Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 397 of 1013.
- CVE-2026-73897 Missing authorization in Helidon
- CVE-2026-73896 Other in Helidon
- CVE-2026-73895 Missing authorization in Helidon
- CVE-2026-73894 Missing authorization in Helidon
- CVE-2026-73893 Missing authorization in Helidon
- CVE-2026-73892 Missing authorization in Helidon
- CVE-2026-73891 Missing authorization in Helidon
- CVE-2026-73890 Denial of service in Helidon
- CVE-2026-7389 EyouCMS common.php GetSortData sql injection
- CVE-2026-73889 Missing authorization in Helidon
- CVE-2026-73888 Missing authorization in Helidon
- CVE-2026-73887 Missing authorization in Helidon
- CVE-2026-73886 Missing authorization in Helidon
- CVE-2026-73885 Missing authorization in Helidon
- CVE-2026-73884 Information disclosure in Helidon
- CVE-2026-73883 Information disclosure in Helidon
- CVE-2026-73882 Denial of service in Helidon
- CVE-2026-73881 Missing authorization in Helidon
- CVE-2026-73880 Missing authorization in Helidon
- CVE-2026-7388 EyouCMS Template File FilemanagerLogic.php editFile code injection
- CVE-2026-73879 Missing authorization in Helidon
- CVE-2026-73878 Information disclosure in Helidon
- CVE-2026-73877 Missing authorization in Helidon
- CVE-2026-73876 Missing authorization in Helidon
- CVE-2026-73875 Missing authorization in Helidon
- CVE-2026-73874 Missing authorization in Helidon
- CVE-2026-73873 Missing authorization in Helidon
- CVE-2026-73872 Missing authorization in Helidon
- CVE-2026-73871 Missing authorization in Helidon
- CVE-2026-73870 Missing authorization in Helidon
- CVE-2026-7387 Mattermost group syncable endpoints allow privilege escalation via scheme_admin
- CVE-2026-73869 Missing authorization in Helidon
- CVE-2026-73868 Missing authorization in Helidon
- CVE-2026-73867 Missing authorization in Helidon
- CVE-2026-73866 Missing authorization in Helidon
- CVE-2026-73865 Missing authorization in Helidon
- CVE-2026-73863 NanoMQ: Heap-Buffer-Overflow in `nmq_subinfo_decode()` During MQTT v5 SUBSCRIBE Parsing
- CVE-2026-7386 fatbobman mail-mcp-bridge mail_mcp_server.py path traversal
- CVE-2026-73858 Solspace Freeform: Limited Twig template injection via submitted field values
- CVE-2026-73851 Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)
- CVE-2026-73850 Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Function
- CVE-2026-7385 Decent Comments < 3.0.2 - Unauthenticated Email Address Disclosure
- CVE-2026-73849 emlog allows unauthenticated reinstallation via `install.php?action=reinstall`.
- CVE-2026-73848 Emlog: Stored XSS via Tag Name in Article Editor
- CVE-2026-73847 Cross-site request forgery in emlog
- CVE-2026-73846 CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning
- CVE-2026-73845 CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)
- CVE-2026-73844 CKAN MCP Server: Information disclosure via verbose error reflection
- CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs
- CVE-2026-73842 OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation
- CVE-2026-73841 OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints
- CVE-2026-73840 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
- CVE-2026-7384 ezequiroga mcp-bases research_server.py search_papers path traversal
- CVE-2026-73839 Ebyte NE2-D11 Insufficiently Protected Credentials
- CVE-2026-73834 Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction
- CVE-2026-7383 Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion
- CVE-2026-73829 Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race
- CVE-2026-73827 Cross-site scripting in SOY Calendar
- CVE-2026-7382 Information Disclosure in MeWare Software's PDKS
- CVE-2026-73819 Ebyte NA111-M Weak Authentication
- CVE-2026-73814 Gitea repository ownership escalation by administrators
- CVE-2026-73812 inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
- CVE-2026-7381 Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting
- CVE-2026-73809 Ebyte NA111-M Cleartext Transmission of Sensitive Information
- CVE-2026-73807 mySCADA myPRO Manager Missing Authorization
- CVE-2026-73804 Gitea API token scope escalation through HTTP signatures
- CVE-2026-73802 Gitea Runner host isolation bypass through container options
- CVE-2026-73800 Gitea reusable workflow secret exposure in pull_request_target
- CVE-2026-7380 HTML Injection in Armiya Technologies' Access Control System
- CVE-2026-73799 HPE NonStop SNMP Trap Multiplexer - Memory Corruption vulnerability
- CVE-2026-73798 HPE NonStop DNS 9.2.3 Non Secure Version
- CVE-2026-73797 HPE NonStop TSQLFIL - Memory corruption vulnerability
- CVE-2026-73796 HPE NonStop TSQLEXE - Memory Corruption vulnerability
- CVE-2026-73795 HPE NonStop TMF Auditread2 - Denial of Service vulnerability
- CVE-2026-73794 HPE NonStop MODULAR NSJ - Vulnerability in Random Number Generation
- CVE-2026-73793 HPE NonStop Middleware - Secret key handling vulnerability
- CVE-2026-73792 HPE NonStop Java JToolkit - Command Injection and buffer overflow vulnerability
- CVE-2026-73791 HPE NonStop Hpjmeter - Buffer overflow vulnerability
- CVE-2026-73790 HPE NonStop iTP WebServer - Memory corruption vulnerability
- CVE-2026-7379 Missing Release of Memory after Effective Lifetime in Wireshark
- CVE-2026-73789 Unauthenticated Insecure Parameter Manipulation allows Data Tampering In CPPM Web Interface
- CVE-2026-73788 Privilege Escalation in ClearPass OnGuard Agent
- CVE-2026-73787 Authenticated Arbitrary File Write allows Remote Code Execution via CPPM Web Interface
- CVE-2026-73786 Unauthenticated Network-Based Denial of Service in CPPM systems
- CVE-2026-73785 HPE IceWall Federation Agent and Proxy, Denial of Service vulnerability
- CVE-2026-73784 HPE IceWall products, Remote Bypass of Security Restrictions
- CVE-2026-73783 Authenticated Stack Overflow Vulnerabilities lead to Denial-of-Service in AOS-CX
- CVE-2026-73782 Unauthenticated Format String Vulnerability leads to Remote Code Execution in AOS-CX
- CVE-2026-73781 Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in AOS-CX Web-Based Management Interface
- CVE-2026-73780 Lack of Cross-Site Request Forgery (CSRF) Protections for Certificate-Authenticated Sessions in AOS-CX
- CVE-2026-7378 Heap-based Buffer Overflow in Wireshark
- CVE-2026-73779 Auth bypass in AOS-CX
- CVE-2026-73778 Credential Manager Vulnerability Allows Unauthorized Administrative Access
- CVE-2026-73777 Authorization Bypass Vulnerabilities Leading to Privilege Escalation in AOS-CX API Endpoint
- CVE-2026-73776 Authenticated Signature Verification Bypass Leading to Arbitrary Code Execution in AOS-CX
- CVE-2026-73775 Authenticated Sensitive Information Disclosure Vulnerabilities in AOS-CX
- CVE-2026-73774 Unauthenticated Buffer Overflow Vulnerability leads to Sensitive Information Disclosure in AOS-CX
- CVE-2026-73773 Unauthenticated Denial-of-Service (DoS) Vulnerability in AOS-CX
- CVE-2026-73772 Unauthenticated Buffer Overflow Vulnerabilities lead to Denial-of-Service in AOS-CX
- CVE-2026-73771 Improper Authentication Handling in AOS-CX Management Interface and API