Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 379 of 1013.
- CVE-2026-76307 Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR
- CVE-2026-76306 Information Disclosure through REST API Query Filters in Splunk SOAR
- CVE-2026-76305 Improper Access Control during App Downloads in Splunk SOAR
- CVE-2026-76304 Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR
- CVE-2026-76303 Stored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAR
- CVE-2026-76302 Security Hardening in Splunk Enterprise - October 2026
- CVE-2026-76301 Security Hardening in Splunk Enterprise - October 2026
- CVE-2026-76300 Security Hardening in Splunk Enterprise - October 2026
- CVE-2026-7630 innocommerce InnoShop Installation Endpoint InstallServiceProvider.php boot improper authentication
- CVE-2026-76299 Security Hardening in Splunk Enterprise - October 2026
- CVE-2026-76298 Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprise
- CVE-2026-76297 Federated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk Web for Splunk Enterprise
- CVE-2026-76296 Missing Authorization through Sourcetype Renaming in Splunk Web for Splunk Enterprise
- CVE-2026-76295 SPL Injection through the REST API in Splunk Secure Gateway
- CVE-2026-76294 Improper Access Control in Field Extraction Management in Splunk Enterprise
- CVE-2026-76293 Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise
- CVE-2026-76292 Missing Authorization through REST API Endpoints in Splunk Secure Gateway
- CVE-2026-76291 Improper Access Control through Scheduled Search Safeguards in Splunk Enterprise
- CVE-2026-76290 Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk Enterprise
- CVE-2026-7629 kleneway awesome-cursor-mpc-server Ccode-Review Tool codeReview.ts runCodeReviewTool command injection
- CVE-2026-76289 Denial of Service (DoS) through the REST API in Splunk Enterprise
- CVE-2026-76288 Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise
- CVE-2026-76287 Authorization Bypass in the Data Management REST API in Splunk Enterprise
- CVE-2026-76286 Server-Side Request Forgery (SSRF) through Custom API Tools in Splunk MCP Server
- CVE-2026-76285 Improper Adherence to Coding Standards in Splunk Enterprise
- CVE-2026-76284 Improper Neutralization in Splunk Enterprise
- CVE-2026-76283 Protection Mechanism Failure in Splunk Enterprise
- CVE-2026-76282 Improper Control of a Resource Through its Lifetime in Splunk Enterprise
- CVE-2026-76281 Improper Access Control in Splunk Enterprise
- CVE-2026-76280 Incorrect Permission Assignment for App Key Value Store Collections in Splunk Secure Gateway
- CVE-2026-7628 crazyrabbitLTC mcp-code-review-server RepoMix repomix.ts executeRepomix command injection
- CVE-2026-76279 Improper Input Validation of Index Names through the collect Command in Splunk Enterprise
- CVE-2026-76278 Authorization Bypass in SPL2 Module Permissions in Splunk Enterprise
- CVE-2026-76277 Improper Input Validation of Native Splunk Usernames through the REST API in Splunk Enterprise
- CVE-2026-76276 Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web for Splunk Enterprise
- CVE-2026-76275 Improper Authorization in Search Job Listings through the REST API in Splunk Enterprise
- CVE-2026-76274 Server-Side Request Forgery (SSRF) through the REST API in Splunk App for Splunk Observability Cloud
- CVE-2026-76273 Improper Input Validation through the collect Command in Splunk Enterprise
- CVE-2026-76272 Missing Access Control through the REST API in Splunk Secure Gateway
- CVE-2026-76271 Denial of Service (DoS) in the Discover Splunk Observability Cloud app for Splunk Enterprise
- CVE-2026-76270 Structured Query Language (SQL) Injection in the SPL2 Module Catalog in Splunk Enterprise
- CVE-2026-7627 8nite metatrader-4-mcp sync_ea_from_file index.ts CallToolRequestSchema path traversal
- CVE-2026-76269 Improper Access Control in Search Job Retrieval through the REST API in Splunk Enterprise
- CVE-2026-76268 Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise
- CVE-2026-76267 Log Injection through the REST API in Splunk App for Splunk O11y Cloud
- CVE-2026-76266 Local Privilege Escalation through Linux Package Upgrades in Splunk Enterprise
- CVE-2026-76265 Improper Access Control through REST API Endpoints in Splunk Secure Gateway
