Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 595 of 1013.
- CVE-2026-48246 Open ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in ajax/reports.php
- CVE-2026-48245 Open ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in tables.php
- CVE-2026-48244 Open ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in settings.inc.php
- CVE-2026-48243 Open ISES Tickets < 3.44.2 Hardcoded WhitePages API Key in wp1.php
- CVE-2026-48242 Open ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in import_mdb.php
- CVE-2026-48241 Open ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in loader.php
- CVE-2026-48240 Open ISES Tickets < 3.44.2 SQL Injection via ajax/statistics.php tick_id and f_tick_id Parameters
- CVE-2026-4824 Enter Software Iperius Backup Backup Job Configuration File privileges management
- CVE-2026-48239 Open ISES Tickets < 3.44.2 SQL Injection via ajax/reports.php tick_id Parameter
- CVE-2026-48238 Open ISES Tickets < 3.44.2 SQL Injection via ajax/mobile_main.php id Parameter
- CVE-2026-48237 Open ISES Tickets < 3.44.2 SQL Injection via message.php frm_ticket_id and frm_resp_id Parameters
- CVE-2026-48236 Open ISES Tickets < 3.44.2 SQL Injection via db_loader.php Multiple Parameters
- CVE-2026-48235 Open ISES Tickets < 3.44.2 SQL Injection in incs/remotes.inc.php via External GPS Tracker Data
- CVE-2026-48234 Open ISES Tickets < 3.44.2 SQL Injection via portal/ajax/list_requests.php sort and dir Parameters
- CVE-2026-48233 Open ISES Tickets < 3.44.2 SQL Injection via ajax/sit_incidents.php offset Parameter
- CVE-2026-48232 Open ISES Tickets < 3.44.2 SQL Injection via ajax/fullsit_incidents.php offset Parameter
- CVE-2026-48231 Open ISES Tickets < 3.44.2 SQL Injection via tables.php Multiple Parameters
- CVE-2026-48230 Open ISES Tickets < 3.44.2 Reflected XSS via ticketsmdb_import.php Multiple POST Parameters
- CVE-2026-4823 Enter Software Iperius Backup NTLM2 information disclosure
- CVE-2026-48229 Open ISES Tickets < 3.44.2 Reflected XSS via routes_i.php ticket_id Parameter
- CVE-2026-48228 Open ISES Tickets < 3.44.2 Reflected XSS via patient_w.php id and ticket_id Parameters
- CVE-2026-48227 Open ISES Tickets < 3.44.2 Reflected XSS via patient.php id and ticket_id Parameters
- CVE-2026-48226 Open ISES Tickets < 3.44.2 Reflected XSS via os_watch.php ref and mode_orig Parameters
- CVE-2026-48225 Open ISES Tickets < 3.44.2 Reflected XSS via landb.php _type Parameter
- CVE-2026-48224 Open ISES Tickets < 3.44.2 Reflected XSS via ics214.php frm_add_str Parameter
- CVE-2026-48223 Open ISES Tickets < 3.44.2 Reflected XSS via ics213rr.php frm_add_str Parameter
- CVE-2026-48222 Open ISES Tickets < 3.44.2 Reflected XSS via ics213.php frm_add_str Parameter
- CVE-2026-48221 Open ISES Tickets < 3.44.2 Reflected XSS via ics205a.php frm_add_str Parameter
- CVE-2026-48220 Open ISES Tickets < 3.44.2 Reflected XSS via ics205.php frm_add_str Parameter
- CVE-2026-4822 Enter Software Iperius Backup Backup Service temp file
- CVE-2026-48219 Open ISES Tickets < 3.44.2 Reflected XSS via ics202.php frm_add_str Parameter
- CVE-2026-48218 Open ISES Tickets < 3.44.2 Reflected XSS via icons/buttons/landb.php frm_name and frm_id Parameters
- CVE-2026-48217 Open ISES Tickets < 3.44.2 Reflected XSS via delete_module.php Multiple POST Parameters
- CVE-2026-48216 Open ISES Tickets < 3.44.2 Reflected XSS via db_loader.php Multiple POST Parameters
- CVE-2026-48215 Open ISES Tickets < 3.44.2 Reflected XSS via circle.php frm_id Parameter
- CVE-2026-48214 Open ISES Tickets < 3.44.2 Reflected XSS via add_nm.php ticket_id Parameter
- CVE-2026-48213 Open ISES Tickets < 3.44.2 Reflected XSS via add.php ticket_id Parameter
- CVE-2026-48212 Stored XSS in external pages
- CVE-2026-48211 Cross-Site Request Forgery in Import/Export Admin console
- CVE-2026-48210 Possible information disclosure via External Interface
- CVE-2026-48209 Reflected XSS in authenticated agent context
- CVE-2026-48208 Denial-of-Service via SVG Rendering in Ticket
- CVE-2026-48207 Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement
- CVE-2026-48206 Apache Camel-JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter
- CVE-2026-48205 Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF)
- CVE-2026-48204 Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered gridfs.* HTTP headers
