Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 428 of 1013.
- CVE-2026-70436 Missing authorization in Jenkins External Workspace Manager Plugin
- CVE-2026-70435 Missing authorization in Jenkins SCM-Manager Plugin
- CVE-2026-70434 Cross-site request forgery in Jenkins SCM-Manager Plugin
- CVE-2026-70433 Missing authorization in Jenkins HCL AppScan Plugin
- CVE-2026-70432 Cross-site request forgery in Jenkins Multijob Plugin
- CVE-2026-70431 Code injection in Jenkins Multijob Plugin
- CVE-2026-70430 Privilege escalation in Jenkins
- CVE-2026-7043 GreenCMS index.php pluginAddLocal unrestricted upload
- CVE-2026-70429 Auth bypass in Jenkins
- CVE-2026-70428 Path traversal in Jenkins
- CVE-2026-70427 Path traversal in Jenkins
- CVE-2026-70426 Deserialization in Jenkins
- CVE-2026-70425 Command injection in PowerScale OneFS
- CVE-2026-70424 Path traversal in OpenManage Enterprise
- CVE-2026-70423 XML external entity in OpenManage Enterprise
- CVE-2026-70422 SQL injection in OpenManage Enterprise
- CVE-2026-70421 Privilege escalation in OpenManage Enterprise
- CVE-2026-7042 666ghj MiroFish REST API Endpoint __init__.py create_app missing authentication
- CVE-2026-70419 Command injection in Cloud Disaster Recovery
- CVE-2026-70416 Deserialization in ObjectScale
- CVE-2026-70415 Memory corruption in PowerStore 1000T
- CVE-2026-70414 Information disclosure in Command | Configure (DCC)
- CVE-2026-70413 Hardcoded credentials in Live Optics Collector
- CVE-2026-70412 Information disclosure in iDRAC10
- CVE-2026-70411 Missing authorization in Container Storage Modules (CSM)
- CVE-2026-70410 Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins
- CVE-2026-7041 666ghj MiroFish Werkzeug Debugger PIN console information disclosure
- CVE-2026-70409 eldap does not bound the port component of a referral URL before integer conversion
- CVE-2026-70408 Privilege escalation in acmailer CGI
- CVE-2026-70407 Gitea organization listing token scope bypass
- CVE-2026-70406 Gitea private comparison disclosure with public-only tokens
- CVE-2026-70405 snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields
- CVE-2026-70403 Hardcoded credentials in XING CPTrans-ME-X
- CVE-2026-70402 Gitea local code execution through writable Git hooks
- CVE-2026-70400 Gitea private migration creation with public-only tokens
- CVE-2026-7040 Memory corruption in Text::Minify::XS
- CVE-2026-70399 httpd does not enforce the documented default max_clients connection limit
- CVE-2026-70398 Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2.11
- CVE-2026-70396 Gitea organization repository creation token scope bypass
- CVE-2026-70395 Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash
- CVE-2026-7039 tufantunc ssh-mcp index.ts shell.write command injection
- CVE-2026-70388 Memory Corruption via Integer Underflow in Message Length Validation
- CVE-2026-70387 OnePlus OxygenOS exposed dangerous method vulnerability
- CVE-2026-70386 OnePlus OxygenOS improper neutralization of special elements vulnerability
- CVE-2026-70383 Arbitrary file overwrite vulnerability in DigiDoc4 client
- CVE-2026-70382 Stored Cross-Site Scripting in Web Interface
- CVE-2026-70381 Unauthorized Access to Internal Web Resources
- CVE-2026-70380 Resource Exhaustion in MICE Service
- CVE-2026-7038 tufantunc ssh-mcp Command Line index.ts insufficiently protected credentials
- CVE-2026-70379 Unauthorized Access to vSolution Matrix RTSP
- CVE-2026-70378 imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic
- CVE-2026-70377 imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Service
- CVE-2026-70376 Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE
- CVE-2026-70375 HashBrown CMS - OS Command Injection via Git Deployer Branch Field
- CVE-2026-70374 HashBrown CMS - OS Command Injection in Media Upload Thumbnail Generation
- CVE-2026-70373 Koha - SQL Injection in reports/issues_stats.pl
- CVE-2026-70372 Koha - SQL Injection in reports/bor_issues_top.pl
- CVE-2026-70371 Koha - SQL Injection in reports/issues_avg_stats.pl
- CVE-2026-70370 Koha - SQL Injection in reports/catalogue_stats.pl
- CVE-2026-7037 Totolink A8000RU CGI cstecgi.cgi setVpnPassCfg os command injection
- CVE-2026-70369 Koha - SQL Injection in reports/acquisitions_stats.pl
- CVE-2026-70368 Stunnel: stack-based out-of-bounds read/write in stunnel s_vlog via oversized log message
- CVE-2026-70367 Server-side request forgery in Red Hat Enterprise Linux 10
- CVE-2026-7036 Tenda i9 HTTP R7WebsSecurityHandlerfunction path traversal
- CVE-2026-70357 Gitea repository migration SSRF through DNS rebinding
- CVE-2026-70356 Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type
- CVE-2026-70355 Microsoft SharePoint Server Elevation of Privilege Vulnerability
- CVE-2026-70354 .NET Core Remote Code Execution Vulnerability
- CVE-2026-70352 Azure AI Language Elevation of Privilege Vulnerability
- CVE-2026-70351 Microsoft WebP Image Extension Remote Code Execution Vulnerability
- CVE-2026-7035 Tenda FH1202 httpd WrlclientSet fromWrlclientSet stack-based overflow
- CVE-2026-70348 Windows Management Services Denial of Service Vulnerability
- CVE-2026-70347 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-70346 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-70345 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-70344 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-70343 Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability
- CVE-2026-70342 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-70341 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-70340 Azure CycleCloud Elevation of Privilege Vulnerability
- CVE-2026-7034 Tenda FH1202 httpd WrlExtraSet stack-based overflow
- CVE-2026-70339 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-70338 Microsoft PowerShell Security Feature Bypass Vulnerability
- CVE-2026-70337 Microsoft PowerShell Remote Code Execution Vulnerability
- CVE-2026-70336 Visual Studio Code Remote Code Execution Vulnerability
- CVE-2026-70335 GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability
- CVE-2026-70334 Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-70332 Microsoft Office SharePoint Spoofing Vulnerability
- CVE-2026-70331 Microsoft Edge for iOS Spoofing Vulnerability
- CVE-2026-70330 Windows DNS Elevation of Privilege Vulnerability
- CVE-2026-7033 Tenda F456 SafeClientFilter fromSafeClientFilter buffer overflow
- CVE-2026-70329 Microsoft Outlook Remote Code Execution Vulnerability
- CVE-2026-70328 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-70327 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-70326 Microsoft SharePoint Server Elevation of Privilege Vulnerability
- CVE-2026-70325 Powerpoint Information Disclosure Vulnerability
- CVE-2026-70324 Microsoft SharePoint Elevation of Privilege Vulnerability
- CVE-2026-70323 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-70322 Powerpoint Information Disclosure Vulnerability
- CVE-2026-70321 Microsoft SharePoint Remote Code Execution Vulnerability