Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 466 of 1013.
- CVE-2026-64906 Microsoft Access Remote Code Execution Vulnerability
- CVE-2026-64905 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-64904 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-64903 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-64902 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-64901 Microsoft SharePoint Server Remote Code Execution Vulnerability
- CVE-2026-64900 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-6490 QueryMine sms GET Request Parameter deletecourse.php sql injection
- CVE-2026-64899 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-64898 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-64897 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-64896 T2000 open debug port
- CVE-2026-64893 Information disclosure in EasyIO NEO
- CVE-2026-64892 Information disclosure in Easy IO Neo
- CVE-2026-6489 QueryMine sms Background Management addteacher.php unrestricted upload
- CVE-2026-64887 Airwall - Hardcoded Secrets
- CVE-2026-64881 Command Injection
- CVE-2026-64880 Blind SQL Injection
- CVE-2026-6488 QueryMine sms GET Request Parameter editcourse.php sql injection
- CVE-2026-64879 Command Injection
- CVE-2026-64878 Command Injection
- CVE-2026-64877 SQL injection in Security Center
- CVE-2026-64876 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension
- CVE-2026-64875 Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension
- CVE-2026-64874 Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension
- CVE-2026-64873 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension
- CVE-2026-64872 Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension
- CVE-2026-64871 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension
- CVE-2026-64870 MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation
- CVE-2026-6487 Qihui jtbc5 CMS Code Endpoint manage.php path traversal
- CVE-2026-64868 New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging
- CVE-2026-64866 New API: Admin can reset passkeys for same-level or higher-privileged users
- CVE-2026-64865 New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass
- CVE-2026-64863 goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite
- CVE-2026-64862 Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS
- CVE-2026-6486 classroombookings User Display Name layout.php read cross site scripting
- CVE-2026-64859 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation
- CVE-2026-64857 tirreno has Session Fixation in Login Authentication
- CVE-2026-64856 FileRise: Missing Authentication Guard on File Snippet Preview Endpoint
- CVE-2026-64852 Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account
- CVE-2026-64851 Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers
- CVE-2026-64850 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
- CVE-2026-6485 UEFI BIOS embedded Shell can be used to bypass Secure Boot
- CVE-2026-64849 MLflow Server-Side Request Forgery
- CVE-2026-64847 AnyIO process-pool workers can block indefinitely on undrained stderr
- CVE-2026-64846 Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature
- CVE-2026-6484 Lack of verified boot to certain FV may cause arbitrary code execution
- CVE-2026-64838 ICEcoder through 8.1 Path Traversal via oldFileName Parameter
- CVE-2026-64837 ICEcoder through 8.1 OS Command Injection via lib/properties.php
- CVE-2026-64836 ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement
- CVE-2026-64835 FFmpeg 4.4 - 8.1.2 Out-of-Bounds Memory Access in ADX Audio Decoder
- CVE-2026-64834 FFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF Demuxer
- CVE-2026-64833 FFmpeg 0.7.1 - 8.1.2 Out-of-Bounds Read via S/PDIF Muxer spdifenc.c
- CVE-2026-64832 FFmpeg 4.4 - 8.1.2 Double-Free in NVDEC Hardware Decoder via nvdec.c
- CVE-2026-64831 FFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC Decoder
- CVE-2026-64830 FFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle Demuxer
- CVE-2026-6483 Wavlink WL-WN530H4 internet.cgi snprintf os command injection
- CVE-2026-64829 Question2Answer 1.8.8 Session Fixation via Forgot-Password Flow
- CVE-2026-64828 Froiden TableTrack 1.3.10 Stored XSS via Order Notes Field
- CVE-2026-64827 Telenia TVox 26.5.3 Authentication Bypass via set_env.php
- CVE-2026-64826 rConfig < 8.2.13 Path Traversal File Read via FileDownloadController
- CVE-2026-64825 Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload
- CVE-2026-64824 Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore
- CVE-2026-64823 Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI
- CVE-2026-64822 djangoSIGE 1.10 User Enumeration via ForgotPasswordView
- CVE-2026-64821 djangoSIGE 1.10 CSRF via GET-based Order Cancellation Views
- CVE-2026-6482 Local Privilege Escalation via OpenSSL configuration file in Insight Agent
- CVE-2026-64816 RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath
- CVE-2026-64815 Code injection in IntelliJ IDEA
- CVE-2026-64814 Missing authorization in IntelliJ IDEA
- CVE-2026-64813 Security feature bypass in IntelliJ IDEA
- CVE-2026-64812 Auth bypass in IntelliJ IDEA
- CVE-2026-64811 Code injection in IntelliJ IDEA
- CVE-2026-64810 Cross-site scripting in IntelliJ IDEA
- CVE-2026-64809 Code injection in PhpStorm
- CVE-2026-64808 Code injection in PhpStorm
- CVE-2026-64807 Code injection in WebStorm
- CVE-2026-64806 Code injection in WebStorm
- CVE-2026-64805 Code injection in WebStorm
- CVE-2026-64804 Code injection in WebStorm
- CVE-2026-64803 Code injection in GoLand
- CVE-2026-64802 Code injection in GoLand
- CVE-2026-64800 Information disclosure in GoLand
- CVE-2026-64799 Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions
- CVE-2026-64798 Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension
- CVE-2026-64797 Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension
- CVE-2026-64796 Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension
- CVE-2026-64795 Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions
- CVE-2026-64794 Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions
- CVE-2026-64793 Missing authorization in Articles Anywhere extension for Joomla
- CVE-2026-64792 Information disclosure in Articles Anywhere extension for Joomla
- CVE-2026-64791 Missing authorization in Regular Labs Extension Manager extension for Joomla
- CVE-2026-64790 Path traversal in macOS
- CVE-2026-6479 PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion
- CVE-2026-64789 Security feature bypass in macOS
- CVE-2026-64788 Memory corruption in iOS and iPadOS
- CVE-2026-64787 Use after free in Safari
- CVE-2026-64785 swift-nio-http2: Missing CR/LF/NUL validation in header values
- CVE-2026-64784 Memory corruption in Safari
- CVE-2026-64783 Use after free in Safari