Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 451 of 1013.
- CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow
- CVE-2026-67278 TLS server impersonation possible in Mikrotik RouterOS
- CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function
- CVE-2026-67276 SSH user impersonation possible in Mikrotik RouterOS
- CVE-2026-67275 Other in PowerProtect One
- CVE-2026-67273 Code injection in Container Storage Modules
- CVE-2026-67271 Memory corruption in PowerStore 1000T
- CVE-2026-67270 Weak cryptography in Container Storage Modules (CSM)
- CVE-2026-6727 CVE-2026-6727
- CVE-2026-67269 Privilege escalation in Container Storage Modules (CSM)
- CVE-2026-67268 XML external entity in Dell Command Update (DCU)
- CVE-2026-67267 Information disclosure in Dell Command Update (DCU)
- CVE-2026-67266 Privilege escalation in Dell Command Update (DCU)
- CVE-2026-67262 Missing authorization in PowerStore 1000T
- CVE-2026-67261 Command injection in Virtual Storage Integrator for VMware vSphere Client
- CVE-2026-67260 Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization
- CVE-2026-6726 An information leakage vulnerability in the TCG TPM 2.0 reference code.
- CVE-2026-6725 Cross-site scripting in WPC Smart Messages for WooCommerce
- CVE-2026-67249 Apache Answer: Email Code Purpose Confusion May Allow Account Takeover
- CVE-2026-67248 A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM
- CVE-2026-67247 A path traversal vulnerability was found in the IHM Log handling of ADM
- CVE-2026-67246 A path traversal vulnerability was found in the Wallpaper component of ADM
- CVE-2026-67245 A path traversal vulnerability was found in the VPN Clients on the ADM
- CVE-2026-67244 A format string vulnerability was found in the Notification OAuth settings of ADM
- CVE-2026-67243 File upload in freo2
- CVE-2026-67242 RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp
- CVE-2026-67241 RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check
- CVE-2026-67240 RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard
- CVE-2026-67239 RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI
- CVE-2026-67238 RabbitMQ: Atom-table exhaustion via reply-to queue name decoding
- CVE-2026-67237 RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint
- CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login
- CVE-2026-67235 RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size
- CVE-2026-67234 RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference
- CVE-2026-67233 RabbitMQ: Monitoring-tag user can DELETE shovels
- CVE-2026-67232 RabbitMQ: Web-MQTT decompression bomb
- CVE-2026-67231 RabbitMQ: Trust-store whitelist by Issuer+Serial only
- CVE-2026-67230 RabbitMQ: Web-STOMP unbounded pre-auth accumulation
- CVE-2026-6723 Missing authorization in Simply Schedule Appointments
- CVE-2026-67229 RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata
- CVE-2026-67228 RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component
- CVE-2026-67227 RabbitMQ: Atom exhaustion: to_atom on global-parameter :name
- CVE-2026-67226 RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list
- CVE-2026-67225 RabbitMQ: Stream-protocol frame length never validated against frame_max
- CVE-2026-67224 RabbitMQ: Admin path-traversal write via trace name
- CVE-2026-67223 RabbitMQ: LDAP DN injection via unescaped substitution
- CVE-2026-67222 RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client
- CVE-2026-67221 RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords
- CVE-2026-67220 RabbitMQ: JMS topic exchange erl_scan atom exhaustion
- CVE-2026-6722 Use-After-Free in SOAP using Apache map
- CVE-2026-67219 RabbitMQ: Consistent-hash exchange unbounded weight
- CVE-2026-67218 RabbitMQ: Super-stream HTTP creation skips configure-permission check
- CVE-2026-67217 cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation
- CVE-2026-67216 cJSON cJSON_Compare Exponential Complexity Denial of Service
- CVE-2026-67215 cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion
- CVE-2026-67214 nanoid Infinite Loop via Negative Size in non-secure module
- CVE-2026-67213 nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom
- CVE-2026-67211 Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer
- CVE-2026-6721 Multiple Vulnerabilities in IBM Concert Software
- CVE-2026-67208 Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console
- CVE-2026-67207 Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController
- CVE-2026-67206 Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload
- CVE-2026-67204 BookStack < 26.05.4 Broken Access Control via Image Gallery API
- CVE-2026-67201 V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http
- CVE-2026-67200 Perspective 5.0.0 Path Traversal via cwd_static_file_handler
- CVE-2026-6720 Calicoctl leaks cluster credentials to stderr when verbose logging is enabled
- CVE-2026-67199 Perspective 5.0.0 DoS via Loop Expression Evaluation
- CVE-2026-67198 Perspective 5.0.0 DoS via VirtualServer Protocol Dispatcher
- CVE-2026-67196 Perspective 5.0.0 XSS via Debug Plugin innerHTML Interpolation
- CVE-2026-67195 Perspective 5.0.0 RCE via eval() Expression Injection
- CVE-2026-67194 Courier IMAP < 6.0.1 Mail Server < 2.0.2 Stack Overflow DoS via Nested SEARCH Queries
- CVE-2026-67193 Xlight FTP Server < 3.9.5 Information Disclosure via USER Command
- CVE-2026-67192 Xlight FTP Server < 3.9.5 Pre-Auth Stack Buffer Overflow via SSH GCM Cipher
- CVE-2026-67191 Xlight FTP Server < 3.9.5 Pre-Auth Heap Buffer Overflow via SSH Parser
- CVE-2026-6719 IBM Concert Software Use of Insufficiently Random Values
- CVE-2026-67189 pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record
- CVE-2026-67187 Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields
- CVE-2026-67185 TinyWeb 0.0.8 Path Traversal via URL Path Component
- CVE-2026-67184 TinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTTP Request
- CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling
- CVE-2026-67182 Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection
- CVE-2026-67181 Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header
- CVE-2026-67180 Google Turbinia arbitrary command execution
- CVE-2026-6718 Multiple Vulnerabilities in IBM Concert Software
- CVE-2026-67179 Genkit improper host header validation
- CVE-2026-67178 Open Redirect in MISP Installer-Generated Apache Configuration
- CVE-2026-67174 DOM-Based Cross-Site Scripting via Unsafe String and SVG Icon Rendering in Pivotick
- CVE-2026-67173 Pivotick Unvalidated Node Image URLs Allow Unintended Client-Side Requests
- CVE-2026-67172 HCL BigFix Service Management is affected by multiple security vulnerabilities.
- CVE-2026-67171 HCL BigFix Service Management is affected by multiple security vulnerabilities.
- CVE-2026-67165 HCL Connections is vulnerable to cross-site scripting (XSS)
- CVE-2026-6713 Incorrect Authorization in GitLab
- CVE-2026-6712 Website LLMs.txt <= 8.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting
- CVE-2026-6711 Website LLMs.txt <= 8.2.6 - Reflected Cross-Site Scripting
- CVE-2026-67106 HCL BigFix Service Management is affected by multiple security vulnerabilities.
- CVE-2026-67105 HCL BigFix Service Management is affected by multiple security vulnerabilities.
- CVE-2026-67104 HCL BigFix Service Management is affected by multiple security vulnerabilities.
- CVE-2026-67103 HCL BigFix Service Management is affected by multiple security vulnerabilities.
- CVE-2026-67102 HCL BigFix Service Management is affected by multiple security vulnerabilities.
- CVE-2026-67101 HCL BigFix Service Management is affected by multiple security vulnerabilities.