Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 323 of 1013.
- CVE-2026-83589 Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect
- CVE-2026-83588 Windows USB Driver Elevation of Privilege Vulnerability
- CVE-2026-83587 Windows Core Messaging Elevation of Privilege Vulnerability
- CVE-2026-83586 Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
- CVE-2026-83585 Windows NTFS Elevation of Privilege Vulnerability
- CVE-2026-83584 Windows Smart Card Elevation of Privilege Vulnerability
- CVE-2026-83583 Windows Geotag Broker Elevation of Privilege Vulnerability
- CVE-2026-83582 Windows Graphics Kernel Information Disclosure Vulnerability
- CVE-2026-83580 Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability
- CVE-2026-8358 Heap buffer overflow in spreadsheet tracked-changes import
- CVE-2026-83579 Windows Smart Card Elevation of Privilege Vulnerability
- CVE-2026-83578 Microsoft PowerShell Remote Code Execution Vulnerability
- CVE-2026-83575 Windows Search Service Elevation of Privilege Vulnerability
- CVE-2026-83574 Windows Search Service Elevation of Privilege Vulnerability
- CVE-2026-83573 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
- CVE-2026-83571 Windows Audio Service Information Disclosure Vulnerability
- CVE-2026-83570 Windows Search Service Elevation of Privilege Vulnerability
- CVE-2026-8357 Heap buffer overflow in Calc formula compilation
- CVE-2026-83569 HID Parser Library Elevation of Privilege Vulnerability
- CVE-2026-83568 Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability
- CVE-2026-83567 Windows NTFS Elevation of Privilege Vulnerability
- CVE-2026-83566 Windows Win32k Elevation of Privilege Vulnerability
- CVE-2026-83565 Windows Encrypting File System (EFS) Information Disclosure Vulnerability
- CVE-2026-83564 Windows Search Service Elevation of Privilege Vulnerability
- CVE-2026-83562 WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-83561 Cross-site scripting in Complianz GDPR/CCPA Cookie Consent Banner
- CVE-2026-83560 New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass
- CVE-2026-8356 Stack buffer overflow in PPT presentation import
- CVE-2026-83557 jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
- CVE-2026-83555 Missing authorization in Email Subscribers & Newsletters
- CVE-2026-83551 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path
- CVE-2026-83550 Postgres-exporter: net/http/pprof exposed on metrics listener
- CVE-2026-8355 IBM ContextForge MCP Gateway is affected by server-side request forgery
- CVE-2026-83549 SonicWall SMA1000 Appliances OS Command Injection
- CVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request Forgery
- CVE-2026-83547 Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets
- CVE-2026-83546 CoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute
- CVE-2026-83545 CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON
- CVE-2026-83544 Greenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps Attribute
- CVE-2026-83543 Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint
- CVE-2026-83541 Sina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table Widget
- CVE-2026-83540 wolfSSHd on Windows race condition leading to logon token reused across connections
- CVE-2026-8354 Cross-site scripting in Gum Addon for Elementor
- CVE-2026-83537 WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment
- CVE-2026-83536 Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris)
- CVE-2026-83535 Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-time comparison
- CVE-2026-83534 PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel()
- CVE-2026-83533 WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment
- CVE-2026-83532 Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes
- CVE-2026-83531 Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages
- CVE-2026-83530 Uncontrolled Memory Allocation in cel-go
- CVE-2026-8353 Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in atomik theme
- CVE-2026-83527 Auth bypass in Sentry
- CVE-2026-83526 File upload in FV Player 8
- CVE-2026-83525 Denial of service in Apache Kafka
- CVE-2026-83524 RedPort Optimizer wXa-223 System Clock datetime.php exec command injection
- CVE-2026-83523 Windows Image Acquisition Remote Code Execution Vulnerability
- CVE-2026-83522 Windows IKE Extension Spoofing Vulnerability
- CVE-2026-83521 Windows IKE Extension Information Disclosure Vulnerability
- CVE-2026-83520 .NET Remote Code Execution Vulnerability
- CVE-2026-83519 Windows Error Reporting Remote Code Execution Vulnerability
- CVE-2026-83518 RPC Runtime Elevation of Privilege Vulnerability
- CVE-2026-83517 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
- CVE-2026-83516 Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability
- CVE-2026-83515 RPC Runtime Information Disclosure Vulnerability
- CVE-2026-83514 Windows Partition Management Driver Elevation of Privilege Vulnerability
- CVE-2026-83513 Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
- CVE-2026-83511 Active Directory Federation Services (AD FS) Spoofing Vulnerability
- CVE-2026-83510 Windows Setup Files Cleanup Elevation of Privilege Vulnerability
- CVE-2026-8351 Cross-site scripting in RTMKit
- CVE-2026-83509 Windows Setup Files Cleanup Elevation of Privilege Vulnerability
- CVE-2026-83508 Windows NTFS Elevation of Privilege Vulnerability
- CVE-2026-83507 Windows Update Orchestrator Service Information Disclosure Vulnerability
- CVE-2026-83506 Servicing Stack Updates Elevation of Privilege Vulnerability
- CVE-2026-83505 Windows Setup Files Cleanup Elevation of Privilege Vulnerability
- CVE-2026-83504 Windows SmartScreen Information Disclosure Vulnerability
- CVE-2026-83501 Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability
- CVE-2026-83500 Windows BitLocker Security Feature Bypass Vulnerability
- CVE-2026-8350 Concrete CMS is vulnerable to missing authorization in the bulk_user_assignment.php
- CVE-2026-83499 Windows Server Update Service Elevation of Privilege Vulnerability
- CVE-2026-83498 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
- CVE-2026-83497 Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination
- CVE-2026-83492 WordPress Kubio AI Website Builder - Denial Of Service
- CVE-2026-83491 Missing authorization in Oracle iRecruitment
- CVE-2026-83490 Missing authorization in Oracle iRecruitment
- CVE-2026-8349 omec-project amf NGAP Message memory corruption
- CVE-2026-83489 Privilege escalation in Oracle Banking Origination
- CVE-2026-83488 Missing authorization in Helidon
- CVE-2026-83487 Missing authorization in Oracle Product Hub
- CVE-2026-83486 Missing authorization in Oracle Product Hub
- CVE-2026-83485 Missing authorization in Oracle Product Hub
- CVE-2026-83484 Missing authorization in Oracle US Federal Human Resources
- CVE-2026-83483 Privilege escalation in Oracle Advanced Benefits
- CVE-2026-83482 Privilege escalation in Oracle Contracts
- CVE-2026-83481 Privilege escalation in Oracle Contracts
- CVE-2026-83480 Denial of service in Helidon
- CVE-2026-83479 Privilege escalation in Oracle Contracts
- CVE-2026-83477 Missing authorization in Oracle Work in Process
- CVE-2026-8347 Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog
- CVE-2026-83465 Denial of service in Oracle Mobile Application Server