Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 332 of 1013.
- CVE-2026-82643 WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php
- CVE-2026-82642 Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution
- CVE-2026-82641 Keploy 3.1.0-3.6.25 Unauthenticated TLS Key Exposure
- CVE-2026-82640 browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage
- CVE-2026-8264 Tenda AC6 httpd WifiApScan formWifiApScan os command injection
- CVE-2026-82639 NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure
- CVE-2026-82638 jina-ai reader Server-Side Request Forgery via disabled private-address guard
- CVE-2026-82637 browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation
- CVE-2026-82636 Command injection in Qubes OS
- CVE-2026-82635 Pake arbitrary file write via unsanitized download_file filename
- CVE-2026-82634 Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint
- CVE-2026-82633 Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint
- CVE-2026-82632 Incorrect Authorization in GitLab
- CVE-2026-82631 valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free
- CVE-2026-82630 PowerJob Transport Endpoint TestController.java MuConnectionManager.getOrCreateConnection server-side request forgery
- CVE-2026-8263 Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection
- CVE-2026-82629 jeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload
- CVE-2026-82628 Colorful iGameCenter IOCTL Dispatch WinRing0x64.sys sub_11504 privileges management
- CVE-2026-82627 Deserialization in Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included
- CVE-2026-82625 code-projects Simple Inventory System User Registration register.php cross site scripting
- CVE-2026-82624 code-projects Simple Inventory System Database Backup File inventorymanagement.sql information disclosure
- CVE-2026-82623 open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free
- CVE-2026-82622 code-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting
- CVE-2026-82621 Soarkey StudentManagement/学生信息管理系统 Administrative Servlet AdminDao.java AdminDao.doGet authorization
- CVE-2026-82620 Soarkey StudentManagement/学生信息管理系统 CourseDao.java CourseDao.course_ranking sql injection
- CVE-2026-8262 Devs Palace ERP Online chart-save cross site scripting
- CVE-2026-82619 Systerel S2OPC subscription_mgr.c use after free
- CVE-2026-82618 Systerel S2OPC String Array Range Writing sopc_builtintypes.c set_range_matrix_on_string_array out-of-bounds
- CVE-2026-82617 Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns
- CVE-2026-82616 TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow
- CVE-2026-82615 itsourcecode Online Medicine Delivery System Password Recovery passwordrecover.php find_phone sql injection
- CVE-2026-82614 itsourcecode Online Medicine Delivery System Product Category Filter index.php loadResultList sql injection
- CVE-2026-82613 itsourcecode Online Medicine Delivery System Product Search index.php loadResultList sql injection
- CVE-2026-82612 itsourcecode Online Medicine Delivery System Product Detail index.php loadResultList sql injection
- CVE-2026-82611 itsourcecode Online Medicine Delivery System Customer Login login.php cusAuthentication sql injection
- CVE-2026-82610 itsourcecode Online Medicine Delivery System Login login.php employeeAuthentication sql injection
- CVE-2026-8261 Squirrel sqobject.cpp Load heap-based overflow
- CVE-2026-82609 itsourcecode Sales and Inventory System inv_edit.php sql injection
- CVE-2026-82608 Kamailio AVP cxdx_avp.c get_4bytes out-of-bounds
- CVE-2026-82607 Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload
- CVE-2026-82605 BareBones BBEdit Lasso Language Tokenizer infinite loop
- CVE-2026-82604 BareBones BBEdit Java Language recursion
- CVE-2026-82603 SeaCMS Comment Cache member.php del_pl path traversal
- CVE-2026-82602 SeaCMS ass.php authorization
- CVE-2026-82601 SeaCMS err.php cross site scripting
- CVE-2026-82600 SeaCMS zyapi.php sql injection
- CVE-2026-8260 D-Link DCS-935L HNAP Service hnap_service SetDeviceSettings buffer overflow
- CVE-2026-82599 SeaCMS Avatar Upload member.php unlink path traversal
- CVE-2026-82598 SeaCMS Template search.php parseIf code injection
- CVE-2026-82597 TOTOLINK NR1800X cstecgi.cgi setUssd command injection
