Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 465 of 1013.
- CVE-2026-65086 Command injection in OpenShell
- CVE-2026-65085 Other in OpenShell
- CVE-2026-65084 Security feature bypass in NemoClaw
- CVE-2026-65083 Security feature bypass in OpenShell
- CVE-2026-65082 Code injection in NemoClaw
- CVE-2026-65081 Supply chain in NemoClaw
- CVE-2026-6508 RCE in TUBITAK BILGEM's Liderahenk
- CVE-2026-6507 Dnsmasq: dnsmasq: denial of service due to out-of-bounds write in dhcp bootreply processing
- CVE-2026-65069 Misconfiguration in Data::DisjointSet::Shared
- CVE-2026-65068 Misconfiguration in Data::SpatialHash::Shared
- CVE-2026-65067 Misconfiguration in Data::Intern::Shared
- CVE-2026-65066 Misconfiguration in Data::RingBuffer::Shared
- CVE-2026-65065 Misconfiguration in Data::RoaringBitmap::Shared
- CVE-2026-65064 Misconfiguration in Data::HashMap::Shared
- CVE-2026-65063 Misconfiguration in Data::RadixTree::Shared
- CVE-2026-65062 Misconfiguration in Data::SortedSet::Shared
- CVE-2026-65061 Misconfiguration in Data::ReqRep::Shared
- CVE-2026-6506 Missing authorization in InfusedWoo Pro
- CVE-2026-65058 Trezor Safe improper security check in on-device display
- CVE-2026-65057 Keep Unauthenticated Server-Side Request Forgery via POST /providers/healthcheck
- CVE-2026-65056 mcp-webresearch Server-Side Request Forgery in visit_page Due to Missing Internal-IP Filtering
- CVE-2026-65055 Taiga taiga-back Private Project Member Roster Disclosure via Unauthenticated filters_data Endpoints
- CVE-2026-65054 MediaCMS Private Media Metadata Disclosure via Playlist Ownership Loophole
- CVE-2026-65053 Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name
- CVE-2026-65052 Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields
- CVE-2026-65051 Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler
- CVE-2026-65050 Missing authorization in Ninja Forms
- CVE-2026-6505 Race condition in AXIS OS
- CVE-2026-65049 Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action
- CVE-2026-65048 Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index
- CVE-2026-6504 Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor
- CVE-2026-65017 Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)
- CVE-2026-65016 n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role
- CVE-2026-65015 n8n before 2.30.1 Privilege Escalation via run_node_tool
- CVE-2026-65014 n8n before 2.28.0 Authentication Bypass via test-webhook
- CVE-2026-65013 Onlook tRPC Insecure Direct Object Reference via multiple procedures
- CVE-2026-65012 InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder
- CVE-2026-65011 Graylog2 Server Missing Permission Check on Event Definition Duplicate
- CVE-2026-65010 Datasets Symlink-following Arbitrary File Write via Extractor.extract()
- CVE-2026-6501 jOpenDocument has an improper restriction of XML external entity reference vulnerability
- CVE-2026-65009 OpenRemote before 1.26.2 Information Disclosure via Syslog REST API
- CVE-2026-65008 Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData
- CVE-2026-65007 Grav before 1.0.8 Missing Authorization on API Key Generation
- CVE-2026-6500 Information disclosure in OpenConcerto
- CVE-2026-64993 Security feature bypass in RVTools
- CVE-2026-6499 Misconfiguration in OpenConcerto
- CVE-2026-6498 Business logic in Five Star Restaurant Reservations – WordPress Booking Plugin
- CVE-2026-64972 Reflected XSS in ATutor
- CVE-2026-64971 Reflected XSS in ATutor
- CVE-2026-64970 Stored XSS in ATutor
- CVE-2026-6497 prasathmani TinyFileManager File Upload filemanager.php server-side request forgery
- CVE-2026-64969 Insecure Direct Object Reference in ATutor
- CVE-2026-64968 Server-Side Request Forgery in ATutor
- CVE-2026-64967 Path Traversal in ATutor
- CVE-2026-64966 Path Traversal leading to Remote Code Execution in ATutor
- CVE-2026-64965 Missing Authorization Check in ATutor
- CVE-2026-64964 Generation of Predictable Email Confirmation Token in ATutor
- CVE-2026-64963 Path Traversal in ATutor
- CVE-2026-64962 Cross-Site Request Forgery (CSRF) in ATutor
- CVE-2026-64961 Authentication Bypass in ATutor
- CVE-2026-64960 Remote Code Execution via Unrestricted File Upload in ATutor
- CVE-2026-6496 prasathmani TinyFileManager POST Parameter filemanager.php path traversal
- CVE-2026-64959 Apache Kylin: Missing authentication on certain cache API endpoints
- CVE-2026-64958 Apache CXF: Denial of service via message header attachments
- CVE-2026-64955 Velociraptor CSV Formula Injection in Export Pipeline
- CVE-2026-64954 Velociraptor collect_client() Permissions Bypass
- CVE-2026-64952 Velociraptor Hunt Deletion With Insufficient Permission Check
- CVE-2026-64951 Velociraptor DoS triggered by Divide by Zero panic
- CVE-2026-64950 Stored Cross-Site Scripting via Directory Name in File Manager Create Directory
- CVE-2026-6495 Ajax Load More < 7.8.4 - Reflected XSS
- CVE-2026-64949 Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager
- CVE-2026-64948 Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure
- CVE-2026-64947 CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager
- CVE-2026-64946 CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager
- CVE-2026-64945 Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
- CVE-2026-64944 Apache Answer: Stored XSS via unsanitized HTML in imported question content
- CVE-2026-64943 Apache Answer: API keys logged in plaintext during authentication
- CVE-2026-64941 Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR
- CVE-2026-64940 Auth bypass in Tegalog -Fumy Otegaru Memo Logger-
- CVE-2026-6494 Aap-mcp-server: aap mcp server: log injection allows social engineering attacks via unsanitized input
- CVE-2026-64934 Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision
- CVE-2026-6493 lukevella rallly Reset Password reset-password-form.tsx cross site scripting
- CVE-2026-64927 Missing authorization in Red Hat Advanced Cluster Management for Kubernetes 2.11
- CVE-2026-64922 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-64921 Microsoft SharePoint Server Elevation of Privilege Vulnerability
- CVE-2026-64920 Microsoft Access Remote Code Execution Vulnerability
- CVE-2026-6492 arnobt78 Hotel Booking Management System Health Check Endpoint detailed information disclosure
- CVE-2026-64919 Microsoft Access Remote Code Execution Vulnerability
- CVE-2026-64918 Microsoft Office Spoofing Vulnerability
- CVE-2026-64917 Microsoft Office Word Information Disclosure Vulnerability
- CVE-2026-64916 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-64915 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-64914 Microsoft Access Remote Code Execution Vulnerability
- CVE-2026-64912 Microsoft Access Remote Code Execution Vulnerability
- CVE-2026-64911 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-64910 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-6491 libvips nip2 vips7compat.c im_minpos_vec heap-based overflow
- CVE-2026-64909 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-64908 Microsoft Access Remote Code Execution Vulnerability
- CVE-2026-64907 Microsoft Office Word Remote Code Execution Vulnerability