Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 380 of 1013.
- CVE-2026-76210 phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export
- CVE-2026-7621 SMTP2GO for WordPress <= 1.16.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate
- CVE-2026-76209 phpMyFAQ before v4.1.6 Registration Bypass via API
- CVE-2026-76208 phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP
- CVE-2026-76207 phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie
- CVE-2026-76206 phpMyFAQ before 4.1.7 Information Disclosure via PDF Export
- CVE-2026-76205 phpMyFAQ before 4.1.7 SQL Injection via Glossary
- CVE-2026-76203 CSS sanitizer bypass in Pentestify report themes allows forced outbound requests
- CVE-2026-76202 Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-76201 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-76200 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-7620 Missing authorization in Notification for Telegram
- CVE-2026-76199 Photoshop Desktop | Uncontrolled Search Path Element (CWE-427)
- CVE-2026-76198 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-76197 Command injection in Adobe Campaign Classic
- CVE-2026-76196 Photoshop Mobile | Session Fixation (CWE-384)
- CVE-2026-76195 Command injection in Adobe Campaign Classic
- CVE-2026-76194 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-76193 Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)
- CVE-2026-76192 InDesign Desktop | NULL Pointer Dereference (CWE-476)
- CVE-2026-76191 Animate | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- CVE-2026-76190 ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)
- CVE-2026-7619 Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter
- CVE-2026-76189 CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)
- CVE-2026-76187 Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT
- CVE-2026-76186 Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
- CVE-2026-76184 Information disclosure in Eclipse Jetty
- CVE-2026-76183 Apache Tomcat: Bypass of security constraints for WebSocket endpoints
- CVE-2026-76182 Other in Eclipse Jetty
- CVE-2026-7618 SQL injection in EnvíaloSimple: Email Marketing y Newsletters
- CVE-2026-76179 Ebyte NA111-M Use of GET Request Method With Sensitive Query Strings
- CVE-2026-76178 Multiple vulnerabilities in Ocsreports for OCS Inventory NG
- CVE-2026-76177 Multiple vulnerabilities in Ocsreports for OCS Inventory NG
- CVE-2026-76176 Multiple vulnerabilities in Ocsreports for OCS Inventory NG
- CVE-2026-76175 Multiple vulnerabilities in Ocsreports for OCS Inventory NG
- CVE-2026-76174 Multiple vulnerabilities in Ocsreports for OCS Inventory NG
- CVE-2026-76172 fast-uri vulnerable to host confusion via percent-encoded scheme normalization
- CVE-2026-7617 Missing authorization in Secufor OAuth
- CVE-2026-76169 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
- CVE-2026-76166 Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram
- CVE-2026-76164 Authenticated Server-Side Request Forgery in AIL Framework Crawler Allows Access to Internal Network Resources
- CVE-2026-76163 named aborts on a TKEY query when the user configuration has no global options statement
- CVE-2026-7616 Zawgyi Embed <= 2.1.1 - Cross-Site Request Forgery via 'zawgyi_forceCSS' Parameter
- CVE-2026-76159 Duplicati for Windows - Incorrect Permission Assignment for Critical Resource
- CVE-2026-76158 Datiphy Data Management Center - External Control of File Name or Path
- CVE-2026-76157 Datiphy Data Management Center - Missing Authentication for Critical Function
- CVE-2026-76156 Datiphy Data Management Center - Improper Neutralization of Special Elements used in an OS Command
- CVE-2026-76155 Datiphy Data Management Center - Use of Default Credentials
- CVE-2026-76154 CVE-2026-76154 CVE Record
- CVE-2026-76151 Memory corruption in qt
- CVE-2026-7615 Widget Context <= 1.3.3 - Cross-Site Request Forgery to Settings Update via 'wl' Parameter
- CVE-2026-76149 Integer overflow in CorvusSKK
- CVE-2026-76148 Code injection in CorvusSKK
- CVE-2026-76147 Genians, Inc Genian NAC/ZTNA Remote Code Execution
- CVE-2026-76146 Genians, Inc Genian SSL PNS OS Command Injection
- CVE-2026-76145 Genians, Inc Genian SSL PNS Improper Privilege Management
- CVE-2026-76144 Genians, Inc Genian SSL PNS Unrestricted File Upload
- CVE-2026-76143 Genians, Inc Genian SSL PNS Multi Factor Authentication Bypass
- CVE-2026-76142 Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface
- CVE-2026-7614 Old Posts Highlighter <= 1.0.3 - Cross-Site Request Forgery to Settings Update
- CVE-2026-76139 Supply chain in Red Hat Advanced Cluster Management for Kubernetes 2.11
- CVE-2026-76137 Missing authorization in VOCALOID6
- CVE-2026-76133 Ebyte NA111-M Use of a Broken or Risky Cryptographic Algorithm
- CVE-2026-76131 Hardcoded credentials in VOCALOID6
- CVE-2026-7613 Cost of Goods by PixelYourSite <= 1.2.12 - Unauthenticated Stored Cross-Site Scripting via Cost of Goods Import
- CVE-2026-76128 Cross-site scripting in eCommerce Product Catalog
- CVE-2026-7612 itsourcecode Courier Management System edit_user.php sql injection
- CVE-2026-76114 Information disclosure in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-76113 Information disclosure in Terraform Provider for Redfish
- CVE-2026-76111 Privilege escalation in PowerStore 1000T
- CVE-2026-7611 TRENDnet TEW-821DAP Firmware Update cameo_dev.sh platform_do_upgrade_cameo_dev data authenticity
- CVE-2026-76105 Weak cryptography in Container Storage Modules
- CVE-2026-76104 Misconfiguration in ObjectScale
- CVE-2026-7610 TRENDnet TEW-821DAP Firmware Update ssi cleartext transmission
- CVE-2026-76098 Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
- CVE-2026-7609 TRENDnet TEW-821DAP Firmware Udpate diagnostic tools_diagnostic os command injection
- CVE-2026-76089 Formie: Missing authorization on sent notification resend modal exposes submission PII
- CVE-2026-76087 Formie: Unauthenticated users can overwrite incomplete submissions via submit action
- CVE-2026-76086 Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
- CVE-2026-76083 Redash: JSON data source query URL can bypass base URL restriction
- CVE-2026-76081 ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions
- CVE-2026-7608 TRENDnet TEW-821DAP tools_diagnostic os command injection
- CVE-2026-76074 Missing authorization in AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress
- CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset
- CVE-2026-76072 Continue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto Mode
- CVE-2026-76071 Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter
- CVE-2026-76070 Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Password Parameter
- CVE-2026-7607 TRENDnet TEW-821DAP Firmware Udpate auto_update_firmware buffer overflow
- CVE-2026-76066 IntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNode
- CVE-2026-76063 FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter
- CVE-2026-76061 Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass
- CVE-2026-76060 OS Command Injection in PayRange API
- CVE-2026-7606 TRENDnet TEW-821DAP Firmware Update new_gui_update_firmware data authenticity
- CVE-2026-76059 Code injection in Langflow OSS
- CVE-2026-76058 Missing authorization in PayPal Brasil para WooCommerce
- CVE-2026-76057 Missing authorization in AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress
- CVE-2026-76055 Command injection in blackduck-c-cpp
- CVE-2026-76054 Information disclosure in blackduck-c-cpp
- CVE-2026-76053 TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser
- CVE-2026-76050 SourceCodester Simple Online Food Ordering System ajax.php delete_menu sql injection