Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 573 of 1013.
- CVE-2026-5156 Tenda CH22 Parameter QuickIndex formQuickIndex stack-based overflow
- CVE-2026-5155 Tenda CH22 Parameter AdvSetWan fromAdvSetWan stack-based overflow
- CVE-2026-51541 Memory corruption in opener project:opener
- CVE-2026-51540 Integer overflow in opener project:opener
- CVE-2026-5154 Tenda CH22 Parameter setcfm fromSetCfm stack-based overflow
- CVE-2026-51539 A Denial of Service (DoS) vulnerability exists in the receive loop of libmodbus 3.1.12 when running on Windows.
- CVE-2026-51538 Auth bypass in opener project:opener
- CVE-2026-51537 Memory corruption in opener project:opener
- CVE-2026-51536 Integer overflow in opener project:opener
- CVE-2026-51535 In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in its network processing loop.
- CVE-2026-5153 Tenda CH22 WriteFacMac FormWriteFacMac command injection
- CVE-2026-5152 Tenda CH22 createFileName formCreateFileName stack-based overflow
- CVE-2026-5150 code-projects Accounting System Parameter viewin_costumer.php sql injection
- CVE-2026-5149 Missing authorization in RTMKit
- CVE-2026-5148 YunaiV yudao-cloud page sql injection
- CVE-2026-5147 YunaiV yudao-cloud get-by-website sql injection
- CVE-2026-5146 Missing authorization in Server
- CVE-2026-5144 BuddyPress Groupblog <= 1.9.3 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR
- CVE-2026-5142 Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass
- CVE-2026-5141 Improper Access Control in TUBITAK BILGEM's Pardus Software Center
- CVE-2026-51401 Code injection in vim:vim
- CVE-2026-51400 Other in vim:vim
- CVE-2026-5140 Authorization Bypass in TUBITAK BILGEM's Pardus Update
- CVE-2026-5139 GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration
- CVE-2026-51385 An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validate_url,
- CVE-2026-51380 Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a permanent Denial of Service (DoS) or pote
- CVE-2026-5138 Foreman: foreman: information disclosure via improper validation of nested request parameters
- CVE-2026-51376 An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mes
- CVE-2026-5137 RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter
- CVE-2026-51368 An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remote attacker to execut
- CVE-2026-51367 An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoin
- CVE-2026-51366 SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo
- CVE-2026-5136 Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation
- CVE-2026-5135 Foreman: foreman: unauthorized modification of host configurations via broken access control
- CVE-2026-51346 SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obta
- CVE-2026-5134 SQLi in Loca Software's CMS
- CVE-2026-5132 Unbounded zlib decompression in Calls SDP WebSocket messages
- CVE-2026-5131 Server-Side Request Forgery in GREENmod
- CVE-2026-5130 Debugger & Troubleshooter <= 1.3.2 - Unauthenticated Privilege Escalation to Administrator via Cookie Manipulation
- CVE-2026-5127 Deserialization in User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration
- CVE-2026-5126 SourceCodester RSS Feed Parser file_get_contents server-side request forgery
- CVE-2026-5125 raine consult-llm-mcp server.ts child_process.execSync os command injection
- CVE-2026-5124 osrg GoBGP BGP Header bgp.go BGPHeader.DecodeFromBytes access control
- CVE-2026-5123 osrg GoBGP bgp.go DecodeFromBytes off-by-one
- CVE-2026-51221 A buffer overflow in the Get_Attribute_List function of EIPStackGroup OpENer commit 76b95c allows attackers to cause a Denial of Service (Do
- CVE-2026-5122 osrg GoBGP BGP OPEN Message bgp.go DecodeFromBytes access control
- CVE-2026-51219 A heap buffer overflow in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 v2.3.3 to v2.3.6 allows attackers to cause
- CVE-2026-51218 A heap buffer overflow in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3 allows attackers to cause a D
- CVE-2026-5121 Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing
- CVE-2026-5120 Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026
- CVE-2026-51190 The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true.
- CVE-2026-5119 Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment
- CVE-2026-5118 Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role'
- CVE-2026-5116 Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting
- CVE-2026-51153 Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803.
- CVE-2026-51152 Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803.
- CVE-2026-5115 Session hijacking in PaperCut NG/MF embedded application for Konica Minolta devices
- CVE-2026-51144 Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary
- CVE-2026-5114 SpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read
- CVE-2026-51134 The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml.
- CVE-2026-51133 Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary cod
- CVE-2026-5113 Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input
- CVE-2026-5112 Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater
- CVE-2026-51119 An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components
- CVE-2026-5111 Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater
- CVE-2026-51106 An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component
- CVE-2026-51105 Buffer Overflow vulnerability in aMULE-Project aMule v.2.3.3 allows a remote attacker to cause a denial of service via the OP_SERVERMESSAGE Handler.
- CVE-2026-5110 Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater
- CVE-2026-5109 Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option
- CVE-2026-51083 Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited
- CVE-2026-51082 A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x b
- CVE-2026-51081 A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmox Virtual Environment (PVE) 8.x 4.3.16 a
- CVE-2026-51080 XML external entity in proxmox:libpve-storage-perl
- CVE-2026-5108 Cross-site scripting in Super Progressive Web Apps
- CVE-2026-51078 An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the file_manage_control.php
- CVE-2026-51077 SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the
- CVE-2026-5107 FRRouting FRR EVPN Type-2 Route bgp_evpn.c process_type2_route access control
- CVE-2026-5106 code-projects Exam Form Submission update_fst.php cross site scripting
- CVE-2026-5105 Totolink A3300R Parameter cstecgi.cgi setVpnPassCfg command injection
- CVE-2026-5104 Totolink A3300R cstecgi.cgi setStaticRoute command injection
- CVE-2026-51031 FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint.
- CVE-2026-5103 Totolink A3300R cstecgi.cgi setUPnPCfg command injection
- CVE-2026-51027 An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.
- CVE-2026-51026 Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request.
- CVE-2026-51025 Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker to execute arbitrary code via the Client
- CVE-2026-5102 Totolink A3300R Parameter cstecgi.cgi setSmartQosCfg command injection
- CVE-2026-5101 Totolink A3300R Parameter cstecgi.cgi setLanCfg command injection
- CVE-2026-5100 AWP Classifieds <= 4.4.5 - Unauthenticated SQL Injection via 'regions'
- CVE-2026-50986 PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF).
- CVE-2026-50980 Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute
- CVE-2026-50979 A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated atta
- CVE-2026-5097 wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter
- CVE-2026-5096 Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'
- CVE-2026-5093 Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'
- CVE-2026-5092 Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI
- CVE-2026-5091 Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks
- CVE-2026-5090 Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected
- CVE-2026-50894 easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows auth
- CVE-2026-50892 Incorrect access control in the "Let's Encrypt" certificate download endpoint of Nginx Proxy Manager v2.14.0 allows authenticated attackers
- CVE-2026-50891 Filestash allows attackers to escalate privileges via sending a crafted request