Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 519 of 1013.
- CVE-2026-58373 CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence
- CVE-2026-58372 SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys
- CVE-2026-58371 SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter
- CVE-2026-58370 Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name
- CVE-2026-5837 PHPGurukul News Portal Project news-details.php sql injection
- CVE-2026-58369 Null dereference in woodpecker
- CVE-2026-5836 code-projects Online Shoe Store admin_product.php cross site scripting
- CVE-2026-5835 code-projects Online Shoe Store admin_football.php cross site scripting
- CVE-2026-5834 code-projects Online Shoe Store admin_running.php cross site scripting
- CVE-2026-5833 awwaiid mcp-server-taskwarrior index.ts server.setRequestHandler command injection
- CVE-2026-5832 atototo api-lab-mcp HTTP http-server.ts test_http_endpoint server-side request forgery
- CVE-2026-58319 Apache Doris: Improper Authentication in Frontend HTTP API
- CVE-2026-58317 Memory corruption in TTSSH2
- CVE-2026-58315 Cross-site request forgery in Web Config
- CVE-2026-58314 Two SSRF findings in Gitea 1.26.2
- CVE-2026-5831 Agions taskflow-ai terminal_execute handlers.ts os command injection
- CVE-2026-58307 Memory corruption in Escargot
- CVE-2026-58306 Memory corruption in Escargot
- CVE-2026-58305 Memory corruption in Escargot
- CVE-2026-58304 Memory corruption in Escargot
- CVE-2026-58303 Memory corruption in Escargot
- CVE-2026-58302 Privilege escalation in LinuxCNC
- CVE-2026-58301 Apache Shiro: Server-side POST request may be steered to an alternate host
- CVE-2026-58300 Microsoft Edge for Android Information Disclosure Vulnerability
- CVE-2026-5830 Tenda AC15 SysToolChangePwd websGetVar stack-based overflow
- CVE-2026-58299 Microsoft Edge for Android Remote Code Execution Vulnerability
- CVE-2026-58298 Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2026-58297 Microsoft Edge for Android Information Disclosure Vulnerability
- CVE-2026-58296 Microsoft Edge for Android Information Disclosure Vulnerability
- CVE-2026-58295 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- CVE-2026-58294 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-58293 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-58292 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-58291 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- CVE-2026-58290 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-5829 code-projects Simple IT Discussion Forum content.php sql injection
- CVE-2026-58289 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-58288 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-58287 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-58286 Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2026-58285 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-58284 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-58283 Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2026-58282 Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2026-58281 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-58280 .NET Denial of Service Vulnerability
- CVE-2026-5828 code-projects Simple IT Discussion Forum addcomment.php sql injection
- CVE-2026-58279 Azure CycleCloud Elevation of Privilege Vulnerability
- CVE-2026-58278 Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2026-58277 Microsoft SharePoint Elevation of Privilege Vulnerability
- CVE-2026-58276 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-58275 Azure DNS Elevation of Privilege Vulnerability
- CVE-2026-58272 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)
- CVE-2026-58271 @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`
- CVE-2026-58270 Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`
- CVE-2026-5827 code-projects Simple IT Discussion Forum question-function.php sql injection
- CVE-2026-58269 Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`
- CVE-2026-58268 SIPGO: DoS via unvalidated Content-Length in the stream parser
- CVE-2026-58266 Anki: User scripts in iframes have access to the internal Anki API
- CVE-2026-58264 FluidSynth: Heap-based buffer overrun
- CVE-2026-58263 Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
- CVE-2026-58262 Klever-Go: PubKeysBitmap padding bits bypass the BLS signature quorum
- CVE-2026-5826 code-projects Simple IT Discussion Forum edit-category.php cross site scripting
- CVE-2026-58257 GRR vulnerable to Arbitrary File Read and Deletion
- CVE-2026-58256 GRR vulnerable to Remote Code Execution Via PHP Code Injection
- CVE-2026-58255 Privilege escalation in Cronicle
- CVE-2026-58254 NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check
- CVE-2026-58253 NATS Server: Route API Auth Bypass
- CVE-2026-58252 NATS Server: Subscribe Authz Bypass via Wildcard-Overlap
- CVE-2026-58251 NATS Server: Queue Subscribe Authz Bypass
- CVE-2026-58250 NATS Server: Pre-auth server crash via double INFO in leafnode handshake
- CVE-2026-5825 code-projects Simple Laundry System delmemberinfo.php cross site scripting
- CVE-2026-58249 Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
- CVE-2026-58248 XML External Entity Injection in SAP BusinessObjects Business Intelligence
- CVE-2026-58247 Memory Corruption vulnerability in SAP ABAP Platform
- CVE-2026-58246 Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
- CVE-2026-58245 Hard-coded Credentials in SAP Advanced Planning and Optimization (Model Mix Planning)
- CVE-2026-58244 Missing Authorization Check in SAP Manufacturing Integration and Intelligence (MII)
- CVE-2026-58243 Privilege Escalation vulnerability in SAP ABAP Developer Tools
- CVE-2026-58242 Improper Authorization check in SAP Cloud Connector
- CVE-2026-58241 Missing authorization in SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard
- CVE-2026-58240 Missing Authentication check in SAP NetWeaver (Message Server)
- CVE-2026-5824 code-projects Simple Laundry System userchecklogin.php sql injection
- CVE-2026-58239 Multiple vulnerabilities in SAP Business AI Platform (Approuter)
- CVE-2026-58238 Multiple vulnerabilities in SAP Business AI Platform (Approuter)
- CVE-2026-58237 Multiple vulnerabilities in SAP Business AI Platform (Approuter)
- CVE-2026-58236 OS Command Injection vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform
- CVE-2026-58235 Use of Vulnerable Third-Party Component in SAP NetWeaver AS Java (Adobe Document Services)
- CVE-2026-58234 Denial of Service vulnerability in SAP Process Integration (SOAP Adapter)
- CVE-2026-58233 Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach)
- CVE-2026-58231 Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)
- CVE-2026-58230 Multiple vulnerabilities in SAP Business AI Platform (Approuter)
- CVE-2026-5823 itsourcecode Construction Management System borrowed_tool_report.php sql injection
- CVE-2026-58229 Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS
- CVE-2026-58228 Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>
- CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
- CVE-2026-58226 Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax
- CVE-2026-58225 Denial of service in postgrex
- CVE-2026-58224 Samba: ctdb fails to do integrity checking of received packets
- CVE-2026-58222 Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes