Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 374 of 1013.
- CVE-2026-76872 Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP/ACL Management Pages
- CVE-2026-76871 Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via VPN Read Handlers
- CVE-2026-76870 Netcore NR255-V 1.5.130703 Out-of-Bounds Read in mtd_write Firmware Upload Validation
- CVE-2026-7687 langflow-ai langflow Full Builtins code_parser.py CodeParser.parse_callable_details command injection
- CVE-2026-76869 Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in reboot_timer_set.cgi
- CVE-2026-76868 Netcore NR255-V 1.5.130703 NULL Pointer Dereference in route_policy_add.cgi via Missing exit_port
- CVE-2026-76867 Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in Route/NAT Configuration CGI Handlers
- CVE-2026-76866 Netcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS Parameters
- CVE-2026-76865 Netcore NR255-V 1.5.130703 NULL Pointer Dereference via Unchecked atoi() in QoS Setter Handlers
- CVE-2026-76864 Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via Unescaped QoS Rule Names
- CVE-2026-76863 Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via QoS Bandwidth Plan Routes
- CVE-2026-76862 Netcore NR255-V 1.5.130703 OS Command Argument Injection in Nettools tcpdump Launch Paths
- CVE-2026-76861 Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in ntools_tcpdump_start_set.cgi
- CVE-2026-76860 Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in wake_up_set.cgi via MAC and ID Tokenization
- CVE-2026-7686 eyeo Adblock Plus Legacy Premium Activation premium.preload.js postMessage access control
- CVE-2026-76859 Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via user_pass_show.cgi
- CVE-2026-76858 Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddns_wan_list_show.cgi
- CVE-2026-76857 Netcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns_wan_list_show.cgi
- CVE-2026-76856 Netcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpoints
- CVE-2026-76855 Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints
- CVE-2026-76854 Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7_web_auth_user_show.cgi
- CVE-2026-76853 Netcore NR268 1.7.121109 Security Check Bypass in parame_put_file.cgi
- CVE-2026-76852 Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_write
- CVE-2026-76851 Server-side request forgery in Enterprise Server
- CVE-2026-76850 LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector
- CVE-2026-7685 Edimax BR-6208AC setWAN buffer overflow
- CVE-2026-76847 act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend
- CVE-2026-76846 Grav before 2.0.16 Information Disclosure via Twig Sandbox
- CVE-2026-76845 adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction
- CVE-2026-76844 zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write
- CVE-2026-76843 Flair 0.15.0 and 0.15.1 Deserialization of Untrusted Data via ClusteringModel.load
- CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients
- CVE-2026-76841 Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders
- CVE-2026-76840 RustDesk through 1.4.9 Heap Buffer Overflow via Unvalidated CLIPRDR FileContentsResponse Length
- CVE-2026-7684 Edimax BR-6428nC setWAN buffer overflow
- CVE-2026-76839 Grav before 2.0.16 Information Disclosure via offsetGet
- CVE-2026-76838 Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects
- CVE-2026-76837 Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name
- CVE-2026-76836 AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass
- CVE-2026-76835 OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set
- CVE-2026-76834 b2evolution CMS 6.7.8 through 7.2.5 Object Injection via Negative Integer Array Key
- CVE-2026-76833 @cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML Tag
- CVE-2026-76832 Agno PythonTools Path Traversal via joinpath file_name argument
- CVE-2026-7683 Edimax BR-6428nC Web setWAN command injection
- CVE-2026-76827 Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)
- CVE-2026-76825 RestrictedPython: Sandbox escape via string.Formatter field resolution
- CVE-2026-76821 OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper
- CVE-2026-76820 OpenCTI: Synchronizer SSRF: stream fetch has no URL validation
- CVE-2026-7682 Edimax BR-6208AC L2TP Mode setWAN command injection
- CVE-2026-76816 Netty: MQTT Topic Name and Client ID Validation Bypass
- CVE-2026-7681 jsbroks COCO Annotator Dataset API datasets.py authorization
- CVE-2026-76805 Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode
- CVE-2026-76804 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass
- CVE-2026-76803 Nuclei: Local File Read via MySQL Client Sandbox Bypass
- CVE-2026-76802 Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass
- CVE-2026-76801 FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation
- CVE-2026-76800 DeDeCMS select_media_post.php unrestricted upload
- CVE-2026-7680 jsbroks COCO Annotator Data Endpoint datasets.py path traversal
- CVE-2026-76799 code-projects Login Registration System SQL Database Backup login_registration_system.sql file access
- CVE-2026-76798 MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports
- CVE-2026-76797 MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports
- CVE-2026-76796 Newell Brands DYMO Connect Desktop improper file path validation
- CVE-2026-76795 AeternaLabsHQ PullMD REST API Endpoint api server-side request forgery
- CVE-2026-76794 MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata
- CVE-2026-76793 Firebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim
- CVE-2026-76790 Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter
- CVE-2026-7679 YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication
- CVE-2026-76789 Slider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers
- CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser
- CVE-2026-76787 NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum
- CVE-2026-76785 amirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injection
- CVE-2026-76784 Weak cryptography in EP10
- CVE-2026-76783 DeDeCMS advancedsearch.php sql injection
- CVE-2026-76782 Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102
- CVE-2026-76781 Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute
- CVE-2026-76780 BeyondSEO <= 1.3.6 - Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation
- CVE-2026-7678 YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection
- CVE-2026-76779 Auth bypass in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-7677 kerwincui FastBee System Notice SysNoticeController.java add cross site scripting
- CVE-2026-76769 Missing authorization in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-76764 code-projects Employee Management System Admin Login Endpoint aprocess.php sql injection
- CVE-2026-76763 Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literals
- CVE-2026-76762 code-projects Assessment Management welcome.php sql injection
- CVE-2026-76761 chenhg5 cc-connect Management API engine.go shellExecCommand os command injection
- CVE-2026-76760 chenhg5 cc-connect webhook.go authenticate code injection
- CVE-2026-7676 kerwincui FastBee Tool Download Endpoint ToolController.java ToolController.download path traversal
- CVE-2026-76759 Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102
- CVE-2026-76758 Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101
- CVE-2026-76757 Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100
- CVE-2026-76756 Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100
- CVE-2026-76755 Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100
- CVE-2026-76754 Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in ClearPass Policy Manager
- CVE-2026-76753 Unauthenticated Format String Vulnerability in HPE Networking ClearPass Policy Manager
- CVE-2026-76752 Auth bypass in ClearPass Policy Manager (CPPM)
- CVE-2026-76751 Security feature bypass in ClearPass Policy Manager (CPPM)
- CVE-2026-76750 Deserialization in ClearPass Policy Manager (CPPM)
- CVE-2026-7675 Shenzhen Libituo Technology LBT-T300-HW1 apply.cgi start_lan buffer overflow
- CVE-2026-76749 Unauthenticated Sensitive Information Disclosure in AOS-S
- CVE-2026-76748 Authenticated Privilege Escalation Vulnerability in the API of AOS-S
- CVE-2026-76747 Unauthenticated Buffer Overflow Vulnerabilities lead to Information Disclosure in AOS-S