned Learning Management & Examination System cross-site request forgery
- CVE-2026-86280 SourceCodester Syllabus-Aligned Learning Management & Examination System cict_portal.sql cleartext storage
- CVE-2026-8628 EntreDroppers <= 1.1.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter
- CVE-2026-86279 SourceCodester Syllabus-Aligned Learning Management & Examination System Login auth_process.php session fixiation
- CVE-2026-86278 SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting
- CVE-2026-86277 SourceCodester Syllabus-Aligned Learning Management & Examination System delete_exam.php authorization
- CVE-2026-86276 SourceCodester Syllabus-Aligned Learning Management & Examination System db.php hard-coded credentials
- CVE-2026-86275 SourceCodester Syllabus-Aligned Learning Management & Examination System auth.php register privileges management
- CVE-2026-86274 projeto-siga Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar authorization
- CVE-2026-86273 projeto-siga HTML-to-PDF Endpoint ExUtilController.java DownloadExterno.getUrl server-side request forgery