Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 336 of 1013.
- CVE-2026-82120 Heap-based Buffer Overflow Vulnerability in HiRDB
- CVE-2026-8212 OSGeo gdal SWapi.c SWSDfldsrch heap-based overflow
- CVE-2026-82119 OS Command Injection Vulnerability in HiRDB
- CVE-2026-82118 Stack-based Buffer Overflow Vulnerability in HiRDB
- CVE-2026-82117 Authentication Bypass by Spoofing Vulnerability in HiRDB
- CVE-2026-82116 Missing Authentication for Critical Function Vulnerability in HiRDB
- CVE-2026-82112 houtini-ai houtini-lm code_task_files index.ts path traversal
- CVE-2026-82111 iswalle getnote-mcp upload_image index.ts fs.readFileSync path traversal
- CVE-2026-82110 DataStage on Cloud Pak for Data Path Traversal
- CVE-2026-8211 codelibs Fess JSP File AdminDesignAction.java update code injection
- CVE-2026-82108 DataStage on Cloud Pak for Data Code Injection
- CVE-2026-82107 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-82103 DataStage on Cloud Pak for Data Information Disclosure
- CVE-2026-82101 DataStage on Cloud Pak for Data Path Traversal
- CVE-2026-82100 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-8210 aandrew-me tgpt Update helper.go helper.Update command injection
- CVE-2026-82099 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-82098 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-82097 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-82096 DataStage on Cloud Pak for Data Command Injection
- CVE-2026-82095 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-82094 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-82093 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-82092 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-82090 Cross-site scripting in Pocket
- CVE-2026-8209 Path traversal in gibbon
- CVE-2026-82089 Cross-site scripting in android-app
- CVE-2026-82082 Green-Computing｜NUMail - OS Command Injection
- CVE-2026-82081 Server-side request forgery in wallabag
- CVE-2026-8208 Code injection in gibbon
- CVE-2026-82079 Potential Leakage of Nintendo Switch System Information Through a Proximity-Based Remote Attack
- CVE-2026-82078 PaperCut NG/MF Unsafe Reflection
- CVE-2026-82077 PaperCut NG/MF: Remote Code Execution via Scan2Fax
- CVE-2026-82076 Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server
- CVE-2026-82075 Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service
- CVE-2026-82074 Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data
- CVE-2026-82073 Missing authorization in MongoDB Server
- CVE-2026-82072 Memory corruption in Chrome
- CVE-2026-82071 Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write
- CVE-2026-82070 Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface
- CVE-2026-8207 SQL injection in gibbon
- CVE-2026-82069 Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router
- CVE-2026-82068 Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service
- CVE-2026-82067 Auth bypass in MongoDB Server
- CVE-2026-82066 Heap Out-of-Bounds Read in MongoDB Server Query Planning Component
- CVE-2026-82065 Denial of service in MongoDB Server
- CVE-2026-82064 Denial of service in MongoDB Server
- CVE-2026-82063 Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service
- CVE-2026-82062 Missing authorization in MongoDB Server
- CVE-2026-82061 Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service
- CVE-2026-82060 Other in MongoDB Server
- CVE-2026-8206 Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
- CVE-2026-82059 Denial of service in MongoDB Server
- CVE-2026-82058 Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service
- CVE-2026-82057 Memory corruption in MongoDB Server
- CVE-2026-82056 Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service
- CVE-2026-82055 Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service
- CVE-2026-82054 Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service
- CVE-2026-82053 Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment
- CVE-2026-82052 $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars
- CVE-2026-8205 Concrete CMS is vulnerable to authorization bypass in the Calendar Block
- CVE-2026-82049 tarfile extraction filters allow file modification and content disclosure via hard link to symlink
- CVE-2026-82045 UTMStack < 11.2.16 JPQL Injection via searchPropertyValues
- CVE-2026-82044 UTMStack < 11.2.16 Server-Side Request Forgery via downloadPdf
- CVE-2026-82043 UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint
- CVE-2026-82042 UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter
- CVE-2026-82041 UTMStack < 11.2.16 Missing Authorization via Command WebSocket
- CVE-2026-82040 UTMStack < 11.2.16 SSRF via IdentityProviderService
- CVE-2026-8204 Concrete CMS 9.5.0 and below is vulnerable to Authorization Bypass in the Calendar Event Frontend Dialog
- CVE-2026-82039 UTMStack < 11.2.16 SQL Injection via searchGroupsByFilter
- CVE-2026-82035 PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch
- CVE-2026-8203 Concrete CMS 9.5.0 and below has Stored XSS on the height parameter
- CVE-2026-82028 Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API
- CVE-2026-82026 Radar < 1.12.2 Missing Authorization via /api/local-terminal
- CVE-2026-82024 LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles
- CVE-2026-82023 LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert
- CVE-2026-82021 Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference
- CVE-2026-82020 Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool
- CVE-2026-8202 Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators
- CVE-2026-82019 TripleLift video-bundle.js DOM-based XSS via postMessage
- CVE-2026-82018 IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf File
- CVE-2026-82017 IGEL OS 12 / 11 Boot Registry Parameter Injection via Unsigned Configuration Area
- CVE-2026-82013 Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)
- CVE-2026-82011 SQL injection in Adobe Campaign Classic
- CVE-2026-82010 SQL injection in Adobe Campaign Classic
- CVE-2026-8201 Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields
- CVE-2026-82009 SQL injection in Adobe Campaign Classic
- CVE-2026-82008 Adobe Campaign Classic (ACC) | Improper Input Validation (CWE-20)
- CVE-2026-82007 Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-82006 Photoshop Desktop | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-82005 Photoshop Desktop | Out-of-bounds Write (CWE-787)
- CVE-2026-82004 Command injection in Adobe Campaign Classic
- CVE-2026-82003 Adobe Campaign Classic (ACC) | Improper Input Validation (CWE-20)
- CVE-2026-82001 Acrobat Reader | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-82000 Adobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918)
- CVE-2026-8200 Schema validation log messages may not redact user data
- CVE-2026-81999 Adobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918)
- CVE-2026-81998 Substance3D - Modeler | Out-of-bounds Write (CWE-787)
- CVE-2026-81997 Acrobat Reader | Incorrect Authorization (CWE-863)
- CVE-2026-81996 Acrobat Reader | Incorrect Authorization (CWE-863)