Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 349 of 1013.
- CVE-2026-80530 xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
- CVE-2026-8053 FlatBSON Duplicate Field Index Drift
- CVE-2026-80529 xfs: don't swallow dquot recovery verification errors
- CVE-2026-80528 ceph: avoid fs reclaim while using current->journal_info
- CVE-2026-80527 ceph: fix hanging __ceph_get_caps() with stale mds_wanted
- CVE-2026-80526 ASoC: tas2562: Validate values for volume writes
- CVE-2026-80525 ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup
- CVE-2026-80524 optee: ffa: Add NULL check in optee_ffa_lend_protmem
- CVE-2026-80523 clk: spacemit: k3: set hdma clock as critical
- CVE-2026-80522 crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()
- CVE-2026-80521 af_unix: Unlink scc_entry in unix_del_edge().
- CVE-2026-80520 ovpn: fix NULL dereference when killing missing key
- CVE-2026-8052 Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack
- CVE-2026-80519 ovpn: finish crypto callback cleanup before peer release
- CVE-2026-80518 WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path
- CVE-2026-80517 WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload
- CVE-2026-80515 Auth bypass in Eclipse Arrowhead
- CVE-2026-80514 wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass
- CVE-2026-80513 wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields
- CVE-2026-8051 Command injection in Virtual Traffic Manager
- CVE-2026-8050 CVE-2026-8050
- CVE-2026-80494 Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Download
- CVE-2026-80491 SAMO Forms <= 1.0.0 - Unauthenticated SQLi
- CVE-2026-80490 Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified.
- CVE-2026-8049 CVE-2026-8049
- CVE-2026-80489 EUC_JISX0213 decoding may hang on crafted input
- CVE-2026-80488 WP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import Fields
- CVE-2026-8048 My Email Shortcode <= 0.91 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]
- CVE-2026-8047 Out-of-bounds Write in CODESYS Control
- CVE-2026-80469 CVE-2026-80469
- CVE-2026-80467 Privilege escalation in Advanced Custom Fields: Extended
- CVE-2026-80465 Auth bypass in Mendix SAML (Mendix 10 compatible)
- CVE-2026-80464 API Tool Runner SSRF in HAVELSAN's Sef - AI Chatbot Platform
- CVE-2026-80463 Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly
- CVE-2026-80462 Privilege Escalation in Progress Chef Automate
- CVE-2026-8046 Incorrect Authorization in CODESYS Control
- CVE-2026-8045 XML external entity in EcoStruxure™ IT Data Center Expert
- CVE-2026-80444 Unauthenticated Open Redirect Vulnerability in Abis Technology's AVESİS
- CVE-2026-80443 Insecure TLS Certificate Validation in API Tool Runner in HAVELSAN's Sef - AI Chatbot Platform
- CVE-2026-80442 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-80441 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-80440 Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders
- CVE-2026-8044 Command injection in EcoStruxure™ IT Data Center Expert (Formerly known as StruxureWare Data Center Expert)
- CVE-2026-80439 Code injection in Redirection for Contact Form 7
- CVE-2026-80438 Missing authorization in Ninja Forms
- CVE-2026-80437 Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags
- CVE-2026-80436 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-80434 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-80433 WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability
- CVE-2026-80432 Missing authorization in kitty
- CVE-2026-80431 Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process
- CVE-2026-80430 Path traversal in kitty
- CVE-2026-8043 Path traversal in Xtraction
- CVE-2026-80428 ILIAS PHP Object Injection via Shibboleth Logout
- CVE-2026-80427 bestzip before 2.2.6 and 3.0.x before 3.0.2 Argument Injection via Missing Option Delimiter
- CVE-2026-80426 FiftyOne before 1.21.0 Stored Cross-Site Scripting via Unescaped Field Description
- CVE-2026-80425 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-80424 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-80423 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-8042 Github Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2026-80412 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-8040 faq shortocde <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute
- CVE-2026-8039 Fancy Testimonials <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting
- CVE-2026-80381 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
- CVE-2026-80380 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-8038 Faces of Users <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute
- CVE-2026-80379 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-80378 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-8037 Progress LoadMaster Command Injection
- CVE-2026-8036 Local privilege escalation in NI-PAL
- CVE-2026-80359 Missing authorization in Boot Optimized Server Storage (BOSS)
- CVE-2026-80358 Missing authorization in Boot Optimized Server Storage (BOSS)
- CVE-2026-80357 Missing authorization in Boot Optimized Server Storage (BOSS)
- CVE-2026-80356 Information disclosure in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-80355 Cross-site request forgery in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-80354 Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace
- CVE-2026-80353 Race condition in Apache Tomcat
- CVE-2026-80352 Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects
- CVE-2026-80351 Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod
- CVE-2026-80350 OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL
- CVE-2026-8035 NULL pointer dereference in NI-PAL
- CVE-2026-80349 TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter
- CVE-2026-80348 TarsWeb through 3.0.16 Missing Authorization on Patch Deploy, Download and Delete Endpoints
- CVE-2026-80347 mcp-fetch through 1.6.3 Server-Side Request Forgery via Unstripped IPv6 Literal Brackets
- CVE-2026-80346 StarRocks through 4.0.13 Missing Authorization on DROP MATERIALIZED VIEW for Legacy Synchronous Materialized Views
- CVE-2026-80344 Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address
- CVE-2026-80343 Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching
- CVE-2026-80342 Payment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order ID
- CVE-2026-80341 Payment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assignment via IDOR
- CVE-2026-80340 Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay
- CVE-2026-8034 Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion
- CVE-2026-80339 Payment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure via order-pay
- CVE-2026-80338 CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler
- CVE-2026-80337 Unauthorized Cross-Chatbot Tool Invocation in HAVELSAN's Sef - AI Chatbot Platform
- CVE-2026-80333 Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes
- CVE-2026-8033 PicoTronica e-Clinic Healthcare System ECHS Response Header v2 information disclosure
- CVE-2026-80327 Open Redirect in PingGateway Fragment Filter
- CVE-2026-8032 PicoTronica e-Clinic Healthcare System ECHS echs.js hard-coded credentials
- CVE-2026-80312 Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors
- CVE-2026-80311 Stripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via IDOR