Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 350 of 1013.
- CVE-2026-8031 PicoTronica e-Clinic Healthcare System ECHS API Endpoint patient-records missing authentication
- CVE-2026-8030 Missing Authorization in GitLab
- CVE-2026-80298 SQL Injection in HAVELSAN's Sef - AI Chatbot Platform
- CVE-2026-8029 SQL Injection Vulnerability in ZTE SmartLife App
- CVE-2026-8028 FlowiseAI Flowise Endpoint account.service.ts verify information disclosure
- CVE-2026-80276 Comelit 1456B gateway exposes remote configuration password via unauthenticated management interface
- CVE-2026-80275 Comelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpoint
- CVE-2026-80274 Validating resolver can abort while caching a mismatched NOQNAME proof
- CVE-2026-8027 FlowiseAI Flowise User Controller authorization
- CVE-2026-8026 FlowiseAI Flowise API Response account.service.ts login information disclosure
- CVE-2026-80255 secure cookie attribute bypass with tab
- CVE-2026-80254 Missing authorization in ShizenBox2 (edge-app)
- CVE-2026-80253 Auth bypass in ShizenBox2 (dev-conf)
- CVE-2026-8025 SQLi in MOSK Informatics' CBS Platform
- CVE-2026-8024 Deserialization vulnerability in ibaPDA and ibaDatCoordinator
- CVE-2026-80239 Information disclosure in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-80238 Privilege escalation in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-80237 Thinking Software Technology｜Efence - Arbitrary File Upload
- CVE-2026-80236 Thinking Software Technology｜Efence - SQL Injection
- CVE-2026-80235 Thinking Software Technology｜EFence - Arbitrary File Upload
- CVE-2026-80234 CAYIN Technology｜CAYIN CMS-WS/CMS-SE - Missing Authentication
- CVE-2026-80233 CAYIN Technology｜CAYIN CMS-WS/CMS-SE/SMP - Arbitrary File Upload
- CVE-2026-80231 native CA store conn reuse
- CVE-2026-80230 OpenSSL pinning bypass
- CVE-2026-8023 Path traversal in zephyr
- CVE-2026-80229 OpenSSL provider use-after-free
- CVE-2026-80227 SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql
- CVE-2026-80225 Possible degradation of service from continuous queries on the same TCP/DoT connection
- CVE-2026-80223 Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read
- CVE-2026-8022 Information disclosure in Chrome
- CVE-2026-80218 Sign-in token minted for one resource accepted by another in AshAuthentication
- CVE-2026-80217 Command injection in FF-RFI078I4
- CVE-2026-80214 LibreNMS Virtualisation Discovery Module RCE
- CVE-2026-80213 Other in resolv
- CVE-2026-80212 Denial of service in resolv
- CVE-2026-80211 FrontAccounting through 2.4.20 Use of Unsalted MD5 for Password Storage
- CVE-2026-80210 FrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms
- CVE-2026-8021 Cross-site scripting in Chrome
- CVE-2026-80209 Fonoster through 0.22.7 Incorrect Authorization in the Identity UpdateWorkspace Handler
- CVE-2026-80208 APITable through 1.13.0-beta.1 Missing Authentication on the Internal Account Closure Endpoints
- CVE-2026-80207 APITable through 1.13.0-beta.1 Missing Authentication on the Internal Notification Create Endpoint
- CVE-2026-80206 NLTK 3.10.2 Regular Expression Denial of Service via tgrep
- CVE-2026-80205 NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex
- CVE-2026-80204 Grav before 1.0.18 Authentication Bypass via Scoped API Key
- CVE-2026-80203 Grav before 1.0.18 Authentication Bypass via Scoped API Key
- CVE-2026-80202 Kimai before 2.56.0 Authorization Bypass via TimesheetVoter
- CVE-2026-80201 Kimai before 2.53.0 API Token Leakage via Invoice Template
- CVE-2026-80200 Kimai before 2.53.0 Open Redirect via RelayState
- CVE-2026-8020 Information disclosure in Chrome
- CVE-2026-80199 Kimai before 2.54.0 Username Enumeration via Timing Oracle
- CVE-2026-80198 Kimai before 2.56.0 Information Disclosure via config() Twig Function
- CVE-2026-80197 Kimai before 2.57.0 Improper Authorization via Favorite Endpoints
- CVE-2026-80196 Kimai before 2.58.0 Authentication Bypass via Password Reset Link
- CVE-2026-80195 Kimai before 2.63.0 Team Membership Removal via API
- CVE-2026-80194 Kimai before 2.64.0 Missing Authorization via ProjectViewController export
- CVE-2026-80193 Kimai before 2.62.0 Authorization Bypass via QuickEntry
- CVE-2026-80192 better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass
- CVE-2026-80191 GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requests
- CVE-2026-80190 Apache Allura: Stored XSS via code repositories
- CVE-2026-8019 Security feature bypass in Chrome
- CVE-2026-80189 LeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consumption via Unbounded ZIP Extraction
- CVE-2026-80186 Bluez: stack overflow in name2utf8 causes dos and potential code execution
- CVE-2026-80185 Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root
- CVE-2026-80184 Security feature bypass in Keystone
- CVE-2026-80183 Missing authorization in Keystone
- CVE-2026-80182 Security feature bypass in Keystone
- CVE-2026-80181 Apache Allura: Server-side request forgery
- CVE-2026-80180 Apache Allura: Stored XSS via markdown HTML processing
- CVE-2026-8018 Security feature bypass in Chrome
- CVE-2026-80179 Jwcrypto: jwcrypto: denial of service via malformed jwe tokens
- CVE-2026-80178 Privilege escalation in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-80177 SQL injection in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-80176 Information disclosure in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-80175 Information disclosure in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-80174 Auth bypass in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-80172 Auth bypass in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-80171 Weak cryptography in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-80170 Hardcoded credentials in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-8017 Information disclosure in Chrome
- CVE-2026-80169 Information disclosure in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-80167 Hardcoded credentials in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-80166 Privilege escalation in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-80164 Security feature bypass in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-80162 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-80161 Acrobat Reader | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
- CVE-2026-80160 Acrobat Reader | Out-of-bounds Read (CWE-125)
- CVE-2026-8016 Use after free in Chrome
- CVE-2026-80159 Acrobat Reader | Untrusted Search Path (CWE-426)
- CVE-2026-80158 Information disclosure in Red Hat Ceph Storage 5
- CVE-2026-80156 Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass
- CVE-2026-80155 Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation
- CVE-2026-80154 Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass
- CVE-2026-80152 Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule
- CVE-2026-80151 Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download
- CVE-2026-80150 Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter
- CVE-2026-8015 Other in Chrome
- CVE-2026-80149 Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter
- CVE-2026-80148 Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation
- CVE-2026-80147 Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write
- CVE-2026-80146 Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read