Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 366 of 1013.
- CVE-2026-78060 SourceCodester Stock Management System getOrderReport.php cross site scripting
- CVE-2026-78059 SourceCodester Stock Management System printOrder.php cross site scripting
- CVE-2026-78058 Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path
- CVE-2026-78057 sambitraj Student-Management-System Management Mutation sql injection
- CVE-2026-78056 sambitraj Student-Management-System Dashboard sql injection
- CVE-2026-78055 SourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting
- CVE-2026-78054 SourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting
- CVE-2026-78051 alexta69 MeTube Cookie File cookies.txt file access
- CVE-2026-78050 Comfast CF-N1-S Web Management mbox-config sub_41AD7C stack-based overflow
- CVE-2026-78049 Systerel S2OPC AddNodes Service sopc_node_mgt_helper_internal.c out-of-bounds
- CVE-2026-78048 Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder
- CVE-2026-78047 Dimension Stored XSS in Scheduled Report Task
- CVE-2026-78043 Path traversal in OpenVPN
- CVE-2026-7804 Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter
- CVE-2026-78038 Job argument injection via :args overrides primary_key and tenant in AshOban
- CVE-2026-78037 Xiiaozet LK100W OS Command Injection
- CVE-2026-78032 Deserialization in SOY CMS
- CVE-2026-78030 DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM
- CVE-2026-7803 Flow Validation Bypass via Empty Component Type Field
- CVE-2026-78027 Server-side request forgery in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-78026 Missing authorization in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-78025 Auth bypass in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-78024 Server-side request forgery in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-78023 Missing authorization in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-78022 Security feature bypass in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-78021 Information disclosure in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-78020 Security feature bypass in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-7802 Missing authorization in Frontend Admin by DynamiApps
- CVE-2026-78019 Privilege escalation in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-78018 Misconfiguration in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-78017 Security feature bypass in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-78016 Other in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-78015 Security feature bypass in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-78013 Misconfiguration in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-78012 Stack-based Buffer Overflow in Pyramid Solutions NetStaX EtherNet/IP Stack
- CVE-2026-78011 Fireware OS Integer Underflow in Iked Allows Unauthenticated Denial of Service (DoS)
- CVE-2026-78010 Fireware OS Stack-Based Buffer Overflow in iked Allows Unauthenticated Denial of Service
- CVE-2026-78009 Fireware OS Out-of-Bounds Read in iked Allows Unauthenticated Denial of Service (DoS)
- CVE-2026-78008 Fireware OS Authenticated Buffer Overflow in wgagent
- CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
- CVE-2026-78003 Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys
- CVE-2026-78002 Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function
- CVE-2026-78001 Cross-site scripting in Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
- CVE-2026-78000 Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
- CVE-2026-77999 Business logic in J2Store extension for Joomla
- CVE-2026-77998 Auth bypass in SAML SP Single Sign On – Login with ADFS extension for Joomla
- CVE-2026-77997 Missing authorization in YOOtheme Pro extension for Joomla
- CVE-2026-77996 Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41
- CVE-2026-77995 Auth bypass in Login with Keycloak OAuth Single Sign-On (SSO) (free) extension for Joomla
- CVE-2026-77994 Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5
- CVE-2026-77993 Joomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.5
- CVE-2026-77992 Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2
- CVE-2026-77991 Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1
- CVE-2026-77990 Missing authorization in JEM - Joomla Event Manager extension for Joomla
- CVE-2026-77989 Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1
- CVE-2026-77988 TRENDnet TEW-823DRU CLI Configuration Tool nvram_get command injection
- CVE-2026-77987 GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery
- CVE-2026-7798 FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter
- CVE-2026-77977 Ebyte NA111-M Missing Authentication for Critical Function
- CVE-2026-77975 Ebyte NA111-M Cleartext Storage of Sensitive Information
- CVE-2026-77974 Softish C6 Ear Camera and EarVision Android Application Missing authentication for critical function
- CVE-2026-77972 safeurl validated address is not bound to the request, allowing DNS rebinding
- CVE-2026-77970 Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions
- CVE-2026-7797 Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter
- CVE-2026-77968 Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serviceaccount
- CVE-2026-77967 Botslab G980H Dashcams Authentication Bypass by Capture-replay
- CVE-2026-77966 Ebyte NA111-M Missing Authorization
- CVE-2026-77960 Use of Hard-coded Credentials in Bransys ELD
- CVE-2026-7796 EmbedPress <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute
- CVE-2026-77956 EEx template evaluation of prompt content in AshAi enables remote code execution
- CVE-2026-77955 Possible ZONEMD verification bypass window
- CVE-2026-77950 RPC error handler fails open in AshTypescript, disclosing unredacted errors
- CVE-2026-7795 Click to Chat <= 4.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Parameter
- CVE-2026-77946 TRENDnet TEW-821DAP NTP Timezone Configuration apply_time.cgi uci_safe_get stack-based overflow
- CVE-2026-77945 TRENDnet TEW-821DAP ssi upload.cgi command injection
- CVE-2026-77939 Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint
- CVE-2026-77938 Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment Inheritance
- CVE-2026-77937 Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header
- CVE-2026-77936 Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access
- CVE-2026-77935 Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers
- CVE-2026-77934 Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner
- CVE-2026-77933 DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment
- CVE-2026-77932 DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent
- CVE-2026-77931 MoviePilot 3.1.5 Command Injection via ExecuteCommandTool
- CVE-2026-77930 EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents
- CVE-2026-77929 ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Upload Endpoint
- CVE-2026-77928 ClipBucket < 5.5.3-#182 Blind SQL Injection via Private Message Deletion Endpoint
- CVE-2026-77927 ClipBucket < 5.5.3-#182 Blind SQL Injection via Photo Deletion Endpoint
- CVE-2026-77926 Aix-DB 1.2.4 Authenticated RCE via ChatBI Common Agent Execute Tool
- CVE-2026-77923 Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action
- CVE-2026-7792 Security feature bypass in WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
- CVE-2026-77915 rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php
- CVE-2026-77914 rConfig Core 8.0.0 < 8.2.13 Core Path Traversal via Export Download Endpoint
- CVE-2026-77912 Cross-site scripting in Enterprise Server
- CVE-2026-77911 Microsoft Office Word Information Disclosure Vulnerability
- CVE-2026-77910 Microsoft Exchange Server Elevation of Privilege Vulnerability
- CVE-2026-7791 Local Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight Agent
- CVE-2026-77909 Azure CycleCloud Information Disclosure Vulnerability
- CVE-2026-77908 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
- CVE-2026-77907 Visual Studio Remote Code Execution Vulnerability