Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 330 of 1013.
- CVE-2026-82857 hulumi before v1.3.2 Privilege Escalation via IAM Policy
- CVE-2026-82856 @hulumi/policies before 1.3.2 OIDC Trust Policy Bypass
- CVE-2026-82855 @hulumi/policies before 1.3.2 Evidence Validation Bypass
- CVE-2026-82854 Nodemailer before 8.0.4 SMTP Command Injection via envelope.size
- CVE-2026-82853 Nodemailer before 8.0.5 SMTP Command Injection via CRLF
- CVE-2026-82852 WordPress MapSVG plugin <= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-82851 Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR
- CVE-2026-82850 Masteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure
- CVE-2026-8285 OTP Bypass in Universal Sotware's FlexCity
- CVE-2026-82849 Masteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR
- CVE-2026-82848 Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure
- CVE-2026-82847 Masteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course Highlights
- CVE-2026-82846 Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields
- CVE-2026-82845 Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection
- CVE-2026-82844 WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce
- CVE-2026-82843 WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution
- CVE-2026-82842 SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching
- CVE-2026-82841 UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice
- CVE-2026-8284 Open Redirect in Universal Sotware's FlexCity
- CVE-2026-82838 Default webserver configuration with incorrect CSP
- CVE-2026-82837 Insertion of Sensitive Information Into Sent Data in GitLab
- CVE-2026-82835 caoqianming django-vue-admin file access control
- CVE-2026-82834 Missing authorization in Auto Labeling Pipeline Module to Annotate a Document Automatically
- CVE-2026-82833 Missing authorization in Auto Labeling Pipeline Module to Annotate a Document Automatically
- CVE-2026-82832 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-82829 Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication process
- CVE-2026-82828 Missing authorization in Hitachi Coding Software Suite
- CVE-2026-82827 Hardcoded credentials in Hitachi Coding Software Suite
- CVE-2026-82826 Authentication information or sensitive data may be intercepted in transit
- CVE-2026-82825 Missing authorization in Hitachi Coding Software Suite
- CVE-2026-82824 Path traversal may allow arbitrary files to be viewed, created, modified, or deleted
- CVE-2026-82821 FLVMeta AMF Object Parsing amf.c amf_object_get null pointer dereference
- CVE-2026-82820 FLVMeta AMF String Processing amf.c amf_string_new heap-based overflow
- CVE-2026-82819 Universal Naming Convention (UNC) Path Injection in Cerberus FTP Server
- CVE-2026-82818 dibo-software diboot Tenant Resource Assignment resource access control
- CVE-2026-82817 dibo-software diboot Tenant Administrator Management API admin access control
- CVE-2026-82816 dibo-software diboot AI Session Endpoint ai-session authorization
- CVE-2026-82815 MegaEase EaseProbe Middleware server.go realIP access control
- CVE-2026-82814 Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection
- CVE-2026-82813 BEN Group TubeBuddy for YouTube Extension tubebuddymaster1.js TBGlobal.GetToken data authenticity
- CVE-2026-82811 Toggl OÜ Toggl Track Extension postMessage origin validation
- CVE-2026-82810 Information disclosure in 2FA Authenticator Extension
- CVE-2026-82809 vidIQ Vision for YouTube Extension postMessage window.addEventListener information disclosure
- CVE-2026-82808 Inbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentials
- CVE-2026-82807 ieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privileges management
- CVE-2026-82806 Apache APISIX: cross-request permission pollution via static permission list mutation
- CVE-2026-82805 Typora Mermaid Rendering cross site scripting
- CVE-2026-82804 Apache DolphinScheduler: Command Injection in the Alert Script Plugin
- CVE-2026-82803 armink struct2json JSON Deserialization s2jdef.h S2J_STRUCT_GET_string_ELEMENT null pointer dereference
- CVE-2026-82802 NASA earthdata-search granules Endpoint handler.js OpenSearchGranuleSearchLambda server-side request forgery
- CVE-2026-82801 NASA earthdata-search scale Endpoint handler.js scaleImage server-side request forgery
- CVE-2026-8280 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-82797 Denial of service in rlottie
- CVE-2026-82796 Cross-site scripting in SV-CPT-MC310
- CVE-2026-82795 Cross-site scripting in SV-CPT-MC310
- CVE-2026-82794 Command injection in SV-CPT-MC310
- CVE-2026-82793 File upload in CAN-2-USB
- CVE-2026-82792 Cross-site scripting in CAN-2-USB
- CVE-2026-82791 Command injection in CAN-2-USB
- CVE-2026-82790 Cross-site scripting in PC-HELPER Wireless I/O DIO-0404RY-LWF
- CVE-2026-8279 Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion
- CVE-2026-82789 Code injection in CONPROSYS HMI System(CHS)
- CVE-2026-82788 Cross-site scripting in CPSL-08P1EN
- CVE-2026-82787 Auth bypass in CPSL-08P1EN
- CVE-2026-82786 Information disclosure in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*
- CVE-2026-82785 Memory corruption in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*
- CVE-2026-82784 Missing authorization in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*
- CVE-2026-82783 Information disclosure in Programmable Remote I/O Coupler Unit (Software PLC Type) CPSN-PCB271-S1-041
- CVE-2026-82782 Memory corruption in Programmable Remote I/O Coupler Unit (Software PLC Type) CPSN-PCB271-S1-041
- CVE-2026-82781 Cross-site scripting in Programmable Remote I/O Coupler Unit (Software PLC Type) CPSN-PCB271-S1-041
- CVE-2026-82780 File upload in CPS-TM341G5MB-ADSC1-931
- CVE-2026-82779 Command injection in CPS-TM341G5MB-ADSC1-931
- CVE-2026-82778 Information disclosure in Configurable type CPS-PCS341[][]-DS1-1201
- CVE-2026-82777 Command injection in Configurable type CPS-PCS341[][]-DS1-1201
- CVE-2026-82776 Cross-site scripting in Configurable type CPS-PCS341[][]-DS1-1201
- CVE-2026-82775 Information disclosure in M2M Controller Configurable type CPS-MCS341*
- CVE-2026-82774 Command injection in M2M Controller Configurable type CPS-MCS341*
- CVE-2026-82773 Cross-site scripting in M2M Controller Configurable type CPS-MCS341*
- CVE-2026-82772 Memory corruption in ECE1000
- CVE-2026-82771 Cross-site scripting in ECE1000
- CVE-2026-82770 Memory corruption in RP-WAH-SR1
- CVE-2026-82769 Cross-site scripting in RP-WAH-SR1
- CVE-2026-82768 Path traversal in SGA1000
- CVE-2026-82767 Cross-site scripting in SGA1000
- CVE-2026-82766 Command injection in SGA1000
- CVE-2026-82765 Path traversal in FXA3000
- CVE-2026-82764 Cross-site request forgery in ECE1000
- CVE-2026-82763 Cross-site scripting in FXA3000
- CVE-2026-82762 Command injection in FXA3000
- CVE-2026-82761 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
- CVE-2026-82760 Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in
- CVE-2026-8276 bettercap MySQL Server mysql_server.go integer coercion
- CVE-2026-82759 Reversible IP address pseudonymisation in AshAuthentication audit log hash mode
- CVE-2026-82758 Auth bypass in ash authentication oauth2 server
- CVE-2026-82757 ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
- CVE-2026-82756 Other in ash authentication oauth2 server
- CVE-2026-82755 Information disclosure in ash authentication oauth2 server
- CVE-2026-82754 ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
- CVE-2026-82753 Denial of service in ash authentication oauth2 server
- CVE-2026-82752 Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length