Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 395 of 1013.
- CVE-2026-74271 power: supply: core: fix supplied_from allocations
- CVE-2026-74270 handshake: Require admin permission for DONE command
- CVE-2026-7427 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-74269 bnxt: fix head underflow on XDP head-grow
- CVE-2026-74268 tcp: clear sock_ops cb flags before force-closing a child socket
- CVE-2026-74267 net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
- CVE-2026-74266 net/sched: sch_dualpi2: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
- CVE-2026-74265 net: mana: initialize gdma queue id to INVALID_QUEUE_ID
- CVE-2026-74264 net: watchdog: fix refcount tracking races
- CVE-2026-74263 net: wwan: t7xx: check skb_clone in control TX
- CVE-2026-74262 kcm: use WRITE_ONCE() when changing lower socket callbacks
- CVE-2026-74261 ALSA: seq: avoid stale FIFO cells during resize
- CVE-2026-74260 netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them
- CVE-2026-7426 Out-of-Bounds Write via Unsanitized Prefix Length in Router Advertisement Processing in FreeRTOS-Plus-TCP
- CVE-2026-74258 bpf: Guard __get_user acesss with access_ok for uprobe_multi data
- CVE-2026-74257 sockmap: Fix use-after-free in udp_bpf_recvmsg()
- CVE-2026-74256 bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
- CVE-2026-74255 tipc: fix UAF in tipc_l2_send_msg()
- CVE-2026-74254 Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5
- CVE-2026-74253 Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0
- CVE-2026-74252 Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
- CVE-2026-74251 Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6
- CVE-2026-74250 Other in Ironic
- CVE-2026-7425 Out-of-Bounds Read in Router Advertisement Option Parser in FreeRTOS-Plus-TCP
- CVE-2026-74248 Missing authorization in Octavia
- CVE-2026-74247 Quay: ssrf via build archive_url in quay build api
- CVE-2026-74245 Quay: unauthenticated exported logs download in quay
- CVE-2026-74244 Quay: stripe webhook accepts forged events without signature verification in quay
- CVE-2026-74243 Quay: unauthenticated secscan notification endpoint in quay when psk is unset
- CVE-2026-74242 Quay: repository notification uuid idor in quay api
- CVE-2026-74241 Quay: ldap referral filter injection in quay external ldap authentication
- CVE-2026-74240 Quay: jwt claim validation bypasses in quay federated robot and sso authentication
- CVE-2026-7424 Integer Underflow in DHCPv6 Sub-Option Parser in FreeRTOS-Plus-TCP
- CVE-2026-74239 XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows
- CVE-2026-74238 TIER IV Nebula 1.2.0 Heap Out-of-Bounds Read via VLP32 UDP Decoder
- CVE-2026-74237 GFI Exinda AI / ClearView < 7.6.5 Argument Injection via Tools Iperf Client
- CVE-2026-74236 GFI Exinda AI / ClearView < 7.6.5 Path Traversal via Diagnostic File Deletion Handler
- CVE-2026-74235 GFI Exinda AI / ClearView < 7.6.5 Path Traversal via Configuration Download Handler
- CVE-2026-74233 Zbtlink MQWrt infosrvd Command Injection
- CVE-2026-74232 Zbtlink MQWrt yunmgrd Cloud C2 Implant
- CVE-2026-7423 Integer Underflow in ICMP Echo Reply Processing in FreeRTOS-Plus-TCP
- CVE-2026-74225 U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6
- CVE-2026-74222 U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive Callback
- CVE-2026-74221 U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK
- CVE-2026-74220 U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply
- CVE-2026-7422 MAC Address Validation Bypass in FreeRTOS-Plus-TCP IPv4 and IPv6 Packet Processing
- CVE-2026-7421 Passeum Ticketing <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'shop_name' Setting
- CVE-2026-7420 UTT HiPER 1250GW ConfigAdvideo strcpy buffer overflow
- CVE-2026-7419 UTT HiPER 1250GW formTaskEdit_ap strcpy buffer overflow
- CVE-2026-7418 UTT HiPER 1250GW NTP strcpy buffer overflow
- CVE-2026-7417 Algovate xhs-mcp MCP mcp.server.ts xhs_publish_content server-side request forgery
- CVE-2026-7416 PolarVista xcode-mcp-server MCP index.ts run_tests os command injection
- CVE-2026-7415 Open MQTT orchestration without read/write ACLs in Yarbo robot firmware
- CVE-2026-7414 Hardcoded credentials in Yarbo robot firmware
- CVE-2026-7413 Persistent undocumented backdoor access in Yarbo robot
- CVE-2026-7412 Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery
- CVE-2026-7411 Eclipse BaSyx Java Server SDK vulnerable to Path Traversal
- CVE-2026-7410 SourceCodester Pizzafy Ecommerce System ajax.php add_to_cart sql injection
- CVE-2026-7409 SourceCodester Pizzafy Ecommerce System ajax.php save_user sql injection
- CVE-2026-7408 SourceCodester Pizzafy Ecommerce System ajax.php save_menu sql injection
- CVE-2026-7407 SourceCodester Pizzafy Ecommerce System Setting ajax.php save_settings sql injection
- CVE-2026-7406 BMP File Parsing Untrusted Pointer Dereference in certain Autodesk products
- CVE-2026-7405 TIF File Parsing Out-of-Bounds Read in certain Autodesk products
- CVE-2026-74049 Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
- CVE-2026-74048 Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
- CVE-2026-74047 Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint
- CVE-2026-74046 Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb
- CVE-2026-74045 Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder
- CVE-2026-74044 Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello
- CVE-2026-74043 Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions
- CVE-2026-74041 Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch
- CVE-2026-74040 Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker
- CVE-2026-7404 getsimpletool mcpo-simple-server base_manager.py delete_shared_prompt path traversal
- CVE-2026-74039 Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context
- CVE-2026-74038 Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment
- CVE-2026-74037 Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token
- CVE-2026-74036 Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies
- CVE-2026-74035 Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user
- CVE-2026-74034 Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
- CVE-2026-74033 Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers
- CVE-2026-74032 Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions
- CVE-2026-74031 Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers
- CVE-2026-74030 Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion
- CVE-2026-7403 geldata gel-mcp server.py fetch_rule path traversal
- CVE-2026-74021 WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability
- CVE-2026-74020 WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability
- CVE-2026-7402 Improper Rate Limiting in MeWare Software's PDKS
- CVE-2026-74019 WordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerability
- CVE-2026-74018 WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability
- CVE-2026-74017 WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability
- CVE-2026-74016 WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability
- CVE-2026-74015 WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability
- CVE-2026-74014 WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability
- CVE-2026-74013 WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerability
- CVE-2026-74012 WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability
- CVE-2026-74011 WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability
- CVE-2026-74010 WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability
- CVE-2026-7401 Cross-site scripting in CET Automated Grading System with AI Predictive Analytics
- CVE-2026-74009 WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-74008 WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.24 - Sensitive Data Exposure vulnerability