Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 575 of 1013.
- CVE-2026-50698 Frappe Framework 17.0.0-dev - Stored XSS in Audit Trail template rendering
- CVE-2026-50697 Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CVE-2026-50696 Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability
- CVE-2026-50695 Windows Active Directory Federation Services Denial of Service Vulnerability
- CVE-2026-50694 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
- CVE-2026-50692 Desktop Window Manager Elevation of Privilege Vulnerability
- CVE-2026-50690 Windows SMB Information Disclosure Vulnerability
- CVE-2026-5069 Missing authorization in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- CVE-2026-50689 Windows Clipboard Server Elevation of Privilege Vulnerability
- CVE-2026-50688 Windows Win32k Elevation of Privilege Vulnerability
- CVE-2026-50687 Windows Win32k Elevation of Privilege Vulnerability
- CVE-2026-50686 Windows OLE Remote Code Execution Vulnerability
- CVE-2026-50685 Windows DHCP Server Remote Code Execution Vulnerability
- CVE-2026-50684 Active Directory Federation Server Spoofing Vulnerability
- CVE-2026-50683 Windows DHCP Client Elevation of Privilege Vulnerability
- CVE-2026-50682 Active Directory Denial of Service Vulnerability
- CVE-2026-50681 Windows Secure Channel Information Disclosure Vulnerability
- CVE-2026-50680 Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2026-5068 bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data
- CVE-2026-50679 Windows Search Service Elevation of Privilege Vulnerability
- CVE-2026-50678 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-50677 Windows Media Elevation of Privilege Vulnerability
- CVE-2026-50676 Windows Media Elevation of Privilege Vulnerability
- CVE-2026-50675 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-50674 Windows USB Print Driver Elevation of Privilege Vulnerability
- CVE-2026-50673 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-50672 Windows NTFS Elevation of Privilege Vulnerability
- CVE-2026-50670 Windows Win32k Elevation of Privilege Vulnerability
- CVE-2026-5067 Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key
- CVE-2026-50669 Windows Telephony Server Elevation of Privilege Vulnerability
- CVE-2026-50668 Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
- CVE-2026-50667 Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CVE-2026-50666 Windows Remote Access Elevation of Privilege Vulnerability
- CVE-2026-50665 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-50663 Game: Age of Empires II: Definitive Edition Remote Code Execution Vulnerability
- CVE-2026-50661 Windows BitLocker Security Feature Bypass Vulnerability
- CVE-2026-5066 net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function
- CVE-2026-50659 .NET Spoofing Vulnerability
- CVE-2026-50658 Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability
- CVE-2026-50657 Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability
- CVE-2026-50656 Microsoft Defender Elevation of Privilege Vulnerability
- CVE-2026-50655 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
- CVE-2026-50653 Azure Active Directory Denial of Service Vulnerability
- CVE-2026-50652 Azure Active Directory Denial of Service Vulnerability
- CVE-2026-50651 .NET Denial of Service Vulnerability
- CVE-2026-50650 .NET Framework Elevation of Privilege Vulnerability
- CVE-2026-5065 IBM Controller is affected by vulnerabilities
- CVE-2026-50649 .NET Remote Code Execution Vulnerability
- CVE-2026-50648 .NET Framework Denial of Service Vulnerability
- CVE-2026-50647 Active Directory Federation Server Denial of Service Vulnerability
- CVE-2026-50646 .NET Framework Remote Code Execution Vulnerability
- CVE-2026-50645 Apache CXF: No restriction on attachment headers per message
- CVE-2026-50644 SQL Injection in SOPlanning Audit Retention Configuration
- CVE-2026-50643 Out‑of‑Bounds Read in 8cc
- CVE-2026-50642 Terminal Escape Injection in diff‑so‑fancy
- CVE-2026-50641 Plaintext password storage in Streamsoft Business Intelligence
- CVE-2026-5064 HP One Agent Software – Security Update
- CVE-2026-50639 Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections
- CVE-2026-50638 Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections
- CVE-2026-50637 Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections
- CVE-2026-50636 LimeSurvey RemoteControl invite_participants/remind_participants SQL Injection
- CVE-2026-50635 LimeSurvey Password Reset Host Header Injection Discloses Reset Token
- CVE-2026-50634 Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry
- CVE-2026-50633 Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
- CVE-2026-50632 Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory
- CVE-2026-50631 Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing
- CVE-2026-50630 Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection
- CVE-2026-5063 NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names
- CVE-2026-50629 Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier
- CVE-2026-50628 Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
- CVE-2026-50627 Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator
- CVE-2026-50623 Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
- CVE-2026-50622 Apache Atlas: Missing Authorization on Admin Endpoints
- CVE-2026-5062 PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter
- CVE-2026-50619 Unauthenticated remote code execution vulnerability
- CVE-2026-50612 Import Symlink Following Remote Code Execution Vulnerability in QuMagie
- CVE-2026-50610 Improper Access control Vulnerability in NitroSense and PredatorSense Software
- CVE-2026-5061 Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack
- CVE-2026-50609 Unauthorized Registry Modification Vulnerability in NitroSense and PredatorSense Software
- CVE-2026-50608 Authentication Vulnerability in NitroSense and PredatorSense Software
- CVE-2026-50607 WebSocket Exposure Vulnerability in NitroSense and PredatorSense Software
- CVE-2026-50606 Hard-coded Encryption Key Vulnerability in Acer System Monitoring for NitroSense and PredatorSense Software
- CVE-2026-50605 Privilege Escalation Vulnerability in NitroSense and PredatorSense Software
- CVE-2026-50604 Unauthenticated Access Vulnerability in NitroSense and PredatorSense Software
- CVE-2026-50603 Hard-coded encryption key vulnerability in Acer Agent Service for NitroSense and PredatorSense
- CVE-2026-50602 Planet9 Incorrect Permission Assignment Vulnerability Information
- CVE-2026-50601 Planet9 Hardcoded Credentials Vulnerability Information
- CVE-2026-5060 Missing authorization in MasterStudy LMS WordPress Plugin – for Online Courses and Education
- CVE-2026-50593 Integer overflow in Graphite
- CVE-2026-50592 Cross-site scripting in Znuny
- CVE-2026-50591 Cross-site scripting in Znuny
- CVE-2026-50590 Misconfiguration in Incydr
- CVE-2026-5059 aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability
- CVE-2026-50589 OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash
- CVE-2026-5058 aws-mcp-server Command Injection Remote Code Execution Vulnerability
- CVE-2026-50578 ePA 3.x Integration: TLS Certificate Verification Universally Disabled
- CVE-2026-50577 ePA 3.x Integration: AES-GCM Nonce Reuse via Frozen VAU Request Counter
- CVE-2026-50576 ePA 3.x Integration: HTTP Header Injection in VAU Inner Requests
- CVE-2026-50575 BetterDesk has a replay behavior vulnerability when devices are deleted
- CVE-2026-50574 yt-dlp: Arbitrary code execution via manifest downloads with aria2c