Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 440 of 1013.
- CVE-2026-69080 Apache Kylin: Broken Access Control in QuerySQLBlacklistController
- CVE-2026-69079 Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmute
- CVE-2026-69078 Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Rendering
- CVE-2026-69077 Apache Kylin: JobController allows unauthorized cross-project manipulation
- CVE-2026-69076 Apache Kylin: Unauthorized cross-project job discard
- CVE-2026-69075 Stored Cross-Site Scripting via Vue Template Injection in FlowIntel
- CVE-2026-6907 Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware
- CVE-2026-6903 Path Traversal Vulnerability in LabOne User Interface
- CVE-2026-6902 Code Injection in Perforce P4 (Helix Core)
- CVE-2026-6901 Untrusted Search Path
- CVE-2026-6900 Improper Certificate Validation
- CVE-2026-6899 Improper Check for Certificate Revocation in S2OPC
- CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
- CVE-2026-68980 Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion
- CVE-2026-6898 Missing authorization in Wishlist Member
- CVE-2026-68979 Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates
- CVE-2026-68971 Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints
- CVE-2026-68970 Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI
- CVE-2026-6897 Missing authorization in Wishlist Member
- CVE-2026-68969 Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext
- CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id
- CVE-2026-68967 Out-of-bounds Write in Bendix EC80 Brake ECU
- CVE-2026-68964 Gitea restricted-user SSH and GPG key metadata disclosure
- CVE-2026-68960 Memory corruption in SKYMEC IT Manager
- CVE-2026-6896 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-68959 Path traversal in SKYMEC IT Manager
- CVE-2026-68957 Gitea restricted-user issue search disclosure
- CVE-2026-68956 SSH daemon allocates unbounded idle session channels, bypassing max_channels
- CVE-2026-68955 Other in The installer for Rakuten Kobo Desktop Application (Windows version)
- CVE-2026-68954 Toptech TMS7 and TopHAT SQL Injection
- CVE-2026-68953 Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups
- CVE-2026-68951 Missing authorization in GROWI
- CVE-2026-68950 Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups
- CVE-2026-6895 Missing authorization in Wishlist Member
- CVE-2026-68945 Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
- CVE-2026-68939 Command injection in pyenv
- CVE-2026-68930 Russh: Channel-scoped server callbacks can be reached without an open channel
- CVE-2026-6893 Dracut: dracut: root code execution via dhcp options command injection
- CVE-2026-68929 FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization
- CVE-2026-68928 Missing authorization in Acode
- CVE-2026-68927 MobSF: SSRF port restriction bypass in assetlinks_check
- CVE-2026-68924 MobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
- CVE-2026-68923 MobSF: CSRF checks not enforced after Django migration
- CVE-2026-68922 MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads
- CVE-2026-68921 DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
- CVE-2026-6892 Privilege escalation in Canon PIXUS iX6800 Series CUPS Printer Driver for macOS
- CVE-2026-68919 GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages
- CVE-2026-68911 Nicotine+: Decompression of peer messages can exhaust available memory
- CVE-2026-6891 Privilege escalation in My Image Garden for macOS
- CVE-2026-68908 libIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string in the report send path
- CVE-2026-68907 Memory corruption in libiec61850
- CVE-2026-68906 libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU
- CVE-2026-68904 node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
- CVE-2026-68901 Null dereference in wekan
- CVE-2026-68900 Wekan: Stored XSS in HTML board exports through a card-title second parse
- CVE-2026-68899 Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback
- CVE-2026-68898 Windows iSCSI Denial of Service Vulnerability
- CVE-2026-68897 Microsoft Standard XPS Elevation of Privilege Vulnerability
- CVE-2026-68896 Microsoft Windows Search Component Elevation of Privilege Vulnerability
- CVE-2026-68895 Internet Storage Name Service Information Disclosure Vulnerability
- CVE-2026-68894 Windows Error Reporting Elevation of Privilege Vulnerability
- CVE-2026-68893 Remote Desktop Licensing Service Elevation of Privilege Vulnerability
- CVE-2026-68892 Microsoft Standard XPS Elevation of Privilege Vulnerability
- CVE-2026-68891 Microsoft Standard XPS Information Disclosure Vulnerability
- CVE-2026-68890 Microsoft Standard XPS Elevation of Privilege Vulnerability
- CVE-2026-68889 Microsoft Standard XPS Elevation of Privilege Vulnerability
- CVE-2026-68888 Microsoft Standard XPS Elevation of Privilege Vulnerability
- CVE-2026-68887 Windows Message Queuing Queue Manager Denial of Service Vulnerability
- CVE-2026-68886 Windows Network Connection Broker Information Disclosure Vulnerability
- CVE-2026-68885 Microsoft Standard XPS Elevation of Privilege Vulnerability
- CVE-2026-68884 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-68883 Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-68881 Microsoft Standard XPS Information Disclosure Vulnerability
- CVE-2026-68880 Windows Win32k Elevation of Privilege Vulnerability
- CVE-2026-6888 SQL Injection Vulnerability
- CVE-2026-68878 Windows Fast FAT Driver Elevation of Privilege Vulnerability
- CVE-2026-68877 Windows Storage Spaces Controller Remote Code Execution Vulnerability
- CVE-2026-68876 Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability
- CVE-2026-68875 Windows NTFS Remote Code Execution Vulnerability
- CVE-2026-68874 Windows Program Compatibility Assistant Service Information Disclosure Vulnerability
- CVE-2026-68873 Windows Program Compatibility Assistant Service Information Disclosure Vulnerability
- CVE-2026-68872 Missing authorization in Apache Airflow Amazon provider
- CVE-2026-68871 Apache Airflow Yandex Lockbox backend allows cross-team secret disclosure
- CVE-2026-68870 Missing authorization in Apache Airflow Microsoft Azure provider
- CVE-2026-6887 BorG Technology Corporation｜Borg SPM 2007 - SQL Injection
- CVE-2026-68868 Missing authorization in Apache Airflow Google provider
- CVE-2026-68866 Path traversal in PowerProtect Data Domain
- CVE-2026-68863 Memory corruption in PowerProtect One
- CVE-2026-68861 Command injection in PowerProtect One
- CVE-2026-68860 Other in PowerProtect Data Manager
- CVE-2026-6886 BorG Technology Corporation｜Borg SPM 2007 - Authentication Bypass
- CVE-2026-68852 Microsoft Account Information Disclosure Vulnerability
- CVE-2026-68851 Windows NTFS Information Disclosure Vulnerability
- CVE-2026-68850 Microsoft Account Elevation of Privilege Vulnerability
- CVE-2026-6885 BorG Technology Corporation｜Borg SPM 2007 - Arbitrary File Upload
- CVE-2026-68849 Windows Bluetooth Port Driver Information Disclosure Vulnerability
- CVE-2026-68848 Windows Print Spooler Components Elevation of Privilege Vulnerability
- CVE-2026-68847 Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
- CVE-2026-68846 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-68845 Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability