Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 341 of 1013.
- CVE-2026-81525 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
- CVE-2026-81524 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver
- CVE-2026-81523 Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt
- CVE-2026-81522 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver
- CVE-2026-81521 Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver
- CVE-2026-81520 MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion
- CVE-2026-8152 Unblu Spark Open Redirect leading to DOM-Based XSS
- CVE-2026-81518 BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections
- CVE-2026-81517 MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL Service
- CVE-2026-81516 Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)
- CVE-2026-81515 Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)
- CVE-2026-8151 Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF
- CVE-2026-81509 nforwardauth: Unvalidated r parameter allows post-authentication open redirect
- CVE-2026-81508 ESF-IDF: Heap Out-of-Bounds Read in Bluedroid A2DP Sink Media Packet Processing
- CVE-2026-81507 ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data
- CVE-2026-81505 Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
- CVE-2026-81491 boxpositron with-context-mcp index.ts project_folder path traversal
- CVE-2026-81490 MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL Service
- CVE-2026-8149 GCM chunking can lead to bad tag exception on decryption
- CVE-2026-81486 bsmi021 mcp-file-context-server Path Resolution index.ts read_context path traversal
- CVE-2026-81485 danielpopamd linkedin-ads-mcp Media Upload campaign-management.ts fs.readFileSync path traversal
- CVE-2026-81481 Path traversal in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-81480 Memory corruption in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-8148 Privilege escalation in NAVER MYBOX Explorer
- CVE-2026-81479 Denial of service in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-81478 Hardcoded credentials in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-81477 Memory corruption in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-81476 Command injection in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-81475 Auth bypass in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-81474 Memory corruption in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-81473 Privilege escalation in Rugged Control Center (RCC)
- CVE-2026-81472 Code injection in iDRAC Service Module for ESXi
- CVE-2026-8147 Authorization Bypass in mlflow/mlflow
- CVE-2026-81469 Privilege escalation in Inventory Collector Client
- CVE-2026-81468 Command injection in ThinOS 10
- CVE-2026-81467 Command injection in ThinOS 10
- CVE-2026-81455 Auth bypass in ThinOS 10
- CVE-2026-81453 Path traversal in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-81452 Privilege escalation in Alienware Command Center (AWCC)
- CVE-2026-8145 WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration'
- CVE-2026-81447 Security feature bypass in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-81446 Server-side request forgery in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-81445 Privilege escalation in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-81443 Server-side request forgery in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-81442 Privilege escalation in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-81441 Missing authorization in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-81440 Hardcoded credentials in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-8144 Missing Authorization in GitLab
- CVE-2026-81439 Missing authorization in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-81438 Weak cryptography in Dell OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-81433 Fireware OS Pre-Authentication Stack Buffer Overflow in fingerd Allows Remote Code Execution
- CVE-2026-81432 JetStyleManager < 1.3.9 - Skin Deletion and Modification via CSRF
- CVE-2026-81431 Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id
- CVE-2026-8143 Booking Calendar – Event Calendar <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters
- CVE-2026-81429 Export & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRF
- CVE-2026-81428 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR
- CVE-2026-81427 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change
- CVE-2026-81426 WC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF
- CVE-2026-81424 Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR
- CVE-2026-81423 Accept Stripe Payments < 2.1.4 - Open Redirect via IPN Handler
- CVE-2026-81421 ddfourtwo sentry-selfhosted-mcp raw_sentry_api server-side request forgery
- CVE-2026-81420 Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter
- CVE-2026-8142 CVE-2026-8142
- CVE-2026-8141 Ajax Load More - Filters <= 3.4.1 - Unauthenticated Stored Cross-Site Scripting via 'taxonomy_include_children' Field
- CVE-2026-81404 IPGP Visitors Origin < 1.6 - Reflected XSS
- CVE-2026-81402 DS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File Upload
- CVE-2026-81401 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-81400 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-8140 Concrete CMS 9.5.0 and below is vulnerable to CSRF on download() in the package install controller
- CVE-2026-81399 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-81398 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-81397 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-81396 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-81395 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-81394 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-81393 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-81392 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-81391 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-81390 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-8139 Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName
- CVE-2026-81389 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-81388 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-81387 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-81386 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-81385 Microsoft Office Publisher Remote Code Execution Vulnerability
- CVE-2026-81383 Visual Studio Code Information Disclosure Vulnerability
- CVE-2026-81381 GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability
- CVE-2026-81380 GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability
- CVE-2026-8138 Tenda CX12L SetPptpServerCfg” formSetPPTPServer stack-based overflow
- CVE-2026-81379 Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-81378 Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-81377 Visual Studio Code Tampering Vulnerability
- CVE-2026-81376 Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-81375 Confused Deputy in Application Integration allows Internal File Read
- CVE-2026-8137 Totolink X5000R formDdns sub_458E40 buffer overflow
- CVE-2026-8136 SourceCodester Pharmacy Sales and Inventory System index.php users cross site scripting
- CVE-2026-81357 Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-81356 Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-81355 Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability
- CVE-2026-81354 Windows Hello Elevation of Privilege Vulnerability