Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 508 of 1013.
- CVE-2026-60162 Privilege escalation in Oracle VM VirtualBox
- CVE-2026-60161 Race condition in Oracle VM VirtualBox
- CVE-2026-60160 Information disclosure in Oracle VM VirtualBox
- CVE-2026-6016 Tenda AC9 POST Request WizardHandle decodePwd stack-based overflow
- CVE-2026-60159 Other in Oracle VM VirtualBox
- CVE-2026-60158 Other in Oracle VM VirtualBox
- CVE-2026-60157 Missing authorization in Oracle GoldenGate
- CVE-2026-60156 Information disclosure in Oracle APEX
- CVE-2026-60155 Other in Oracle VM VirtualBox
- CVE-2026-60154 Missing authorization in Oracle Application Object Library
- CVE-2026-60153 Auth bypass in Oracle WebLogic Server
- CVE-2026-60152 Missing authorization in PeopleSoft Enterprise PeopleTools
- CVE-2026-60150 Privilege escalation in Oracle VM VirtualBox
- CVE-2026-6015 Tenda AC9 POST Request QuickIndex formQuickIndex stack-based overflow
- CVE-2026-60149 Other in Oracle Workflow
- CVE-2026-60147 Other in Oracle GraalVM Enterprise Edition
- CVE-2026-60146 Missing authorization in Oracle Access Manager
- CVE-2026-60145 Denial of service in MySQL Cluster
- CVE-2026-60144 Missing authorization in Oracle Workflow
- CVE-2026-60143 Missing authorization in Oracle Workflow
- CVE-2026-60140 AutomationDirect Productivity Suite Out-of-bounds Read
- CVE-2026-6014 D-Link DIR-513 POST Request formAdvanceSetup buffer overflow
- CVE-2026-60137 WordPress Core SQL Injection
- CVE-2026-60135 Weintek cMT3092X Incorrect User Management
- CVE-2026-60134 Weintek cMT3092X Reliance on Cookies without Validation and Integrity Checking in a Security Decision
- CVE-2026-6013 D-Link DIR-513 POST Request formSetRoute buffer overflow
- CVE-2026-60125 importModule function in MISP ignores per-organisation import module restrictions
- CVE-2026-60124 MISP importModule missing authorization allows read-only users to modify events via misp_standard imports
- CVE-2026-60122 gpsd gpsprof Code Injection via SKY.satellites used Field
- CVE-2026-60121 Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.php
- CVE-2026-60120 Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php
- CVE-2026-6012 D-Link DIR-513 POST Request formSetPassword buffer overflow
- CVE-2026-60119 Hi.Events < 1.11.0 XSS via Event Title JSON.stringify Injection
- CVE-2026-60118 Hi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation Endpoint
- CVE-2026-60114 Sustainable Irrigation Platform 5.2.16 Path Traversal via JSON Backup Restore
- CVE-2026-60113 AIT-DSN < 2.2.2 Missing Authentication via SLE API Routes
- CVE-2026-60112 AIT-GUI < 2.5.1 Missing Authentication via Sessions.create()
- CVE-2026-6011 OpenClaw assertPublicHostname web-fetch.ts server-side request forgery
- CVE-2026-60109 Zeek < 8.0.9 Null Pointer Dereference DoS via Kerberos KRB_ERROR Parsing
- CVE-2026-60108 Zeek < 8.0.9 Uncontrolled Memory Consumption DoS via FTP Analyzer
- CVE-2026-60105 Monsta FTP < 2.14.5 SSRF via IPv4-Mapped IPv6 Address Bypass
- CVE-2026-60104 Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request
- CVE-2026-60103 Blender 3.0.0 - 5.1.2 Out-of-Bounds Read via crafted .blend SDNA block
- CVE-2026-60102 Horde VFS < 3.0.1 OS Command Injection via Horde_Vfs_Smb Driver
- CVE-2026-6010 CodeAstro Online Classroom takeassessment2.php sql injection
- CVE-2026-60095 Vinchin Backup & Recovery 9.0.0.86562 Stack Buffer Overflow via ModuleHandShake
- CVE-2026-60094 Vinchin Backup & Recovery 9.0.0.86562 Heap Buffer Overflow via agentlink_server
- CVE-2026-60093 Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir
- CVE-2026-60092 AVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants Panel
