Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 409 of 1013.
- CVE-2026-72608 Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name
- CVE-2026-72607 Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age
- CVE-2026-72606 Pinry Pinry - Server-Side Request Forgery
- CVE-2026-72605 Swing Music Swing Music - Missing Authentication
- CVE-2026-72604 Intelliants Subrion CMS - Path Traversal
- CVE-2026-72603 wg-easy wg-easy - OS Command Injection
- CVE-2026-72602 AsyncFuncAI deepwiki-open - Path Traversal
- CVE-2026-72601 CSZ CMS CSZ CMS - Broken Access Control
- CVE-2026-72600 Idurar IDURAR ERP CRM - Broken Access Control
- CVE-2026-7260 Stack overflow in phar with circular symlinks
- CVE-2026-72599 e107 e107 - SQL Injection
- CVE-2026-72598 Apioo Fusio - Server-Side Request Forgery
- CVE-2026-72597 Friendica Friendica - Server-Side Request Forgery
- CVE-2026-72596 Ghost Foundation Ghost - Broken Access Control
- CVE-2026-72595 BadChoice Handesk - Broken Access Control
- CVE-2026-72594 lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload
- CVE-2026-72593 dulldusk phpfm - Missing Authentication by Default Allows Full Filesystem Access
- CVE-2026-72592 dulldusk phpfm - Unauthenticated Remote Code Execution via Unrestricted PHP File Upload
- CVE-2026-72591 Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter
- CVE-2026-72590 alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameter
- CVE-2026-7259 Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
- CVE-2026-72589 alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field
- CVE-2026-72588 bluewave-labs Checkmate - User Enumeration via Differential HTTP Response in Password Recovery
- CVE-2026-72587 Instatic - Cache Poisoning via Unauthenticated Server Island Endpoint
- CVE-2026-72586 frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler
- CVE-2026-72584 fastschema - TOCTOU Race Condition Bypasses OTP Attempt Limit in Account Recovery
- CVE-2026-72583 fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload
- CVE-2026-72582 fastschema - Unauthenticated NULL Pointer Dereference DoS in Account Recovery Endpoint
- CVE-2026-72581 duhow xiaoai-patch - Server-Side Request Forgery in /auth Endpoint
- CVE-2026-72580 duhow xiaoai-patch - OS Command Injection in /mute and /unmute Endpoints
- CVE-2026-7258 Out-of-bounds read in urldecode() on NetBSD
- CVE-2026-72579 NASA HyperCP - OS Command Injection via Malicious HTTP Response from Data Server
- CVE-2026-72578 FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax Dispatcher
- CVE-2026-72577 NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection
- CVE-2026-72576 Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload
- CVE-2026-72575 daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects
- CVE-2026-72574 picocms Pico - Host Header Injection Enables Script Source Hijacking
- CVE-2026-72573 4xmen pm2panel - Authenticated OS Command Injection via id Query Parameter
- CVE-2026-72572 o1lab xmysql - Unauthenticated Path Traversal via name Query Parameter
- CVE-2026-72571 mustafaakin cast-localvideo - Unauthenticated Path Traversal via dir Parameter
- CVE-2026-72570 cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename
- CVE-2026-7257 Information disclosure in WRE6505 v2 firmware
- CVE-2026-72569 cube-root directory-serve - Unauthenticated Path Traversal Arbitrary File Deletion
- CVE-2026-72567 deepwiki-open - Unauthenticated Path Traversal Leading to Arbitrary File Write and Delete
- CVE-2026-72566 automatisch - Server-Side Request Forgery via HTTP Request Custom Action
