Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 387 of 1013.
- CVE-2026-75107 Grav Form Plugin before 9.1.19 Stored XSS via Field Properties
- CVE-2026-75106 OpnForm Editable Submission Secret Derivation via Empty Hashids Salt
- CVE-2026-75105 phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter
- CVE-2026-75104 Hugging Face Transformers Path Traversal via Checkpoint Index
- CVE-2026-75103 Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover
- CVE-2026-75101 Missing authorization in Enterprise Server
- CVE-2026-7510 OWAP DefectDojo Benchmark/Engagement/Product/Survey authorization
- CVE-2026-75099 Apache Allura: Unauthenticated REST disclosure
- CVE-2026-75098 Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design
- CVE-2026-75095 IBM Aspera Enterprise Webapps Denial of Service
- CVE-2026-75094 COMFAST CF-N1-S CGI mbox-config sub_44B438 os command injection
- CVE-2026-75093 sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size
- CVE-2026-75092 Privilege escalation in Red Hat Enterprise Linux 8
- CVE-2026-75091 Quill Forms <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting
- CVE-2026-75090 EricLBuehler Mistral.rs GGUF Tokenizer gguf_tokenizer.rs convert_gguf_to_hf_tokenizer out-of-bounds
- CVE-2026-7509 KIA Subtitle <= 4.0.1 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]
- CVE-2026-75089 PHPGurukul Complaint Management System check_availability.php sql injection
- CVE-2026-75088 itsourcecode Hospital Management System viewbilling.php sql injection
- CVE-2026-75087 itsourcecode Hospital Management System viewdepartment.php sql injection
- CVE-2026-75086 itsourcecode Hospital Management System viewroom.php sql injection
- CVE-2026-75085 Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver
- CVE-2026-75084 Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length
- CVE-2026-75083 Integer overflow in zephyr
- CVE-2026-75082 Webkul Bagisto Customer-Registration Notification Email register cross site scripting
- CVE-2026-75081 Webkul Bagisto store behavioral workflow
- CVE-2026-75080 SourceCodester Class and Exam Timetabling System edit_subject1.php sql injection
- CVE-2026-7508 Bootstrap CMS Page Creation show.blade.php code injection
- CVE-2026-75079 SourceCodester Class and Exam Timetabling System edit_subject2.php sql injection
- CVE-2026-75078 SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting
- CVE-2026-75077 SourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting
- CVE-2026-75076 IBM Aspera Enterprise Webapps Information Disclosure
- CVE-2026-7507 Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover
- CVE-2026-75063 IBM Planning Analytics Local is affected by security vulnerabilities
- CVE-2026-75062 Eval Injection in google/langfun via default lf.query protocol
- CVE-2026-75061 IBM Planning Analytics Local is affected by security vulnerabilities
- CVE-2026-75060 Auth bypass in PyCharm
- CVE-2026-7506 SourceCodester Hotel Management System check sql injection
- CVE-2026-75059 Cross-site scripting in PyCharm
- CVE-2026-75058 XML external entity in IntelliJ IDEA
- CVE-2026-75057 Information disclosure in IntelliJ IDEA
- CVE-2026-75056 Command injection in IntelliJ IDEA
- CVE-2026-75055 XML external entity in IntelliJ IDEA
- CVE-2026-75054 Server-side request forgery in IntelliJ IDEA
- CVE-2026-75053 Server-side request forgery in IntelliJ IDEA
- CVE-2026-75052 Command injection in IntelliJ IDEA
- CVE-2026-75051 Missing authorization in YouTrack
- CVE-2026-75050 Denial of service in YouTrack
- CVE-2026-7505 nextlevelbuilder GoClaw/GoClaw Lite RPC improper authorization
- CVE-2026-75049 Missing authorization in YouTrack
- CVE-2026-75048 Cross-site scripting in YouTrack
- CVE-2026-75047 Denial of service in YouTrack
- CVE-2026-75046 Missing authorization in YouTrack
- CVE-2026-75045 Auth bypass in YouTrack
- CVE-2026-75044 Missing authorization in YouTrack
- CVE-2026-7504 Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak
- CVE-2026-75038 Predictable temporary file in /tmp allows symlink attack in LACT
- CVE-2026-75037 Polkit authentication bypass in LACT
- CVE-2026-75036 Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing
- CVE-2026-75035 Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass
- CVE-2026-75034 Rancher: SAML Assertion Replay
- CVE-2026-75033 Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing
- CVE-2026-75032 Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder
- CVE-2026-75031 Code injection in Interchange
- CVE-2026-75030 Apache Syncope: Incomplete authorization checks for Group members deprovisioning
- CVE-2026-7503 code-projects for Plugin cstecgi.cgi setWiFiMultipleConfig buffer overflow
- CVE-2026-75029 Message parser retains every identical singleton RDATA, enabling wire-to-work amplification
- CVE-2026-75028 WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting
- CVE-2026-75027 Missing authorization in Themify Builder
- CVE-2026-75025 Mattermost Desktop local network access from server-rendered content
- CVE-2026-75021 fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address
- CVE-2026-75020 Apache APISIX: ldap-auth plugin cross-subtree identity impersonation
- CVE-2026-7502 LinkStackOrg LinkStack Management Endpoint UserController.php saveLink authorization
- CVE-2026-75019 Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute
- CVE-2026-75018 Missing authorization in Custom Contact Forms
- CVE-2026-75017 Missing authorization in Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid
- CVE-2026-75016 Magazine Blocks <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute
- CVE-2026-75015 Apache Syncope: Nested secrets leak cleartext into audit records readable
- CVE-2026-75014 SourceCodester Pet Grooming Management Software get_barcode_data.php sql injection
- CVE-2026-75013 TOTOLINK EX1200L cstecgi.cgi setWizardCfg null pointer dereference
- CVE-2026-75012 TOTOLINK EX1200L Password Configuration cstecgi.cgi setPasswordCfg null pointer dereference
- CVE-2026-75011 kylecui NetForensicMCP index.js execAsync command injection
- CVE-2026-75010 Information disclosure in Webmail
- CVE-2026-7501 LinkStackOrg LinkStack UserController.php editPage cross site scripting
- CVE-2026-75007 Command injection in Webmail
- CVE-2026-75006 Server-side request forgery in Webmail
- CVE-2026-75005 Apache APISIX: Unauthenticated CPU-exhaustion DoS
- CVE-2026-75004 Security feature bypass in Webmail
- CVE-2026-75003 Security feature bypass in Webmail
- CVE-2026-75002 Command injection in Webmail
- CVE-2026-75000 Cross-site scripting in Webmail
- CVE-2026-7500 Keycloak has a Forced Browsing issue
- CVE-2026-74999 Cross-site scripting in Webmail
- CVE-2026-74998 Cross-site scripting in Webmail
- CVE-2026-74997 Command injection in Webmail
- CVE-2026-74994 inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth
- CVE-2026-74992 Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload
- CVE-2026-74991 WPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent
- CVE-2026-74990 Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154
- CVE-2026-74989 Internally found bugs fixed in Firefox 154
- CVE-2026-74988 Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154