Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 448 of 1013.
- CVE-2026-67864 An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeManagement type-instantiation log
- CVE-2026-67863 In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path.
- CVE-2026-67862 open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/ua_client_highlevel.c.
- CVE-2026-67861 An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UA_Client_getRemoteDataTypes componen
- CVE-2026-67860 open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend.
- CVE-2026-6786 Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150
- CVE-2026-67859 Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Discovery/LDS handling.
- CVE-2026-67858 Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled thro
- CVE-2026-67857 open62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray() in src/client/ua_client_connect.c.
- CVE-2026-67856 An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via crafted CreateSubscription, CreateMonitor
- CVE-2026-67855 open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled.
- CVE-2026-67854 SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code
- CVE-2026-6785 Memory corruption in Firefox
- CVE-2026-67846 Berkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment iss
- CVE-2026-6784 Memory safety bugs fixed in Firefox 150 and Thunderbird 150
- CVE-2026-6783 Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component
- CVE-2026-67827 Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE)
- CVE-2026-67822 Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint.
- CVE-2026-6782 Information disclosure in the IP Protection component
- CVE-2026-6781 Denial-of-service in the Audio/Video: Playback component
- CVE-2026-6780 Denial-of-service in the Audio/Video: Playback component
- CVE-2026-6779 Other issue in the JavaScript Engine component
- CVE-2026-6778 Invalid pointer in the Audio/Video: Playback component
- CVE-2026-6777 Other issue in the Networking: DNS component
- CVE-2026-6776 Incorrect boundary conditions in the WebRTC: Networking component
- CVE-2026-6775 Incorrect boundary conditions in the WebRTC component
- CVE-2026-6774 Mitigation bypass in the DOM: Security component
- CVE-2026-6773 Denial-of-service due to integer overflow in the Graphics: WebGPU component
- CVE-2026-6772 Incorrect boundary conditions in the Libraries component in NSS
- CVE-2026-6771 Mitigation bypass in the DOM: Security component
- CVE-2026-6770 Other issue in the Storage: IndexedDB component
- CVE-2026-67693 An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that cont
- CVE-2026-6769 Privilege escalation in the Debugger component
- CVE-2026-67689 SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `order` parameters in p
- CVE-2026-67688 ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module.
- CVE-2026-67687 Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in R
- CVE-2026-6768 Mitigation bypass in the Networking: Cookies component
- CVE-2026-67678 File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code
- CVE-2026-67673 A stack-based buffer overflow vulnerability exists in the cmd_edl function of OreSat Firmware v1.0.
- CVE-2026-6767 Other issue in the Libraries component in NSS
- CVE-2026-6766 Incorrect boundary conditions in the Libraries component in NSS
- CVE-2026-6765 Information disclosure in the Form Autofill component
- CVE-2026-67648 Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-67645 Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-67643 Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67642 Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67641 Microsoft SQL Server Denial of Service Vulnerability
- CVE-2026-6764 Incorrect boundary conditions in the DOM: Device Interfaces component
- CVE-2026-67639 Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67638 Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67636 Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67633 Microsoft SQL Server Denial of Service Vulnerability
- CVE-2026-67631 Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67630 Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-6763 Mitigation bypass in the File Handling component
- CVE-2026-67629 Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-67628 Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-67626 Microsoft SQL Server Denial of Service Vulnerability
- CVE-2026-67625 Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67624 Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-67623 Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook
- CVE-2026-67622 Flowise 3.1.4 IDOR in OpenAI Assistants Integration
- CVE-2026-67621 Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints
- CVE-2026-67620 Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List
- CVE-2026-6762 Spoofing issue in the DOM: Core & HTML component
- CVE-2026-67618 marimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadata
- CVE-2026-67617 Microweber CMS 2.0.20 Stored XSS via tag_names Parameter
- CVE-2026-67616 Camaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpoint
- CVE-2026-67615 openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker
- CVE-2026-67614 CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal
- CVE-2026-67613 CyberPanel < 3.0.0 Path Traversal File Read via cloudAPI ReadReport
- CVE-2026-67612 OpenEMR 8.2.0 Stored XSS via import_template.php Template Management
- CVE-2026-67611 OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
- CVE-2026-67610 OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access
- CVE-2026-6761 Privilege escalation in the Networking component
- CVE-2026-67609 Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration
- CVE-2026-67608 Telenia TVox 26.5.3 OS Command Injection via action_audio.php
- CVE-2026-67607 LightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup
- CVE-2026-67602 phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache
- CVE-2026-6760 Mitigation bypass in the Networking: Cookies component
- CVE-2026-67599 ClearOS 7.9 OS Command Injection via Log Viewer filter parameter
- CVE-2026-67598 Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php
- CVE-2026-67596 CSL 1010 M2M 3G WiFi Module 2.2.1.4 Weak Encryption via Router.cfg
- CVE-2026-67595 VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php
- CVE-2026-67594 Spikster Missing Authentication via API Route Group
- CVE-2026-67593 Missing authorization in Apache ActiveMQ Artemis
- CVE-2026-67592 Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery
- CVE-2026-67591 Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded
- CVE-2026-67590 Apache Qpid ProtonJ2: Unbounded type nesting can lead to pre-authentication stackoverflow
- CVE-2026-6759 Use-after-free in the Widget: Cocoa component
- CVE-2026-67589 Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authentication
- CVE-2026-67588 Apache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
- CVE-2026-67587 Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget
- CVE-2026-67585 Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation
- CVE-2026-67581 On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay
- CVE-2026-6758 Use-after-free in the JavaScript: WebAssembly component
- CVE-2026-67579 Filter expression injection via forged keyset pagination cursor in Ash
- CVE-2026-67578 Missing authorization in FA-50
- CVE-2026-67577 Gitea restricted-user activity and heatmap disclosure
- CVE-2026-6757 Invalid pointer in the JavaScript: WebAssembly component