Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 382 of 1013.
- CVE-2026-75933 Jet Admin Stored XSS
- CVE-2026-75932 Jet Admin tenant isolation failure
- CVE-2026-75931 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
- CVE-2026-75930 Missing authorization in FundEngine – Donation and Crowdfunding Platform
- CVE-2026-7593 Sunwood-ai-labs command-executor-mcp-server MCP index.ts execute_command os command injection
- CVE-2026-75928 Brushfire unauthenticated information disclosure
- CVE-2026-75927 Privilege escalation in User Role Editor – PublishPress Capabilities: Access Control and User Roles
- CVE-2026-75926 Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant
- CVE-2026-75925 IXON VPN Client CRLF Injection
- CVE-2026-75924 Privilege escalation in Multicluster Engine for Kubernetes
- CVE-2026-75922 Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line.
- CVE-2026-75921 File upload in Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
- CVE-2026-75920 phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP
- CVE-2026-7592 itsourcecode Courier Management System edit_staff.php sql injection
- CVE-2026-75919 phpMyFAQ before 4.1.7 Authentication Bypass via Setup API
- CVE-2026-75918 phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File
- CVE-2026-75917 SiYuan before v3.7.4 XSS-to-RCE via pathName.ts
- CVE-2026-75916 SiYuan XSS-to-RCE via unescaped block metadata in hint popup
- CVE-2026-75915 CodeWhale before 0.8.64 Environment Variable Leak via js_execution
- CVE-2026-75914 CodeWhale before 0.8.64 Path Traversal via image_analyze symlink
- CVE-2026-75913 CodeWhale before 0.8.64 Argument Injection via git_show
- CVE-2026-75912 CodeWhale before 0.8.64 Argument Injection via git_blame
- CVE-2026-75911 CodeWhale before 0.8.64 Remote Code Execution via allow_shell
- CVE-2026-75910 Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template
- CVE-2026-7591 TimBroddin astro-mcp-server MCP Tool Query Construction index.ts sql injection
- CVE-2026-75908 Missing authorization in Newsletters
- CVE-2026-75907 CVE-2026-75907
- CVE-2026-75905 Missing authorization in WP Recipe Maker
- CVE-2026-75904 libmodplug <= 0.8.9.1 - Out-of-Bounds Read in pat_smplooped via Crafted MIDI File
- CVE-2026-75903 Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials
- CVE-2026-75900 Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch
- CVE-2026-7590 eyal-gor p_69_branch_monkey_mcp Preview Endpoint advanced.py os command injection
- CVE-2026-75899 fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
- CVE-2026-75898 RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component
- CVE-2026-75897 Uncontrolled Resource Consumption in Capabilities Route in OpenSearch Dashboards
- CVE-2026-75896 Use of Hard-coded LDAP Credentials in TÜBİTAK BİLGEM's Liderahenk
- CVE-2026-75895 Out of bounds read at smpp34_unpack()
- CVE-2026-75894 Reachable assertion at ranap_handle_co_dt()
- CVE-2026-75893 Heap based buffer overflow at ipaccess_proxy_read_msg()
- CVE-2026-75892 Out of bounds write in PDP ctx GSN-Address decode
- CVE-2026-75891 Deserialization in Kirki – Freeform Page Builder, Website Builder & Customizer
- CVE-2026-7589 ghantakiran splunk-mcp-integration CSV Export csv_export.py create_csv_export path traversal
- CVE-2026-75889 CVE-2026-75889 CVE Record
- CVE-2026-75888 Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch
- CVE-2026-75887 Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler
- CVE-2026-75886 Misconfiguration in Red Hat OpenShift Container Platform 4
- CVE-2026-75885 Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint
- CVE-2026-75884 Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups
- CVE-2026-75883 PPPD buffer overflow in PEAP response code
- CVE-2026-75881 IBM Maximo Application Suite - IoT Component Denial of Service
- CVE-2026-75880 Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service
- CVE-2026-7588 ggerve coding-standards-mcp server.py get_best_practices path traversal
- CVE-2026-75878 IBM Sterling File Gateway is Vulnerable to Authentication Bypass
- CVE-2026-75877 TRENDnet TV-IP751WIC alphapd FUN_0043372C stack-based overflow
- CVE-2026-75876 xianrendzw EasyReport Move Operations ModuleController.java sql injection
- CVE-2026-75875 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
- CVE-2026-75874 Sandbox escape in the Remote Settings Client component
- CVE-2026-75873 Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload
- CVE-2026-75872 HTML Injection in MailerUp double opt-in verification email
- CVE-2026-75871 Server-Side Request Forgery (SSRF) in GitLab AI Gateway
- CVE-2026-75870 Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret.
- CVE-2026-7587 Open5GS AMF nsmf-handler.c amf_nsmf_pdusession_handle_update_sm_context denial of service
- CVE-2026-75866 Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no auth
- CVE-2026-75865 WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint
- CVE-2026-75863 Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-75862 Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-75861 Ultimate Gift Cards for WooCommerce < 3.2.10 - Subscriber+ Gift Card Theft and Destruction via Unauthorized Redemption
- CVE-2026-75860 JSON Options <= 0.0.4 - Unauthenticated Arbitrary Options Update
- CVE-2026-7586 Open5GS AMF nudm-handler.c ogs_id_get_value denial of service
- CVE-2026-75859 CodeWhale before 0.8.64 Arbitrary File Read via instructions
- CVE-2026-75858 CodeWhale rlm_eval before 0.8.64 Remote Code Execution
- CVE-2026-75857 CodeWhale before 0.8.64 Privilege Escalation via exec_shell_interact
- CVE-2026-75856 CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU
- CVE-2026-75855 ArcadeDB before 26.8.1 Path Traversal via create/drop database
- CVE-2026-75854 ArcadeDB Redis Wire-Protocol Plugin Missing Authentication
- CVE-2026-75853 ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database
- CVE-2026-75852 ArcadeDB MongoDB wire protocol authentication bypass cross-database
- CVE-2026-75851 ArcadeDB before 26.8.1 Authentication Bypass via Async Command
- CVE-2026-75850 ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers
- CVE-2026-7585 Open5GS AMF nudm-handler.c amf_nudm_sdm_handle_provisioned denial of service
- CVE-2026-75847 Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail
- CVE-2026-75846 ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION
- CVE-2026-75845 ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_setting
- CVE-2026-75844 ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass
- CVE-2026-75843 ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction
- CVE-2026-75842 ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV
- CVE-2026-75841 ArcadeDB before 26.8.1 Denial of Service via range()
- CVE-2026-75840 ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex
- CVE-2026-7584 Arbitrary Code Execution via Unsafe Deserialization in LabOne Q
- CVE-2026-75839 ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints
- CVE-2026-75838 DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook
- CVE-2026-75837 Grav before 2.0.14 Privilege Escalation via Group Access Field
- CVE-2026-75836 Grav API Plugin before 1.0.14 Missing Authorization
- CVE-2026-75835 Grav API Plugin before 1.0.14 Missing Authorization
- CVE-2026-75834 Grav before 2.0.14 Stored XSS via Invalid UTF-8 Byte
- CVE-2026-75833 Grav API Plugin Open Redirect via Backslash Bypass
- CVE-2026-75832 Grav API Plugin before 1.0.14 Authorization Bypass
- CVE-2026-75831 Grav before 2.0.15 Stored XSS via audio/video source URL
- CVE-2026-75830 grav-plugin-api before 1.0.15 Path Traversal via batchCopy
- CVE-2026-7583 Open5GS BSF context.c bsf_sess_find_by_ipv6prefix denial of service