Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 337 of 1013.
- CVE-2026-81995 Adobe Experience Manager Forms JEE | Improper Input Validation (CWE-20)
- CVE-2026-81994 Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
- CVE-2026-81993 Acrobat Reader | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-81992 Acrobat Reader | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-81991 Acrobat Reader | Out-of-bounds Read (CWE-125)
- CVE-2026-81990 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-8199 Post-auth memory exhaustion via bitwise match expressions
- CVE-2026-81989 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-81988 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-81987 Acrobat Reader | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-81986 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-81985 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-81984 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-81983 Acrobat Reader | Out-of-bounds Write (CWE-787)
- CVE-2026-81982 Acrobat Reader | Out-of-bounds Read (CWE-125)
- CVE-2026-81981 Acrobat Reader | Out-of-bounds Write (CWE-787)
- CVE-2026-81980 Acrobat Reader | Out-of-bounds Write (CWE-787)
- CVE-2026-8198 Auth bypass in Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity
- CVE-2026-81979 Acrobat Reader | Out-of-bounds Write (CWE-787)
- CVE-2026-81978 Acrobat Reader | Out-of-bounds Read (CWE-125)
- CVE-2026-81977 Acrobat Reader | Integer Underflow (Wrap or Wraparound) (CWE-191)
- CVE-2026-81976 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-81975 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-81973 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-81971 Windows NTFS Elevation of Privilege Vulnerability
- CVE-2026-8197 Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name
- CVE-2026-81969 Windows Server Update Service Elevation of Privilege Vulnerability
- CVE-2026-81964 Windows Update Orchestrator Service Security Feature Bypass Vulnerability
- CVE-2026-81963 Microsoft Windows Link Following
- CVE-2026-81960 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-8196 JeecgBoot mLogin Endpoint LoginController.java authorization
- CVE-2026-81959 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-81958 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-81957 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-81956 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-81955 Windows Graphics Component Remote Code Execution Vulnerability
- CVE-2026-81954 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-81953 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-81952 Microsoft Word Remote Code Execution Vulnerability
- CVE-2026-81951 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-81950 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-8195 JeecgBoot SVG File CommonController.java cross site scripting
- CVE-2026-81949 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-81948 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-81947 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-81946 PLANET IGS-5225-8P2T4S V1/V2 Weak Password Hashing via MD5 Algorithm
- CVE-2026-81945 PLANET IGS-5225-8P2T4S V1/V2 Admin Stack-Based Buffer Overflow via Web Server
- CVE-2026-81944 PLANET IGS-5225-8P2T4S V1/V2 Stack-Based Buffer Overflow via Web Server
- CVE-2026-81943 PLANET IGS-5225-8P2T4S V1/V2 Debug Mode RCE
- CVE-2026-81942 PLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web Server
- CVE-2026-81941 Code injection in Langflow OSS
- CVE-2026-81940 Code injection in Langflow OSS
- CVE-2026-8194 osTicket Dispatcher class.dispatcher.php cross-site request forgery
- CVE-2026-81939 Path traversal in Network Security Manager (NSM)
- CVE-2026-81937 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-81934 Redis TLS pending-data list use-after-free
- CVE-2026-81933 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-81932 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
- CVE-2026-81931 Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting
- CVE-2026-81930 Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain
- CVE-2026-8193 Akaunting Invoice PDF Rendering dompdf.php server-side request forgery
- CVE-2026-81929 Cross-site scripting in Ocean Pro Demos
- CVE-2026-81928 Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record.
- CVE-2026-81927 Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode
- CVE-2026-81926 Cross-site scripting in Concrete CMS
- CVE-2026-81925 Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format
- CVE-2026-81924 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation
- CVE-2026-81923 Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor
- CVE-2026-81922 Missing authorization in Concrete CMS
- CVE-2026-81921 In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status
- CVE-2026-81920 Cross-site request forgery in Concrete CMS
- CVE-2026-8192 Wavlink NU516U1 adm.cgi wzdap os command injection
- CVE-2026-81919 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint
- CVE-2026-81918 Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block
- CVE-2026-81917 Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags
- CVE-2026-81916 Missing authorization in Concrete CMS
- CVE-2026-81915 In Concrete CMS below 9.5.3, Page Type update omits object-level authorization
- CVE-2026-81914 Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names
- CVE-2026-81913 Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.
- CVE-2026-81912 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature
- CVE-2026-81911 Cross-site scripting in Concrete CMS
- CVE-2026-81910 Code injection in Concrete CMS
- CVE-2026-8191 Wavlink NU516U1 adm.cgi wifi_region os command injection
- CVE-2026-81909 Missing authorization in Concrete CMS
- CVE-2026-81908 Missing authorization in Concrete CMS
- CVE-2026-81907 Cross-site request forgery in Concrete CMS
- CVE-2026-81906 [UNREVIEWED] OAuth Callback Login Bypasses Deactivated-Account Checks
- CVE-2026-81905 Business logic in Concrete CMS
- CVE-2026-81904 Concrete CMS before 9.5.3 is vulnerable to Missing Authorization in Stack/Container Sub-Block Asset Registration
- CVE-2026-81903 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon
- CVE-2026-81902 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup
- CVE-2026-81901 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint
- CVE-2026-81900 Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight)
- CVE-2026-8190 Wavlink NU516U1 adm.cgi wan os command injection
- CVE-2026-81899 Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members > Groups dashboard
- CVE-2026-81898 Cross-site scripting in Concrete CMS
- CVE-2026-81897 Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save_control
- CVE-2026-81896 Cross-site scripting in Concrete CMS
- CVE-2026-81895 SQL injection in Concrete CMS
- CVE-2026-81894 Cross-site scripting in Concrete CMS