Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 301 of 1013.
- CVE-2026-86179 code-projects Daily Expense Manager Database Backup exp_ak.sql information disclosure
- CVE-2026-86178 Pixelfed through 0.12.9 Unauthorized Story Access via API
- CVE-2026-86177 Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks
- CVE-2026-86176 NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs
- CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs
- CVE-2026-86174 Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board
- CVE-2026-86173 MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler
- CVE-2026-86172 DefaultFuction CRM delete.php sql injection
- CVE-2026-86171 DefaultFuction CRM delete.php sql injection
- CVE-2026-86170 DefaultFuction CRM edit.php sql injection
- CVE-2026-8617 Missing authorization in SearchPlus
- CVE-2026-86169 Axolotl before 0.19.0 Remote Code Execution via Multipack Patching
- CVE-2026-86168 code-projects Content Management System login.php sql injection
- CVE-2026-86167 Tenda HG10 Boa formgponConf os command injection
- CVE-2026-86166 Tenda HG10 Boa Web Server formWanRedirect buffer overflow
- CVE-2026-86165 Tenda HG10 formURL buffer overflow
- CVE-2026-86164 itsourcecode Sales and Inventory System trans_view.php sql injection
- CVE-2026-86163 itsourcecode Sales and Inventory System pro_del.php sql injection
- CVE-2026-86162 SourceCodester Online Voting System ajax.php login sql injection
- CVE-2026-86161 SourceCodester Online Voting System ajax.php delete_category sql injection
- CVE-2026-86160 SourceCodester Online Voting System ajax.php delete_voting sql injection
- CVE-2026-8616 Missing authorization in Fense Proxy & VPN Blocker
- CVE-2026-86159 SourceCodester Online Voting System ajax.php save_user sql injection
- CVE-2026-86158 Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere
- CVE-2026-86157 Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere
- CVE-2026-86153 Tenda CP3 Redirect.cpp SetRedirectEnable privileges management
- CVE-2026-86152 Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection
- CVE-2026-86151 Tenda CP3 Network Configuration Management system.c sub_2F77E8 os command injection
- CVE-2026-86150 Tenda CP3 hostapd hard-coded credentials
- CVE-2026-8615 Missing authorization in ilGhera Reviso Exporter for WooCommerce
- CVE-2026-86149 Tenda CP3 NetCheckPing.cpp os command injection
- CVE-2026-86148 Tenda CP3 Kylin system.c SystemAsh os command injection
- CVE-2026-86147 Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof
- CVE-2026-86146 Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing
- CVE-2026-86145 Memory corruption in PCRE2
- CVE-2026-86144 XML external entity in libxml2
- CVE-2026-86143 Integer overflow in libxml2
- CVE-2026-86142 Memory corruption in libxml2
- CVE-2026-86141 Null dereference in libxml2
- CVE-2026-86140 Memory corruption in libxml2
- CVE-2026-8614 Missing authorization in Assistio
- CVE-2026-86139 Integer overflow in libxml2
- CVE-2026-86138 Integer overflow in libxml2
- CVE-2026-86137 Memory corruption in libxml2
- CVE-2026-86136 Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A
- CVE-2026-86135 Dimension CSRF Vulnerability in Database Snapshot Creation Allows Denial of Service
- CVE-2026-86134 Fireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial of Service
- CVE-2026-86133 Fireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of Service
- CVE-2026-86132 Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Service
- CVE-2026-86131 Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution
- CVE-2026-8613 Cross-site scripting in aThemes Addons for Elementor
- CVE-2026-86128 Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service
- CVE-2026-86124 AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Server
- CVE-2026-86123 SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints
- CVE-2026-86122 Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server
- CVE-2026-86121 Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control
- CVE-2026-86120 APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard
- CVE-2026-8612 Deserialization in WWW::Mechanize::Cached
- CVE-2026-86119 Webstudio through 0.296.0 SSRF via /cgi proxy routes
- CVE-2026-86118 gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint
- CVE-2026-86117 Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching
- CVE-2026-86116 Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
- CVE-2026-86115 Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path
- CVE-2026-86114 Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints
- CVE-2026-86113 Missing authorization in bookwyrm
- CVE-2026-86112 BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints
- CVE-2026-86111 BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses
- CVE-2026-8611 Missing authorization in Klamra Paycal for Aspaclaria
- CVE-2026-86109 Security Advisory 0182
- CVE-2026-86108 Security Advisory 0181
- CVE-2026-86107 Security Advisory 0180
- CVE-2026-86106 Security Advisory 0179
- CVE-2026-86105 Fireware OS Improper Authorization in Access Portal Reverse Proxy
- CVE-2026-86104 Fireware OS Resource Exhaustion in Login Process Allows Denial of Service
- CVE-2026-86102 WatchGuard AP Command Injection in Internal Management API Allows Command Execution
- CVE-2026-86101 Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access
- CVE-2026-86100 Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL
- CVE-2026-8610 Missing authorization in TypeSquare Webfonts for ConoHa
- CVE-2026-86099 Chainlit through 2.12.0 Path Traversal via socket.io sessionId
- CVE-2026-86098 ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape
- CVE-2026-86097 PX4 Autopilot through 1.17.0 Null Pointer Dereference via param select
- CVE-2026-86096 PX4 Autopilot through 1.17.0 Use-After-Free via Temperature Calibration Task Startup
- CVE-2026-86095 Unidata netcdf-c through 4.10.1 Out-of-bounds Write via Oversized HDF5 Attribute Name
- CVE-2026-86093 Memory corruption in Db2
- CVE-2026-86091 ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler
- CVE-2026-86090 ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers
- CVE-2026-8609 Pre-authentication denial of service via the OAuth login route
- CVE-2026-86089 Apache NiFi: Missing Process Group Authorization for Connector Migration
- CVE-2026-86087 IBM® Db2® could allow an authenticated user to send a specially crafted request to write arbitrary files on the system
- CVE-2026-86085 n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints
- CVE-2026-86084 n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
- CVE-2026-86083 n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
- CVE-2026-86082 n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
- CVE-2026-86081 n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
- CVE-2026-86080 n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open
- CVE-2026-8608 Business logic in Event Monster – Event Manager, Ticket Booking & Registration
- CVE-2026-86079 n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
- CVE-2026-86078 n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
- CVE-2026-86077 n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket
- CVE-2026-86076 n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution