Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 340 of 1013.
- CVE-2026-81678 AVideo SSRF Guard Bypass via IPv6 Transition Addresses
- CVE-2026-81677 Multiple Vulnerabilities in TOOOLS' iSquad
- CVE-2026-81676 Multiple Vulnerabilities in TOOOLS' iSquad
- CVE-2026-81675 Multiple Vulnerabilities in TOOOLS' iSquad
- CVE-2026-81674 Multiple Vulnerabilities in TOOOLS' iSquad
- CVE-2026-81673 Multiple Vulnerabilities in TOOOLS' iSquad
- CVE-2026-81672 Multiple Vulnerabilities in TOOOLS' iSquad
- CVE-2026-8167 Reflected XSS in theWP's News Theme V8
- CVE-2026-81669 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-81668 Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup
- CVE-2026-81666 Integer overflow in Red Hat Enterprise Linux 10
- CVE-2026-81665 Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly
- CVE-2026-81664 OpenFaaS Gateway 0.27.11 through 0.27.13 Missing Authentication on the /system/telemetry Route
- CVE-2026-81662 Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys
- CVE-2026-81660 Groundhogg < 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio Field
- CVE-2026-8166 Stored XSS in Logo Software's e-Logo Purchasing Portal
- CVE-2026-81659 Flowintel Note PDF Export Allows Arbitrary Local File Read via Pandoc/XeLaTeX Processing
- CVE-2026-81658 Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup
- CVE-2026-81657 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-81656 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-81655 Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields
- CVE-2026-81654 NextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings Update
- CVE-2026-81653 NextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR
- CVE-2026-81652 NextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR
- CVE-2026-81651 NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR
- CVE-2026-81650 NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import
- CVE-2026-81649 Fundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosure
- CVE-2026-81648 Missing authorization in CryptoPayment Gateway
- CVE-2026-81647 Memory corruption in HarmonyOS
- CVE-2026-81646 Memory corruption in HarmonyOS
- CVE-2026-81645 Memory corruption in HarmonyOS
- CVE-2026-81644 Denial of service in HarmonyOS
- CVE-2026-81643 Missing authorization in ash graphql
- CVE-2026-81642 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY
- CVE-2026-81640 Softish C6 Ear Camera and EarVision Android Application Use of Hard-coded Credentials
- CVE-2026-8164 Search Order Hijacking in ArkSigner's ArkSigner Desktop Client
- CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry
- CVE-2026-81637 Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication
- CVE-2026-81636 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service
- CVE-2026-81635 Cross-site scripting in SHIRASAGI
- CVE-2026-81634 Possible heap buffer overflow during DNSSEC canonicalization
- CVE-2026-81633 Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment
- CVE-2026-81632 Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
- CVE-2026-81630 Botslab G980H Dashcams Insufficient Verification of Data Authenticity
- CVE-2026-8163 Infility Global < 2.15.19 - Subscriber+ SQL Injection via order Parameter
- CVE-2026-81627 Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram
- CVE-2026-81626 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-81625 Stack buffer overflow in Greenbone OS and openvas-scanner
- CVE-2026-81624 Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite
- CVE-2026-81623 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-8162 multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing
- CVE-2026-8161 multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception
- CVE-2026-8159 multiparty vulnerable to ReDoS via filename parsing
- CVE-2026-81583 Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation
- CVE-2026-81581 Memory corruption in wibukey
- CVE-2026-8158 Memory corruption in Axis File Player
- CVE-2026-81579 An untrusted Pointer Dereference can be exploited to escalate privileges by an unprivileged user on Windows
- CVE-2026-81578 PaperCut NG/MF Missing Authentication for Critical Function
- CVE-2026-81576 Improper Authentication of Session Handles
- CVE-2026-81575 Missing Sanity Checks for Buffer Lengths
- CVE-2026-81574 Format String Vulnerability in Logger
- CVE-2026-81573 Improper Access Control in Local-Only Configuration Commands
- CVE-2026-81572 Local Privilege Escalation in CodeMeter Runtime on Windows
- CVE-2026-81571 Brave Popup Builder < 0.8.8 - Unauthenticated Arbitrary Shortcode Execution via UTM Parameter
- CVE-2026-8157 Vitepos < 3.4.2 - Outlet Manager+ Privilege Escalation
- CVE-2026-81569 Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution
- CVE-2026-81568 Path traversal in J2Store extension for Joomla
- CVE-2026-81567 SQL injection in J2Store extension for Joomla
- CVE-2026-81566 Missing authorization in SP Page Builder (Free and Pro) extension for Joomla
- CVE-2026-81565 Path traversal in SP Page Builder (Free and Pro) extension for Joomla
- CVE-2026-81564 Path traversal in SP Page Builder (Free and Pro) extension for Joomla
- CVE-2026-81563 SVCB AliasMode additional-data error leaks qpcache references
- CVE-2026-81562 AlexGladkov claude-in-mobile client.ts execSync os command injection
- CVE-2026-81560 blackms aistack Static File server.ts path traversal
- CVE-2026-81554 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-81552 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-81551 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-81550 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-8155 BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR
- CVE-2026-81549 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-81548 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-81547 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-81546 Memory corruption in Affinity
- CVE-2026-81545 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-81543 Privilege escalation in Abandoned Cart Pro for WooCommerce
- CVE-2026-81540 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-81539 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-81537 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-81536 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-81535 wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check
- CVE-2026-81534 Code injection in Email Customizer for WooCommerce (Pro)
- CVE-2026-81533 MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values
- CVE-2026-81532 BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corruption
- CVE-2026-81531 Unauthenticated Account Information Disclosure in Multiple Omada Controllers
- CVE-2026-81530 KMS master key exposure via unredacted credential serialization in driver settings string
- CVE-2026-8153 Command injection in Dashboard Server interface
- CVE-2026-81529 Connection-option injection via unescaped settings in the canonical MongoDB URL builder
- CVE-2026-81528 NoSQL injection via array replacement bypassing update shape validation in driver write path
- CVE-2026-81527 NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation
- CVE-2026-81526 Cross-database write redirection via unvalidated dotted database name in bulk write namespaces