Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 460 of 1013.
- CVE-2026-65772 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
- CVE-2026-65770 Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability
- CVE-2026-6577 liangliangyy DjangoBlog logtracks Endpoint views.py missing authentication
- CVE-2026-65769 Microsoft Teams iOS Information Disclosure Vulnerability
- CVE-2026-65768 Microsoft Teams Remote Code Execution Vulnerability
- CVE-2026-65767 Microsoft Teams for Android Spoofing Vulnerability
- CVE-2026-65766 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1
- CVE-2026-65765 Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.1
- CVE-2026-65764 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.1.1
- CVE-2026-65763 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4
- CVE-2026-65762 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0
- CVE-2026-65761 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1
- CVE-2026-65760 Missing authorization in Easy Store extension for Joomla
- CVE-2026-6576 liangliangyy DjangoBlog WeChat Bot commonapi.py CommandHandler command injection
- CVE-2026-65759 Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1
- CVE-2026-65758 Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2
- CVE-2026-65757 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension
- CVE-2026-65756 Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension
- CVE-2026-65755 Information disclosure in Articles Anywhere extension for Joomla
- CVE-2026-65754 Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension
- CVE-2026-6575 PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array
- CVE-2026-6574 osuuu LightPicture API Upload Endpoint lp.sql hard-coded credentials
- CVE-2026-6573 PHPEMS Instant Exam Creation exams.master.php temppage server-side request forgery
- CVE-2026-6572 Collabora KodExplorer fileUpload Endpoint share.class.php improper authorization
- CVE-2026-65713 Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension
- CVE-2026-65712 Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension
- CVE-2026-65711 sysPass 3.2.11 Authenticated OS Command Injection via Backup Path
- CVE-2026-65710 sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption
- CVE-2026-6571 kodcloud KodExplorer systemRole.class.php roleGroupAction authorization
- CVE-2026-65709 sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API
- CVE-2026-65708 sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController
- CVE-2026-65707 Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint
- CVE-2026-65706 FFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame Processing
- CVE-2026-65705 FFmpeg 3.4 - 8.1.2 vf_floodfill Out-of-Bounds Write via filter_frame()
- CVE-2026-65704 FFmpeg 8.1.2 Out-of-Bounds Write via TY Demuxer and Shorten Decoder
- CVE-2026-65703 FFmpeg 2.7 - 8.1.2 Out-of-Bounds Write in TDSC Video Decoder
- CVE-2026-65702 Vanna 2.0.2 Path Traversal via FileSystemConversationStore
- CVE-2026-65701 SoftVC VITS Singing Voice Conversion Path Traversal via /wav2wav Flask Route
- CVE-2026-65700 h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API
- CVE-2026-6570 kodcloud KodExplorer systemMember.class.php initInstall authorization
- CVE-2026-65699 AgentGPT 1.0.0 Authorization Bypass via Agent Task Creation
- CVE-2026-65698 Void 1.3.4 Path Traversal via AI Agent File-Reading Tools
- CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint
- CVE-2026-65696 Overseerr 1.35.0 Authorization Bypass via pushSubscriptions API
- CVE-2026-65695 Office-Word-MCP-Server 1.1.11 Path Traversal via document tools
- CVE-2026-65694 Microweber CMS 2.0.20 Path Traversal via ServeStaticFileController
- CVE-2026-65693 Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates
- CVE-2026-65690 Bold Reports Standalone Report Designer < 14.1.12 Path Traversal RCE via File Upload
- CVE-2026-6569 kodcloud KodExplorer fileGet Endpoint share.class.php improper authentication
- CVE-2026-65689 Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database Download
- CVE-2026-65688 Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Font Processing
- CVE-2026-65687 Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via SVG Processing
- CVE-2026-65681 Windows iSCSI Target Service Denial of Service Vulnerability
- CVE-2026-65680 Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability
- CVE-2026-6568 kodcloud KodExplorer Public Share share.class.php initShareOld path traversal
- CVE-2026-65679 Windows iSCSI Target Service Remote Code Execution Vulnerability
- CVE-2026-65678 Windows Win32k Elevation of Privilege Vulnerability
- CVE-2026-65675 CoPilot Chat Security Feature Bypass Vulnerability
- CVE-2026-65674 Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-65673 Microsoft Entra Connect Elevation of Privilege Vulnerability
- CVE-2026-65672 Remote Access API Elevation of Privilege Vulnerability
- CVE-2026-65671 Remote Access API Elevation of Privilege Vulnerability
- CVE-2026-6567 Incorrect Authorization in GitLab
- CVE-2026-65669 Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-65668 Microsoft Purview eDiscovery Elevation of Privilege Vulnerability
- CVE-2026-65667 Microsoft Teams Elevation of Privilege Vulnerability
- CVE-2026-65665 Microsoft SharePoint Server Remote Code Execution Vulnerability
- CVE-2026-65664 Microsoft Office Graphics Component Remote Code Execution Vulnerability
- CVE-2026-65663 Microsoft SharePoint Server Remote Code Execution Vulnerability
- CVE-2026-65662 Windows GDI Information Disclosure Vulnerability
- CVE-2026-65661 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-65660 Microsoft SharePoint Code Injection
- CVE-2026-6566 Missing authorization in Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
- CVE-2026-65658 Microsoft SharePoint Server Remote Code Execution Vulnerability
- CVE-2026-65657 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-65656 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-65655 Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy
- CVE-2026-65654 temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip
- CVE-2026-65653 temporalio/tchannel-go zero-chunk call fragment causes process termination
- CVE-2026-65652 temporalio/tchannel-go malformed checksum type causes process termination
- CVE-2026-65651 temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal
- CVE-2026-65650 Denial of service in Elgg
- CVE-2026-6565 Cross-site scripting in Style Kits for Elementor
- CVE-2026-65647 Path traversal in Plesk Migrator
- CVE-2026-65646 Code injection in Plesk
- CVE-2026-65645 Missing authorization in Rocket.Chat
- CVE-2026-65644 Cross-site scripting in Rocket.Chat
- CVE-2026-65643 Code injection in cPanel
- CVE-2026-65642 Missing authorization in Plesk
- CVE-2026-65641 Auth bypass in One
- CVE-2026-65640 File upload in WordPress
- CVE-2026-6564 EMQ EMQX Enterprise Session Handling improper authorization
- CVE-2026-65639 Command injection in ConfigServer Security & Firewall
- CVE-2026-65638 Command injection in ConfigServer Security & Firewall
- CVE-2026-65637 Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete
- CVE-2026-65636 YAML injection via unescaped newlines in ymlr document comments
- CVE-2026-65635 Boruta dynamic client registration allows creation of over-privileged OAuth clients
- CVE-2026-65634 Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder
- CVE-2026-65633 Purpose-limited JWT accepted as full bearer authentication in AshAuthentication
- CVE-2026-65632 ECDSA signature length is not validated in jose, allowing signature malleability