Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 442 of 1013.
- CVE-2026-6869 Improperly Controlled Sequential Memory Allocation in Wireshark
- CVE-2026-6868 Stack-based Buffer Overflow in Wireshark
- CVE-2026-6867 Improperly Controlled Sequential Memory Allocation in Wireshark
- CVE-2026-6866 Initialization of a Resource with an Insecure Default vulnerability on EcoStruxure™ Panel Server
- CVE-2026-6865 Improper Limitation of a Pathname to a Restricted Directory Vulnerability on Multiple Products
- CVE-2026-6864 CBX 5 Star Rating & Review <= 1.0.7 - Reflected Cross-Site Scripting via 'page' Parameter
- CVE-2026-6863 HTTP Filestore Endpoints Misapply Permissions Across Organizations
- CVE-2026-6862 Efivar: efivar: denial of service due to stack overflow in device path node parsing
- CVE-2026-6861 Emacs: emacs: memory corruption vulnerability when processing svg css
- CVE-2026-6860 Vert.x has a DoS via unbounded server-side SNI SslContext cache growth
- CVE-2026-6859 Instructlab: instructlab: arbitrary code execution due to hardcoded `trust_remote_code=true`
- CVE-2026-68587 SiYuan before v3.7.3 Information Disclosure via getHeading*Transaction
- CVE-2026-68586 SiYuan before v3.7.3 Content Disclosure via getBacklinkDoc
- CVE-2026-68585 SiYuan before v3.7.3 Metadata Disclosure via getBlockInfo
- CVE-2026-68584 SiYuan before v3.7.3 Authentication Bypass via Content Endpoints
- CVE-2026-68583 luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name
- CVE-2026-68582 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
- CVE-2026-68581 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision
- CVE-2026-68580 FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel
- CVE-2026-6858 Transbank Webpay < 1.14.0 - Unauthenticated Stored XSS
- CVE-2026-68579 FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read
- CVE-2026-68578 ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport
- CVE-2026-68573 Apache Kylin: Unauthenticated Metastore Cleanup
- CVE-2026-68572 Apache Kylin: Unauthorized SQL execution to Spark SQL env
- CVE-2026-68571 Apache Kylin: JDBC URL Whitelist Verification Bypass
- CVE-2026-68570 Apache Doris: Authorization bypass leading to unauthorized data access
- CVE-2026-6857 Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization
- CVE-2026-68569 Apache Tomcat: Principal lookup can fail open in some cases
- CVE-2026-68568 WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability
- CVE-2026-68567 WordPress EasyTest – Simplify A/B Testing plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-68566 WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability
- CVE-2026-68565 WordPress GeoDirectory plugin <= 2.8.172 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-68564 WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-68563 Information disclosure in Red Hat Enterprise Linux 10
- CVE-2026-68562 Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure via leapp report tampering
- CVE-2026-68561 Privilege escalation in wekan
- CVE-2026-68560 Wekan:hell Injection in External Antivirus Scanner Path via asyncExec
- CVE-2026-68559 Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)
- CVE-2026-68558 Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)
- CVE-2026-68555 coturn: Chained mobility resumes allow authenticated remote memory exhaustion
- CVE-2026-68554 Security feature bypass in coturn
- CVE-2026-68553 Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command
- CVE-2026-68552 Coturn: uint16_t truncation overflow in STUN message length causes TCP stream framing bypass
- CVE-2026-6855 Instructlab: instructlab: path traversal allows arbitrary directory creation and file write
- CVE-2026-6854 My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters
- CVE-2026-68537 Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service
- CVE-2026-68536 Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability
- CVE-2026-68535 Missing authorization in Concrete CMS
- CVE-2026-68534 Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors
- CVE-2026-68533 Missing authorization in Concrete CMS
- CVE-2026-68532 Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashboard Action
- CVE-2026-68531 Denial of service in Concrete CMS
- CVE-2026-68530 Missing authorization in Concrete CMS
- CVE-2026-6853 OTP Bypass in Başbelen Group's Pause+ Mobile App
- CVE-2026-68529 Missing authorization in Concrete CMS
- CVE-2026-68528 Concrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unescaped Remote Feed Item title
- CVE-2026-68527 Missing authorization in Concrete CMS
- CVE-2026-68526 Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller
- CVE-2026-68525 Apache Tomcat: Redirect after FORM auth may bypass method specific constraints
- CVE-2026-68523 Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service
- CVE-2026-68520 Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config
- CVE-2026-68519 Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)
- CVE-2026-68518 Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction
- CVE-2026-68517 Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard
- CVE-2026-68516 OpenEXR: HTJ2K SIZ image-offset gap stack buffer overflow
- CVE-2026-68515 OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union
- CVE-2026-68514 OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision in deep images
- CVE-2026-68513 OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision
- CVE-2026-6851 Improper link resolution before file access in Bitdefender Total Security via Link Following (VA-13681)
- CVE-2026-68508 Hydra: hydra.utils.instantiate with untrusted config can lead to code execution
- CVE-2026-68503 LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard
- CVE-2026-68502 LazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCE
- CVE-2026-68501 Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII
- CVE-2026-68500 Sylius Mollie Plugin: Payment status forgery via the payment webhook
- CVE-2026-6850 Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost
- CVE-2026-68499 re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)
- CVE-2026-68498 Denial of service in jackson-core
- CVE-2026-68497 jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS
- CVE-2026-68496 Denial of service in jackson-dataformats-binary
- CVE-2026-68495 Denial of service in jackson-dataformats-binary
- CVE-2026-68494 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
- CVE-2026-68493 Missing authorization in Server
- CVE-2026-68492 Code injection in Plesk
- CVE-2026-68491 Path traversal in SolusVM
- CVE-2026-68490 Misconfiguration in cPanel
- CVE-2026-6849 OS Command Injection in TUBITAK BILGEM's Pardus OS My Computer
- CVE-2026-68489 Code injection in Plesk extension "Node.js Toolkit"
- CVE-2026-68488 Race condition in Plesk
- CVE-2026-68487 Path traversal in Plesk
- CVE-2026-68484 Missing authorization in Sage AR Automation
- CVE-2026-68482 Apache Answer: Improper Authorization in Question Invite User Lookup
- CVE-2026-68481 Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider
- CVE-2026-68480 x86/bugs: Make Safe-RET robust against interrupt injection
- CVE-2026-6848 Quay: red hat quay: authentication bypass allows privileged actions without valid credentials
- CVE-2026-68479 Bluetooth: btrtl: validate firmware patch bounds
- CVE-2026-68478 memstick: ms_block: reject a card that reports too many blocks
- CVE-2026-68477 ipvs: fix more places with wrong ipv6 transport offsets
- CVE-2026-68476 ipvs: reload ip header after head reallocation
- CVE-2026-68475 reset: sunxi: fix memory region leak on ioremap failure
- CVE-2026-68474 powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()