Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 478 of 1013.
- CVE-2026-63702 Hardcoded credentials in Wyse Management Suite (WMS)
- CVE-2026-63701 Deserialization in Wyse Management Suite (WMS)
- CVE-2026-63700 Privilege escalation in Wyse Management Suite (WMS)
- CVE-2026-6370 WordPress Mini Ajax Cart for WooCommerce plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-63697 Security feature bypass in System Update
- CVE-2026-63696 Supply chain in SmartFabric OS10 Software
- CVE-2026-63695 Auth bypass in SmartFabric OS10 Software
- CVE-2026-63694 Command injection in SmartFabric OS10
- CVE-2026-63693 Privilege escalation in AURORA R16
- CVE-2026-63692 Auth bypass in Container Storage Modules
- CVE-2026-63691 Missing authorization in Container Storage Modules
- CVE-2026-63690 Missing authorization in Container Storage Modules
- CVE-2026-6369 Exposed Session Token in canonical-livepatch client snap
- CVE-2026-63689 Information disclosure in Container Storage Modules
- CVE-2026-63688 Missing authorization in Dell Container Storage Modules (CSM)
- CVE-2026-63687 Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters
- CVE-2026-63686 Apache HTTP Server: mod_xml2enc crash on charset conversion failure
- CVE-2026-63685 Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension
- CVE-2026-63684 Cross-site request forgery in Content Templater extension for Joomla
- CVE-2026-63683 Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager
- CVE-2026-6368 wordexp with WRDE_APPEND can return or use invalid memory
- CVE-2026-63671 @nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
- CVE-2026-63670 ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
- CVE-2026-6367 Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
- CVE-2026-63669 ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
- CVE-2026-63667 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
- CVE-2026-6366 Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002
- CVE-2026-63654 Frappe: Unauthenticated Workflow approval via confirm_action
- CVE-2026-63652 FreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDU
- CVE-2026-63650 Auth bypass in OpenVPN
- CVE-2026-6365 Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
- CVE-2026-63649 Security feature bypass in OpenVPN
- CVE-2026-63647 CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`
- CVE-2026-63646 CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users
- CVE-2026-63645 OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials
- CVE-2026-63643 MagicMirror: ssrf calendar .js
- CVE-2026-63642 MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery
- CVE-2026-63641 MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions
- CVE-2026-63640 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables
- CVE-2026-6364 Memory corruption in Chrome
- CVE-2026-63639 Valkey: UAF in stream deserialization may lead to remote code execution
- CVE-2026-63638 OpenImageIO: Cineon invalid bit depth heap out-of-bounds write
- CVE-2026-63637 Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter
- CVE-2026-63635 OpenImageIO: PSD RawColor invalid color mode causes global out-of-bounds read and allocation DoS
- CVE-2026-63633 FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client
- CVE-2026-63632 ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape
- CVE-2026-63630 BentoPDF: Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests
- CVE-2026-6363 Memory corruption in Chrome
- CVE-2026-63628 mppx: Gas Draining with access list
- CVE-2026-63627 mppx: Gas Draining with padding
- CVE-2026-63626 Memory corruption in mongoose
- CVE-2026-63623 Libvirt: information disclosure via world-readable storage volume images during clone/convert
- CVE-2026-63622 Libvirt: swtpm privilege escalation via symlink following
- CVE-2026-63621 Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy
- CVE-2026-6362 Use after free in Chrome
- CVE-2026-63619 Apache Kylin: Missing authorization and path-confinement on system meta dump
- CVE-2026-63618 Apache Kylin: Low-Privilege Config Exposure
- CVE-2026-6361 Memory corruption in Chrome
- CVE-2026-6360 Use after free in Chrome
- CVE-2026-6359 Use after free in Chrome
- CVE-2026-63587 SMS Password Authorization Bypass via Failed Attempt Counter
- CVE-2026-63586 Unauthenticated Remote Code Execution via Shell Injection in Web Management Interface
- CVE-2026-6358 Use after free in Chrome
- CVE-2026-63578 Unbounded PBE iteration count when decrypting PKCS#8 private keys
- CVE-2026-63577 Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix
- CVE-2026-63576 URI name constraints checked against a mis-parsed host
- CVE-2026-63575 PKCS#12 key derivation loops about 2^32 times on a zero or negative iteration count
- CVE-2026-63574 Unbounded allocation from OpenPGP signature and user attribute subpacket lengths
- CVE-2026-63573 Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap
- CVE-2026-63572 Unbounded MAC and bag-decryption iteration counts when loading PKCS#12 files
- CVE-2026-63571 Attribute certificate path validation does not verify the attribute certificate's signature
- CVE-2026-63570 Pkcs12Store.GetCertificateChain loops forever on cyclic issuer links
- CVE-2026-6357 pip self-update functionality can import newly installed modules after wheel installation
- CVE-2026-63569 MTI/A0 DHAgreement does not validate the peer's ephemeral value
- CVE-2026-63568 Unbounded CMP/CRMF password-based MAC iteration count allows CPU exhaustion
- CVE-2026-63567 IesEngine block-cipher mode checks padding before MAC (CBC padding oracle)
- CVE-2026-63566 DTLS handshake reassembler allocates buffer from unchecked 24-bit length
- CVE-2026-63563 Misconfiguration in Sharp MFPs
- CVE-2026-6356 CVE-2026-6356
- CVE-2026-63559 o6 Automation open62541 Integer Overflow or Wraparound
- CVE-2026-63550 MZ Automation libiec61850 Out-of-bounds Read
- CVE-2026-6355 CVE-2026-6355
- CVE-2026-63545 Information disclosure in Sharp MFPs
- CVE-2026-63533 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-63532 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-63531 Microsoft Office Word Information Disclosure Vulnerability
- CVE-2026-63530 Microsoft Office Word Information Disclosure Vulnerability
- CVE-2026-63529 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-63528 Microsoft Office Word Information Disclosure Vulnerability
- CVE-2026-63527 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-63526 Microsoft Office Graphics Component Remote Code Execution Vulnerability
- CVE-2026-63525 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-63524 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-63523 Skype for Business Spoofing Vulnerability
- CVE-2026-63522 Azure SQL Database Elevation of Privilege Vulnerability
- CVE-2026-63521 Microsoft Office Word Information Disclosure Vulnerability
- CVE-2026-63520 Microsoft SharePoint Server Remote Code Execution Vulnerability
- CVE-2026-6352 Incorrect Authorization in GitLab
- CVE-2026-63519 Microsoft Office Graphics Component Remote Code Execution Vulnerability
- CVE-2026-63518 Microsoft Office Word Remote Code Execution Vulnerability