Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 372 of 1013.
- CVE-2026-77106 Cvlaunchd Code Execution
- CVE-2026-77105 CommServe Privilege Escalation
- CVE-2026-77104 CommServe Path Traversal
- CVE-2026-77103 CommServe Information Disclosure
- CVE-2026-77102 CommServe Denial of Service
- CVE-2026-77101 CommServe Stack-based Buffer Overflow
- CVE-2026-77100 MediaAgent Denial of Service
- CVE-2026-7710 YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication
- CVE-2026-77099 CVFS Command Execution
- CVE-2026-77098 Private Metrics Server SQL Injection
- CVE-2026-77097 Private Metrics Server Denial of Service
- CVE-2026-77096 CVFS Missing Authentication
- CVE-2026-77095 CvFWD Null Pointer Dereference
- CVE-2026-77094 CvFWD Out-of-Bounds Write
- CVE-2026-77093 CvFWD Denial of Service
- CVE-2026-77092 Content Extractor Privilege Escalation
- CVE-2026-77091 DataCube Security Feature Bypass
- CVE-2026-77090 CVFS Information Disclosure
- CVE-2026-7709 janeczku Calibre-Web Endpoint kobo_auth.py generate_auth_token improper authorization
- CVE-2026-77089 Command Center API Authentication Bypass
- CVE-2026-77088 justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-span
- CVE-2026-77087 Paperclip before 0.3.1 Remote Code Execution via DNS Rebinding
- CVE-2026-77086 SiYuan before v3.7.4 Path Traversal via packageName
- CVE-2026-77085 n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool
- CVE-2026-77084 n8n before 1.123.69 Remote Code Execution via Git Node Configuration Values
- CVE-2026-77083 n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution
- CVE-2026-77082 n8n before 1.123.69 ReDoS via Filter and Switch Node
- CVE-2026-77081 n8n before 1.123.69 Allowed-Domains Bypass via GraphQL Node
- CVE-2026-77080 n8n before 1.123.69 Arbitrary File Read and Write via Snowflake
- CVE-2026-7708 Open5GS UDR subscription.c ogs_dbi_subscription_data denial of service
- CVE-2026-77079 n8n before 2.34.1 Authorization Bypass via Custom Role Deletion
- CVE-2026-77078 multer vulnerable to Denial of Service via crafted multipart field names
- CVE-2026-77077 n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution
- CVE-2026-77076 n8n before 1.123.69 Credential Leak via GraphQL Node Error
- CVE-2026-77075 n8n before 1.123.69 Expression Injection via Resource Locator
- CVE-2026-77074 n8n before 1.123.69 SSRF via Edit Image Node
- CVE-2026-77073 n8n before 2.34.1 Cross-Project Credential Access via MCP
- CVE-2026-77072 n8n before 1.123.69 Stored XSS via Form Completion Page
- CVE-2026-77071 n8n before 1.123.69 PostgREST Filter Injection via Supabase
- CVE-2026-77070 n8n before 1.123.69 NoSQL Injection via MongoDB Node
- CVE-2026-7707 Open5GS UDR nudr-handler.c udr_nudr_dr_handle_subscription_context denial of service
- CVE-2026-77069 n8n before 1.123.69 SSRF Protection Bypass via OAuth2
- CVE-2026-77068 n8n before 2.34.1 Remote Code Execution via Path Traversal
- CVE-2026-77067 Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation
- CVE-2026-77066 Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query
- CVE-2026-77063 multer vulnerable to file size limit bypass via async fileFilter race condition
- CVE-2026-77062 Clickjacking in boneIO
- CVE-2026-77061 Missing Authentication for Critical Function in boneIO
- CVE-2026-77060 Incorrect Permission Assignment for Critical Resource in boneIO
- CVE-2026-7706 Open5GS AMF gmm-handler.c gmm_handle_service_request denial of service
- CVE-2026-77059 TOCTOU Race Condition in boneIO
- CVE-2026-77058 Cross-Site Request Forgery (CSRF) in boneIO
- CVE-2026-77057 Improper Restriction of Excessive Authentication Attempts in boneIO
- CVE-2026-77056 Use of Default Credentials in boneIO
- CVE-2026-77055 Improper Privilege Assignment in boneIO
- CVE-2026-77054 Cleartext Storage of Sensitive Information in boneIO
- CVE-2026-77053 Missing Authentication in Default Configuration in boneIO
- CVE-2026-77052 Missing Authentication for Node-RED in boneIO
- CVE-2026-77051 Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
- CVE-2026-77050 Potential denial-of-service vulnerability in get_supported_language_variant()
- CVE-2026-7705 JD Cloud JDCOS Service jdcap set_iptv_info command injection
- CVE-2026-7704 AV Stumpfl Pixera Two Media Server Service Port 1338 path traversal
- CVE-2026-77037 multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
- CVE-2026-77036 elunez eladmin GenConfigController improper authorization
- CVE-2026-77035 Missing authorization in JEM - Joomla Event Manager extension for Joomla
- CVE-2026-77034 Missing authorization in JEM - Joomla Event Manager extension for Joomla
- CVE-2026-77031 Tenda CH22 formcreateFileName command injection
- CVE-2026-7703 AV Stumpfl Pixera Two Media Server Websocket API code injection
- CVE-2026-77029 Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66
- CVE-2026-77028 Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66
- CVE-2026-77027 Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2
- CVE-2026-77026 Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5
- CVE-2026-77025 itsourcecode Hospital Management System viewappointmentpending.php sql injection
- CVE-2026-77022 Comfast CF-N1-S SSID Configuration mbox-config sub_44B438 stack-based overflow
- CVE-2026-77021 Missing decompression size limit in agent receiver allows memory exhaustion via push agent data
- CVE-2026-77020 CodeAstro Apartment Visitor Management System password-recovery.php sql injection
- CVE-2026-7702 toeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization
- CVE-2026-77019 CodeAstro Apartment Visitor Management System forgotpw.php sql injection
- CVE-2026-77018 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment
- CVE-2026-77017 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Profile Mass Assignment
- CVE-2026-77016 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass Assignment
- CVE-2026-77014 Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses
- CVE-2026-77013 Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch
- CVE-2026-77012 Server-side request forgery in 爱采集数据采集和发布插件
- CVE-2026-77010 Missing authorization in HEL Online Classroom: AI-powered Online Classrooms
- CVE-2026-7701 Telegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereference
- CVE-2026-77009 WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console
- CVE-2026-77008 HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Plugin Settings Update
- CVE-2026-77007 HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated BigBlueButton API Secret Disclosure
- CVE-2026-77006 WebTotem Backups < 1.1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal
- CVE-2026-77005 Code Monkeys Proposals <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path Traversal
- CVE-2026-77004 Comfast CF-N1-S mbox-config sprintf command injection
- CVE-2026-77003 Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask
- CVE-2026-77002 SmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentication Bypass
- CVE-2026-77001 Social Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication Bypass
- CVE-2026-77000 WP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow
- CVE-2026-7700 langflow-ai langflow LambdaFilterComponent lambda_filter.py eval code injection
- CVE-2026-76999 SourceCodester CET Automated Grading System with AI Predictive Analytics index.php add_grade improper authorization
- CVE-2026-76998 SourceCodester Simple Online Food Ordering System ajax.php delete_category sql injection
- CVE-2026-76997 SourceCodester Simple Online Food Ordering System ajax.php save_category sql injection