Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 369 of 1013.
- CVE-2026-77557 Privilege escalation in UniFi Protect AI Key
- CVE-2026-77556 Memory corruption in Cloud Gateways
- CVE-2026-77555 Memory corruption in Cloud Gateways
- CVE-2026-77554 Command injection in UniFi Talk Application
- CVE-2026-77553 Privilege escalation in UniFi Access Application
- CVE-2026-77552 Command injection in UniFi Enterprise Audio/Video Bridge
- CVE-2026-77551 Privilege escalation in UniFi Connect Display Cast Pro
- CVE-2026-77550 Auth bypass in Cloud Gateways
- CVE-2026-7755 MCP Server Configuration Validator Bypass via File Upload API
- CVE-2026-77549 Auth bypass in Cloud Gateways
- CVE-2026-77548 Command injection in UniFi Protect Application
- CVE-2026-77547 Command injection in UniFi Access Application
- CVE-2026-77546 Command injection in UniFi Access Application
- CVE-2026-77545 Privilege escalation in Cloud Gateways
- CVE-2026-77544 Memory corruption in Cloud Gateways
- CVE-2026-77543 Command injection in UniFi Access Application
- CVE-2026-77542 Command injection in UID Enterprise Agent
- CVE-2026-77541 Privilege escalation in UniFi Network Application
- CVE-2026-77540 Command injection in UniFi OS Server
- CVE-2026-7754 SSRF Protection Configuration Vulnerability
- CVE-2026-77539 Command injection in UniFi OS Server
- CVE-2026-77538 Privilege escalation in UniFi Connect Application
- CVE-2026-77537 Command injection in UniFi Protect Application
- CVE-2026-77536 Privilege escalation in Cloud Gateways
- CVE-2026-77535 Command injection in UniFi Network Application
- CVE-2026-77534 Privilege escalation in Cloud Gateways
- CVE-2026-77533 Command injection in UniFi Protect Application
- CVE-2026-77532 Memory corruption in EdgeMAX EdgeSwitch
- CVE-2026-7753 Missing authorization in Cost Calculator Builder
- CVE-2026-77528 Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
- CVE-2026-77525 MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id
- CVE-2026-77524 KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
- CVE-2026-77523 MaxKB: Cross-workspace model parameter form write
- CVE-2026-77522 Server-side request forgery in MaxKB
- CVE-2026-77521 MaxKB: Prompt-injectable agent can lead to command execution
- CVE-2026-77520 Missing authorization in MaxKB
- CVE-2026-77519 MaxKB: Expired application API keys remain usable on `/chat/api/mcp`
- CVE-2026-77518 MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows
- CVE-2026-77517 MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge base
- CVE-2026-77516 MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path
- CVE-2026-77508 Weblate: Unverified REST API email changes
- CVE-2026-77507 Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users
- CVE-2026-77506 Cross-site scripting in Znuny
- CVE-2026-77505 Windows DNS Server Remote Code Execution Vulnerability
- CVE-2026-77504 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-77503 Windows NTFS Elevation of Privilege Vulnerability
- CVE-2026-77502 Windows DHCP Server Denial of Service Vulnerability
- CVE-2026-77501 Windows DHCP Server Denial of Service Vulnerability
- CVE-2026-77500 Windows Device Association Service Elevation of Privilege Vulnerability
- CVE-2026-7750 Totolink N300RH POST Request cstecgi.cgi setMacFilterRules buffer overflow
- CVE-2026-77499 Windows DHCP Server Denial of Service Vulnerability
- CVE-2026-77498 Windows DHCP Server Denial of Service Vulnerability
- CVE-2026-77496 Windows Imaging Component Remote Code Execution Vulnerability
- CVE-2026-77495 Windows Imaging Component Remote Code Execution Vulnerability
- CVE-2026-77494 Windows DHCP Server Denial of Service Vulnerability
- CVE-2026-77493 Windows Graphics Component Remote Code Execution Vulnerability
- CVE-2026-77492 Windows Storage Port Driver Information Disclosure Vulnerability
- CVE-2026-77491 Windows GDI Information Disclosure Vulnerability
- CVE-2026-77490 Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2026-7749 Totolink N300RH POST Request cstecgi.cgi setWanConfig buffer overflow
- CVE-2026-77489 Windows Biometric Service Elevation of Privilege Vulnerability
- CVE-2026-77488 Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-77487 SQL Server Elevation of Privilege Vulnerability
- CVE-2026-77486 Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-77485 SQL Server Elevation of Privilege Vulnerability
- CVE-2026-77484 Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-77483 SQL Server Elevation of Privilege Vulnerability
- CVE-2026-77482 Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-77481 Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-77480 SQL Server Elevation of Privilege Vulnerability
- CVE-2026-7748 Totolink N300RH POST Request cstecgi.cgi setUpgradeFW buffer overflow
- CVE-2026-77474 Denial of service in destructive command guard
- CVE-2026-77470 Business logic in Lychee
- CVE-2026-7747 Totolink N300RH Parameter cstecgi.cgi loginauth buffer overflow
- CVE-2026-77468 Information disclosure in Lychee
- CVE-2026-77467 Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path
- CVE-2026-77466 Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection
- CVE-2026-77465 toml-node: Uncontrolled Recursion
- CVE-2026-77460 EspoCRM: Mass email template renderer leaks restricted record fields
- CVE-2026-7746 SourceCodester Web-based Pharmacy Product Management System edit-admin.php sql injection
- CVE-2026-77459 Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
- CVE-2026-77454 exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql
- CVE-2026-7745 CodeAstro Online Classroom facultydetails sql injection
- CVE-2026-7744 CodeAstro Online Classroom addnewstudent sql injection
- CVE-2026-77438 Trilium unauthenticated share-search discloses password-protected and hidden shared notes
- CVE-2026-7743 CodeAstro Online Classroom studentdetails sql injection
- CVE-2026-77427 FileRise: Insecure default cryptographic key fallback in manual installs
- CVE-2026-77426 Unleash: Missing await on permission check + cross-project IDOR in admin API
- CVE-2026-77425 Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log
- CVE-2026-77423 JLine: ReDoS in Built-in Less Viewer Search
- CVE-2026-77422 JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping
- CVE-2026-77421 JLine: ReDoS in Nano Editor Regex Search Mode
- CVE-2026-77420 JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable
- CVE-2026-7742 CodeAstro Online Classroom facultylogin sql injection
- CVE-2026-77415 JSONata: Arbitrary Code Execution via crafted JSONata expressions
- CVE-2026-77414 JSONata: Arbitrary Code Execution via crafted JSONata expressions
- CVE-2026-77413 JSONata: Arbitrary Code Execution via crafted JSONata expressions
- CVE-2026-77412 RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client
- CVE-2026-77411 RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr
- CVE-2026-77410 RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation