Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 371 of 1013.
- CVE-2026-77237 Missing type validation in xQueueAddToSet in FreeRTOS-Kernel
- CVE-2026-77236 Missing size validation in SecureContext_AllocateContext in FreeRTOS-Kernel
- CVE-2026-77235 Missing privilege check in SecureContext_FreeContext in FreeRTOS-Kernel
- CVE-2026-77234 Improper input validation in FreeRTOS-Kernel timer command handling
- CVE-2026-77233 Cross-site scripting in iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more
- CVE-2026-7723 PrefectHQ prefect WebSocket Endpoint in missing authentication
- CVE-2026-77226 Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint
- CVE-2026-77220 PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting
- CVE-2026-7722 PrefectHQ prefect Health Check API health endswith improper authentication
- CVE-2026-77219 GNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader
- CVE-2026-77218 PLANET GS-4210-16P2S V3 Stack Buffer Overflow via dispatcher.cgi Credential Handlers
- CVE-2026-77217 PLANET GS-4210-16P2S V3 Stack Buffer Overflow and NULL Pointer Dereference via dispatcher.cgi RADIUS Handlers
- CVE-2026-77214 libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer
- CVE-2026-7721 Totolink WA300 cstecgi.cgi NTPSyncWithHost command injection
- CVE-2026-77207 Null Pointer Dereference in PKCS#7 bundle with no certificates
- CVE-2026-77206 IKEv2 pre-authentication Null Pointer Dereference in EAP code
- CVE-2026-77205 Denial of Service via sending bogus X.509 certificates
- CVE-2026-77203 Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode
- CVE-2026-7720 Totolink WA300 POST Request cstecgi.cgi setLanguageCfg command injection
- CVE-2026-77194 Auth bypass in Simple Membership
- CVE-2026-77193 Path traversal in eesy ID2WP – Publish InDesign HTML5
- CVE-2026-77191 Security feature bypass in EOS
- CVE-2026-77190 Security Advisory 0177
- CVE-2026-7719 Totolink WA300 POST Request cstecgi.cgi loginauth buffer overflow
- CVE-2026-77189 Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute
- CVE-2026-77188 Cross-site scripting in Waitlist Woocommerce ( Back in stock notifier )
- CVE-2026-77187 Cross-site scripting in My Calendar – Accessible Event Manager
- CVE-2026-77186 My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute
- CVE-2026-77185 Apache MINA SSHD: Asynchronous authentication can bypass signature verification
- CVE-2026-77184 MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output
- CVE-2026-77183 FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint
- CVE-2026-77181 Apache Syncope: ClientApp update entitlement not effective
- CVE-2026-77180 NGINX Ingress Controller vulnerability
- CVE-2026-7718 Totolink WA300 POST Request cstecgi.cgi setWebWlanIdx command injection
- CVE-2026-77179 Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback
- CVE-2026-77178 Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp
- CVE-2026-77177 Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prom
- CVE-2026-77176 Kata-containers: insufficient validation of createcontainer mount and storage rules in genpolicy
- CVE-2026-77173 Information disclosure in Files Confidential
- CVE-2026-77172 Security feature bypass in Server
- CVE-2026-77171 Missing authorization in Collectives
- CVE-2026-77170 Missing authorization in Deck
- CVE-2026-7717 Totolink WA300 POST Request cstecgi.cgi UploadCustomModule buffer overflow
- CVE-2026-77169 Missing authorization in Team Folders
- CVE-2026-77167 Denial of service in server
- CVE-2026-77166 Other in Collectives
- CVE-2026-77165 Business logic in Server
- CVE-2026-77164 Server-side request forgery in Server
- CVE-2026-77161 Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name
- CVE-2026-7716 code-projects Gym Management System In PHP/Windows NT index.php sql injection
- CVE-2026-77159 Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink
- CVE-2026-77157 ast-cli: Auto-update downloads are not verified against a checksum before execution
- CVE-2026-77156 ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory
- CVE-2026-77151 lin-snow Ech0 crypto.go MD5Encrypt risky encryption
- CVE-2026-77150 Unlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scripting
- CVE-2026-7715 ravenwits mcp-server-arangodb MCP tools.ts arango_backup path traversal
- CVE-2026-77148 Comfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflow
- CVE-2026-77147 Apache Syncope: Groovy Sandbox escape for empty CommandArgs
- CVE-2026-77146 Broken Access Control in extension "femanager" (femanager)
- CVE-2026-77145 Broken Access Control in extension "Events 2" (events2)
- CVE-2026-77144 Broken Access Control in extension "Events 2" (events2)
- CVE-2026-77143 Broken Access Control in extension "Forum" (pforum)
- CVE-2026-77142 Broken Access Control in extension "Industry Directory" (yellowpages2)
- CVE-2026-77141 Broken Access Control in extension "Club Directory" (clubdirectory)
- CVE-2026-77140 Broken Access Control in extension "Telephone Directory" (telephonedirectory)
- CVE-2026-7714 crocodilestick Calibre-Web-Automated Admin Endpoint cwa_functions.py missing authentication
- CVE-2026-77139 Path Traversal in extension "Mask" (mask)
- CVE-2026-77138 Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)
- CVE-2026-77137 SQL Injection in extension "Forms Export" (frp_form_answers)
- CVE-2026-77136 Server-Side Template Injection in extension "powermail" (powermail)
- CVE-2026-77135 Information Disclosure in extension "femanager" (femanager)
- CVE-2026-77134 Broken Access Control in extension "femanager" (femanager)
- CVE-2026-77133 Broken Access Control in extension "femanager" (femanager)
- CVE-2026-77132 TYPO3 CMS - Information Disclosure via Backend Localization Wizard
- CVE-2026-77131 Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)
- CVE-2026-77130 Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)
- CVE-2026-7713 crocodilestick Calibre-Web-Automated Kobo auth-token Route kobo_auth.py generate_auth_token improper authorization
- CVE-2026-77129 Server-Side Template Injection in extension "Event management and registration" (sf_event_mgt)
- CVE-2026-77128 Broken Access Control in extension "Event management and registration" (sf_event_mgt)
- CVE-2026-77127 Information Disclosure in extension "Modules" (modules)
- CVE-2026-77125 Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints
- CVE-2026-77124 Nexus Repository 3 - Script Execution Disable Setting Not Enforced
- CVE-2026-77123 Nexus Repository 3 - Webhook Secret Disclosure via Capability Read API
- CVE-2026-77122 Missing authorization in Nexus Repository 3
- CVE-2026-77121 Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields
- CVE-2026-77120 Command injection in PowerLogic T300
- CVE-2026-7712 MindsDB Pickle pickle.loads deserialization
- CVE-2026-77119 NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets
- CVE-2026-77118 Out-of-bounds write in GraphicsMagick PCD decoder
- CVE-2026-77117 SHIFT_JISX0213 decoding may hang on crafted input
- CVE-2026-77116 Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview
- CVE-2026-77115 Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters
- CVE-2026-77114 Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting
- CVE-2026-77113 Path Traversal Vulnerability in apport-unpack
- CVE-2026-77112 SSRF Leading to JWT Token Disclosure in Global IT Informatics' Weoll
- CVE-2026-77111 Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-77110 Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- CVE-2026-7711 MindsDB Engine proc_wrapper.py exec unrestricted upload
- CVE-2026-77109 Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-77108 Adobe Commerce | Incorrect Authorization (CWE-863)