- CVE-2026-76264 Improper Authorization through the REST API in Splunk Enterprise
- CVE-2026-76263 Improper Access Control through the REST API in Splunk Enterprise
- CVE-2026-76262 Exposure of Sensitive Information to an Unauthorized Actor through the REST API in Splunk Enterprise
- CVE-2026-76261 Insecure Default Access Control List through the REST API in Splunk Secure Gateway
- CVE-2026-76260 Incorrect Permission Assignment for Critical Resource through the REST API in Splunk Enterprise
- CVE-2026-7626 Information disclosure in Slek Gateway for WooCommerce
- CVE-2026-76259 Improper Privilege Management on the Management Port in Splunk Enterprise for Windows
- CVE-2026-76258 Use of Hard-coded Cryptographic Key through Companion App Registration in Splunk Secure Gateway
- CVE-2026-76257 Missing Authorization through REST API Endpoints in Splunk Secure Gateway
- CVE-2026-76256 Information Exposure through REST API Endpoints in Splunk Secure Gateway
- CVE-2026-76255 Risky Command Safeguards Bypass through Splunk Web in Splunk Enterprise
- CVE-2026-76254 SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprise
- CVE-2026-76253 Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterprise
- CVE-2026-76252 Cross-Site Scripting (XSS) through Splunk Web Message Validation in Splunk Enterprise
- CVE-2026-76251 Missing Authorization through REST API Endpoints in the Splunk App for Splunk Observability Cloud
- CVE-2026-76245 stigmem Federation Peer Token Timestamp Validation Bypass
- CVE-2026-76244 stigmem-node Insecure Federation Transport Configuration
- CVE-2026-76243 stigmem before 0.9.0a2 Authentication Bypass via Disabled Auth
- CVE-2026-76242 stigmem Federation Peer Registration Authentication Bypass
- CVE-2026-76241 stigmem Plugin Signature Enforcement Bypass via Configuration
- CVE-2026-76240 stigmem Postgres SQL Injection via Schema Identifier
- CVE-2026-7624 Missing authorization in SEO Plugin by Squirrly SEO
- CVE-2026-76239 Stigmem before 0.9.0a11 SSRF via unvalidated webhook delivery_address
- CVE-2026-76238 stigmem before 0.9.0a12 Cross-Tenant BOLA via decay sweep
- CVE-2026-76237 stigmem before 0.9.0a12 Cross-Tenant BOLA via quarantine
- CVE-2026-76236 stigmem before 0.9.0a12 Cross-Tenant BOLA via Tombstones
- CVE-2026-76235 Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html
- CVE-2026-76234 libcrux before 0.0.6 Cryptographic Implementation Bug Fixes
- CVE-2026-76233 Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager
- CVE-2026-76232 Renovate 31.51.0 before 40.33.0 Command Injection via helmv3
- CVE-2026-76231 Renovate 32.135.0 before 40.33.0 Command Injection via hermit
- CVE-2026-76230 Renovate 35.63.0 before 40.33.0 Command Injection via npm
- CVE-2026-7623 SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute
- CVE-2026-76229 Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize
- CVE-2026-76228 Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper
- CVE-2026-76227 Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure
- CVE-2026-76226 Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance
- CVE-2026-76225 ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV
- CVE-2026-76224 ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback
- CVE-2026-76223 ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION
- CVE-2026-76222 GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name
- CVE-2026-76221 GitPython before 3.1.58 Config Injection via option-name
- CVE-2026-76220 GitPython before 3.1.58 Command Execution via split_single_char_options
- CVE-2026-7622 ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
- CVE-2026-76219 GitPython before 3.1.58 Arbitrary File Overwrite via read-tree
- CVE-2026-76218 GitPython before 3.1.58 Remote Code Execution via Repo.init
- CVE-2026-76217 GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file
- CVE-2026-76216 Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing
- CVE-2026-76215 phpMyFAQ before 4.1.7 Missing Authorization via child resources
- CVE-2026-76214 phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge
- CVE-2026-76213 phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle
- CVE-2026-76212 phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL
- CVE-2026-76211 phpMyFAQ before 4.1.7 Information Disclosure via Admin API