Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 533 of 1013.
- CVE-2026-56667 ZITADEL: Stored XSS via Default URI Redirect in Login V2
- CVE-2026-56666 ZITADEL: Auto-linking by email: IdP-side email verification is not checked
- CVE-2026-56665 ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider
- CVE-2026-56664 ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider
- CVE-2026-56663 AutoGPT: SSRF-to-RCE Chain in `SendWebRequestBlock` via IP validation bypass and internal `pg-meta` access
- CVE-2026-56662 GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request
- CVE-2026-56661 GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint
- CVE-2026-56660 GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction
- CVE-2026-5666 code-projects Online FIR System SQL Database Backup File complaints.sql sensitive information
- CVE-2026-56657 Gitea SSH Key Parser Denial of Service
- CVE-2026-56654 Privilege Escalation via Access Token Scope Escalation in API
- CVE-2026-56652 Formula Injection in dool project
- CVE-2026-56651 Arbitrary File Overwrite via Symlink Following in dool project
- CVE-2026-56650 Windows Network File System Elevation of Privilege Vulnerability
- CVE-2026-5665 code-projects Online FIR System Login checklogin.php sql injection
- CVE-2026-56649 Windows Network File System Remote Code Execution Vulnerability
- CVE-2026-56648 Windows NFS Server Elevation of Privilege Vulnerability
- CVE-2026-56647 Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability
- CVE-2026-56646 Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2026-56645 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-56644 DirectX Graphics Kernel Elevation of Privilege Vulnerability
- CVE-2026-56643 DirectX Graphics Kernel Elevation of Privilege Vulnerability
- CVE-2026-56642 Microsoft Fabric Data Warehouse Remote Code Execution Vulnerability
- CVE-2026-5663 OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection
- CVE-2026-56624 Apache MINA SSHD: SSH certificate options lack validations
- CVE-2026-56623 Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows
- CVE-2026-56620 HCL BigFix Mobile is vulnerable to information disclosure
- CVE-2026-56619 HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS)
- CVE-2026-5661 Free5GC NGSetupRequest denial of service
- CVE-2026-56609 HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).
- CVE-2026-56608 HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).
- CVE-2026-5660 itsourcecode Construction Management System Parameter borrowed_equip.php sql injection
- CVE-2026-56599 HCL BigFix Service Management is affected by multiple security vulnerabilities.
- CVE-2026-56597 HCL BigFix Service Management is affected by multiple security vulnerabilities.
- CVE-2026-56596 HCL BigFix Service Management is affected by multiple security vulnerabilities.
- CVE-2026-56595 HCL BigFix Service Management is affected by multiple security vulnerabilities.
- CVE-2026-56592 HCL BigFix Service Management is affected by multiple security vulnerabilities.
- CVE-2026-56590 HCL BigFix Service Management is affected by multiple security vulnerabilities.
- CVE-2026-5659 pytries datrie trie File datrie.pyx Trie.__setstate__ deserialization
- CVE-2026-56589 HCL BigFix Service Management is affected by multiple security vulnerabilities.
- CVE-2026-56587 HCL IEM was affected with Strict transport security not enforced
- CVE-2026-56586 HCL IEM was affected with X-Content-Type-Options Header Missing
- CVE-2026-56585 HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing
- CVE-2026-56584 HCL IEM was affected with the Information disclosure nginx server
- CVE-2026-56583 HCL MyCloud was affected with Concurrent Login Vulnerability.
- CVE-2026-56582 HCL MyCloud was affected with SSL/TLS Protocol Affected with LUCKY13 Vulnerability.
- CVE-2026-56581 HCL MyCloud was affected with Cookie Attribute Path Not Set
- CVE-2026-56580 HCL MyCloud was affected by Using Components with Known Vulnerability
- CVE-2026-56579 HCL MyCloud was affected with Exposure of Sensitive Information to an Unauthorized Actor.