- CVE-2026-60091 PraisonAI before 4.6.78 Unauthenticated SSRF via webhook_url
- CVE-2026-60090 PraisonAI before 4.6.78 SQL/CQL Injection via vector dimension
- CVE-2026-6009 Jaspersoft Library Deserialisation Vulnerability
- CVE-2026-60089 PraisonAI before 1.6.78 Path Traversal via config.toml
- CVE-2026-60088 PraisonAI before 4.6.78 Path Traversal via Custom Commands
- CVE-2026-60087 PraisonAI before 1.6.78 Tool Approval Cache Bypass
- CVE-2026-60086 PraisonAI before 4.6.78 Prompt Injection Defense Bypass
- CVE-2026-60085 PraisonAI before 4.6.78 Unenforced Security Policy in Subprocess Sandbox
- CVE-2026-60084 SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate
- CVE-2026-60083 SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool
- CVE-2026-60082 DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row
- CVE-2026-60081 DBI::ProfileData versions before 1.651 for Perl do not limit the path index
- CVE-2026-60080 Apache Fory: Rust MetaString heap use-after-free
- CVE-2026-6008 IDOR in Im Park's DijiDemi
- CVE-2026-60075 Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.
- CVE-2026-60074 Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check.
- CVE-2026-60073 AutomationDirect Productivity Suite Out-of-bounds Read
- CVE-2026-6007 itsourcecode Construction Management System del.php sql injection
- CVE-2026-60065 NGINX Plus ngx_stream_mqtt_filter_module vulnerability
- CVE-2026-60063 AutomationDirect Productivity Suite Out-of-bounds Write
- CVE-2026-60062 NGINX Agent Vulnerability
- CVE-2026-60060 Memory corruption in TTSSH2
- CVE-2026-6006 code-projects Patient Record Management System edit_hpatient.php sql injection
- CVE-2026-60053 Apache Answer: Residual Administrative API Key Access After Role or Account Revocation
- CVE-2026-6005 code-projects Patient Record Management System hematology_print.php sql injection
- CVE-2026-6004 code-projects Simple IT Discussion Forum delete-category.php sql injection
- CVE-2026-60034 Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0
- CVE-2026-60033 Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0
- CVE-2026-60032 Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0
- CVE-2026-60031 Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1
- CVE-2026-60030 Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1
- CVE-2026-6003 code-projects Simple IT Discussion Forum user.php cross site scripting
- CVE-2026-60029 Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1
- CVE-2026-60028 Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1
- CVE-2026-60027 Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1
- CVE-2026-60026 Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1
- CVE-2026-60025 Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0
- CVE-2026-60024 Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0
- CVE-2026-60023 Apache Answer: Unauthorized disclosure of deleted or pending answer content
- CVE-2026-60021 Gitea GitLab migration denial of service
- CVE-2026-6002 HTML Injection in DivvyDrive Information Technologies' DivvyDrive
- CVE-2026-60018 Gitea OneDev migration denial of service
- CVE-2026-60011 Missing authorization in Sharp MFPs
- CVE-2026-60010 Gitea organization team policy bypass through repository API
- CVE-2026-6001 IDOR in Abis Technology's BAPSİS
- CVE-2026-60009 Cross-site request forgery in Eclipse Theia
- CVE-2026-60008 Gitea Jupyter notebook UI redress through CSS class injection
- CVE-2026-60007 Weak cryptography in Eclipse Milo
- CVE-2026-60005 NGINX ngx_http_slice_module vulnerability
- CVE-2026-60004 Gitea Code Injection
- CVE-2026-60002 Use after free in OpenSSH