Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 464 of 1013.
- CVE-2026-6532 Buffer Over-read in Wireshark
- CVE-2026-65319 Feedbin Unauthenticated Entry Content Disclosure via GET /api/v2/entries/:id/text
- CVE-2026-65318 Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader
- CVE-2026-65317 Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass
- CVE-2026-65316 xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat
- CVE-2026-65315 Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser
- CVE-2026-65314 Electric Postgres Sync Excluded-Column Value Inference via Subset Where Clauses
- CVE-2026-65313 Use of hard-coded VNC credentials in the engineering-workstation provisioning
- CVE-2026-65311 Missing authentication for logging-configuration endpoint
- CVE-2026-65310 Missing authentication and permissive CORS policy
- CVE-2026-6531 Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
- CVE-2026-65309 Storage of passwords in a reversible format
- CVE-2026-6530 Heap-based Buffer Overflow in Wireshark
- CVE-2026-6529 Heap-based Buffer Overflow in Wireshark
- CVE-2026-6528 Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
- CVE-2026-6527 Uncontrolled Recursion in Wireshark
- CVE-2026-6526 NULL Pointer Dereference in Wireshark
- CVE-2026-6525 NULL Pointer Dereference in Wireshark
- CVE-2026-6524 Access of Uninitialized Pointer in Wireshark
- CVE-2026-6523 Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
- CVE-2026-65220 Supermicro BMC IPMI feature contains a Privilege escalation vulnerability
- CVE-2026-6522 Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
- CVE-2026-65219 Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability
- CVE-2026-65213 Supermicro BMC IPMI feature contains a Arbitrary Command Execution with Superuser Privileges vulnerability
- CVE-2026-65211 Supermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerability
- CVE-2026-65210 Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability
- CVE-2026-6521 Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
- CVE-2026-65200 Huawei malicious on-bus PLDM or NCSI device can drive out-of-bounds-heap reads via short MCTP responses
- CVE-2026-6520 Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
- CVE-2026-65199 Huawei openUBMC low-privilege SNMP to administrator privilege escalation
- CVE-2026-65198 Huawei Default SNMPv3 USM key
- CVE-2026-65197 H3C G3/G5 HDM Firmware Verification Key Replacement
- CVE-2026-6519 Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
- CVE-2026-65184 Avocent ACS8000 wsserver command injection
- CVE-2026-65183 Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets
- CVE-2026-65182 Apache Tomcat: Bypass longest prefix security constraint
- CVE-2026-65181 Apache Impala: RCE via External Data Source Class Loading
- CVE-2026-65180 Deserialization in Megatron-LM
- CVE-2026-6518 File upload in CMP – Coming Soon & Maintenance Plugin by NiteoThemes
- CVE-2026-65179 Deserialization in NeMo Speech
- CVE-2026-65178 Deserialization in NeMo Speech
- CVE-2026-65173 Missing authorization in AIStore framework
- CVE-2026-65172 Missing authorization in AIStore framework
- CVE-2026-65170 Server-side request forgery in AIStore framework
- CVE-2026-6517 Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed
- CVE-2026-65164 Path traversal in AIStore framework
- CVE-2026-65162 Privilege escalation in AIStore framework
- CVE-2026-65161 Path traversal in AIStore framework
- CVE-2026-6516 Remote Code Execution
- CVE-2026-65151 SQL injection in NeMo Agent Toolkit
- CVE-2026-65150 Memory corruption in DALI
- CVE-2026-6515 Insufficient Session Expiration in GitLab
- CVE-2026-65149 Memory corruption in DALI
- CVE-2026-65148 Memory corruption in DALI
- CVE-2026-65147 Memory corruption in DALI
- CVE-2026-65145 Auth bypass in NeMo Agent Toolkit
- CVE-2026-65142 Deserialization in Model-Optimizer
- CVE-2026-65141 Code injection in Isaac Lab
- CVE-2026-6514 InfusedWoo Pro <= 5.1.2 - Unauthenticated Arbitrary File Read via 'url' Parameter
- CVE-2026-65131 Missing authorization in NVSentinel
- CVE-2026-65130 Command injection in Infrastructure Controller
- CVE-2026-65129 Security feature bypass in Infrastructure Controller
- CVE-2026-65128 SQL injection in Infrastructure Controller
- CVE-2026-65127 Information disclosure in Infrastructure Controller
- CVE-2026-65126 Business logic in Infrastructure Controller
- CVE-2026-65125 Path traversal in Infrastructure Controller
- CVE-2026-65124 Code injection in Infrastructure Controller
- CVE-2026-65122 Memory corruption in TensorRT
- CVE-2026-65121 Auth bypass in Infrastructure Controller
- CVE-2026-65120 Server-side request forgery in TensorRT-LLM
- CVE-2026-6512 InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Arbitrary Post Deletion via Multiple Parameters
- CVE-2026-65119 Code injection in TensorRT-LLM
- CVE-2026-65118 Security feature bypass in Infrastructure Controller
- CVE-2026-65117 Hardcoded credentials in Infrastructure Controller
- CVE-2026-65115 Denial of service in Infrastructure Controller
- CVE-2026-65114 Auth bypass in Infrastructure Controller
- CVE-2026-65113 Hardcoded credentials in Infrastructure Controller
- CVE-2026-65112 Denial of service in Infrastructure Controller
- CVE-2026-65111 Code injection in NeMo Speech
- CVE-2026-65110 Deserialization in Megatron-LM
- CVE-2026-6511 Missing authorization in Smart Connect
- CVE-2026-65105 Missing authorization in NemoClaw
- CVE-2026-65104 Weak cryptography in Megatron-LM
- CVE-2026-65103 Path traversal in AIStore framework
- CVE-2026-65102 Integer overflow in DeepStream
- CVE-2026-65101 Server-side request forgery in AIStore framework
- CVE-2026-65100 Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode
- CVE-2026-6510 InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Privilege Escalation via 'iwar_save_recipe'
- CVE-2026-65099 Command injection in NemoClaw
- CVE-2026-65098 Auth bypass in NemoClaw
- CVE-2026-65097 Supply chain in NemoClaw
- CVE-2026-65096 Command injection in NemoClaw
- CVE-2026-65093 Security feature bypass in OpenShell
- CVE-2026-65092 Path traversal in OpenShell
- CVE-2026-65091 Command injection in OpenShell
- CVE-2026-65090 Command injection in NemoClaw
- CVE-2026-6509 Privilege Escalation in TUBITAK BILGEM's Pardus Update
- CVE-2026-65089 Command injection in NemoClaw
- CVE-2026-65088 Information disclosure in NemoClaw
- CVE-2026-65087 Information disclosure in NemoClaw