Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 300 of 1013.
- CVE-2026-86272 Beijing Meite Software Technology U+Smart Enjoyment WebSite UploadFormImg.ashx unrestricted upload
- CVE-2026-86271 FluentCMS PermissionManager.cs GetAccessible authorization
- CVE-2026-86270 itsourcecode Sales and Inventory System settings_edit.php sql injection
- CVE-2026-8627 Correct Prices <= 1.0 - Reflected Cross-Site Scripting via PHP_SELF Parameter
- CVE-2026-86269 itsourcecode Sales and Inventory System emp_edit1.php sql injection
- CVE-2026-86268 itsourcecode School Management System User_Login.php sql injection
- CVE-2026-86267 itsourcecode Information System Society Membership System check_student.php sql injection
- CVE-2026-86265 itsourcecode Sales and Inventory System us_transac.php sql injection
- CVE-2026-86264 sfturing ssm_pro Order Endpoint OrderController.java cross site scripting
- CVE-2026-86263 sfturing hosp_order Order Cancellation OrderController.java orderRecordsService.cancelOrder authorization
- CVE-2026-86262 sfturing hosp_order Order OrderController.java updateOrderdiseaseInfo authorization
- CVE-2026-86261 sfturing hosp_order Order Controller OrderController.java authorization
- CVE-2026-86260 sfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password change
- CVE-2026-8626 SponsorMe <= 0.5.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter
- CVE-2026-86259 OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation
- CVE-2026-86258 nbviewer through 1.0.1 Path Traversal via LocalFileHandler
- CVE-2026-86257 wger before 2.6 CSV Formula Injection via member export
- CVE-2026-86256 wger before 2.6 Open Redirect via trainer-login next parameter
- CVE-2026-86255 wger before 2.5 Uncontrolled Resource Consumption via date_sequence
- CVE-2026-86254 wger Incomplete Authorization Fix Cross-Tenant Account Deletion
- CVE-2026-86253 h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments
- CVE-2026-86252 h3 before 1.15.9 SSE Event Injection via Carriage Return
- CVE-2026-86251 h3 before 1.15.9 Path Traversal via Double Decoding
- CVE-2026-86250 h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie
- CVE-2026-8625 Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML
- CVE-2026-86249 Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth
- CVE-2026-86248 Auth bypass in Apache Tomcat
- CVE-2026-86247 Apache Tomcat Native: Client certificate requirements can be down-graded
- CVE-2026-86246 Apache Tomcat Native: Insecure OpenSSL options enabled
- CVE-2026-86245 itsourcecode Sales and Inventory System sup_transac.php sql injection
- CVE-2026-86244 FastAdmin User Controller User.php login cross site scripting
- CVE-2026-86243 Apache Tomcat Native: DoS via TLS handshake
- CVE-2026-86242 Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds
- CVE-2026-86241 liufee FeehiCMS Cookie Validation main-local.php hard-coded key
- CVE-2026-86240 liufee FeehiCMS UEditor Uploader.php catchImage server-side request forgery
- CVE-2026-8624 LJ comments import: reloaded <= 0.97.1 - Reflected Cross-Site Scripting via PHP_SELF Parameter
- CVE-2026-86239 liufee FeehiCMS UEditor Widget UeditorAction.php init unrestricted upload
- CVE-2026-86238 projectworlds Online Examination System Feedback Form feedback.php cross site scripting
- CVE-2026-86237 openagents-org openagents http.py test_default_model server-side request forgery
- CVE-2026-86236 itsourcecode Sales and Inventory System pro_transac.php add sql injection
- CVE-2026-86235 itsourcecode Sales and Inventory System pos_transac.php add sql injection
- CVE-2026-86234 itsourcecode Sales and Inventory System cust_transac.php add sql injection
- CVE-2026-86233 itsourcecode Sales and Inventory System us_del.php sql injection
- CVE-2026-86232 itsourcecode Sales and Inventory System sup_del.php sql injection
- CVE-2026-86231 mwiede jsch KnownHosts.java getRevokedKeys improper check for certificate revocation
- CVE-2026-8623 Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute
- CVE-2026-86228 JeecgBoot AiragModelController.java exportXls access control
- CVE-2026-86227 valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds
- CVE-2026-86226 Projectwolds Online Attendance System profile.php cross site scripting
- CVE-2026-86225 SourceCodester Class and Exam Timetabling System modal_add_room.php mysqli_query sql injection
- CVE-2026-86224 SourceCodester Class and Exam Timetabling System modal_add_product.php mysqli_query sql injection
- CVE-2026-86223 SourceCodester Class and Exam Timetabling System modal_add_coursea.php mysqli_query sql injection
- CVE-2026-86222 SourceCodester Class and Exam Timetabling System modal_add_course2.php mysqli_query sql injection
- CVE-2026-86221 SourceCodester Class and Exam Timetabling System modal_add_course1.php mysqli_query sql injection
- CVE-2026-86220 SourceCodester Class and Exam Timetabling System modal_add_course.php mysqli_query sql injection
- CVE-2026-8622 Image Sizes on Demand <= 1.3 - Reflected Cross-Site Scripting via PHP_SELF Server Variable
- CVE-2026-86219 Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step.
