Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 598 of 1013.
- CVE-2026-47942 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47941 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47940 Lightroom Classic | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-4794 Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF
- CVE-2026-47939 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47938 Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)
- CVE-2026-47937 Acrobat Reader | Uncontrolled Search Path Element (CWE-427)
- CVE-2026-47936 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47935 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-47934 DNG SDK | Out-of-bounds Read (CWE-125)
- CVE-2026-47933 ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47932 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- CVE-2026-47931 ColdFusion | Improper Input Validation (CWE-20)
- CVE-2026-47930 ColdFusion | Improper Input Validation (CWE-20)
- CVE-2026-4793 Misconfiguration in Synology Assistant
- CVE-2026-47929 ColdFusion | Incorrect Authorization (CWE-863)
- CVE-2026-47928 ColdFusion | Improper Input Validation (CWE-20)
- CVE-2026-47927 DNG SDK | Out-of-bounds Read (CWE-125)
- CVE-2026-47926 Acrobat Reader | Out-of-bounds Read (CWE-125)
- CVE-2026-47925 Acrobat Reader | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-47924 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-47923 Acrobat Reader | Out-of-bounds Read (CWE-125)
- CVE-2026-47922 CAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918)
- CVE-2026-47921 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-47920 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-4792 Bread <= 2.9.12 - Missing Authorization to Unauthenticated Information Exposure
- CVE-2026-47919 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-47918 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-47917 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-47916 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-47915 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-47914 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-47913 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-47912 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-47911 Acrobat Reader | Out-of-bounds Write (CWE-787)
- CVE-2026-47910 Dreamweaver Desktop | Incorrect Authorization (CWE-863)
- CVE-2026-4791 Cross-site scripting in PeproDev Ultimate Profile Solutions
- CVE-2026-47909 Dreamweaver Desktop | Improper Input Validation (CWE-20)
- CVE-2026-47908 Dreamweaver Desktop | Access of Uninitialized Pointer (CWE-824)
- CVE-2026-47907 Dreamweaver Desktop | Improper Access Control (CWE-284)
- CVE-2026-47906 Dreamweaver Desktop | Dependency on Vulnerable Third-Party Component (CWE-1395)
- CVE-2026-47905 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-47904 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-47903 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-47902 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-47901 Iframe escape by plugins in Logseq
- CVE-2026-47900 Stored XSS via Unsanitized Plugin Metadata in Logseq
- CVE-2026-4790 Cross-site scripting in Premium Addons for Elementor – Powerful Elementor Templates & Widgets
- CVE-2026-47899 Arbitrary File Read, Write, Rename, and Delete in Logseq
- CVE-2026-47898 Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser
- CVE-2026-47897 Apache Lucene.Net: Arbitrary file write from malicious server to Lucene.Net.Replicator client
- CVE-2026-47896 Apache Lucene.Net: Unauthenticated arbitrary file read on the Lucene.Net.Replicator replication server
- CVE-2026-47895 Memory corruption in strongSwan
- CVE-2026-47894 Spring Cloud Config Server Native Environment Repository Exposure
- CVE-2026-47893 Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService
- CVE-2026-47892 Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
- CVE-2026-47891 Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
- CVE-2026-47890 Spring Framework Server Sent Event stream corruption while rendering fragments
- CVE-2026-4789 CVE-2026-4789
- CVE-2026-47889 Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse
- CVE-2026-47888 Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler
- CVE-2026-47887 Spring Framework Open Redirect in UrlFileNameViewController
- CVE-2026-47886 Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions
- CVE-2026-47885 Spring Framework maxPartSize Ignored in PartEventHttpMessageReader
- CVE-2026-47884 Spring Framework Improper Path Limitation in XsltView
- CVE-2026-47883 Spring Framework Open Redirect in UrlHandlerFilter
- CVE-2026-47882 Spring Boot DevTools remote secret generated with a non-cryptographic PRNG
- CVE-2026-47881 Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File
- CVE-2026-47880 DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names
- CVE-2026-4788 Multiple Vulnerabilities affect IBM Tivoli Netcool Impact
- CVE-2026-47879 Spring Cloud Gateway SSRF and native file access with gRPC
- CVE-2026-47878 Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
- CVE-2026-47877 Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)
- CVE-2026-47876 VMXNET3 out-of-bounds write vulnerability
- CVE-2026-47875 JobParameterDeserializer bypasses the trusted-type allowlist
- CVE-2026-47874 Reactor Netty HTTP Server Denial of Service With Pipelined Requests
- CVE-2026-47873 Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces
- CVE-2026-47871 VMware Avi Load Balancer Directory Traversal Vulnerability
- CVE-2026-47870 VMware Avi Load Balancer Privilege Escalation Vulnerability
- CVE-2026-47869 VMware Avi Load Balancer Remote Code Execution Vulnerability
- CVE-2026-47868 VMware Avi Load Balancer Local Privilege Escalation Vulnerability
- CVE-2026-47867 VMware Avi Load Balancer Remote Code Execution Vulnerability
- CVE-2026-47866 VMware Avi Load Balancer Authorization Bypass Vulnerability
- CVE-2026-47865 VMware Avi Load Balancer Authentication Bypass Vulnerability
- CVE-2026-47864 Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
- CVE-2026-47863 Denial of service in Reactor Core
- CVE-2026-47862 ZipTransformer uses file_name header to build workDirectory path without sanitization
- CVE-2026-47861 UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false
- CVE-2026-47860 Unbounded decompression of attacker-supplied compressed message bodies
- CVE-2026-4786 Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
- CVE-2026-47859 Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS
- CVE-2026-47858 live information startup mode is vulnerable for remote code execution
- CVE-2026-47857 Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around
- CVE-2026-47856 JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list
- CVE-2026-47852 Predictable cache directory location allows local ONNX model substitution in Spring AI
- CVE-2026-47851 Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader
- CVE-2026-47850 Spring Data REST allows mutation of the version property of immutable aggregates via PUT
- CVE-2026-4785 LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2026-47849 Spring Data REST allows mutation of identifier and version properties via JSON Patch
- CVE-2026-47848 Reactor Netty WebSocket Client Leaks Credentials On Redirect