Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 365 of 1013.
- CVE-2026-78181 ractivejs ractive Keypath Ractive#set prototype pollution
- CVE-2026-78180 alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution
- CVE-2026-7818 pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution
- CVE-2026-78179 rexrainbow phaser3-rex-notes BehaviorTree Blackboard Data SetValue.js SetValue prototype pollution
- CVE-2026-78178 jQWidgets jqx-all.js jqxBaseFramework.extend prototype pollution
- CVE-2026-78177 TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection
- CVE-2026-78175 Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
- CVE-2026-78174 WatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs
- CVE-2026-78172 Themify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scripting
- CVE-2026-78171 itsourcecode Sales and Inventory System processlogin.php sql injection
- CVE-2026-78170 UTT HiPER 1200GW formConfigFastDirectionW strcpy buffer overflow
- CVE-2026-7817 pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpoints
- CVE-2026-78169 UTT HiPER 1250GW HTTP Request aspRemoteApConfTempSend strcpy stack-based overflow
- CVE-2026-78168 EFM ipTIME T24000M Session Validation httpcon_check_session_url improper authentication
- CVE-2026-78167 EFM ipTIME T16000M Session Validation httpcon_check_session_url improper authentication
- CVE-2026-78166 provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection
- CVE-2026-78165 Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads
- CVE-2026-78164 Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers
- CVE-2026-78163 Server-side request forgery in Apache Camel
- CVE-2026-78162 Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)
- CVE-2026-78161 warmcat libwebsockets LECP CBOR Recording lecp.c report_raw_cbor out-of-bounds write
- CVE-2026-78160 Dolibarr ERP User Notes note.php authorization
- CVE-2026-7816 pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout
- CVE-2026-78159 Code injection in The Events Calendar
- CVE-2026-78158 Open5GS AMF UEContextReleaseRequest Path improper authorization
- CVE-2026-78157 Open5GS Rx AA-Request pcrf-rx-path.c pcrf_rx_aar_cb out-of-bounds
- CVE-2026-78156 Open5GS S6a Authentication-Information-Request hss-s6a-path.c hss_ogs_diam_s6a_air_cb heap-based overflow
- CVE-2026-78155 Untrusted Search Path in StackGres
- CVE-2026-78153 Restrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization
- CVE-2026-78152 SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema
- CVE-2026-78151 FormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response
- CVE-2026-78150 Missing authorization in Smart Post
- CVE-2026-7815 pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution
- CVE-2026-78149 Missing authorization in Smart Post
- CVE-2026-78148 ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_compute null pointer dereference
- CVE-2026-78147 ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp deserialize_tensor deserialization
- CVE-2026-78146 Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure via Actions Page
- CVE-2026-78145 CTFd __init__.py _is_safe_url redirect
- CVE-2026-78144 code-projects Barangay Resident Profiling Management System Boarder Management boarders.php authorization
- CVE-2026-78143 code-projects Barangay Resident Profiling Management System Resident Search Functionality residents.php sql injection
- CVE-2026-78142 code-projects Barangay Resident Profiling Management System Restore/Delete archived_records.php authorization
- CVE-2026-78141 Tenda CH22 exeCommand formexeCommand command injection
- CVE-2026-78140 Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine
- CVE-2026-7814 pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer
- CVE-2026-78139 Notifima < 3.1.4 - Subscriber+ Stock Alert Unsubscription via IDOR
- CVE-2026-78138 Finale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_html
- CVE-2026-78137 Business logic in StoreGrowth
- CVE-2026-78136 Code injection in CHIRP
- CVE-2026-78135 Auth bypass in strongSwan
- CVE-2026-78134 Auth bypass in strongSwan
- CVE-2026-78133 Use after free in strongSwan
- CVE-2026-78132 Denial of service in strongSwan
- CVE-2026-78131 Denial of service in strongSwan
- CVE-2026-78130 Null dereference in strongSwan
- CVE-2026-7813 pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode
- CVE-2026-78129 Denial of service in strongSwan
- CVE-2026-78127 Denial of service in strongSwan
- CVE-2026-78126 Null dereference in strongSwan
- CVE-2026-78125 LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure
- CVE-2026-78124 Denial of service in strongSwan
- CVE-2026-78123 Use after free in strongSwan
- CVE-2026-78122 docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems
- CVE-2026-7812 54yyyu code-mcp MCP Tool server.py git_operation command injection
- CVE-2026-78119 Memory corruption in zephyr
- CVE-2026-78118 Race condition in zephyr
- CVE-2026-78117 Race condition in zephyr
- CVE-2026-78116 Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path
- CVE-2026-78115 SourceCodester Class and Exam Timetabling System User Account Update edit_user_account.php improper authorization
- CVE-2026-78112 itsourcecode Hospital Management System Project in PHP viewservicetype.php sql injection
- CVE-2026-7811 54yyyu code-mcp MCP File server.py is_safe_path path traversal
- CVE-2026-78103 Dimension Log Server Configuration Lock Bypass Vulnerability
- CVE-2026-7810 UsamaK98 python-notebook-mcp server.py add_cell path traversal
- CVE-2026-78088 Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter
- CVE-2026-78087 VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature
- CVE-2026-78085 Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4
- CVE-2026-78084 Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4
- CVE-2026-78083 Cross-site request forgery in SP Property extension for Joomla
- CVE-2026-78082 SQL injection in SP Property extension for Joomla
- CVE-2026-78081 Cross-site request forgery in J2Store extension for Joomla
- CVE-2026-78080 Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0
- CVE-2026-7808 justhtml before 1.16.0 Multiple Security Issues via Sanitization
- CVE-2026-78079 Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10
- CVE-2026-78078 Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10
- CVE-2026-78077 Cross-site scripting in Helix Ultimate extension for Joomla
- CVE-2026-78076 Missing authorization in Helix Ultimate extension for Joomla
- CVE-2026-78075 Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10
- CVE-2026-78074 Missing authorization in Custom API for Joomla (free) extension for Joomla
- CVE-2026-78073 Joomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0
- CVE-2026-78072 Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1
- CVE-2026-78071 Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0
- CVE-2026-78070 Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2
- CVE-2026-7807 SmarterTools SmarterMail < Build 9560 Server Local File Inclusion via the /api/v1/report/summary/{type} API
- CVE-2026-78069 Missing authorization in J2Store extension for Joomla
- CVE-2026-78068 Cross-site scripting in Table Field Add-on for ACF and SCF
- CVE-2026-78066 Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes
- CVE-2026-78065 Missing authorization in J2Store extension for Joomla
- CVE-2026-78064 Missing authorization in J2Store extension for Joomla
- CVE-2026-78063 Tenda CH22 editFileName formeditFileName command injection
- CVE-2026-78062 vas3k TaxHacker JWT Secret config.ts envSchema.parse hard-coded credentials
- CVE-2026-78061 vas3k TaxHacker Email Sync imap-client.ts buildImapConfig server-side request forgery