Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 383 of 1013.
- CVE-2026-75829 grav-plugin-api before 1.0.15 Twig SSTI via translate endpoint
- CVE-2026-75828 Grav before 2.0.15 Stored XSS via detectXss() Quote Bypass
- CVE-2026-75827 Grav before 2.0.15 Arbitrary File Write via error_log
- CVE-2026-75826 Teltonika Command Injection in Backup function
- CVE-2026-75825 Authentication Bypass vulnerability
- CVE-2026-75824 WP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration Disabled
- CVE-2026-75823 WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption
- CVE-2026-75820 Integer Truncation Leading to Heap Corruption in GNU Aspell
- CVE-2026-7582 AcademySoftwareFoundation OpenImageIO DDS Image ddsinput.cpp out-of-bounds write
- CVE-2026-75819 Out-of-bounds Read in GNU Aspell
- CVE-2026-75818 Heap Buffer Overflow in GNU Aspell's prezip utility
- CVE-2026-75816 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier
- CVE-2026-75814 Ebyte NA111-M Cross-Site Request Forgery
- CVE-2026-75813 Ebyte NE2-D11 Missing Authorization
- CVE-2026-75811 Security feature bypass in Armoury Crate
- CVE-2026-75810 Security feature bypass in Armoury Crate
- CVE-2026-7581 alexta69 MeTube CORS Policy main.py on_prepare cross-domain policy
- CVE-2026-75809 Missing authorization in Armoury Crate
- CVE-2026-75808 Denial of service in Armoury Crate
- CVE-2026-75807 SAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning
- CVE-2026-75806 Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS
- CVE-2026-75805 NULL Pointer Dereference in CMP Client Revocation Response Handling
- CVE-2026-75804 QUIC Connection-Level Flow Control is Not Enforced for Streams
- CVE-2026-75803 AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()
- CVE-2026-75802 Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel
- CVE-2026-75800 Frontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponse
- CVE-2026-7580 Exiftool JPEG/QuickTime/MOV/MP4 GM.pm Process_mrld code injection
- CVE-2026-75799 YAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card Cache
- CVE-2026-75798 AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant
- CVE-2026-75797 AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter
- CVE-2026-75796 AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools
- CVE-2026-75793 SureCart < 4.7.0 - Unauthenticated Account Creation with Automatic Login
- CVE-2026-75792 IBM Sterling Secure Proxy is vulnerable to multiple issues
- CVE-2026-75791 Authentication bypass vulnerability
- CVE-2026-7579 AstrBotDevs AstrBot Dashboard auth.py hard-coded credentials
- CVE-2026-75786 SQL Injection in Grafana Integration Endpoint (query.php)
- CVE-2026-75784 TRENDnet TEW-WLC100 HTTP Header nginx FUN_0040da4c stack-based overflow
- CVE-2026-75783 TRENDnet TEW-WLC100P DHCP blobmsg netifd stack-based overflow
- CVE-2026-75782 IBM Aspera Enterprise Webapps Untrusted Search Path
- CVE-2026-7578 MacCMS Pro Plugin Installation add.html install unrestricted upload
- CVE-2026-75779 Command injection in Router
- CVE-2026-75778 code-projects Task Management System Login Form index.php select_with_multiple_condition sql injection
- CVE-2026-75777 Multiple vulnerabilities in IBM Aspera Enterprise Webapps
- CVE-2026-75775 Command injection in Router
- CVE-2026-75774 karakeep-app karakeep OAuth Sign-In auth.ts improper authentication
- CVE-2026-75773 karakeep-app karakeep Login Endpoint auth.ts authorize excessive authentication
- CVE-2026-75771 Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-75770 Substance3D - Painter | Out-of-bounds Write (CWE-787)
- CVE-2026-75769 Substance3D - Painter | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-75768 Substance3D - Painter | Untrusted Search Path (CWE-426)
- CVE-2026-75767 Substance3D - Painter | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-75766 Substance3D - Painter | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-75760 AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error
- CVE-2026-75759 Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc
- CVE-2026-75758 Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir
- CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain
- CVE-2026-75754 Server-side request forgery in Control Center Enterprise (ACC)
- CVE-2026-75753 Missing authorization in Router
- CVE-2026-75752 Substance3D - Painter | Out-of-bounds Read (CWE-125)
- CVE-2026-75750 Substance3D - Painter | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-75749 Substance3D - Painter | Out-of-bounds Write (CWE-787)
- CVE-2026-75748 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
- CVE-2026-75746 ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
- CVE-2026-75745 Adobe Experience Manager Forms JEE | Incorrect Authorization (CWE-863)
- CVE-2026-75744 Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-75743 Adobe Experience Manager Forms JEE | Cross-Site Request Forgery (CSRF) (CWE-352)
- CVE-2026-75742 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-75741 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-75740 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-7574 Anthropic Claude Desktop Cowork VM Image Contents Not Validated Before Use
- CVE-2026-75739 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-75738 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-75737 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-75736 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-75735 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-75734 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-75733 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-75732 Adobe Experience Manager | Incorrect Authorization (CWE-863)
- CVE-2026-75731 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-75730 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-7573 GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations
- CVE-2026-75729 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-75728 Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
- CVE-2026-75727 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-75726 Adobe Experience Manager | Improper Input Validation (CWE-20)
- CVE-2026-75725 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-75724 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-75723 Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
- CVE-2026-75722 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-75721 Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- CVE-2026-75720 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-7572 Velociraptor EVTX Parser — Process Crash via Crafted .evtx File
- CVE-2026-75719 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-75718 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-75717 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-75716 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-75715 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-75714 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-75713 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-75712 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)