- CVE-2026-86218 N-able N-central Static Code Injection
- CVE-2026-86217 code-projects Hotel and Tourism Reservation in PHP Database Backup hotel_db%20(1).sql information disclosure
- CVE-2026-86216 code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting
- CVE-2026-86215 Mstfakts College-Management-System Logout server.php session expiration
- CVE-2026-86214 Mstfakts College-Management-System login.php improper authentication
- CVE-2026-86213 Mstfakts College-Management-System Search university.php mysqli_query sql injection
- CVE-2026-86212 Open5GS AMF/MME improper authorization
- CVE-2026-86211 rabindralamsal inventory-management-system Login index.php sql injection
- CVE-2026-86210 SourceCodester Class and Exam Timetabling System delete_user_account.php sql injection
- CVE-2026-8621 Crabbox < v0.12.0 Authentication Bypass via Header Spoofing
- CVE-2026-86209 SourceCodester Class and Exam Timetabling System delete_user.php sql injection
- CVE-2026-86208 SourceCodester Class and Exam Timetabling System delete_teacher.php sql injection
- CVE-2026-86207 Authentication bypass leads to unauthorised access to N-central
- CVE-2026-86206 Access control filter bypass allows unauthorised access to APIs
- CVE-2026-86205 h3 before 2.0.1-rc.18 Open Redirect via redirectBack()
- CVE-2026-86204 PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket
- CVE-2026-86203 PocketMine-MP before 5.39.2 Item Duplication via Despawn State
- CVE-2026-86202 PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket
- CVE-2026-86201 PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData
- CVE-2026-86200 PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT
- CVE-2026-8620 Other in Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty
- CVE-2026-86199 PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login
- CVE-2026-86198 PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket
- CVE-2026-86197 Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox
- CVE-2026-86196 Grav API Plugin before 1.0.20 Authentication Bypass via Host Header
- CVE-2026-86195 grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag
- CVE-2026-86194 Grav Form Plugin before 9.1.22 Cross-Page Form Execution
- CVE-2026-86193 Grav API Plugin Authentication Bypass via Group-Inherited Super
- CVE-2026-86192 SiYuan before v3.8.2 Information Disclosure via Attribute-View
- CVE-2026-86191 SiYuan before v3.8.2 Private Attribute View Key Enumeration
- CVE-2026-86190 WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter
- CVE-2026-8619 Null dereference in Archer MR600 v2
- CVE-2026-86189 WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php
- CVE-2026-86188 AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting
- CVE-2026-86187 WWBN AVideo Weak PRNG Password Generation via External Login
- CVE-2026-86186 AVideo API Rate Limit Bypass via Bot User-Agent Header
- CVE-2026-86185 Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification Bypass
- CVE-2026-86184 Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route
- CVE-2026-86183 diem-project diem dmWidget BasedmWidgetActions.class.php authorization
- CVE-2026-86182 diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery
- CVE-2026-86181 code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting
- CVE-2026-86180 code-projects Task Management System In PHP Login index.php sql injection
- CVE-2026-8618 Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv2 Subtype 0x91 on Deco M9 Plus