Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 373 of 1013.
- CVE-2026-76996 SourceCodester Simple Online Food Ordering System view_order.php sql injection
- CVE-2026-76995 SourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted upload
- CVE-2026-76994 Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles
- CVE-2026-76993 GreyDGL PentestGPT Web-Page Crawling injection
- CVE-2026-76992 Uncontrolled Memory Allocation in CODESYS Gateway Client
- CVE-2026-76991 itsourcecode Hospital Management System viewappointmentapproved.php sql injection
- CVE-2026-76990 code-projects Simple Inventory System delete.php sql injection
- CVE-2026-7699 Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection
- CVE-2026-76989 liftoff-sr CIPster TCP Encapsulation Receive Path encap.cc out-of-bounds
- CVE-2026-76988 liftoff-sr CIPster ForwardOpen cipconnectionmanager.cc forward_open out-of-bounds
- CVE-2026-76987 liftoff-sr CIPster Generic Attribute Logic ciptypes.h SetAttrData memory corruption
- CVE-2026-76986 Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue
- CVE-2026-76985 Apache Wicket: XSS in Palette via getAdditionalAttributes
- CVE-2026-76984 Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute
- CVE-2026-76983 Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel
- CVE-2026-76982 Apache Wicket: XSS in Button via its model object
- CVE-2026-76980 Data Exposure vulnerability
- CVE-2026-7698 Tiandy Easy7 Integrated Management Platform updateDbBackupInfo os command injection
- CVE-2026-76979 XML Injection vulnerability
- CVE-2026-76978 Command Injection vulnerability
- CVE-2026-76977 Clickjacking vulnerability in SAPUI5(Frame Options Allowlist)
- CVE-2026-76976 Cross-site scripting in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)
- CVE-2026-76975 Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay)
- CVE-2026-76974 Information Disclosure vulnerability in SAP Fiori Launchpad
- CVE-2026-76972 Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence
- CVE-2026-76971 Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence
- CVE-2026-7697 AMTT Hotel Broadband Operation System cardhand_submit.php sql injection
- CVE-2026-76969 Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)
- CVE-2026-76968 Information Disclosure vulnerability in SAP Web Dispatcher, Internet Communication Manager and SAP Content Server
- CVE-2026-76967 Insecure Deserialization in SAP NetWeaver Business Client
- CVE-2026-76963 Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform
- CVE-2026-76962 Missing Authorization check in SAP S/4HANA (Manage Bank Chains app)
- CVE-2026-76961 Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)
- CVE-2026-76960 Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)
- CVE-2026-7696 Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform uploadH5Files unrestricted upload
- CVE-2026-76959 Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)
- CVE-2026-76958 XML External Entity (XXE) Vulnerability in SAP Integration Suite
- CVE-2026-76957 Use after free in libexpat
- CVE-2026-76956 Denial of service in libexpat
- CVE-2026-7695 Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform elecMaxMinAvgValue sql injection
- CVE-2026-76949 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement
- CVE-2026-76945 Ebyte NE2-D11 Use of Client-Side Authentication
- CVE-2026-76943 Xiiaozet LK100W Authentication Bypass Using an Alternate Path or Channel
- CVE-2026-76940 Ebyte NA111-M Improper Restriction of Excessive Authentication Attempts
- CVE-2026-7694 Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System elecMaxMinAvgValue sql injection
- CVE-2026-76939 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
- CVE-2026-76938 Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3
- CVE-2026-76937 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
- CVE-2026-76936 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
- CVE-2026-76935 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
- CVE-2026-76934 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
- CVE-2026-76933 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
- CVE-2026-76932 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
- CVE-2026-76931 Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter
- CVE-2026-7693 Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter
- CVE-2026-76929 Out-of-bounds Read in Wireshark
- CVE-2026-76928 NULL Pointer Dereference in Wireshark
- CVE-2026-76927 NULL Pointer Dereference in Wireshark
- CVE-2026-76926 Reachable Assertion in Wireshark
- CVE-2026-76925 Flatpak: flatpak: toctou race condition allows symlink redirection
- CVE-2026-76924 Out-of-bounds Read in Wireshark
- CVE-2026-76923 Out-of-bounds Read in Wireshark
- CVE-2026-76922 NULL Pointer Dereference in Wireshark
- CVE-2026-76921 Use After Free in Wireshark
- CVE-2026-76920 Out-of-bounds Write in Wireshark
- CVE-2026-7692 Wavlink WL-WN570HA1 adm.cgi ping_ddns command injection
- CVE-2026-76919 Use of Uninitialized Variable in Wireshark
- CVE-2026-76918 Heap-based Buffer Overflow in Wireshark
- CVE-2026-76917 Heap-based Buffer Overflow in Wireshark
- CVE-2026-76910 Unleash: Clone-feature lets a user copy a feature from a project they cannot read
- CVE-2026-7691 Wavlink WL-WN570HA1 adm.cgi set_sys_cmd command injection
- CVE-2026-76909 Unleash: CR-approval email renders user-controlled raw HTML
- CVE-2026-76907 LaSuite Doc: Public Documents Enumeration
- CVE-2026-76905 kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS
- CVE-2026-76904 GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
- CVE-2026-76902 CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`
- CVE-2026-76901 Missing authorization in CordysCRM
- CVE-2026-76900 CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime
- CVE-2026-7690 Wavlink WL-WN570HA1 adm.cgi set_sys_adm command injection
- CVE-2026-76899 CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`
- CVE-2026-76898 draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js
- CVE-2026-76891 Expired Pointer Dereference in Wireshark
- CVE-2026-76890 Expired Pointer Dereference in Wireshark
- CVE-2026-7689 Dolibarr ERP CRM Online Signature security.lib.php dol_verifyHash signature verification
- CVE-2026-76889 Heap-based Buffer Overflow in Wireshark
- CVE-2026-76888 Heap-based Buffer Overflow in Wireshark
- CVE-2026-76887 Heap-based Buffer Overflow in Wireshark
- CVE-2026-76886 Heap-based Buffer Overflow in Wireshark
- CVE-2026-76885 Buffer Over-read in Wireshark
- CVE-2026-76884 Buffer Over-read in Wireshark
- CVE-2026-76883 Heap-based Buffer Overflow in Wireshark
- CVE-2026-76882 Out-of-bounds Read in Wireshark
- CVE-2026-76881 NULL Pointer Dereference in Wireshark
- CVE-2026-76880 Out-of-bounds Write in Wireshark
- CVE-2026-7688 Dolibarr ERP CRM Shipments API Endpoint expedition.class.php _checkValForAPI sql injection
- CVE-2026-76879 Stack-based Buffer Overflow in Wireshark
- CVE-2026-76878 Missing authorization in Aodh
- CVE-2026-76876 Craftplan < 0.5.1 Broken Access Control Information Disclosure via Settings API
- CVE-2026-76875 PyPy pyexpat ExternalEntityParserCreate Use-After-Free
- CVE-2026-76873 Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP and ARP Hostname Fields