Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 457 of 1013.
- CVE-2026-66282 Authenticated Denial-of-Service in Zigbee Publish Billing Period
- CVE-2026-66281 Authenticated Denial-of-Service in Zigbee Discover Attributes Handling
- CVE-2026-6628 phili67 Ecclesia CRM Query Viewer view ValidateInput sql injection
- CVE-2026-66279 Dis-connect vulnerability in Connect Stack
- CVE-2026-66277 Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery
- CVE-2026-66276 Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial of service
- CVE-2026-66275 Apache Qpid Proton-J: Incoming session flow control window can be exceeded
- CVE-2026-66274 Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow
- CVE-2026-66273 Apache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authentication
- CVE-2026-66272 Missing authorization in Wyse Management Suite (WMS)
- CVE-2026-66271 File upload in Wyse Management Suite (WMS)
- CVE-2026-66270 File upload in Wyse Management Suite (WMS)
- CVE-2026-6627 WPFormify <= 1.1.1 - Missing Authorization
- CVE-2026-66269 Security feature bypass in Dell OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-6626 Cockpit-HQ Cockpit Asset Handler/Aggregate data query logic injection
- CVE-2026-66257 Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
- CVE-2026-66256 Deserialization in Apache Shindig Common
- CVE-2026-66253 HCL iControl is affected by a Session Timeout vulnerability
- CVE-2026-6625 Server-side request forgery in Mogu Blog v2
- CVE-2026-66249 HCL iControl is affected by a Missing Secure Attribute vulnerability
- CVE-2026-66248 HCL iControl is affected by an Improper Error Handling vulnerability
- CVE-2026-66247 Misconfiguration in iControl
- CVE-2026-66246 HCL iControl is affected by multiple security vulnerabilities
- CVE-2026-6624 BichitroGan ISP Billing Software Pool List add cross site scripting
- CVE-2026-6623 BichitroGan ISP Billing Software Profile users-view cross site scripting
- CVE-2026-6622 BichitroGan ISP Billing Software Customer edit cross site scripting
- CVE-2026-6621 1024bit extend-deep index.js prototype pollution
- CVE-2026-6620 SonicCloudOrg sonic-server File Upload Endpoint FileTool.java upload path traversal
- CVE-2026-6619 langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting
- CVE-2026-6618 langgenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request forgery
- CVE-2026-6617 Server-side request forgery in dify
- CVE-2026-6616 TransformerOptimus SuperAGI WebScraperTool webpage_extractor.py extract_with_lxml server-side request forgery
- CVE-2026-66155 Cross-site scripting in Element maps-ng V47
- CVE-2026-66154 Security feature bypass in GMS
- CVE-2026-66153 Path traversal in NetExtender
- CVE-2026-66152 Path traversal in NetExtender
- CVE-2026-66151 Memory corruption in Global VPN Client
- CVE-2026-66150 Code injection in Email Security
- CVE-2026-6615 TransformerOptimus SuperAGI Multipart Upload resources.py upload path traversal
- CVE-2026-66149 Command injection in Email Security
- CVE-2026-66148 Command injection in GMS
- CVE-2026-66147 Command injection in GMS
- CVE-2026-66146 Cross-site scripting in GMS
- CVE-2026-66145 Path traversal in GMS
- CVE-2026-66144 Apache Neethi: Remote PolicyReference fetch lacks resource bounds
- CVE-2026-66143 Apache Neethi: Missing global alternative-output budget across policy computation paths
- CVE-2026-66142 Apache Neethi: Uncontrolled recursion in policy processing
- CVE-2026-66141 Privilege escalation in Exim
- CVE-2026-66140 Path traversal in Exim
- CVE-2026-6614 TransformerOptimus SuperAGI project.py get_projects_organisation authorization
- CVE-2026-66139 Auth bypass in Zaqar
- CVE-2026-66138 Command injection in Ironic Python Agent
- CVE-2026-6613 TransformerOptimus SuperAGI agent.py get_schedule_data authorization
- CVE-2026-6612 TransformerOptimus SuperAGI Agent Execution Endpoint agent_execution.py update_agent_execution authorization
- CVE-2026-6611 liangliangyy DjangoBlog File Upload Endpoint settings.py hard-coded key
- CVE-2026-66109 Missing authorization in SKYMEC IT Manager
- CVE-2026-6610 liangliangyy DjangoBlog Setting settings.py hard-coded credentials
- CVE-2026-66098 Mira Hormone Monitor, Mira Android App Missing authentication for critical function
- CVE-2026-66092 Stored XSS in pre-login notice via reachable legacy logon route
- CVE-2026-66091 Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details
- CVE-2026-66090 XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read
- CVE-2026-6609 liangliangyy DjangoBlog views.py form_valid improper authorization
- CVE-2026-66089 XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion
- CVE-2026-66088 Unrestricted Command Execution via system.execute
- CVE-2026-66087 Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint
- CVE-2026-66086 Stack-based Buffer Overflow in Modem
- CVE-2026-66085 Information Disclosure in Modem
- CVE-2026-66084 Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint
- CVE-2026-66083 Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource
- CVE-2026-66082 Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）
- CVE-2026-66081 Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages
- CVE-2026-66080 RabbitMQ: Super-stream partitions unbounded allocation
- CVE-2026-6608 lm-sys fastchat Arena Side-by-Side View add_text control flow
- CVE-2026-66079 RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS
- CVE-2026-66078 RabbitMQ: protected tag bypass via bulk-delete
- CVE-2026-66077 RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI
- CVE-2026-66076 RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure
- CVE-2026-66075 RabbitMQ: Monitoring-tag user can restart federation links
- CVE-2026-66074 RabbitMQ: ReDoS via management API ?name= filter
- CVE-2026-66073 RabbitMQ: Atom table exhaustion via management API node field
- CVE-2026-66072 RabbitMQ: Atom table exhaustion via stream `chunk_selector`
- CVE-2026-66071 RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values
- CVE-2026-66070 RabbitMQ: CORS * reflects Origin with Allow-Credentials
- CVE-2026-6607 lm-sys fastchat Worker API Endpoint api_generate resource consumption
- CVE-2026-66069 RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics
- CVE-2026-66068 RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs
- CVE-2026-66067 RabbitMQ: Stream protocol skips per vhost per user connection limits
- CVE-2026-66066 Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
- CVE-2026-66065 ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys
- CVE-2026-66064 goshs has ACL Bypass & Path Traversal
- CVE-2026-66063 goshs has a Path Traversal issue
- CVE-2026-66062 SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header
- CVE-2026-66061 Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution
- CVE-2026-66060 Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers
- CVE-2026-6606 modelscope agentscope _agent_base.py _process_audio_block server-side request forgery
- CVE-2026-66059 Frappe: Field-level permission bypass via Document Follow
- CVE-2026-66058 Frappe: Unrestricted access to a Document Follow API
- CVE-2026-66057 Frappe: Open Redirect via Unsanitized OAuth State Param.
- CVE-2026-66055 Denial of service in Apache Thrift
- CVE-2026-66054 Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize