Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 569 of 1013.
- CVE-2026-52491 An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c:
- CVE-2026-52490 An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() fun
- CVE-2026-5249 gougucms Record Endpoint record.html cross site scripting
- CVE-2026-52489 Buffer Overflow vulnerability in gpac 31becc9e08b88e525a4a62013a4000de1c0f8fd9 allows an attacker to execute arbitrary code via the svgNameT
- CVE-2026-52486 An issue in OpenDDS 3.33.x allows a local attacker to cause a denial of service via the verify function in the SIgnedDocument module
- CVE-2026-52484 An issue in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/de
- CVE-2026-52483 The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BR_g8.10_1.11(WVK.0)b46 allow auth
- CVE-2026-52482 An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service spa
- CVE-2026-52481 An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the tcp_actions() fun
- CVE-2026-52480 An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service
- CVE-2026-5248 gougucms User Registration Login.php reg_submit dynamically-determined object attributes
- CVE-2026-52476 SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the D
- CVE-2026-52475 Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.jav
- CVE-2026-52474 An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.
- CVE-2026-52473 An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concatenated to the ProcessBuilder.
- CVE-2026-52472 SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file
- CVE-2026-52470 SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file
- CVE-2026-5247 Cross-site scripting in Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
- CVE-2026-52469 SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file
- CVE-2026-52466 Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control.
- CVE-2026-5246 Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization
- CVE-2026-5245 Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow
- CVE-2026-5244 Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow
- CVE-2026-52439 An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection m
- CVE-2026-5243 Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
- CVE-2026-5242 Code Injection in Mia Technologies' Pizzy Library
- CVE-2026-5241 Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers
- CVE-2026-5240 code-projects BloodBank Managing System admin_state.php cross site scripting
- CVE-2026-52394 DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.
- CVE-2026-5238 itsourcecode Payroll Management System Parameter view_employee.php sql injection
- CVE-2026-52371 A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan
- CVE-2026-52370 A reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascr
- CVE-2026-5237 itsourcecode Payroll Management System Parameter manage_user.php sql injection
- CVE-2026-5236 Axiomatic Bento4 DSI v1 Ap4Dac4Atom.cpp SkipBits heap-based overflow
- CVE-2026-52356 An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execut
- CVE-2026-5235 Axiomatic Bento4 MP4 File Ap4Dac4Atom.cpp ReadCache heap-based overflow
- CVE-2026-52349 Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit 729aa48 allows a local attacker to execute a
- CVE-2026-52348 cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java.
- CVE-2026-5234 Missing authorization in LatePoint – Calendar Booking Plugin for Appointments and Events
- CVE-2026-5233 Missing Rate Limiting in Mia Technologies' Pizzy Library
- CVE-2026-5231 WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter
- CVE-2026-52307 An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers t
- CVE-2026-5230 Improper Access Control in Mia Technologies' Pizzy Library
- CVE-2026-52297 Memory corruption in FFmpeg
- CVE-2026-52296 Memory corruption in FFmpeg
- CVE-2026-52295 Memory corruption in FFmpeg
- CVE-2026-5229 Auth bypass in Receive Notifications After Form Submitting – Form Notify for Any Forms
- CVE-2026-5228 Improper Access Control in Kurt Software Studio's WriteUp Mobile App
- CVE-2026-5226 Optimole <= 4.2.3 - Reflected Cross-Site Scripting via Page Profiler URL
- CVE-2026-5224 Sensitive Data Exposure in Kriptek Crypto's Cryptosim
- CVE-2026-52232 A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attac
- CVE-2026-5223 Crates in third party registries can override the cached source of other crates
- CVE-2026-5222 Cargo can be coerced to share credentials between registries
- CVE-2026-52203 An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter.
- CVE-2026-52200 An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API
- CVE-2026-5220 Stored XSS in DivvyDrive Information Technologies' DivvyDrive
- CVE-2026-52199 An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component
- CVE-2026-52198 Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea
- CVE-2026-52197 An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_44af70 componen
- CVE-2026-52196 Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea
- CVE-2026-52195 Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea
- CVE-2026-52193 Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea
- CVE-2026-52192 An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_445C5C componen
- CVE-2026-52191 Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea
- CVE-2026-52190 Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea
- CVE-2026-5219 CSRF in Softtr's E-Commerce Pack
- CVE-2026-52189 Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea
- CVE-2026-52188 Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea
- CVE-2026-52187 Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea
- CVE-2026-52186 SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to execute arbitrary code via the gohead/sub
- CVE-2026-5218 HTML Injection in Softtr's E-Commerce Pack
- CVE-2026-5217 Optimole <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor Parameter
- CVE-2026-52167 A stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service (DoS) via supplying
- CVE-2026-5215 D-Link DNS-1550-04 network_mgr.cgi cgi_get_ipv6 access control
- CVE-2026-5214 D-Link DNS-1550-04 account_mgr.cgi cgi_addgroup_get_group_quota_minsize stack-based overflow
- CVE-2026-52134 An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a captured GOOSE frame.
- CVE-2026-52132 Denial of service in ggml:llama.cpp
- CVE-2026-52131 Denial of service in ggml:llama.cpp
- CVE-2026-52130 Denial of service in ggml:llama.cpp
- CVE-2026-5213 D-Link DNS-1550-04 account_mgr.cgi cgi_adduser_to_session stack-based overflow
- CVE-2026-5212 D-Link DNS-1550-04 webdav_mgr.cgi Webdav_Upload_File stack-based overflow
- CVE-2026-52111 An issue in fast-note-sync-service <=2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes aut
- CVE-2026-5211 D-Link DNS-1550-04 app_mgr.cgi UPnP_AV_Server_Path_Del stack-based overflow
- CVE-2026-52103 A zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attacke
- CVE-2026-52102 An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary comma
- CVE-2026-52101 An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadR
- CVE-2026-52100 Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary cod
- CVE-2026-5210 SourceCodester Leave Application System file inclusion
- CVE-2026-52098 Code injection in flowiseai:flowise
- CVE-2026-52097 An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (url_launcher.dart), O
- CVE-2026-5209 SourceCodester Leave Application System User Management cross site scripting
- CVE-2026-5208 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in coolercontrold
- CVE-2026-5207 LifterLMS <= 9.2.1 - Authenticated (Custom+) SQL Injection via 'order' Parameter
- CVE-2026-5206 code-projects Simple Gym Management System Payment sql injection
- CVE-2026-5205 chatwoot Webhook API trigger.rb Trigger server-side request forgery
- CVE-2026-5204 Tenda CH22 Parameter webtypelibrary formWebTypeLibrary stack-based overflow
- CVE-2026-5203 CMS Made Simple UserGuide Module XML Import class.UserGuideImporterExporter.php _copyFilesToFolder path traversal
- CVE-2026-52023 Denial of service in kamailio:kamailio
- CVE-2026-52022 Denial of service in kamailio:kamailio
- CVE-2026-52021 An issue in code100xDevs 100xdevs CMS v.1.0 (2026-04-30) allows a remote attacker to obtain sensitive information via the src/middleware.ts,