Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 363 of 1013.
- CVE-2026-78417 Security feature bypass in Remote Desktop Manager
- CVE-2026-78416 Authenticated RCE via `condition.config` JSON cleanse bypass
- CVE-2026-78415 IBM Sterling Secure Proxy is vulnerable to multiple issues
- CVE-2026-78414 Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name
- CVE-2026-78413 Velociraptor privilege escalation via SysmonLogForward client monitoring artifact
- CVE-2026-78412 WatchEvent API streams another organization's live events
- CVE-2026-78411 Velociraptor Server Metadata update with Insufficient Permission Check
- CVE-2026-78410 Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection
- CVE-2026-7841 GV-ASWeb Remote Code Execution (RCE) vulnerability
- CVE-2026-78409 Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks
- CVE-2026-78408 Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority
- CVE-2026-78407 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-78406 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-78404 IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility
- CVE-2026-78401 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-7840 UltraVNC repeater HTTP server global buffer overflow via long URI (pre-auth RCE)
- CVE-2026-78399 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-78397 Link Library < 7.9.6 - Unauthenticated SSRF via Reciprocal Link Validation
- CVE-2026-78396 Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure
- CVE-2026-78395 Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass
- CVE-2026-78394 Link Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' Parameter
- CVE-2026-78393 Link Library < 7.9.6 - Reflected XSS via 'link_tags' and 'link_price' Sort and Breadcrumb Links
- CVE-2026-78392 Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter
- CVE-2026-78391 Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook
- CVE-2026-7839 UltraVNC repeater ships hardcoded default admin password allowing unauthenticated admin access
- CVE-2026-78388 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-78387 RansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification
- CVE-2026-78386 Unauthenticated Disclosure of Scraping Credentials and Bypass Configuration via RansomLook API
- CVE-2026-78385 RansomLook Analysis PDF Generation Allows Server-Side Request Forgery and Arbitrary Local File Access
- CVE-2026-78384 Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)
- CVE-2026-78383 Apache Tomcat: AJP DoS via missing request body
- CVE-2026-78381 RansomLook Arbitrary File Read via Path Traversal in Post screen Field
- CVE-2026-78380 Private Group and Market Posts Disclosed Through Public Notification Channels in RansomLook
- CVE-2026-7838 UltraVNC viewer heap buffer overflow via integer overflow in RFB connection-failure reason length
- CVE-2026-78379 Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents Tools
- CVE-2026-78378 Redis Glob Pattern Injection Allows Unauthorized Enumeration of Private Ransomlook Data
- CVE-2026-78377 Open Redirect in Yordam Informatics's Library Automation System
- CVE-2026-78376 Webkitgtk: use-after-free of jscvalue function parameters
- CVE-2026-78375 SQL injection in SP Page Builder (Free and Pro) extension for Joomla
- CVE-2026-78374 Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0
- CVE-2026-78372 RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data
- CVE-2026-78371 File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File Disclosure
- CVE-2026-78370 RansomLook Unauthenticated Database Export Exposes Private Data
- CVE-2026-7837 TOCTOU with root privilege in ad_flush
- CVE-2026-78369 Missing Authentication Allows Unauthorized Creation of Crypto Groups in RansomLook
- CVE-2026-78367 Rpm: rpmbuild gettarspec() crafted tar member name → macro injection
- CVE-2026-78365 IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
- CVE-2026-78364 MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data List
- CVE-2026-78363 MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge Tags
- CVE-2026-78362 SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication
- CVE-2026-78361 zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion
- CVE-2026-7836 hextoint macro uppercase bug
- CVE-2026-78359 Duplicate Identity / Identity Shadowing across CustomerUser backends
- CVE-2026-78358 Cross-Site Request Forgery in Administrative Actions
- CVE-2026-78357 Insufficient Session Revocation for JWT Authentication
- CVE-2026-78356 Unauthenticated Disclosure of Agent Frontend Configuration
- CVE-2026-78355 Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory
- CVE-2026-7835 Format string argument mismatch
- CVE-2026-78341 Privilege escalation in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-78340 Path traversal in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-7834 EFM ipTIME NAS1dual misc_main.cgi get_csrf_whites stack-based overflow
- CVE-2026-78339 Misconfiguration in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-78337 Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG
- CVE-2026-78336 Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user
- CVE-2026-78335 Incorrect Authorization in GitLab
- CVE-2026-78334 Apache bRPC: Missing Authentication for Streaming RPC Frames
- CVE-2026-78333 12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log
- CVE-2026-78330 Apache Syncope: Privilege escalation for admin user via JWT authentication
- CVE-2026-7833 EFM ipTIME C200 ApplyRestore Endpoint iux_set.cgi sub_408F90 command injection
- CVE-2026-78329 Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes
- CVE-2026-78328 Privilege escalation in Network Security Manager (NSM)
- CVE-2026-78327 Command injection in Network Security Manager (NSM)
- CVE-2026-78325 XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML Import
- CVE-2026-78323 Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates
- CVE-2026-78322 File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar handlers
- CVE-2026-78321 DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
- CVE-2026-7832 IObit Advanced SystemCare Service ASC.exe symlink
- CVE-2026-78319 TOCTOU Vulnerability in file exchange
- CVE-2026-78318 Apache Syncope: Unauthenticated reflected XSS in Console and Enduser
- CVE-2026-78317 DIAEnergie - SQL Injection
- CVE-2026-78316 DIAEnergie - SQL Injection
- CVE-2026-78315 DIAEnergie - SQL Injection
- CVE-2026-78314 DIAEnergie - SQL Injection
- CVE-2026-78313 Improper Access Control in DIAEnergie
- CVE-2026-78312 Path Traversal in DIAEnergie
- CVE-2026-78311 SQL Injection in DIAEnergie
- CVE-2026-78310 Authorization Bypass Through User-Controlled Key in DIAEnergie
- CVE-2026-7831 UltraVNC viewer off-by-one stack overflow in ServerInit desktop name parsing
- CVE-2026-78309 SQL Injection in DIAEnergie
- CVE-2026-78308 Authentication Bypass in DIAEnergie
- CVE-2026-78306 DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
- CVE-2026-78303 Business logic in SP Property extension for Joomla
- CVE-2026-78302 Cross-site scripting in SP Property extension for Joomla
- CVE-2026-78301 Out-of-zone database nodes can become authoritative zone cuts
- CVE-2026-7830 UltraVNC MS-Logon II uses 64-bit Diffie-Hellman and seeded libc rand() enabling credential interception
- CVE-2026-78299 Path traversal in Eclipse Embedded CDT (C/C++ Development Tools)
- CVE-2026-78296 WordPress FluentAuth plugin <= 2.1.2 - Email Verification Bypass vulnerability
- CVE-2026-78295 WordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-78294 WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-78293 WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability