Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 420 of 1013.
- CVE-2026-7125 Totolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injection
- CVE-2026-71249 299Ko - Unauthenticated Reflected XSS in Public Contact Form
- CVE-2026-71248 Inventory-Management-System-PHP - Unauthenticated SQL Injection in Login and Product Deletion
- CVE-2026-71247 Documenso - Assistant Recipient Can Forge Another Signer's Signature in Sequential-Signing Documents
- CVE-2026-71246 Pixelfed - Authenticated SSRF via Remote URL Search
- CVE-2026-71244 Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host
- CVE-2026-71243 backmeup (npm) - OS Command Injection via Backup Option Values
- CVE-2026-71242 Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy
- CVE-2026-71241 Book-Management-System - Unauthenticated Disclosure of Student PII and Borrowing History
- CVE-2026-71240 DjangoCRM - Unauthenticated Open Redirect via toggle_default_sorting next_url Parameter
- CVE-2026-7124 Totolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injection
- CVE-2026-71239 DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering
- CVE-2026-71238 DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery
- CVE-2026-71237 Miantang IoT-PHP - Unauthenticated SQL Injection in /userlogin
- CVE-2026-71236 Grocy - Stored XSS via HTMLPurifier Output Double-Decode
- CVE-2026-71235 Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine
- CVE-2026-71234 Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token
- CVE-2026-71233 InvoiceNinja - Stored XSS via Invoice/Quote Terms Field
- CVE-2026-71232 MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE
- CVE-2026-71231 IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie
- CVE-2026-7123 Totolink A8000RU CGI cstecgi.cgi setIptvCfg os command injection
- CVE-2026-71227 Denial of service in Red Hat Enterprise Linux 10
- CVE-2026-71226 Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path
- CVE-2026-71225 Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries
- CVE-2026-71224 Gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk
- CVE-2026-71222 Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing
- CVE-2026-71221 Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta
- CVE-2026-71220 Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit
- CVE-2026-7122 Totolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injection
- CVE-2026-71219 Gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal
- CVE-2026-71218 Iperf3: unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion
- CVE-2026-71217 Denial of service in Red Hat Enterprise Linux 10
- CVE-2026-71216 Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP
- CVE-2026-71215 art-template - Path Traversal in Sub-Template Resolution via include()/extend()
- CVE-2026-71214 NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server
- CVE-2026-71213 typemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force
- CVE-2026-71212 xidown - Argument Injection via Unterminated yt-dlp Command Line Construction
- CVE-2026-71211 mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint
- CVE-2026-71210 mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access
- CVE-2026-7121 Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection
- CVE-2026-71209 Path traversal in audiobookshelf
- CVE-2026-71208 KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation
- CVE-2026-71207 SQL injection in Stock-Inventory-Management-System
- CVE-2026-71206 shiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotion
- CVE-2026-71205 changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force
- CVE-2026-71204 changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement
- CVE-2026-71203 changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema
- CVE-2026-71202 raster - Integer Underflow in crop() Offset Handling Causes Capacity-Overflow Panic
- CVE-2026-71201 Missing authorization in Ironic
- CVE-2026-7120 @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths
- CVE-2026-71198 Server-side request forgery in Glance
- CVE-2026-71195 Missing authorization in Manila
- CVE-2026-71194 Denial of service in Designate
- CVE-2026-71193 Missing authorization in Designate
- CVE-2026-71192 Missing authorization in Swift
- CVE-2026-71191 Missing authorization in Swift
- CVE-2026-71190 Denial of service in Swift
- CVE-2026-7119 Tenda HG3 formCountrystr os command injection
- CVE-2026-71189 Toptech TMS7 and TopHAT Cross-site Scripting
- CVE-2026-71187 Ebyte NA111-M Use of Client-Side Authentication
- CVE-2026-71184 Gitea fork workflow approval bypass through review events
- CVE-2026-71183 Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords
- CVE-2026-71182 Path traversal in Update Package Framework
- CVE-2026-71181 Path traversal in Update Package Framework
- CVE-2026-71180 Privilege escalation in Update Package Framework
- CVE-2026-7118 code-projects Employee Management System cancel.php sql injection
- CVE-2026-71179 Command injection in Update Package Framework
- CVE-2026-71178 Auth bypass in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-71177 Other in Secure Connect Gateway (SCG) Policy Manager
- CVE-2026-71176 SQL injection in OpenManage Enterprise
- CVE-2026-71172 Server-side request forgery in Cloud Disaster Recovery
- CVE-2026-71171 Command injection in Cloud Disaster Recovery
- CVE-2026-71170 Privilege escalation in Application Store
- CVE-2026-7117 code-projects Employee Management System approve.php sql injection
- CVE-2026-71169 Misconfiguration in Application Store
- CVE-2026-71168 Path traversal in System Update
- CVE-2026-71167 Missing authorization in Helidon
- CVE-2026-71166 Missing authorization in Helidon
- CVE-2026-71165 Missing authorization in Helidon
- CVE-2026-71164 Missing authorization in Helidon
- CVE-2026-71163 Missing authorization in Oracle Access Manager
- CVE-2026-71162 Missing authorization in Helidon
- CVE-2026-71161 Denial of service in Helidon
- CVE-2026-71160 Missing authorization in Helidon
- CVE-2026-7116 code-projects Employee Management System mark.php cross site scripting
- CVE-2026-71159 Missing authorization in Helidon
- CVE-2026-71158 Missing authorization in Helidon
- CVE-2026-71157 Missing authorization in Helidon
- CVE-2026-71156 Missing authorization in Helidon
- CVE-2026-71155 Missing authorization in Helidon
- CVE-2026-71154 Missing authorization in Helidon
- CVE-2026-71153 Denial of service in Helidon
- CVE-2026-71152 Missing authorization in Helidon
- CVE-2026-71151 Missing authorization in Oracle VM VirtualBox
- CVE-2026-71150 Privilege escalation in Oracle Hyperion Financial Management
- CVE-2026-7115 code-projects Employee Management System delete.php sql injection
- CVE-2026-71149 Missing authorization in Oracle Hyperion Financial Management
- CVE-2026-71148 Missing authorization in Oracle Hyperion Financial Management
- CVE-2026-71147 Missing authorization in Oracle Hyperion Financial Management
- CVE-2026-71146 Other in Oracle Hyperion Financial Management