Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 404 of 1013.
- CVE-2026-73137 Information disclosure in Red Hat Advanced Cluster Management for Kubernetes 2.11
- CVE-2026-73136 Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay
- CVE-2026-73135 Gitea hidden-owner repository listing disclosure
- CVE-2026-73130 Gitea repository initialization resource exhaustion
- CVE-2026-7313 CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity
- CVE-2026-73126 Gitea private workflow badge token scope bypass
- CVE-2026-73125 Ebyte NA111-M Missing Authentication for Critical Function
- CVE-2026-73122 Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2.11
- CVE-2026-7312 CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity
- CVE-2026-7311 Path traversal in TinyPNG – JPEG, PNG & WebP image compression
- CVE-2026-73108 RustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodec
- CVE-2026-73102 RustDesk Path Traversal via macOS Clipboard File-Paste
- CVE-2026-7310 Memory corruption in MACH HiDraw
- CVE-2026-73090 PeerTube: Cross-origin remote video takeover via Update activity
- CVE-2026-7309 Openshift-controller-manager: openshift container platform: information disclosure via environment variable injection
- CVE-2026-73089 Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
- CVE-2026-73088 Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
- CVE-2026-73087 Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher
- CVE-2026-73086 nanoid: Integer Overflow or Wraparound
- CVE-2026-73085 Audiobookshelf: Refresh Token Accepted on Resource Endpoints
- CVE-2026-73084 Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint
- CVE-2026-73083 Activepieces: V8 Isolate Sandbox Bypass via importFresh Module Loading
- CVE-2026-73082 Activepieces: Server-side request forgery in MCP tool validation endpoint
- CVE-2026-73081 Activepieces: Remote Code Execution via Command Injection in Code Step Name
- CVE-2026-73080 SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle
- CVE-2026-7308 Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via HTML Browse Page
- CVE-2026-73079 Server-side request forgery in sub2api
- CVE-2026-73078 Vim: Arbitrary Code Execution via Netrw Menu Construction
- CVE-2026-73077 Vim: Arbitrary Code Execution via Shell Keyword Lookup
- CVE-2026-73076 Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`
- CVE-2026-73075 Vim: Out-of-bounds Access in Popup Opacity Handling
- CVE-2026-73074 Vim: Heap Buffer Overflow in Text Property Handling
- CVE-2026-73073 Vim: Arbitrary Ex Command Execution in C Omni-Completion
- CVE-2026-73072 Vim: Heap Buffer Overflow when Loading a Spell File
- CVE-2026-73071 Vim: Use-after-free in JSON Decoding
- CVE-2026-73070 Vim: Stack Buffer Overflow in the Vim Socket Server
- CVE-2026-7307 Keycloak: keycloak: denial of service via specially crafted saml input
- CVE-2026-73069 Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution
- CVE-2026-73068 Missing authorization in ToolJet
- CVE-2026-73067 Tesseract: Heap OOB read in the DAWG loader
- CVE-2026-73066 Tesseract: Heap out-of-bounds write in LSTM Convolve layer via crafted .traineddata
- CVE-2026-73064 Weak cryptography in Mbed TLS
- CVE-2026-73062 Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication
- CVE-2026-73061 Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor
- CVE-2026-73060 Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply
- CVE-2026-7306 Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key
- CVE-2026-73059 stoatchat before 0.15.0 Permission Bypass via message_fetch
- CVE-2026-73058 stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypass
- CVE-2026-73057 stoatchat before 0.15.0 Uncapped SVG Rendering Denial of Service
- CVE-2026-73056 SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Token
- CVE-2026-73055 Shescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBox
- CVE-2026-73054 SiYuan before v3.7.4 Authentication Bypass via WebSocket
- CVE-2026-73053 SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji
- CVE-2026-73052 SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names
- CVE-2026-73051 actix-http before 3.12.1 HTTP Request Smuggling via CL.TE
- CVE-2026-73050 SiYuan before v3.7.4 Stored XSS via select option color
- CVE-2026-7305 Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java triggerJob server-side request forgery
- CVE-2026-73049 SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks
- CVE-2026-73048 SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID
- CVE-2026-73047 siyuan before v3.7.4 Server-Side Template Injection via attribute-view
- CVE-2026-73046 SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth
- CVE-2026-73045 SiYuan before 3.7.4 Brute-Force via authFilePublishAccess
- CVE-2026-73044 SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width
- CVE-2026-73043 SiYuan before v3.7.4 Remote Code Execution via Template Calculation
- CVE-2026-73042 SiYuan before v3.7.4 Remote Code Execution via Menu Metadata
- CVE-2026-73041 SiYuan before v3.7.4 Remote Code Execution via PDF Annotations
- CVE-2026-73040 Path traversal in dockge
- CVE-2026-7304 CVE-2026-7304
- CVE-2026-73039 streama Insecure Direct Object Reference via ViewingStatusController
- CVE-2026-73038 NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name
- CVE-2026-73037 Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter
- CVE-2026-73036 Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml
- CVE-2026-73035 npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences
- CVE-2026-73034 DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header
- CVE-2026-73033 Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php
- CVE-2026-73032 PapersGPT for Zotero 0.6.1 RCE via Unsanitized LLM Response eval()
- CVE-2026-73031 telegram-search Stored XSS via v-html in MessageList.vue
- CVE-2026-73030 unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape
- CVE-2026-7303 Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection
- CVE-2026-73029 Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-73028 SQL Server Elevation of Privilege Vulnerability
- CVE-2026-73027 Windows Setup Files Cleanup Elevation of Privilege Vulnerability
- CVE-2026-73026 Windows Biometric Service Elevation of Privilege Vulnerability
- CVE-2026-73025 Windows iSCSI Security Feature Bypass Vulnerability
- CVE-2026-73024 Windows Services for NFS ONCRPC XDR Driver Elevation of Privilege Vulnerability
- CVE-2026-73023 Windows Imaging Component Remote Code Execution Vulnerability
- CVE-2026-73022 Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability
- CVE-2026-73021 Windows Biometric Service Elevation of Privilege Vulnerability
- CVE-2026-73020 Windows Biometric Service Elevation of Privilege Vulnerability
- CVE-2026-7302 CVE-2026-7302
- CVE-2026-73019 Windows URL Moniker Security Feature Bypass Vulnerability
- CVE-2026-73018 Graphic Fonts Remote Code Execution Vulnerability
- CVE-2026-73017 Graphics Kernel Remote Code Execution Vulnerability
- CVE-2026-73016 DirectWrite Remote Code Execution Vulnerability
- CVE-2026-73015 Windows Biometric Service Elevation of Privilege Vulnerability
- CVE-2026-73014 Data Sharing Service Client Elevation of Privilege Vulnerability
- CVE-2026-73013 Windows Imaging Component Remote Code Execution Vulnerability
- CVE-2026-73012 Windows Management Services Elevation of Privilege Vulnerability
- CVE-2026-73011 Windows Biometric Service Elevation of Privilege Vulnerability
- CVE-2026-73010 Microsoft Failover Cluster Remote Code Execution Vulnerability