Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 416 of 1013.
- CVE-2026-71932 DrayTek VigorSwitch Multiple Models Path Traversal via getSyslogFile
- CVE-2026-71931 DrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgrade
- CVE-2026-71930 DrayTek VigorSwitch Multiple Models OS Command Injection via setTime
- CVE-2026-7193 Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment
- CVE-2026-71929 DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProto
- CVE-2026-71928 DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevice
- CVE-2026-71927 DrayTek VigorSwitch Multiple Models OS Command Injection via rebDevice
- CVE-2026-71926 DrayTek VigorSwitch Multiple Models OS Command Injection via setDevice
- CVE-2026-71925 DrayTek VigorSwitch Multiple Models OS Command Injection via getDetail
- CVE-2026-71924 DrayTek VigorSwitch Multiple Models OS Command Injection via getVid
- CVE-2026-71923 DrayTek VigorSwitch Multiple Models OS Command Injection via auth_set
- CVE-2026-71922 DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgi
- CVE-2026-71921 DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi
- CVE-2026-71920 DrayTek VigorSwitch Multiple Models NULL Pointer Dereference via formlogout
- CVE-2026-7192 Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment
- CVE-2026-71919 DrayTek VigorSwitch Multiple Models OS Command Injection via sysreboot
- CVE-2026-71918 DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupAction
- CVE-2026-71917 DrayTek VigorSwitch Multiple Models OS Command Injection via pingtrace
- CVE-2026-71916 DrayTek VigorSwitch Multiple Models OS Command Injection via commandTable
- CVE-2026-71915 DrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatus
- CVE-2026-71914 DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm
- CVE-2026-71913 DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi
- CVE-2026-71912 DrayTek VigorAP Multiple Models Buffer Overflow via apautotest
- CVE-2026-71911 DrayTek VigorAP Multiple Models Buffer Overflow via setLan
- CVE-2026-71910 DrayTek VigorAP Multiple Models OS Command Injection via apautotest
- CVE-2026-7191 Arbitrary Code Execution via Sandbox Bypass in the open source solution QnABot on AWS
- CVE-2026-71909 DrayTek VigorAP Multiple Models OS Command Injection via InquierTime
- CVE-2026-71908 DrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_test
- CVE-2026-71907 DrayTek VigorAP Multiple Models OS Command Injection via setcamset
- CVE-2026-71906 DrayTek VigorAP Multiple Models OS Command Injection via setLan
- CVE-2026-71905 DrayTek VigorAP Multiple Models OS Command Injection via ExportSettings
- CVE-2026-71904 DrayTek VigorAP Multiple Models OS Command Injection via tr069TestInform
- CVE-2026-7190 Reflected Cross-Site Scripting in ICT Innovations’ PHP-CGI/PHP-FPM configuration
- CVE-2026-71899 Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure
- CVE-2026-71898 Missing authorization in Apache DolphinScheduler
- CVE-2026-71897 Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints
- CVE-2026-71896 Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information
- CVE-2026-71895 Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials
- CVE-2026-71892 CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys
- CVE-2026-71891 BLS12-381 key validation accepts a public key built on a foreign curve
- CVE-2026-71890 MLS external commit can remove an arbitrary group member
- CVE-2026-7189 Sensitive Data Exposure in Proliz's OBS
- CVE-2026-71889 PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate
- CVE-2026-71888 CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent
- CVE-2026-71887 OpenPGP data signature accepted from a signing subkey without cross-certification
- CVE-2026-71886 OpenPGP certification accepted from a subkey without certification authority
- CVE-2026-71885 MLS X.509 credential not bound to the LeafNode signature key
- CVE-2026-71884 Packet CTR reports a full success length after the counter is exhausted
- CVE-2026-71883 Native AES packet cipher returns the raw AES key on an alias
- CVE-2026-71880 Server-side template injection in Integrated Publishing Toolkit
- CVE-2026-7188 SQLi in Armiya Information Technologies' Access Control System
- CVE-2026-71879 Authentication bypass in Integrated Publishing Toolkit
- CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit
- CVE-2026-71871 Orval: Import-time RCE via header-parameter default -> zod module-level template literal
- CVE-2026-71870 pypdf: Possible large memory usage for large /ToUnicode streams
- CVE-2026-7187 Improper Authentication in Universal Sotware's UKBS
- CVE-2026-71869 Orval: Import-time RCE via array-items default -> zod module-level template literal
- CVE-2026-71868 Orval: Import-time RCE via enum-typed default -> zod module-level template literal
- CVE-2026-71867 Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
- CVE-2026-71866 Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
- CVE-2026-71865 Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
- CVE-2026-71864 Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
- CVE-2026-71862 Checkmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled
- CVE-2026-7186 Fix stored XSS in URL dashboard widget via dangerous URI schemes
- CVE-2026-71858 Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution
- CVE-2026-71855 Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state
- CVE-2026-71854 OpenAEV has unauthenticated access and missing object-level authorization on player lessons API
- CVE-2026-71852 pypdf: Possible long runtimes/large memory usage for large CID font width ranges
- CVE-2026-71851 crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
- CVE-2026-71850 Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure
- CVE-2026-7185 Unauthorized access to files in T-Systems products
- CVE-2026-71849 Hono: Proxy Helper does not remove response headers listed in the `Connection` header
- CVE-2026-71848 Hono: Algorithmic Complexity DoS in Language Middleware
- CVE-2026-71847 Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams
- CVE-2026-71846 Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege
- CVE-2026-71845 Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()
- CVE-2026-7184 Mattermost Remote Cluster PATCH API Leaks Authentication Tokens
- CVE-2026-71832 Aria2 version 1.37.0 and below is affected by a Divide By Zero issue in src/bittorrent_helper.cc, which allows a remote malicious user to ca
- CVE-2026-7183 aligungr UERANSIM Radio Link Simulation Layer rls_pdu.cpp DecodeRlsMessage uncaught exception
- CVE-2026-7182 Path Traversal in Diagram
- CVE-2026-71809 Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote unauthenticate
- CVE-2026-71808 A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands v
- CVE-2026-71807 In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the
- CVE-2026-71805 An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0.
- CVE-2026-71803 money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability.
- CVE-2026-71802 A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3.
- CVE-2026-71801 An issue was discovered in s-pms SPMS-Server through v1.0.
- CVE-2026-7179 OSPG binwalk WinCE Extraction Plugin winceextract.py read_null_terminated_string path traversal
- CVE-2026-7178 ChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgery
- CVE-2026-7177 ChatGPTNextWeb NextChat route.ts proxyHandler server-side request forgery
- CVE-2026-7176 Multiple vulnerabilities in Entradium by Crocantickets
- CVE-2026-7175 Multiple vulnerabilities in Entradium by Crocantickets
- CVE-2026-7174 Multiple vulnerabilities in Entradium by Crocantickets
- CVE-2026-7173 Multiple vulnerabilities in Entradium by Crocantickets
- CVE-2026-7172 Stored Cross-Site Scripting (XSS) in TPVEnlanube
- CVE-2026-7171 Stored Cross-Site Scripting (XSS) in TPVEnlanube
- CVE-2026-7170 Stored Cross-Site Scripting (XSS) in TPVEnlanube
- CVE-2026-71694 An issue in Berkeley Out-of-Order Machine (BOOM) / BoomTile RTL benchmark v1.2 2d08d0d8b4563212175212f9db0e69f6e68c9619 allows a remote atta
- CVE-2026-7169 Uncontrolled Search Path Element in Evope Collector
- CVE-2026-7168 cross-proxy Digest auth state leak