Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 385 of 1013.
- CVE-2026-75595 Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
- CVE-2026-75594 Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
- CVE-2026-75593 BuildKit: Malicious client can bypass destination directory validation on local sources upload
- CVE-2026-75592 Kirby: Access to image files outside of the site root via path traversal in the media handling
- CVE-2026-7559 Affilia <= 3.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Status Modification
- CVE-2026-75589 Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify.
- CVE-2026-75588 Mattermost Desktop App plugin popout scheme validation bypass
- CVE-2026-75587 Plaintext pre-auth secret exposure via Desktop App diagnostics report
- CVE-2026-75586 Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter
- CVE-2026-75584 ION-DTN < 4.2.1-a.1 Denial of Service via canonicalizePayloadBlock() Assertion
- CVE-2026-75583 keeper.sh Calendar version prior to 2.18.14 SSRF Guard Bypass via DNS Rebinding
- CVE-2026-7558 Missing authorization in Age Verification & Identity Verification by Token of Trust
- CVE-2026-75575 Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method
- CVE-2026-75574 Grav before 4.2.2 Remote Code Execution via Email Twig
- CVE-2026-75573 MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Are Supplied
- CVE-2026-7557 SAML authentication bypass in Progress MarkLogic Server
- CVE-2026-75569 Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha
- CVE-2026-7556 FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text
- CVE-2026-75559 Information disclosure in Vehicle Inspection Certificate Viewer (for Android)
- CVE-2026-75558 Botslab G980H Dashcams Use of Hard-coded Cryptographic Key
- CVE-2026-75554 Explicit organization scopes survive token refresh after membership ends
- CVE-2026-75553 Hardcoded credentials in Tohoku Electric Power "Yorisou e Net" Android App
- CVE-2026-7555 itsourcecode Electronic Judging System login.php sql injection
- CVE-2026-75548 Ebyte NA111-M Improper Restriction of Rendered UI Layers or Frames
- CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access
- CVE-2026-7554 D-Link M60 httpd password recovery
- CVE-2026-75538 Integer overflow in OTP
- CVE-2026-75531 Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora
- CVE-2026-7553 code-projects Gym Management System edit_exercises.php sql injection
- CVE-2026-75529 Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora
- CVE-2026-75528 Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log
- CVE-2026-75526 django CMS: Stored XSS in edit-mode plugin exception rendering
- CVE-2026-75525 OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant
- CVE-2026-75524 OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent
- CVE-2026-75523 Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets
- CVE-2026-75520 Domoticz: Missing authorization and path traversal in the udevices Lua parser handler
- CVE-2026-7552 Missing authorization in Geo Mashup
- CVE-2026-75517 Novu: Cross-Environment Integration Manipulation (IDOR)
- CVE-2026-75516 RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement
- CVE-2026-75514 BunkerWeb: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, and antibot
- CVE-2026-75513 Marten: SQL injection in Marten's LINQ provider via unescaped string literals
- CVE-2026-75511 Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs
- CVE-2026-75510 Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme
- CVE-2026-7551 HKUDS OpenHarness Remote Command Execution via /bridge Slash Command
- CVE-2026-75509 joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)
- CVE-2026-75508 GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
- CVE-2026-75507 GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
- CVE-2026-75505 EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment
- CVE-2026-7550 SourceCodester Pharmacy Sales and Inventory System ajax.php save_customer sql injection
- CVE-2026-75498 Webkul QloApps SQL injection
- CVE-2026-75497 Webkul QloApps SQL injection
- CVE-2026-75496 Webkul QloApps improper file upload validation
- CVE-2026-7549 SourceCodester Pharmacy Sales and Inventory System ajax.php delete_customer sql injection
- CVE-2026-75486 Synk Sweater Comb < 3.8.8 Command Injection via .vervet.yaml Branch Name
- CVE-2026-75485 Must-gather: /tmp/kubeconfig retention
- CVE-2026-75484 HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit
- CVE-2026-75483 powerlevel10k Control Character Injection via package.json Version
- CVE-2026-75482 SWE-agent Trajectory Inspector Path Traversal File Disclosure
- CVE-2026-75481 SkyPilot Authentication Bypass via Service Account Role Escalation
- CVE-2026-75480 OpenViking Debug Vector Endpoints Multi-tenant Data Exposure
- CVE-2026-7548 Totolink NR1800X cstecgi.cgi sub_41A68C command injection
- CVE-2026-75479 JimuReport Unauthenticated Report Listing and Share Token Disclosure
- CVE-2026-75476 Tanium addressed a compression bomb vulnerability in Threat Response.
- CVE-2026-7547 Woosa <= 2.0.5 - Authenticated (Administrator+) Arbitrary File Read via 'log_file' Parameter
- CVE-2026-75466 libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader.
- CVE-2026-75465 The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue.
- CVE-2026-75464 OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link().
- CVE-2026-75460 XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list.
- CVE-2026-7546 Totolink NR1800X lighttpd find_host_ip stack-based overflow
- CVE-2026-75458 The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escalatio vulnerability.
- CVE-2026-7545 SourceCodester Advanced School Management System checkEmail Endpoint commonController.php sql injection
- CVE-2026-7544 Mux Video Uploader <= 1.1.4 - Authenticated (Subscriber+) Information Exposure
- CVE-2026-75439 An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component
- CVE-2026-75438 Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of service via the ogs_sbi_time_parse() function
- CVE-2026-75432 An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent(), and Scann
- CVE-2026-75431 PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication.
- CVE-2026-75430 PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the
- CVE-2026-7543 Breakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting via Webhook Action Details
- CVE-2026-75429 PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Se
- CVE-2026-75421 aria2 <=1.37.0 has a stack-buffer-underflow vulnerability in the IOFile::getLine() function.
- CVE-2026-7542 Slider Revolution 7.0 - 7.0.10 - Authenticated (Subscriber+) Sensitive Information Disclosure
- CVE-2026-75419 go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability.
- CVE-2026-75418 A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows.
- CVE-2026-75417 A SQL injection vulnerability was found in YzmCMS 7.5.
- CVE-2026-75415 AntFlow V2.0.0 is vulnerable to Incorrect Access Control.
- CVE-2026-75414 In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command ex
- CVE-2026-75413 DocSys V2.02.80 is vulnerable to Any File Download.
- CVE-2026-75411 JeecgBoot v3.9.2 is vulnerable to Remote command execution.
- CVE-2026-7541 Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint
- CVE-2026-7539 HP Dock Accessory WMI Provider Installer Security Update
- CVE-2026-7538 Totolink A8000RU CGI cstecgi.cgi vulnerability os command injection
- CVE-2026-75371 An integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physically-proximate attackers
- CVE-2026-75370 An out-of-bounds read/write vulnerability in the MessageParser::parseECSSTCHeader component of SpaceDot AcubeSAT OBC software commit eaf90ec
- CVE-2026-7537 File upload in MDJM Event Management
- CVE-2026-75369 An out-of-bounds read vulnerability in the CAN::Application::parsePerformFunctionMessage component of SpaceDot AcubeSAT OBC software commit
- CVE-2026-75368 A stack overflow in the loadRawData function of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service
- CVE-2026-75364 Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to saniti
- CVE-2026-75363 An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config,
- CVE-2026-7536 Open5GS BSF pcfBindings bsf_sess_add_by_ip_address denial of service
- CVE-2026-75357 An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components.