Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 367 of 1013.
- CVE-2026-77906 Visual Studio Remote Code Execution Vulnerability
- CVE-2026-77905 Windows Management Instrumentation Elevation of Privilege Vulnerability
- CVE-2026-77904 Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability
- CVE-2026-77903 Microsoft Dataverse Elevation of Privilege Vulnerability
- CVE-2026-77902 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-77901 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-77900 Azure App Service Remote Code Execution Vulnerability
- CVE-2026-7790 Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS
- CVE-2026-77899 Windows Security Center Elevation of Privilege Vulnerability
- CVE-2026-77898 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-77897 Microsoft Power Automate Desktop Elevation of Privilege Vulnerability
- CVE-2026-77896 Windows Remote Desktop Client Denial of Service Vulnerability
- CVE-2026-77895 Windows DHCP Server Denial of Service Vulnerability
- CVE-2026-77894 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-77893 Windows DHCP Server Denial of Service Vulnerability
- CVE-2026-77892 Windows Boot Manager Elevation of Privilege Vulnerability
- CVE-2026-77891 Windows DHCP Server Remote Code Execution Vulnerability
- CVE-2026-77890 Windows DHCP Server Denial of Service Vulnerability
- CVE-2026-77889 Windows DHCP Server Denial of Service Vulnerability
- CVE-2026-77888 Windows DHCP Server Denial of Service Vulnerability
- CVE-2026-77887 Windows DHCP Server Remote Code Execution Vulnerability
- CVE-2026-77886 Windows DHCP Server Denial of Service Vulnerability
- CVE-2026-77884 Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposure
- CVE-2026-77883 Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist
- CVE-2026-7788 Axle-Bucamp MCP-Docusaurus document.py get_content path traversal
- CVE-2026-77875 Hide Photos - Secure vault 4.1.0 - Insecure storage of vault media and wallet records in shared external storage
- CVE-2026-77874 IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
- CVE-2026-77871 Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-7787 Unauthenticated Session History Access via Public Flow Execution
- CVE-2026-77866 SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts
- CVE-2026-77860 'serve-expired' can bypass Unbound 'wait-limit'
- CVE-2026-7786 Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter Use of Hard-coded Credentials
- CVE-2026-77856 Unbounded atom creation from typed struct field names in AshTypescript field selector
- CVE-2026-77853 Command injection in FF-RFI078I4
- CVE-2026-77850 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content
- CVE-2026-7785 A-G-U-P-T-A wireshark-mcp pyshark_mcp.py quick_capture os command injection
- CVE-2026-77847 Tycon Systems TPDIN-Monitor-WEB3 Use of Hard-coded Credentials
- CVE-2026-77846 JSON path injection via unescaped get_path segments in AshSqlite
- CVE-2026-7784 RTGS2017 NagaAgent Skills Endpoint extensions.py path traversal
- CVE-2026-77838 Cross-site scripting in SOY Calendar
- CVE-2026-77831 Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking
- CVE-2026-77830 Cross-site scripting in Spam protection, Honeypot, Anti-Spam by CleanTalk
- CVE-2026-7783 CodeCanyon Perfex CRM Admin Kanban Endpoint AbstractKanban.php applySortQuery sql injection
- CVE-2026-77829 Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content
- CVE-2026-77827 Maono Link local privilege escalation
- CVE-2026-77826 Auth bypass in RegistrationMagic
- CVE-2026-77825 IBM ContextForge MCP Gateway is affected by path traversal
- CVE-2026-77824 Media Sweep <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter
- CVE-2026-77823 LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
- CVE-2026-77822 Server-side request forgery in ContextForge MCP Gateway
- CVE-2026-77820 WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute
- CVE-2026-7782 CodeCanyon Perfex CRM Tenant Clients.php project authorization
- CVE-2026-77819 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-77818 Reflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation System
- CVE-2026-77817 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-77816 IBM WebSphere Application Server Liberty Improper Certificate Validation
- CVE-2026-77815 Infinite Image Browsing Resolves Paths With normpath, Allowing Symlink Escape From Scanned Directories
- CVE-2026-77814 Infinite Image Browsing is_path_trusted Prefix Comparison Omits the Trailing Path Separator
- CVE-2026-77812 Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE
- CVE-2026-77811 Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards
- CVE-2026-77810 Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector
- CVE-2026-7781 Open5GS amf-3gpp-access Endpoint nudm-handler.c udm_nudm_uecm_handle_amf_registration_update denial of service
- CVE-2026-77807 Path traversal in AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
- CVE-2026-77806 Code injection in SPIP
- CVE-2026-77805 Weak Executable Signature Verification Vulnerability in Progress® Telerik® Fiddler® Classic
- CVE-2026-77804 Race condition in Progress® Telerik® Fiddler® Classic
- CVE-2026-77803 Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic
- CVE-2026-77802 HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic
- CVE-2026-77801 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-7780 Open5GS smf-registrations Endpoint udm-sm.c udm_state_operational denial of service
- CVE-2026-77798 Velociraptor Authenticated Denial of Service
- CVE-2026-77797 Velociraptor Prefetch parser out of bounds
- CVE-2026-77795 Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorization
- CVE-2026-77794 RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity
- CVE-2026-77793 RegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field
- CVE-2026-77792 RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field
- CVE-2026-77791 Apache Tomcat: DoS via busy wait during WebSocket close
- CVE-2026-77790 RegistrationMagic < 6.0.9.4 - Admin+ SQLi via 'rm_sortby' Parameter
- CVE-2026-7779 Denial of service in Open5GS
- CVE-2026-77789 Stripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer Subscription Modification via IDOR
- CVE-2026-77788 Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas
- CVE-2026-77787 Rank Math SEO < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk
- CVE-2026-77786 Rank Math SEO < 1.0.277 - Editor+ Core Settings Modification via fix-site-seo Ability
- CVE-2026-77785 Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API
- CVE-2026-77784 Rank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as
- CVE-2026-77783 Rank Math SEO < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure
- CVE-2026-77782 Rank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt
- CVE-2026-77781 Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys
- CVE-2026-77780 Missing authorization in Prospero Flow CRM
- CVE-2026-7778 runZero Platform dashboard configuration exposure
- CVE-2026-77776 Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity
- CVE-2026-77775 Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation
- CVE-2026-77774 Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-77773 Social Contact Form (FormyChat) < 2.15.8 - Unauthenticated Gravity Forms Entry Disclosure via formychat_get_gf_entry
- CVE-2026-77771 miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout
- CVE-2026-77770 miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator
- CVE-2026-77769 OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries
- CVE-2026-77768 OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access
- CVE-2026-77767 Missing authorization in reconmap
- CVE-2026-77766 Directorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure via REST Orders Endpoint