- CVE-2026-56578 HCL MyCloud was affected by Server Version Disclosure
- CVE-2026-56577 HCL MyCloud affected by Weak Password Policy
- CVE-2026-56571 HCL iControl is affected by multiple security vulnerabilities.
- CVE-2026-56570 HCL iControl is affected by multiple security vulnerabilities.
- CVE-2026-5657 Double Free in Wireshark
- CVE-2026-56569 HCL iControl is affected by multiple security vulnerabilities.
- CVE-2026-56568 HCL iControl is affected by multiple security vulnerabilities.
- CVE-2026-56567 HCL iControl is affected by multiple security vulnerabilities.
- CVE-2026-5656 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark
- CVE-2026-5655 Use After Free in Wireshark
- CVE-2026-56547 An input reflection vulnerability affects HCL Traveler
- CVE-2026-5654 Stack-based Buffer Overflow in Wireshark
- CVE-2026-56538 HCL Connections is vulnerable to information disclosure
- CVE-2026-56537 HCL Connections is vulnerable to information disclosure
- CVE-2026-5653 Heap-based Buffer Overflow in Wireshark
- CVE-2026-5652 Authorization Bypass Through User-Controlled Key in Crafty Controller
- CVE-2026-5651 Askeet <= 3.0 - Authenticated (Administrator+) SQL Injection via 'sql_query' Parameter
- CVE-2026-5650 code-projects Online Application System for Admission oas.sql sensitive information
- CVE-2026-5649 code-projects Online Application System for Admission Endpoint admsnform.php sql injection
- CVE-2026-5648 code-projects Simple Laundry System Parameter userfinishregister.php sql injection
- CVE-2026-5647 code-projects Online Shoe Store Add Product admin_feature.php cross site scripting
- CVE-2026-56460 HCL DevOps Deploy / HCL Launch is susceptible to an Insertion of Sensitive Information Into Sent Data vulnerability
- CVE-2026-5646 code-projects Easy Blog Site login.php sql injection
- CVE-2026-56459 HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure
- CVE-2026-56458 HCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains
- CVE-2026-56457 HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information
- CVE-2026-56456 HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability.
- CVE-2026-56455 HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS).
- CVE-2026-56454 HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1.
- CVE-2026-56453 HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability.
- CVE-2026-56452 Apache MINA SSHD: Path traversal in SCP file reception
- CVE-2026-56451 Auth bypass in Opcenter X
- CVE-2026-56450 AIL Framework - Missing Rate Limiting Enables Brute-Force Attacks Against Two-Factor Authentication Codes
- CVE-2026-5645 projectworlds Car Rental System Parameter pay.php sql injection
- CVE-2026-56449 Apache HTTP Server: mod_proxy_html: crash in dump_content
- CVE-2026-56448 Authenticated Path Traversal in AIL Framework Investigation Downloads Allows Arbitrary File Read
- CVE-2026-56447 MISP remote code execution via arbitrary rdkafka configuration path
- CVE-2026-56446 Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP
- CVE-2026-56445 pydicom pynetdicom Library Path Traversal
- CVE-2026-56444 Denial of service in Unbound
- CVE-2026-56443 Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
- CVE-2026-5644 Cyber-III Student-Management-System batch-notice.php cross site scripting
- CVE-2026-56437 Other in Pupsman
- CVE-2026-56434 NGINX ngx_http_ssi_module vulnerability
- CVE-2026-5643 Cyber-III Student-Management-System Admin Add Endpoint notice.php cross site scripting
- CVE-2026-56428 Hardcoded credentials in BSH ELP (Electronic Platform) Modules
- CVE-2026-56425 Auth bypass in misp
- CVE-2026-56424 Missing authorization in misp
- CVE-2026-56423 Missing authorization in misp
- CVE-2026-56422 MISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fields
- CVE-2026-5642 Cyber-III Student-Management-System HTTP POST Request update.php improper authorization