- CVE-2026-48203 Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields
- CVE-2026-48202 WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability
- CVE-2026-48200 WordPress Document Library Lite plugin <= 1.3.0 - Sensitive Data Exposure vulnerability
- CVE-2026-4820 IBM Maximo Application Suite was vulnerable to because Cookie ltpatoken2_<workspace_name> was not set with secure flag
- CVE-2026-48199 WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability
- CVE-2026-48197 WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability
- CVE-2026-48196 WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-48195 WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-48194 WordPress DukaMarket theme <= 1.3.0 - Local File Inclusion vulnerability
- CVE-2026-48193 WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerability
- CVE-2026-48192 Code injection in Mendix Studio Pro 10.11
- CVE-2026-48191 Wrong Permission Handling in Document Search Article Meta Filters
- CVE-2026-48190 Incorrect handling of permissions in External Interface Config Item List module
- CVE-2026-4819 Search Guard audit logs can contain under certain conditions user credentials
- CVE-2026-48189 Bypass DedicatedAgentToCustomerGroups Setting
- CVE-2026-48188 SQL Injection via MySQL Quote Method
- CVE-2026-48187 Email with special content can lead to DoS
- CVE-2026-4818 Some management operations on data streams are not properly restricted when user does not have the necessary privileges
- CVE-2026-48172 LiteSpeed cPanel Plugin Privilege Escalation
- CVE-2026-48170 scimPatch vulnerable to prototype pollution via unfiltered keys in patch
- CVE-2026-4817 SQL injection in MasterStudy LMS WordPress Plugin – for Online Courses and Education
- CVE-2026-48169 PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API
- CVE-2026-48168 PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name
- CVE-2026-48167 Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS
- CVE-2026-48166 Filament: Timing-based user enumeration on login page
- CVE-2026-48165 MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side
- CVE-2026-48163 MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)
- CVE-2026-48162 Path traversal in wazuh
- CVE-2026-48161 react18-use was vulnerable to malicious code execution via compromised commits
- CVE-2026-48160 react-tracked was vulnerable to malicious code execution via compromised commits
- CVE-2026-4816 Reflected Cross Site Scripting (XSS) vulnerability in Support Board
- CVE-2026-48159 use-reducer-async was vulnerable to malicious code execution via compromised commits
- CVE-2026-48158 use-context-selector was vulnerable to malicious code execution via compromised commits
- CVE-2026-48157 Slim has Reflected XSS in the HtmlErrorRenderer
- CVE-2026-48156 pypdf: Possible long runtimes for zero-only width values in cross-reference streams
- CVE-2026-48155 pypdf: Possible large memory usage for large offsets for layout mode text
- CVE-2026-48154 GoRest: InMemorySecret2FA race condition allows process crash via concurrent map access
- CVE-2026-48153 Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata
- CVE-2026-48152 Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
- CVE-2026-48151 Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema
- CVE-2026-48150 Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
- CVE-2026-4815 SQL Injection vulnerability in Support Board
- CVE-2026-48149 Cross-site scripting in budibase
- CVE-2026-48148 Budibase: Unvalidated VectorDB Host Parameter Enables SSRF
- CVE-2026-48147 Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker
- CVE-2026-48146 Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection
- CVE-2026-48145 Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass
- CVE-2026-48144 Apache Thrift: c_glib TLS Client Missing Hostname Verification
- CVE-2026-48142 NGINX ngx_http_charset_module vulnerability
- CVE-2026-48141 Memory leak in NI grpc-device BeginSidebandStream
- CVE-2026-48140 Unchecked enum cast vulnerability in NI grpc-device in BeginSidebandStream
- CVE-2026-48139 NULL pointer dereference vulnerability in NI grpc-device data moniker service
- CVE-2026-48138 Out-of-bounds read vulnerability in the NI grpc-device streaming API
- CVE-2026-48137 Untrusted pointer dereference in NI grpc-device sideband streaming API