Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 329 of 1013.
- CVE-2026-82988 CVE-2026-82988
- CVE-2026-82987 CVE-2026-82987
- CVE-2026-82986 Missing authorization in Tables
- CVE-2026-82985 Missing authorization in Server
- CVE-2026-82984 Missing authorization in Server
- CVE-2026-82983 Missing authorization in Tables
- CVE-2026-82982 Business logic in Approval
- CVE-2026-82980 Missing authorization in Files Lock
- CVE-2026-82973 Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox
- CVE-2026-82971 QVidium Opera11 CGI Script net_tr.cgi command injection
- CVE-2026-82970 WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability
- CVE-2026-8297 SQLi in GIS Informatics' GisLab Laboratory Management System
- CVE-2026-82969 Stored XSS in BİMSER's eBA Plus
- CVE-2026-82968 Auth bypass in Red Hat Build of Keycloak
- CVE-2026-82967 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-82964 Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys
- CVE-2026-82962 Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packet
- CVE-2026-82961 Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode
- CVE-2026-8296 Cross-site scripting in Octopus Server
- CVE-2026-82958 Code injection in Eclipse Ditto
- CVE-2026-82957 hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery
- CVE-2026-82955 Security feature bypass in Eclipse aeriOS
- CVE-2026-82954 Dokploy Settings application.ts writeTraefikConfigInPath path traversal
- CVE-2026-82953 Apache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of Service
- CVE-2026-8295 Integer overflow in simdjson
- CVE-2026-82947 Multiple Out-of-Bounds Reads in Frame Processing
- CVE-2026-82946 Null Pointer Dereference in Mailbox Error Handling
- CVE-2026-82945 Memory Corruption via FMMU Configuration Table Overflow
- CVE-2026-82944 Buffer Overflow in CoE SDO Upload Multi-Segment Data Transfers
- CVE-2026-82943 Out-of-Bounds Read via Unchecked Length Values
- CVE-2026-82942 Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service
- CVE-2026-82936 Denial of Service in mH-DEVELOPER
- CVE-2026-82935 Use of End-of-Life components in mH-DEVELOPER
- CVE-2026-82933 Cleartext Transmission of Sensitive Information in mH-DEVELOPER
- CVE-2026-82932 Missing Firewall Configuration in mH-DEVELOPER
- CVE-2026-82930 Missing Authentication in mH-DEVELOPER
- CVE-2026-8293 Really Simple Security < 9.5.10.1 - Authentication Bypass via Two-Factor OTP Skip
- CVE-2026-82929 Use of Shared Cryptographic Key in mH-DEVELOPER
- CVE-2026-82928 Undocumented access path in mH-DEVELOPER
- CVE-2026-82927 Memory corruption in mTower
- CVE-2026-82926 Null dereference in mTower
- CVE-2026-82925 Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature
- CVE-2026-82924 PII Enumeration via Missing Rate Limiting in Pusula Communication's Expert Mail
- CVE-2026-82923 AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes
- CVE-2026-82922 ShopEx ECShop flow.php flow_update_cart sql injection
- CVE-2026-82921 ShopEx ECShop pack.php check_img_type unrestricted upload
- CVE-2026-82920 Mattermost ABAC parent policy bypass via policy update endpoint
- CVE-2026-8292 Open5GS NRF conv.c yuarel_parse denial of service
- CVE-2026-82919 cu silicon edit Endpoint views.py create_app missing authentication
- CVE-2026-82918 XML external entity in LJ Series Terminal-Software
- CVE-2026-82915 Path Traversal in Bimser Solution Software's eBA Plus
- CVE-2026-82914 kishan0725 Hospital-Management-System search.php sql injection
- CVE-2026-82911 CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes
- CVE-2026-8291 Open5GS NRF nnrf-handler.c ogs_nnrf_nfm_handle_nf_profile denial of service
- CVE-2026-82909 QuantumNous new-api Revoked API Token token session expiration
- CVE-2026-82908 MSI Dragon Center MMIO Write Path NTIOLib_X64.sys MmioWritePath integer overflow
- CVE-2026-82906 sdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authentication
- CVE-2026-82905 sdcb chats fetch-tools Endpoint McpController.cs McpController server-side request forgery
- CVE-2026-82901 Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field
- CVE-2026-82900 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-8290 Open5GS SMF nsmf-handler.c smf_nsmf_handle_update_data_in_vsmf denial of service
- CVE-2026-82896 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-82895 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
- CVE-2026-82893 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-82892 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-82891 IBM Guardium Data Protection is affected by a security vulnerability
- CVE-2026-82890 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-8289 Open5GS SMF nsmf-handler.c smf_nsmf_handle_update_data_in_vsmf denial of service
- CVE-2026-82887 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-82885 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-82884 All in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block
- CVE-2026-82883 WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-82882 Devtron through 2.2.0 Missing Authorization via webhook API token endpoint
- CVE-2026-82881 Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown
- CVE-2026-82880 YaCy Search Server through 1.941 XML External Entity Injection via Parsers
- CVE-2026-8288 Open5GS SMF gsm-handler.c denial of service
- CVE-2026-82879 DataEase before 2.10.26 Access Control Bypass via Share Tickets
- CVE-2026-82878 DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints
- CVE-2026-82877 ILIAS Arbitrary File Read via SOAP addFile
- CVE-2026-82876 Phison PS3111-S11 Controller Firmware Signature Verification Bypass
- CVE-2026-82875 ToolJet before v3.16.208 Authorization Bypass via organizationId
- CVE-2026-82874 ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db
- CVE-2026-82873 ToolJet through 3.0.0-ee-beta.2 Cross-workspace Schema Disclosure via Export
- CVE-2026-82872 ToolJet before v3.16.208 Cross-Workspace Authorization Bypass
- CVE-2026-82871 ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes
- CVE-2026-82870 ToolJet before v3.16.208 Cross-Tenant Database Manipulation
- CVE-2026-8287 Unrestricted File Upload in BizimHesap Information Systems' Online Pre-Accounting Software
- CVE-2026-82869 ToolJet Database before v3.16.44 Privilege Escalation via join_tables
- CVE-2026-82868 @pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG
- CVE-2026-82867 @pdfme/schemas before 5.5.9 Cross-Site Scripting via Select
- CVE-2026-82866 @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch
- CVE-2026-82865 pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label
- CVE-2026-82864 pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb
- CVE-2026-82863 @hulumi/baseline before 1.3.2 CloudTrail Selector Tampering Detection
- CVE-2026-82862 Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files
- CVE-2026-82861 @hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypass
- CVE-2026-82860 @hulumi/policies before 1.3.2 Admin Policy Bypass
- CVE-2026-8286 wrong STARTTLS connection reuse
- CVE-2026-82859 hulumi before v1.3.2 SCP Template Tag-on-Create Bypass
- CVE-2026-82858 @hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptance