Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 522 of 1013.
- CVE-2026-57992 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-57991 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- CVE-2026-57990 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- CVE-2026-5799 IDOR in Idvlabs' Ontime
- CVE-2026-57989 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- CVE-2026-57988 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-57987 Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2026-57986 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-57985 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-57984 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-57983 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- CVE-2026-57982 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
- CVE-2026-57981 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-57980 Microsoft Edge (Chromium-based) Tampering Vulnerability
- CVE-2026-5798 Unsafe Object Reference (IDOR) vulnerability in Stel Order
- CVE-2026-57979 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
- CVE-2026-57978 Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2026-57977 Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2026-57976 Windows Active Directory Domain Services Denial of Service Vulnerability
- CVE-2026-57975 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-57974 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-57973 Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability
- CVE-2026-5797 Code injection in Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- CVE-2026-57969 Azure CycleCloud Elevation of Privilege Vulnerability
- CVE-2026-57968 Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
- CVE-2026-57967 Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
- CVE-2026-57966 Spice-vdagent: path traversal in file transfer via unsanitized filename
- CVE-2026-57965 Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow
- CVE-2026-57963 Chat UI manipulation by injection
- CVE-2026-57962 Denial-of-service via malicious LDAP address-book server
- CVE-2026-57961 phpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths Function
- CVE-2026-57960 Hi.Events 1.9.0 - Unauthenticated Attendee PII Exposure via Check-in List short_id
- CVE-2026-5796 Incorrect Authorization in GitLab
- CVE-2026-57959 Hi.Events 1.9.0 - Promo Code Max-Usage Bypass via Asynchronous Job Race Condition
- CVE-2026-57958 Mixpost 2.6.0 - Reflected XSS via OAuth Callback Error Parameter
- CVE-2026-57957 Papermark 0.22.0 - CORS Misconfiguration in Viewer Upload Endpoint
- CVE-2026-57956 SigNoz < 0.133.0 - Cross-Organization Insecure Direct Object Reference in Alert Rules
- CVE-2026-57955 SigNoz 0.130.1 - SQL Injection in Alert History Endpoints via Rule ID Parameter
- CVE-2026-57954 Elide 7.1.17 - Permission Bypass in Sort Expression Validation
- CVE-2026-57953 Mythic < 3.4.0.60 - Unauthorized Automation Workflow Modification via eventing_import_automatic_webhook Endpoint
- CVE-2026-57952 Mythic < 3.4.0.60 - Unauthorized C2 Profile Configuration Access via Unverified Payload UUID
- CVE-2026-57951 Mythic < 3.4.0.60 - Broken Permission Filter in payload_build_step Table
- CVE-2026-57950 ruoyi-vue-pro - Incorrect Permission Namespace in ErpSaleOrderController
- CVE-2026-5795 Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
- CVE-2026-57949 ruoyi-vue-pro - Missing Authorization in CRM Follow-up Record GET Endpoint
- CVE-2026-57948 Pinpoint - Insecure Session Cookie Attributes in pinpointJwt
- CVE-2026-57947 Pinpoint - Server-Side Request Forgery via Alarm Webhook Registration
- CVE-2026-57946 Invidious - Private Playlist Disclosure via Unauthenticated RSS Feed Endpoint
- CVE-2026-57945 PhotoPrism - Unauthorized User Profile Modification via PUT /api/v1/users/{uid} Endpoint
- CVE-2026-57944 AVideo channelToGallery.json.php Cross-Site Request Forgery
- CVE-2026-57943 LibrePhotos < 1.0.0 - Insecure Direct Object Reference in SetPhotosShared Endpoint
- CVE-2026-57942 LibreTranslate - IP Spoofing via X-Forwarded-For Header
- CVE-2026-57941 Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy
- CVE-2026-57940 Server-side request forgery in HTMLy
- CVE-2026-5794 Vulnerability in Cryptobox allows an authenticated user to trigger an account lockout
- CVE-2026-5793 XSS in Inrove Software's BiEticaret
- CVE-2026-57926 Code injection in YouTrack
- CVE-2026-57925 Missing authorization in YouTrack
- CVE-2026-57924 Information disclosure in YouTrack
- CVE-2026-57923 Missing authorization in YouTrack
- CVE-2026-57922 Missing authorization in YouTrack
- CVE-2026-57921 Missing authorization in YouTrack
- CVE-2026-57920 Auth bypass in InControl
- CVE-2026-5792 Authentication Bypass in Hedef Media's Related Marketing Cloud (RMC)
- CVE-2026-57919 PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENER
- CVE-2026-57918 Integer overflow in libnfs
- CVE-2026-57917 Improper Restriction of XML External Entity Reference in proCertum SmartSign
- CVE-2026-57916 Arbitrary Path Execution via CPS URI in proCertum SmartSign
- CVE-2026-57915 Apache Kerby: Kerberos Pre-Authentication Bypass
- CVE-2026-57914 Apache Kerby: StackOverflow on parsing deeply nested ASN1 structures
- CVE-2026-57913 Missing authorization in Audit Tracking Management System
- CVE-2026-57912 Missing authorization in Campus Recruiting
- CVE-2026-57910 WatchGuard Agent improper authentication allows unauthenticated remote code execution
- CVE-2026-5791 CSRF in DivvyDrive Information Technologies' DivvyDrive
- CVE-2026-57909 WatchGuard Agent path traversal allows unauthenticated remote code execution
- CVE-2026-5790 Stored Cross-Site Scripting (XSS) vulnerability in Stel Order
- CVE-2026-57898 Path traversal in Eclipse BaSyx - Java Server SDK
- CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
- CVE-2026-57896 AutomationDirect Productivity Suite Out-of-bounds Read
- CVE-2026-57895 Misconfiguration in Pupsman
- CVE-2026-57894 Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
- CVE-2026-5789 Search path without quotes in CivetWeb
- CVE-2026-57886 Cross-repository issue/comment attachment re-linking can expose private attachment content
- CVE-2026-57881 GV-LPC2011/LPC2211 - unauthorized stack-based buffer overflow vulnerability (vlsvr)
- CVE-2026-57880 GV-LPC2011/LPC2211 - unauthorized buffer overflow via RTSP Digest username (ssvr)
- CVE-2026-5788 Missing authorization in Endpoint Manager Mobile
- CVE-2026-57879 GV-LPC2011/LPC2211 - unauthorized buffer overflow via AuthMode/AuthValue path (ssvr)
- CVE-2026-57878 GV-LPC2011/LPC2211 - unauthorized buffer overflow vulnerability (thttpd)
- CVE-2026-57877 GV-LPC2011/LPC2211 - unauthorized format string vulnerability (vlsvr)
- CVE-2026-57876 GV-LPC2011/LPC2211 - unauthorized out-of-bounds writing vulnerability (onvif.cgi)
- CVE-2026-57875 GV-LPC2011/LPC2211 - unauthorized null pointer dereference vulnerability in packet parsing
- CVE-2026-57874 GV-LPC2011/LPC2211 - unauthorized buffer overflow vulnerability (IEEE8021x_upload.cgi)
- CVE-2026-57873 GV-LPC2011/LPC2211 - unauthorized null pointer dereference vulnerability (IEEE8021x_upload.cgi)
- CVE-2026-57872 GV-LPC2011/LPC2211 - unauthorized directory traversal vulnerability (get_fcont.cgi)
- CVE-2026-57871 Path traversal in MicroRealEstate
- CVE-2026-57870 Missing authorization in MicroRealEstate
- CVE-2026-5787 Security feature bypass in Endpoint Manager Mobile
- CVE-2026-57869 Missing authorization in MicroRealEstate
- CVE-2026-57868 Missing authorization in MicroRealEstate
- CVE-2026-57867 Auth bypass in MicroRealEstate