Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 361 of 1013.
- CVE-2026-78660 HTTP/2 transport accepts malformed framing-related headers in net/http
- CVE-2026-7866 Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers.
- CVE-2026-78659 HTTP/2 server memory exhaustion due to Trailer headers in net/http
- CVE-2026-78658 IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an information disclosure vulnerability
- CVE-2026-78657 SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field
- CVE-2026-78656 itsourcecode Sales and Inventory System cust_del.php sql injection
- CVE-2026-78655 Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie be
- CVE-2026-78654 cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution
- CVE-2026-7865 Hidden Console Command
- CVE-2026-7864 Exposure of Sensitive Information to an Unauthorized Actor
- CVE-2026-78638 peerigon unzip-crx/unzip-crx-3 Archive Extraction index.js unzip path traversal
- CVE-2026-78637 Fdawgs node-poppler Argument Injection index.js pdfUnite argument injection
- CVE-2026-78635 Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument
- CVE-2026-78633 Denial of Service in Okta RADIUS Agent Packet Parser
- CVE-2026-78632 Insecure Default File Permissions in Okta RADIUS Agent Windows Installer
- CVE-2026-78631 Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging
- CVE-2026-78630 Improper Input Neutralization in Okta Access Gateway SNMP Configuration Processing
- CVE-2026-7863 OS Command Injection in TUBITAK BILGEM's Pardus Software
- CVE-2026-78629 Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling
- CVE-2026-78628 Improper Input Validation in the Okta Credential Provider for Windows
- CVE-2026-78627 Improper Credential Protection in Okta Hyperdrive Integration Installer Logging
- CVE-2026-78626 Improper Input Sanitization in Okta Access Gateway Protected Rules
- CVE-2026-78625 Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration
- CVE-2026-78624 Improper Path Validation in Okta Access Gateway Backup and Restore Functionality
- CVE-2026-78623 Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores
- CVE-2026-78622 Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal
- CVE-2026-78620 Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling
- CVE-2026-7862 Eupago Gateway For Woocommerce < 4.7.2 - Unauthenticated Arbitrary Refund Initiation
- CVE-2026-78619 Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recover
- CVE-2026-78618 Dimension Business Logic Flaw Allows Chained Backend Object Operations
- CVE-2026-78617 WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting
- CVE-2026-78616 Dimension Stored XSS via Trusted CA Certificate Configuration
- CVE-2026-78615 WatchGuard Dimension Reflected DOM-Based XSS in Report Detail Page
- CVE-2026-78614 Dimension SQL Injection in Audit Report
- CVE-2026-78613 Dimension SQL Injection in Log Viewer
- CVE-2026-78612 Dimension SQL Injection in Scheduled Report
- CVE-2026-78610 Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint
- CVE-2026-7861 Code Injection in Next4Biz's CSM (Customer Service Management)
- CVE-2026-78609 Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data
- CVE-2026-78608 Missing Authorization in Kibana Leading to Information Disclosure
- CVE-2026-78607 Missing Authorization in Elasticsearch Leading to Information Disclosure
- CVE-2026-78606 Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data
- CVE-2026-78605 Information disclosure in Elasticsearch
- CVE-2026-78604 Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM
- CVE-2026-78603 Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata
- CVE-2026-78602 Path traversal in Elastic Maps Server
- CVE-2026-78601 Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure
- CVE-2026-78600 Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention
- CVE-2026-7860 Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build
- CVE-2026-78599 Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources
- CVE-2026-78598 Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data
- CVE-2026-78597 Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation
- CVE-2026-78596 Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations
- CVE-2026-78595 Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure
- CVE-2026-78594 Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service
- CVE-2026-78593 Improper Control of Generation of Code in Kibana Leading to Privilege Escalation
- CVE-2026-78592 Path traversal in Kibana
- CVE-2026-78591 Path traversal in Kibana
- CVE-2026-78590 Path traversal in Kibana
- CVE-2026-7859 Motors Car Dealership & Classified Listings < 1.4.110 - Unauthenticated Post-Meta Write via stm_ajax_add_a_car_media
- CVE-2026-78588 Allocation of Resources Without Limits or Throttling in Filebeat Leading to Denial of Service
- CVE-2026-78587 Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations
- CVE-2026-78586 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-78584 Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure
- CVE-2026-78583 Incorrect Authorization in Kibana Leading to Privilege Escalation
- CVE-2026-78582 Missing Authorization in Kibana Leading to Unauthorized Deletion of Data
- CVE-2026-78581 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana
- CVE-2026-7858 Deserialization in Magic Collaboration Studio
- CVE-2026-78579 Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation
- CVE-2026-78578 Missing authorization in Tapo C120 v1
- CVE-2026-78577 Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200
- CVE-2026-78575 Command injection in Langflow OSS
- CVE-2026-78574 Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling
- CVE-2026-78573 IBM ContextForge MCP Gateway is affected by use of default credentials
- CVE-2026-78571 Code injection in Langflow OSS
- CVE-2026-7857 D-Link DI-8100 CGI user_group.asp sprintf buffer overflow
- CVE-2026-78569 Code injection in Langflow OSS
- CVE-2026-78560 Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source
- CVE-2026-7856 D-Link DI-8100 Web Management url_member.asp buffer overflow
- CVE-2026-78557 Cross-site scripting in Industrial Edge App Publisher
- CVE-2026-78556 Security feature bypass in Industrial Edge App Publisher
- CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source
- CVE-2026-78553 Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook
- CVE-2026-78552 Validation Bypass in Okta Access Gateway Custom Directives
- CVE-2026-78551 RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts
- CVE-2026-78550 Improper Input Handling in Okta Access Gateway Management Console Exception Handler
- CVE-2026-7855 D-Link DI-8100 HTTP Request tggl.asp tggl_asp buffer overflow
- CVE-2026-78547 Out-of-Bounds Write
- CVE-2026-78546 Out-of-Bounds Read
- CVE-2026-78545 Improper Input Sanitization in Okta Access Gateway Application Label Configuration
- CVE-2026-78543 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
- CVE-2026-78541 Command Injection in Parent Control of TP-Link Archer BE3600 v1
- CVE-2026-7854 D-Link DI-8100 POST Parameter url_rule.asp url_rule_asp buffer overflow
- CVE-2026-78536 WordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.9 - Broken Access Control vulnerability
- CVE-2026-78535 WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability
- CVE-2026-78534 WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-78533 WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability
- CVE-2026-78532 WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-78531 WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability
- CVE-2026-78530 WordPress FoodBakery theme <= 4.6 - Arbitrary File Deletion vulnerability