Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 408 of 1013.
- CVE-2026-72719 Chatwoot: Cross-Account Resource Transfer via `account_id` Parameter
- CVE-2026-72718 goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor
- CVE-2026-72717 Orval: Import-time RCE via schema default -> zod module-level template literal
- CVE-2026-72716 Orval: Import-time RCE via query-parameter default -> zod module-level template literal
- CVE-2026-72714 Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close
- CVE-2026-72713 XAgent Path Traversal Arbitrary File Read via /workspace/file
- CVE-2026-72712 Nmap 7.99 Denial of Service via Zero-Length TCP Option Packet
- CVE-2026-72711 Lean 4 before 4.32.2 Kernel Accepts Opaque Declaration With an Unbound Free Variable
- CVE-2026-72710 SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection
- CVE-2026-7271 DV0x creative-ad-agent creative-ad-agent-server sdk-server.ts path traversal
- CVE-2026-72709 SPIP < 4.4.18 Missing Authorization via ecrire/action/
- CVE-2026-72708 SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html
- CVE-2026-72705 Rocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order Argument
- CVE-2026-72704 Rocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After Transport
- CVE-2026-72703 Rocq Prover 8.20 before 9.2.0 Guard Checker Accepts Non-Terminating Fixpoint via Unchecked Cross-Calls
- CVE-2026-72702 Grav CMS before 2.0.16 Origin Validation Bypass via Referer
- CVE-2026-72701 Grav CMS before 2.0.16 Timing Attack via verifyNonce
- CVE-2026-72700 Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison
- CVE-2026-7270 Local privilege escalation via execve()
- CVE-2026-72699 Grav Login Plugin before 3.9.1 Email Enumeration via Registration
- CVE-2026-72698 Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
- CVE-2026-72697 Grav CMS before 2.0.16 Path Traversal via media_directory
- CVE-2026-72696 Grav CMS before 2.0.16 Symlink Following via createLockFile
- CVE-2026-72695 Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile
- CVE-2026-72694 Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation
- CVE-2026-72693 Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login
- CVE-2026-72692 OpenSignLabs opensignserver - Missing Authorization
- CVE-2026-72691 OpenSignLabs opensignserver - Authentication Bypass
- CVE-2026-72690 Attendize Attendize - Cross-Tenant Authorization Bypass
- CVE-2026-7269 SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting
- CVE-2026-72689 OpenSignLabs opensignserver - Broken Object Level Authorization
- CVE-2026-72688 OpenSignLabs opensignserver - Missing Authentication for Critical Function
- CVE-2026-72687 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
- CVE-2026-72686 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-72685 Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service
- CVE-2026-72684 Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
- CVE-2026-72683 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-72682 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-72681 Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure
- CVE-2026-72680 Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification
- CVE-2026-7268 SourceCodester Pizzafy Ecommerce System ajax.php save_category sql injection
- CVE-2026-72679 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-72678 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
- CVE-2026-72677 Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources
- CVE-2026-72676 Improper Control of Generation of Code in Fleet Server Leading to Code Injection
- CVE-2026-72675 Missing authorization in Kibana
- CVE-2026-72674 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-72673 Incorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private Locations
- CVE-2026-72672 Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data
- CVE-2026-72671 Missing authorization in Kibana
- CVE-2026-72670 Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials
- CVE-2026-7267 SourceCodester Pizzafy Ecommerce System view_prod.php sql injection
- CVE-2026-72669 Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering
- CVE-2026-72668 Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation
- CVE-2026-72667 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-72666 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts
- CVE-2026-72665 Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions
- CVE-2026-72664 Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions
- CVE-2026-72663 Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service
- CVE-2026-72662 Missing authorization in Kibana
- CVE-2026-72661 Missing Authorization in Kibana Leading to Information Disclosure
- CVE-2026-72660 Uncaught Exception in Kibana Leading to Denial of Service
- CVE-2026-7266 SourceCodester Pizzafy Ecommerce System ajax.php save_order sql injection
- CVE-2026-72659 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-72658 Cross-Site Request Forgery in Kibana Leading to Privilege Escalation
- CVE-2026-72657 Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure
- CVE-2026-72656 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
- CVE-2026-72655 Missing authorization in Kibana
- CVE-2026-72654 Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure
- CVE-2026-72653 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-72652 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-72651 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-72650 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure
- CVE-2026-7265 SourceCodester Pizzafy Ecommerce System index.php category sql injection
- CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
- CVE-2026-72648 Information disclosure in Eck Operator
- CVE-2026-72647 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-72645 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
- CVE-2026-72644 Uncaught Exception in Kibana Leading to Denial of Service
- CVE-2026-72643 Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents
- CVE-2026-72642 Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process
- CVE-2026-72641 Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data
- CVE-2026-72640 Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure
- CVE-2026-7264 SourceCodester Pizzafy Ecommerce System ajax.php get_cart_items sql injection
- CVE-2026-72639 Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service
- CVE-2026-72638 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-72636 Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service
- CVE-2026-72633 Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring
- CVE-2026-72632 Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys
- CVE-2026-72631 Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys
- CVE-2026-72630 Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation
- CVE-2026-7263 DoS attack via DOMNode::C14N()
- CVE-2026-72629 Missing authorization in Kibana
- CVE-2026-72628 Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service
- CVE-2026-72627 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-72626 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-7262 NULL pointer dereference in SOAP apache:Map decoder with missing <value>
- CVE-2026-72610 Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation
- CVE-2026-7261 SoapServer session-persisted object use-after-free via SOAP header fault
- CVE-2026-72609 Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl