Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 452 of 1013.
- CVE-2026-67100 HCL BigFix Service Management is affected by multiple security vulnerabilities.
- CVE-2026-6710 Skysa Text Ticker App <= 1.4 - Cross-Site Request Forgery to Settings Modification via 'Save Settings' Form
- CVE-2026-6709 Missing authorization in Coinbase Commerce for Contact Form 7
- CVE-2026-67080 HCL BigFix AEX is affected by multiple security vulnerabilities.
- CVE-2026-6708 Missing authorization in HEL Online Classroom: AI-powered Online Classrooms
- CVE-2026-67079 HCL BigFix AEX is affected by multiple security vulnerabilities.
- CVE-2026-67077 HCL BigFix AEX is affected by multiple security vulnerabilities.
- CVE-2026-67075 HCL Digital Experience is affected by improper input sanitation
- CVE-2026-67074 HCL BigFix AEX is affected by multiple security vulnerabilities.
- CVE-2026-67073 HCL BigFix AEX is affected by multiple security vulnerabilities.
- CVE-2026-67071 Information disclosure in HCL DevOps Deploy / HCL Launch
- CVE-2026-6706 Missing authorization in Server
- CVE-2026-6704 Blog Settings <= 1.0 - Reflected Cross-Site Scripting via 'page' Parameter
- CVE-2026-6703 Missing authorization in Responsive Blocks – Page Builder for Blocks & Patterns
- CVE-2026-6702 Publish 2 Ping.fm <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpPingPingKey' Parameter
- CVE-2026-6701 addfreespace <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page
- CVE-2026-6700 DX Sources <= 2.0.1 - Cross-Site Request Forgery to Settings Update
- CVE-2026-6696 Zingaya Click-to-Call <= 1.0 - Reflected Cross-Site Scripting via 'email' Parameter
- CVE-2026-6695 Gimp: gimp: remote code execution via crafted paa file
- CVE-2026-6694 Gimp: gimp file-png plugin: denial of service via oversized apng trns chunk
- CVE-2026-66922 Pivotick Prototype-Key Collision in Tree Layout and Cycle Detection Allows Graph Manipulation and Denial of Service
- CVE-2026-66921 Pivotick - Stored DOM-Based Cross-Site Scripting via Unescaped Markdown Node References
- CVE-2026-66920 Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data
- CVE-2026-6692 Slider Revolution 7.0.0 - 7.0.10 - Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url
- CVE-2026-66919 Stored DOM-Based Cross-Site Scripting in Node Modal Headers
- CVE-2026-66918 DOM-Based Cross-Site Scripting via Unsanitized SVG Node Icons
- CVE-2026-66917 Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0
- CVE-2026-66916 Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0
- CVE-2026-66915 Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.7.2
- CVE-2026-66914 Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1
- CVE-2026-66913 Zip Bomb in Lookyloo Capture Upload Allows Denial of Service
- CVE-2026-66912 Stored Cross-Site Scripting in Zimbra
- CVE-2026-66911 Stored Cross-Site Scripting in Zimbra
- CVE-2026-6691 MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow
- CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
- CVE-2026-66908 Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted
- CVE-2026-66907 Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result
- CVE-2026-66906 Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir
- CVE-2026-66902 Command injection in Google::Auth
- CVE-2026-66901 Server-side request forgery in Google::Auth
- CVE-2026-6690 LifePress <= 2.2.2 - Unauthenticated Stored Cross-Site Scripting via 'n' Parameter via lp_update_mds AJAX Action
- CVE-2026-66898 Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE
- CVE-2026-66897 Instance template path traversal allows arbitrary host file write as root
- CVE-2026-66890 Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups
- CVE-2026-6689 Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation
- CVE-2026-66887 Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups
- CVE-2026-66885 Livebook Teams identity callback lacks state binding, allowing login CSRF
- CVE-2026-66884 Cross-site request forgery in oidcc plug
- CVE-2026-66883 Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup
- CVE-2026-66882 Reflected XSS in AshAuthentication confirmation and magic link interaction forms
- CVE-2026-66881 Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download
- CVE-2026-6688 FatFs Buffer Overflow via Unbounded LFN Filename Copy
- CVE-2026-66878 Missing authorization in Red Hat Advanced Cluster Management for Kubernetes 2.11
- CVE-2026-66877 Gitea fork workflow approval bypass through concurrency cancellation
- CVE-2026-66875 Mira Hormone Monitor, Mira Android App Missing authentication for critical function
- CVE-2026-66874 Gitea required Actions check bypass through skipped workflows
- CVE-2026-6687 FatFs Stack Buffer Overflow via Uncapped exFAT Label Length
- CVE-2026-6686 FatFs Use of Uninitialized Clusters After Seek Past EOF
- CVE-2026-66859 Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route
- CVE-2026-66858 Denial of service in Apache Thrift
- CVE-2026-66853 Gitea restricted-user organization metadata disclosure
- CVE-2026-66849 Gitea restricted-user package visibility bypass
- CVE-2026-66843 html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding
- CVE-2026-66842 BIG-IP and BIG-IQ Configuration utility vulnerability
- CVE-2026-66840 Information disclosure in XING CPTrans-ME-X
- CVE-2026-6684 FatFs Infinite Loop in GPT Partition Scan
- CVE-2026-66839 Privilege escalation in NetKids iMark
- CVE-2026-66838 SQL injection via the :comment option in Postgrex.stream/4
- CVE-2026-66837 Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length
- CVE-2026-66835 httpd mod_auth directory protection bypassed by a doubled slash in the request path
- CVE-2026-66832 Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings
- CVE-2026-6683 FatFs Divide-by-Zero in exFAT Sync
- CVE-2026-66829 html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection
- CVE-2026-66825 Cross-Site Scripting via Unsafe URL Schemes in Pivotick Property Links
- CVE-2026-66824 Stored Cross-Site Scripting via Unsafe Capture Tree JSON Embedding
- CVE-2026-66822 .NET Information Disclosure Vulnerability
- CVE-2026-66820 SQL Server Elevation of Privilege Vulnerability
- CVE-2026-6682 FatFs Integer Overflow in FAT32 Volume Mount
- CVE-2026-66819 Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-66818 Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-66816 Microsoft SQL Server Security Feature Bypass Vulnerability
- CVE-2026-66814 Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-66810 Microsoft Office Word Information Disclosure Vulnerability
- CVE-2026-6681 PKCS#7 decode ignores caller output buffer size, writing past buffer bounds
- CVE-2026-66809 Microsoft Office Graphics Component Information Disclosure Vulnerability
- CVE-2026-66808 Microsoft SharePoint Server Remote Code Execution Vulnerability
- CVE-2026-66807 Microsoft Office Graphics Component Remote Code Execution Vulnerability
- CVE-2026-66806 Microsoft Office Word Information Disclosure Vulnerability
- CVE-2026-66805 Microsoft SharePoint Server Remote Code Execution Vulnerability
- CVE-2026-66804 Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability
- CVE-2026-66803 Azure Cosmos DB Remote Code Execution Vulnerability
- CVE-2026-66802 Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability
- CVE-2026-66800 Azure Data Factory Information Disclosure Vulnerability
- CVE-2026-66799 Windows Key Guard Elevation of Privilege Vulnerability
- CVE-2026-66798 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-66797 Apache CloudStack: Unauthorised comment creation and disclosure
- CVE-2026-66795 Auth bypass in multicluster engine for Kubernetes 2.10
- CVE-2026-66794 Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route
- CVE-2026-66793 Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2.11
- CVE-2026-66792 Privilege escalation in Multicluster Global Hub 1.4.9