- CVE-2026-82596 LatencyUtils PauseDetector LatencyStats.java LatencyStats.recordDetectedPause memory corruption
- CVE-2026-82595 D-Link DIR-825M System Command Execution formSysCmd sub_456CF4 command injection
- CVE-2026-82594 LogNet grpc-spring-boot-starter Annotation Processing improper authorization
- CVE-2026-82593 D-Link DIR-825M LTE Module Firmware Upgrade formLtefotaUpgradeFibocom sub_41802C stack-based overflow
- CVE-2026-82592 D-Link DIR-825M Disk Formatting Handler Endpoint formDiskFormat sub_46725C stack-based overflow
- CVE-2026-82591 Open Asset Import Library Assimp MD5Loader.cpp MakeDataUnique heap-based overflow
- CVE-2026-82590 Open5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertion
- CVE-2026-8259 Tenda AC6 httpd telnet os command injection
- CVE-2026-82589 Open5GS N1-N2 Message namf-handler.c amf_namf_comm_handle_n1_n2_message_transfer denial of service
- CVE-2026-82588 Open5GS Transfer Endpoint namf-handler.c null pointer dereference
- CVE-2026-82587 Open5GS AMF namf-handler.c amf_namf_comm_decode_ue_mm_context_list memory corruption
- CVE-2026-82586 AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes
- CVE-2026-82585 Botslab G980H Dashcams Cleartext Transmission of Sensitive Information
- CVE-2026-82584 Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
- CVE-2026-82583 NextGen Healthcare Mirth Connect SQL Injection
- CVE-2026-82582 Missing authorization in SHIRASAGI
- CVE-2026-82580 AshAi echoes raw tool exception messages into the conversation, disclosing internal details
- CVE-2026-8258 Squirrel sqstdstring.cpp validate_format stack-based overflow
- CVE-2026-82579 AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service
- CVE-2026-82578 NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference
- CVE-2026-8257 WebAssembly Binaryen BrOn wasm-ir-builder.cpp makeBrOn assertion
- CVE-2026-82567 mySCADA myPRO Manager Missing Authorization
- CVE-2026-82566 Botslab G980H Dashcams Insufficient session expiration
- CVE-2026-82564 Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records
- CVE-2026-82563 Softish C6 Ear Camera and EarVision Android Application Authentication bypass by spoofing
- CVE-2026-82562 qs array-limit bypass via bracket-key comma parsing
- CVE-2026-82561 Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods
- CVE-2026-82560 Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.
- CVE-2026-8256 Devs Palace ERP Online mr-save cross site scripting
- CVE-2026-82556 Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery
- CVE-2026-82555 TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values
- CVE-2026-82554 SourceCodester Queue Management System add_customer.php cross site scripting
- CVE-2026-82553 sambitraj Student Management System Student Dashboard student_dashboard.php mysqli_query improper authorization
- CVE-2026-82552 Linux Foundation Magma gNB Termination ngap_amf.c denial of service
- CVE-2026-82551 Linux Foundation Magma NGSetup ngap_amf_handlers.c state issue
- CVE-2026-82550 Linux Foundation Magma NGSetupRequest input validation
- CVE-2026-8255 Devs Palace ERP Online add_new_customer cross site scripting
- CVE-2026-82549 Linux Foundation Magma SecurityModeComplete integrity check
- CVE-2026-82548 Linux Foundation Magma InitialUEMessage information disclosure
- CVE-2026-82547 Linux Foundation Magma Registration Complete Message amf_fsm.cpp improper authentication
- CVE-2026-82546 Apache Roller: Stored cross-site scripting through incoming Trackback links
- CVE-2026-82545 itsourcecode Sales and Inventory System sup_searchfrm.php sql injection
- CVE-2026-82544 wger-project wger Password Reset gym.py reset_user_password cross-site request forgery
- CVE-2026-82543 vastsa FileCodeBox Pickup Limit views.py update_file_usage race condition
- CVE-2026-82542 Tenda HG10 Boa Web Server formIPv6Routing buffer overflow
- CVE-2026-82541 itsourcecode Sales and Inventory System sup_edit.php sql injection
- CVE-2026-82540 itsourcecode Sales and Inventory System cust_searchfrm.php sql injection
- CVE-2026-8254 Devs Palace ERP Online sales_save cross site scripting
- CVE-2026-82539 TOTOLINK A720R MAC Filtering cstecgi.cgi setMacFilterRules memory corruption
- CVE-2026-82538 ILIAS Arbitrary SQL Injection via Repository Trash Table Sort Parameter