Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 459 of 1013.
- CVE-2026-65911 DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage
- CVE-2026-6591 ComfyUI LoadImage Node folder_paths.py folder_paths.get_annotated_filepath path traversal
- CVE-2026-65908 Code injection in PyCharm
- CVE-2026-65907 Code injection in TeamCity
- CVE-2026-65906 Code injection in TeamCity
- CVE-2026-65905 Apache Tomcat: Limited replay attack possible with DIGEST authentication
- CVE-2026-65904 DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode
- CVE-2026-65903 DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS
- CVE-2026-65902 DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags
- CVE-2026-65901 DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName
- CVE-2026-65900 DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM
- CVE-2026-6590 ComfyUI Model Preview Endpoint model_manager.py get_model_preview path traversal
- CVE-2026-65899 DOMPurify before 3.4.9 Trusted Types Policy State Contamination
- CVE-2026-65898 DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig
- CVE-2026-65897 Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups
- CVE-2026-65896 Grav API Plugin before 1.0.10 Path Traversal via move
- CVE-2026-65895 Grav API Plugin before 1.0.10 Broken Access Control
- CVE-2026-65894 Improper Authentication Vulnerability in CP PLUS EZ-P21 IP Camera
- CVE-2026-65893 Arbitrary Code Execution Vulnerability in CP PLUS EZ-P21 IP Camera
- CVE-2026-65891 Path traversal in Joomla Content Editor (JCE) extension for Joomla
- CVE-2026-65890 Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2
- CVE-2026-6589 ComfyUI server.py create_origin_only_middleware cross-site request forgery
- CVE-2026-65889 Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2
- CVE-2026-65888 Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2
- CVE-2026-65887 Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2
- CVE-2026-65886 Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2
- CVE-2026-65885 Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2
- CVE-2026-65884 Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2
- CVE-2026-65883 Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0
- CVE-2026-65882 Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1
- CVE-2026-65881 Misconfiguration in Joomdle component for Joomla
- CVE-2026-65880 Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3
- CVE-2026-6588 serge-chat serge Model API Endpoint model.py delete_model missing authentication
- CVE-2026-65879 Hardcoded credentials in SP Page Builder extension for Joomla
- CVE-2026-65878 Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1
- CVE-2026-65877 Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1
- CVE-2026-65876 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0
- CVE-2026-65875 Code injection in BaserCMS
- CVE-2026-6587 vibrantlabsai RAGAS Collections util.py _try_process_url server-side request forgery
- CVE-2026-6586 TransformerOptimus SuperAGI Budget Endpoint budget.py update_budget authorization
- CVE-2026-6585 TransformerOptimus SuperAGI Organisation Update Endpoint organisation.py update_organisation authorization
- CVE-2026-65842 Plate: SSRF with response disclosure in DOCX image embedding
- CVE-2026-65841 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
- CVE-2026-6584 TransformerOptimus SuperAGI User Update Endpoint user.py update_user authorization
- CVE-2026-65838 Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies
- CVE-2026-65835 Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)
- CVE-2026-65834 Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests
- CVE-2026-65832 Memory corruption in deskflow
- CVE-2026-65831 ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read
- CVE-2026-6583 TransformerOptimus SuperAGI API Key Management Endpoint api_key.py edit_api_key authorization
- CVE-2026-65829 MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
- CVE-2026-65828 Zammad: Pending upload deletion bypass via legacy attachment endpoint
- CVE-2026-65827 Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service
- CVE-2026-65825 OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants
- CVE-2026-65824 Auth bypass in appointment-booking-software
- CVE-2026-65822 ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter
- CVE-2026-6582 Auth bypass in SuperAGI
- CVE-2026-65819 Denial of service in gopacket
- CVE-2026-65818 Power Automate Elevation of Privilege Vulnerability
- CVE-2026-65816 Azure Arc Elevation of Privilege Vulnerability
- CVE-2026-65815 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
- CVE-2026-65814 Microsoft Windows Storage Port Driver Elevation of Privilege Vulnerability
- CVE-2026-65813 Microsoft Exchange Server Elevation of Privilege Vulnerability
- CVE-2026-65812 Microsoft Teams for Android Information Disclosure Vulnerability
- CVE-2026-65811 Power BI Remote Code Execution Vulnerability
- CVE-2026-65810 .NET Framework Elevation of Privilege Vulnerability
- CVE-2026-6581 H3C Magic B1 aspForm SetMobileAPInfoById buffer overflow
- CVE-2026-65807 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-65806 Azure CycleCloud Information Disclosure Vulnerability
- CVE-2026-65804 Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2026-65802 Microsoft Edge for Android Information Disclosure Vulnerability
- CVE-2026-65801 Microsoft Exchange Online Elevation of Privilege Vulnerability
- CVE-2026-6580 liangliangyy DjangoBlog Amap API Call views.py hard-coded key
- CVE-2026-65799 Windows DNS Elevation of Privilege Vulnerability
- CVE-2026-65798 Windows DNS Elevation of Privilege Vulnerability
- CVE-2026-65797 Windows DNS Elevation of Privilege Vulnerability
- CVE-2026-65796 Windows iSCSI Target Service Remote Code Execution Vulnerability
- CVE-2026-65795 Windows DNS Elevation of Privilege Vulnerability
- CVE-2026-65794 Windows SMB Client Information Disclosure Vulnerability
- CVE-2026-65791 Windows iSCSI Target Service Remote Code Execution Vulnerability
- CVE-2026-65790 Windows Message Queuing Elevation of Privilege Vulnerability
- CVE-2026-6579 liangliangyy DjangoBlog Clean Endpoint views.py missing authentication
- CVE-2026-65789 Windows DNS Server Remote Code Execution Vulnerability
- CVE-2026-65788 Desktop Window Manager Elevation of Privilege Vulnerability
- CVE-2026-65787 Desktop Window Manager Elevation of Privilege Vulnerability
- CVE-2026-65786 Desktop Window Manager Elevation of Privilege Vulnerability
- CVE-2026-65785 Windows DHCP Client Denial of Service Vulnerability
- CVE-2026-65784 Windows NTFS Information Disclosure Vulnerability
- CVE-2026-65783 Windows Autopilot Elevation of Privilege Vulnerability
- CVE-2026-65782 Windows Autopilot Elevation of Privilege Vulnerability
- CVE-2026-65781 Windows Autopilot Elevation of Privilege Vulnerability
- CVE-2026-65780 Windows Autopilot Elevation of Privilege Vulnerability
- CVE-2026-6578 liangliangyy DjangoBlog Setting settings.py hard-coded credentials
- CVE-2026-65779 Windows Autopilot Elevation of Privilege Vulnerability
- CVE-2026-65778 Windows Autopilot Elevation of Privilege Vulnerability
- CVE-2026-65777 Active Directory Security Feature Bypass Vulnerability
- CVE-2026-65776 Windows Win32k Elevation of Privilege Vulnerability
- CVE-2026-65775 Windows Win32k Elevation of Privilege Vulnerability
- CVE-2026-65774 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-65773 Windows Kernel Elevation of Privilege Vulnerability