- CVE-2026-72565 Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass
- CVE-2026-72564 fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication
- CVE-2026-72563 BadChoice Handesk - Broken Access Control
- CVE-2026-72562 Pimcore pimcore admin-ui-classic-bundle - SQL Injection
- CVE-2026-72561 Peppermint Lab Peppermint - Broken Access Control
- CVE-2026-72560 HumanSignal Label Studio - Server-Side Request Forgery
- CVE-2026-7256 Command injection in WRE6505 v2 firmware
- CVE-2026-72559 Daniel Brendel HortusFox - Cross-Site Scripting
- CVE-2026-72558 CiviCRM CiviCRM - SQL Injection
- CVE-2026-72557 Cockpit CMS Cockpit CMS - Unrestricted File Upload
- CVE-2026-72556 ZoneMinder ZoneMinder - Remote Code Execution
- CVE-2026-72555 Peppermint Lab Peppermint - Broken Access Control
- CVE-2026-72554 Ladybird Web Solution Faveo Helpdesk - Broken Access Control
- CVE-2026-72553 ElkArte Forum ElkArte - Cross-Site Scripting
- CVE-2026-72552 Dub Dub - Server-Side Request Forgery
- CVE-2026-72551 Apioo Fusio - Remote Code Execution
- CVE-2026-72550 Friendica Friendica - SQL Injection
- CVE-2026-7255 Auth bypass in WRE6505 v2 firmware
- CVE-2026-72549 OpenSignLabs OpenSign - Information Disclosure
- CVE-2026-72548 OpenSignLabs OpenSign - Information Disclosure
- CVE-2026-72547 Attendize Attendize - Insecure Direct Object Reference
- CVE-2026-72546 Attendize Attendize - Insecure Direct Object Reference
- CVE-2026-72545 OpenSignLabs OpenSign - Insecure Direct Object Reference
- CVE-2026-72544 OpenSignLabs OpenSign - Insufficient Verification of Data Authenticity
- CVE-2026-72543 OpenSignLabs OpenSign - Insecure Direct Object Reference
- CVE-2026-72542 Windmill Labs Windmill - Missing Authorization
- CVE-2026-72541 Windmill Labs Windmill - Missing Authorization
- CVE-2026-7254 Open BMC Denial of Service
- CVE-2026-72539 Windmill Labs Windmill - Information Disclosure
- CVE-2026-72538 PrefectHQ Prefect - Argument Injection
- CVE-2026-72537 Authentik Security authentik - Privilege Escalation
- CVE-2026-72536 Chaskiq Chaskiq - Missing Authentication
- CVE-2026-72535 Chaskiq Chaskiq - Missing Authentication
- CVE-2026-72534 Authentik Security authentik - Privilege Escalation
- CVE-2026-72533 Portainer Portainer CE - Authentication Bypass
- CVE-2026-72532 Joomla! Core - [20260805] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2
- CVE-2026-72531 Missing authorization in Joomla! CMS
- CVE-2026-72530 TrueConf Server Code Injection
- CVE-2026-7253 IBM Sterling File Gateway SQL Injection
- CVE-2026-72529 TrueConf Server Missing Authentication for Critical Function
- CVE-2026-72528 Open redirect in "Creema - Handmade Marketplace App" for iOS
- CVE-2026-72526 Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2.11
- CVE-2026-72524 Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables
- CVE-2026-72522 Memory corruption in libexpat
- CVE-2026-7252 WP-Optimize <= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta
- CVE-2026-72510 Toptech TMS7 and TopHAT SQL Injection
- CVE-2026-7251 Eppendorf BioFlo 320 Use of hard-coded password
- CVE-2026-72508 Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2.11
- CVE-2026-72507 Toptech TMS7 and TopHAT SQL Injection
- CVE-2026-72506 Other in "VoiceTra(Voice Translator)" for Android
- CVE-2026-72502 tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
- CVE-2026-72501 RDMA/bnxt_re: Initialize dpi variable to zero
- CVE-2026-72500 RDMA/bnxt_re: Free SRQ toggle page after firmware teardown
- CVE-2026-7250 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-72499 RDMA/bnxt_re: Free CQ toggle page after firmware teardown