Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 447 of 1013.
- CVE-2026-68104 drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
- CVE-2026-68103 drm/amdgpu: reject mapping a reserved doorbell to a new queue
- CVE-2026-68102 drm/amdgpu: fix aperture mapping leak
- CVE-2026-68100 ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
- CVE-2026-6810 Missing authorization in Booking Calendar Contact Form
- CVE-2026-68099 ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
- CVE-2026-68098 ksmbd: bound DACL dedup walk to copied ACEs
- CVE-2026-68097 ksmbd: validate ACE size against SID sub-authorities
- CVE-2026-68096 audit: fix recursive locking deadlock in audit_dupe_exe()
- CVE-2026-68095 fuse-uring: fix race between registration and connection abortion
- CVE-2026-68094 sched_ext: Preserve rq tracking across local DSQ dispatch
- CVE-2026-68093 KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
- CVE-2026-68092 time/jiffies: Register jiffies clocksource before usage
- CVE-2026-68091 HID: wacom: stop hardware after post-start probe failures
- CVE-2026-68090 debugobjects: Plug race against a concurrent OOM disable
- CVE-2026-6809 Social Post Embed <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Threads Embed
- CVE-2026-68089 iio: core: fix uninitialized data in debugfs
- CVE-2026-68088 usb: gadget: function: rndis: add length check to response query
- CVE-2026-68087 HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()
- CVE-2026-68086 mm/khugepaged: write all dirty file folios when collapsing
- CVE-2026-68085 Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
- CVE-2026-68084 staging: vme_user: fix location monitor leak in tsi148 bridge
- CVE-2026-68083 ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
- CVE-2026-68082 libceph: fix two unsafe bare decodes in decode_lockers()
- CVE-2026-68081 KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
- CVE-2026-68080 Apache Qpid Broker-J: Unbounded echo flow responses can lead to denial of service
- CVE-2026-6808 Pricing Tables for WP <= 1.1.0 - Reflected Cross-Site Scripting via 'page' Parameter
- CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
- CVE-2026-68078 Apache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming delivery
- CVE-2026-68077 Apache Qpid Broker-J: Unbounded disposition range handling can lead to denial of service
- CVE-2026-68076 Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection
- CVE-2026-68075 Apache Qpid Broker-J: Incoming session flow control window can be exceeded
- CVE-2026-68074 Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
- CVE-2026-68073 Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow
- CVE-2026-68070 Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups
- CVE-2026-6807 NSA GRASSMARLIN Improper Restriction of XML External Entity Reference
- CVE-2026-68068 Toptech TMS7 and TopHAT SQL Injection
- CVE-2026-68067 Mira Hormone Monitor, Mira Android App Weak Authentication
- CVE-2026-68062 Path traversal in SKYMEC IT Manager
- CVE-2026-68060 Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication
- CVE-2026-6806 Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters
- CVE-2026-6805 Vulnerability on Cryptobox external sharing feature
- CVE-2026-6804 Missing authorization in AI Copilot – Content Generator
- CVE-2026-6803 Missing authorization in AI Copilot – Content Generator
- CVE-2026-6802 Missing authorization in Easy Upload Files During Checkout
- CVE-2026-6801 Context Blog <= 1.3.5 - Unauthenticated Sensitive Information Exposure via 'postID' Parameter
- CVE-2026-68006 An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file
- CVE-2026-68005 An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the h
- CVE-2026-68004 An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization,
- CVE-2026-68000 The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection.
- CVE-2026-6800 FastBots <= 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
- CVE-2026-67993 basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback.
- CVE-2026-67991 crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition
- CVE-2026-67990 basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers.
- CVE-2026-6799 Comfast CF-N1-S Endpoint mbox-config command injection
- CVE-2026-67989 crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition
- CVE-2026-67987 crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions i
- CVE-2026-67986 amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArray#grep.
- CVE-2026-6798 Missing authorization in 2Download Connector for 2DL Hosted Checkout
- CVE-2026-67979 Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute a
- CVE-2026-67978 An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via transmitting a crafted SBN frame.
- CVE-2026-67977 An integer overflow in the Svc::FileDownlink::SendPartial component of fprime framework v4.2.2 allows attackers to cause a Denial of Service
- CVE-2026-67976 The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to ca
- CVE-2026-67975 Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending T
- CVE-2026-67974 A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attacker
- CVE-2026-67973 An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via replaying final CFDP PDUs.
- CVE-2026-67972 An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly
- CVE-2026-67970 Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal.
- CVE-2026-6797 Sanluan PublicCMS DocToHtmlUtils.java ZipSecureFile.setMinflateRatio resource consumption
- CVE-2026-67969 An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a craft
- CVE-2026-67967 Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary code.
- CVE-2026-67966 Tenda W20E V16.01.0.6(2782) /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access.
- CVE-2026-67965 An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login function
- CVE-2026-67961 An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mechanism of the Invoke script execution.
- CVE-2026-67960 An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentControll
- CVE-2026-6796 Sanluan PublicCMS Failed Login LoginAdminController.java log_login cleartext storage in file
- CVE-2026-6795 Open Redirect in DivvyDrive Information Technologies' DivvyDrive
- CVE-2026-6794 Multiple Vulnerabilities in IBM Concert Software
- CVE-2026-6793 Stored XSS in Bifra Engineering's Q-smart NexT Poll
- CVE-2026-67926 An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module
- CVE-2026-67925 Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/uplo
- CVE-2026-67921 Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components.
- CVE-2026-67920 An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreW
- CVE-2026-6792 Improper Authorization in Universal Sotware's FlexCity
- CVE-2026-67919 An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPl
- CVE-2026-67918 Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath fu
- CVE-2026-67917 zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality.
- CVE-2026-6791 Potential stack-based buffer clash during tilde expansion in wordexp
- CVE-2026-6790 Eclipse Jetty: HTTP Authority/Host mismatch
- CVE-2026-6788 Uncontrolled search path in PluginLauncher allows SYSTEM code execution in WatchGuard Agent
- CVE-2026-67873 A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path.
- CVE-2026-67872 An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the event monitored-item queue resize handling
- CVE-2026-67871 Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, address_space_
- CVE-2026-67870 In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets.
- CVE-2026-6787 Usage of a hard-coded cryptographic key in WatchGuard Agent allows inclusion of code into existing process
- CVE-2026-67869 Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Service_Call validates input
- CVE-2026-67868 A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during CreateMonitoredItems processing.
- CVE-2026-67867 Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the Alarm/Conditions wrapper
- CVE-2026-67866 Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the LockedStaMac_ProcessMsg_
- CVE-2026-67865 S2OPC 1.7.3 contains an out-of-bounds read in RepublishResponse handling.