Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 418 of 1013.
- CVE-2026-71473 Code injection in Red Hat Advanced Cluster Management for Kubernetes 2.11
- CVE-2026-71472 Command injection in Red Hat Advanced Cluster Management for Kubernetes 2.11
- CVE-2026-71471 Code injection in Red Hat Advanced Cluster Management for Kubernetes 2.11
- CVE-2026-71470 Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2.11
- CVE-2026-7147 JoeCastrom mcp-chat-studio LLM Models API llm.js server-side request forgery
- CVE-2026-71469 Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos
- CVE-2026-71468 Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache
- CVE-2026-71467 Acm-search-v2-api-rhel9: search-v2-api: authentication bypass on /federated via upgrade: websocket header spoofing
- CVE-2026-71465 Command injection in Red Hat Ansible Automation Platform 2.5 for RHEL 8
- CVE-2026-71464 Command injection in Red Hat Ansible Automation Platform 2.5 for RHEL 8
- CVE-2026-71463 Information disclosure in Red Hat Ansible Automation Platform 2.5 for RHEL 8
- CVE-2026-71462 Information disclosure in Red Hat Ansible Automation Platform 2.5 for RHEL 8
- CVE-2026-71461 Information disclosure in Red Hat Ansible Automation Platform 2
- CVE-2026-71460 Missing authorization in Red Hat Ansible Automation Platform 2.5 for RHEL 8
- CVE-2026-7146 AlejandroArciniegas mcp-data-vis HTTP Request server.js axios server-side request forgery
- CVE-2026-71459 Missing authorization in Red Hat Ansible Automation Platform 2.5 for RHEL 8
- CVE-2026-71458 Information disclosure in Red Hat Ansible Automation Platform 2.5 for RHEL 8
- CVE-2026-71456 Hardcoded credentials in Kantech Entrapass
- CVE-2026-71455 Information disclosure in Kantech Entrapass
- CVE-2026-71454 Cross-site scripting in CAPEC-63
- CVE-2026-71453 Path traversal in EasyIO FS32
- CVE-2026-71452 Command injection in EasyIO FS32
- CVE-2026-71451 Command injection in EasyIO FS32
- CVE-2026-7145 mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization
- CVE-2026-71449 Hardcoded credentials in EasyIO FS32
- CVE-2026-71448 Misconfiguration in EasyIO FS32
- CVE-2026-71447 Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework
- CVE-2026-71446 Stored Cross-Site Scripting in AIL Framework Domain Screenshot View
- CVE-2026-71445 Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework
- CVE-2026-71444 CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)
- CVE-2026-71443 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-71442 CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)
- CVE-2026-71441 Illustrator | Out-of-bounds Read (CWE-125)
- CVE-2026-71440 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-7144 1000 Projects Portfolio Management System MCA update_passwd_process.php authorization
- CVE-2026-71439 Mermaid radar diagrams are vulnerable to DoS
- CVE-2026-71438 Mermaid configuration APIs allow prototype pollution
- CVE-2026-71437 Mermaid Architecture diagrams are vulnerable to prototype pollution
- CVE-2026-71436 Mermaid XY Charts are vulnerable to an infinite loop DoS
- CVE-2026-71435 Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template
- CVE-2026-71434 Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
- CVE-2026-71433 LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores
- CVE-2026-71430 node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length
- CVE-2026-7143 1000 Projects Portfolio Management System MCA block_status.php sql injection
- CVE-2026-71429 stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
- CVE-2026-71428 unstructured: Server-Side Request Forgery in the URL-based partitioning
- CVE-2026-71426 GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field
- CVE-2026-71424 Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers
- CVE-2026-7142 Wooey API Endpoint scripts.py add_or_update_script improper authorization
- CVE-2026-71418 Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumption
- CVE-2026-71417 Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it
- CVE-2026-71416 Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)
- CVE-2026-71415 Kirby: File upload permissions are not checked during processing of chunk data
- CVE-2026-7141 vLLM KV Block kv_cache_interface.py has_mamba_layers uninitialized resource
- CVE-2026-71408 Denial of service in FortiOS
- CVE-2026-71407 Memory corruption in FortiOS
- CVE-2026-71404 Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole
- CVE-2026-71403 Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind
- CVE-2026-71402 wicked: out-of-bounds read in the DHCPv4 option parser due to payload length taken from the IP total length
- CVE-2026-71401 wicked: integer underflow of the UDP length in ni_capture_inspect_udp_header() leads to an out-of-bounds read
- CVE-2026-7140 Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection
- CVE-2026-71399 Adobe XD | Buffer Overflow (CWE-120)
- CVE-2026-71398 Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
- CVE-2026-71396 Use of Hard-coded Credentials in Bendix EC80 Brake ECU
- CVE-2026-71394 Heap Use of Uninitialized Memory in GNU Emacs for Android
- CVE-2026-71393 Heap Buffer Overflow in GNU Emacs for Android
- CVE-2026-71392 Integer Overflow in GNU Emacs for Android
- CVE-2026-71391 Off-by-One Error in GNU Emacs for Android
- CVE-2026-71390 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-7139 Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection
- CVE-2026-71389 CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)
- CVE-2026-71388 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-71387 ColdFusion | Incorrect Authorization (CWE-863)
- CVE-2026-71386 ColdFusion | Cross-site Scripting (XSS) (CWE-79)
- CVE-2026-71385 ColdFusion | Incorrect Authorization (CWE-863)
- CVE-2026-71384 ColdFusion | Incorrect Authorization (CWE-863)
- CVE-2026-71383 ColdFusion | Incorrect Authorization (CWE-863)
- CVE-2026-71382 Substance3D - Sampler | Out-of-bounds Write (CWE-787)
- CVE-2026-71381 Adobe Genuine Software Integrity Service | CWE-863 Incorrect Authorization
- CVE-2026-71380 httpd applies no timeout while receiving a request body, parking a worker on a stalled client
- CVE-2026-7138 Totolink A8000RU CGI cstecgi.cgi setNtpCfg os command injection
- CVE-2026-71379 Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties
- CVE-2026-71378 Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener
- CVE-2026-71377 Command Argument Injection Vulnerability in Cosminexus Component Container
- CVE-2026-71376 OS Command Injection Vulnerability in Cosminexus Component Container
- CVE-2026-71375 XXE Vulnerability in Cosminexus Component Container
- CVE-2026-71374 Deserialization of Untrusted Data Vulnerability in Cosminexus Component Container
- CVE-2026-7137 Totolink A8000RU CGI cstecgi.cgi setStorageCfg os command injection
- CVE-2026-71368 Cross-site scripting in F-RevoCRM
- CVE-2026-71366 Awx: notification backends allow ssrf and credential leakage
- CVE-2026-71365 Awx: webhook status callback ssrf leaks the git pat
- CVE-2026-71364 Awx: project archive extraction allows path traversal file writes
- CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability
- CVE-2026-71360 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-7136 Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection
- CVE-2026-71357 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-71356 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-71353 Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability
- CVE-2026-71352 Windows Remote Access Connection Manager Remote Code Execution Vulnerability
- CVE-2026-71351 Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability