Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 528 of 1013.
- CVE-2026-57301 Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE
- CVE-2026-57300 Jenkins MCP Server Plugin missing a permission check
- CVE-2026-5730 IDOR in Idvlabs' Ontime
- CVE-2026-57299 Jenkins Contrast Continuous Application Security Plugin missing permission checks
- CVE-2026-57298 Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability
- CVE-2026-57297 Jenkins Contrast Continuous Application Security Plugin has a missing permission check
- CVE-2026-57296 Jenkins External Workspace Manager Plugin has a path traversal vulnerability
- CVE-2026-57295 Jenkins EC2 Fleet Plugin has a cross-site request forgery (CSRF) vulnerability
- CVE-2026-57294 Jenkins EC2 Fleet Plugin has a missing permission check
- CVE-2026-57293 Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs
- CVE-2026-57292 Jenkins Gitee Plugin has a cross-site request forgery vulnerability
- CVE-2026-57291 Jenkins Gitee Plugin missing permission checks
- CVE-2026-57290 Jenkins Priority Sorter Plugin has a CSRF vulnerability
- CVE-2026-5729 Mali GPU Kernel Driver allows access to already freed memory
- CVE-2026-57289 Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation
- CVE-2026-57288 Jenkins Active Directory Plugin has an LDAP injection vulnerability
- CVE-2026-57287 Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations
- CVE-2026-57286 Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names
- CVE-2026-57285 Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs
- CVE-2026-57284 Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types
- CVE-2026-57283 Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability
- CVE-2026-57282 Jenkins Git client Plugin has an OS command injection vulnerability on agents
- CVE-2026-57281 Jenkins Script Security Plugin has a script security bypass vulnerability
- CVE-2026-57280 Jenkins Script Security Plugin sandbox bypass vulnerability
- CVE-2026-57279 Cross-site scripting in Cybozu Garoon
- CVE-2026-57278 GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability
- CVE-2026-57277 GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability
- CVE-2026-57276 GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability
- CVE-2026-57275 GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability
- CVE-2026-57274 GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability
- CVE-2026-57273 GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability
- CVE-2026-57272 GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability
- CVE-2026-57271 GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability
- CVE-2026-57270 GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability
- CVE-2026-5727 Missing authorization in Hello Plus
- CVE-2026-57269 GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability
- CVE-2026-57268 GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability
- CVE-2026-57267 GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability
- CVE-2026-57266 GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability
- CVE-2026-57265 GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability
- CVE-2026-57264 GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability
- CVE-2026-57263 Weak cryptography in LOGO! Soft Comfort
- CVE-2026-57262 Hardcoded credentials in LOGO! Soft Comfort
- CVE-2026-57260 Memory corruption in Foxit PDF Editor
- CVE-2026-5726 ASDA-Soft Stack-based Buffer Overflow Vulnerability
- CVE-2026-57259 Foxit PDF Editor/Reader XDP XFA XXE arbitrary local file read
- CVE-2026-57258 Foxit PDF Editor/Reader Crash via Malformed PRC 3D Stream
- CVE-2026-57257 Security vulnerability in Foxit PDF Editor/Reader — PRC 3D BRep Renderer Heap OOB Read
- CVE-2026-57256 Foxit Editor/Reader List Box Format Use-After-Free Vulnerability
- CVE-2026-57255 Security vulnerability in Foxit PDF Editor/Reader — OOB Read via NaN-Bypass Clamp
- CVE-2026-57254 Foxit PDF Editor/Reader Annotation Type Confusion Vulnerability
- CVE-2026-57253 Foxit PDF Editor/Reader PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
- CVE-2026-57252 Foxit PDF Editor/Reader AcroForm Use-After-Free Remote Code Execution Vulnerability
- CVE-2026-57251 Foxit PDF Editor/Reader Cloud Appearance Buffer Overflow Vulnerability
- CVE-2026-57250 Foxit PDF Editor/Reader Form Field Use-After-Free Vulnerability
- CVE-2026-5725 Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix
- CVE-2026-57249 Foxit PDF Editor/Reader Annotation Use-After-Free Vulnerability
- CVE-2026-57248 Foxit PDF Editor/Reader Annotation Improper Release Vulnerability
- CVE-2026-57247 Foxit PDF Editor/Reader Field Use-After-Free Vulnerability
- CVE-2026-57246 Foxit PDF Editor/Reader Signature Buffer Overflow Vulnerability
- CVE-2026-57245 Foxit PDF Editor/Reader Signature Hyperlink Use-After-Free Vulnerability
- CVE-2026-57244 Foxit PDF Editor/Reader Form Control Use-After-Free Vulnerability
- CVE-2026-57243 Foxit PDF Editor/Reader Page Out-of-bounds Read Vulnerability
- CVE-2026-57242 Foxit PDF Editor/Reader Page Use-After-Free Vulnerability
- CVE-2026-57241 Foxit PDF Editor/Reader Page Out-of-bounds Read Vulnerability
- CVE-2026-57240 Foxit PDF Editor/Reader Form Field Use-After-Free Remote Code Execution Vulnerability
- CVE-2026-5724 Missing Authentication on Streaming gRPC Replication Endpoint
- CVE-2026-57239 Foxit PDF Editor/Reader Local Privilege Escalation
- CVE-2026-57238 Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
- CVE-2026-57237 Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
- CVE-2026-57236 Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception
- CVE-2026-57235 Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`
- CVE-2026-57234 Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247
- CVE-2026-57233 Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction
- CVE-2026-57232 Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
- CVE-2026-57231 Podman: Malformed Image can trick podman run into leaking host environment variables into the container
- CVE-2026-57230 OpenReplay: Authenticated ClickHouse SQL injection via session search
- CVE-2026-57229 Suricata smtp/mime: incomplete state reset allows detection bypass
- CVE-2026-57228 Suricata smtp/mime: heap out-of-bounds read quoted-printable decoder
- CVE-2026-57227 Suricata mqtt: unbounded resource consumption from repeated pubrec and pubrel messages
- CVE-2026-57226 Suricata swf: heap buffer overflow in SWF decompression depth handling
- CVE-2026-57225 Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading
- CVE-2026-57224 Suricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustion
- CVE-2026-57223 Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation
- CVE-2026-57222 Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6
- CVE-2026-57221 Missing authorization in rabbitmq-server
- CVE-2026-57220 Denial of service in rabbitmq-server
- CVE-2026-5722 MoreConvert Pro <= 1.9.14 - Authentication Bypass via Waitlist Guest Verification Token Reuse
- CVE-2026-57219 Information disclosure in rabbitmq-server
- CVE-2026-57218 RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure
- CVE-2026-57217 RabbitMQ: Topic authorization can lead to cross-tenant routing-key bypass
- CVE-2026-57216 Auth bypass in rabbitmq-server
- CVE-2026-57215 RabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom
- CVE-2026-57214 RabbitMQ: Stored XSS in RabbitMQ management UI
- CVE-2026-57213 RabbitMQ: Stored XSS federation management plugin via unsanitized consumer_tag rendering
- CVE-2026-57212 RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size
- CVE-2026-57211 RabbitMQ: UNC SSRF affecting the management UI on Windows
- CVE-2026-57210 Heimdall: IP Spoofing via Unvalidated Forwarding Headers
- CVE-2026-5721 Cross-site scripting in wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin
- CVE-2026-57209 Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode