Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 609 of 1013.
- CVE-2026-46796 Open redirect in Oracle WebCenter Sites
- CVE-2026-46795 Missing authorization in Oracle WebCenter Content
- CVE-2026-46794 Privilege escalation in Identity Manager Connector
- CVE-2026-46793 Missing authorization in Identity Manager Connector
- CVE-2026-46792 Missing authorization in Identity Manager Connector
- CVE-2026-46791 Missing authorization in Oracle WebCenter Content
- CVE-2026-46790 Information disclosure in Oracle WebCenter Content
- CVE-2026-4679 Integer overflow in Chrome
- CVE-2026-46789 Auth bypass in Oracle WebCenter Content
- CVE-2026-46788 Missing authorization in Oracle WebCenter Content
- CVE-2026-46787 Cross-site request forgery in Oracle WebCenter Content
- CVE-2026-46786 Cross-site request forgery in Oracle WebCenter Content
- CVE-2026-46785 Cross-site request forgery in Oracle WebCenter Content
- CVE-2026-46784 Missing authorization in WebCenter Content: Imaging
- CVE-2026-46783 Missing authorization in WebCenter Content: Imaging
- CVE-2026-46782 Missing authorization in Oracle WebCenter Enterprise Capture
- CVE-2026-46781 Missing authorization in Oracle WebCenter Enterprise Capture
- CVE-2026-46780 Missing authorization in WebCenter Content: Imaging
- CVE-2026-4678 Use after free in Chrome
- CVE-2026-46779 Missing authorization in Oracle WebCenter Enterprise Capture
- CVE-2026-46778 Missing authorization in Oracle WebCenter Enterprise Capture
- CVE-2026-46777 Missing authorization in Oracle WebCenter Content
- CVE-2026-46776 Missing authorization in Oracle Unified Directory
- CVE-2026-46775 Denial of service in Oracle REST Data Services
- CVE-2026-46774 Missing authorization in Oracle Unified Directory
- CVE-2026-46773 Missing authorization in Oracle Unified Directory
- CVE-2026-46772 Missing authorization in Oracle Application Development Framework (ADF)
- CVE-2026-46771 Missing authorization in Oracle Application Development Framework (ADF)
- CVE-2026-46770 Missing authorization in Oracle Application Development Framework (ADF)
- CVE-2026-4677 Memory corruption in Chrome
- CVE-2026-46769 Missing authorization in Oracle Application Development Framework (ADF)
- CVE-2026-46768 Denial of service in Oracle VM VirtualBox
- CVE-2026-46767 Missing authorization in Oracle WebCenter Portal
- CVE-2026-46766 Missing authorization in Oracle WebCenter Content
- CVE-2026-46765 Missing authorization in Oracle WebCenter Portal
- CVE-2026-46764 Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter
- CVE-2026-4676 Use after free in Chrome
- CVE-2026-46752 Apache Kvrocks: Stack buffer overflow in Lua bit.tohex()
- CVE-2026-46751 Code injection in Apache Kvrocks
- CVE-2026-4675 Memory corruption in Chrome
- CVE-2026-46749 Weak cryptography in SINEC INS
- CVE-2026-46748 Privilege escalation in SINEC INS
- CVE-2026-46747 Path traversal in SINEC INS
- CVE-2026-46746 Command injection in SINEC INS
- CVE-2026-46745 Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token
- CVE-2026-46741 Etsy::StatsD versions through 1.002002 for Perl allow metric injections
- CVE-2026-46740 Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections
- CVE-2026-4674 Memory corruption in Chrome
- CVE-2026-46739 Net::Statsd versions before 0.13 for Perl allow metric injections
- CVE-2026-46738 Privilege escalation in PowerProtect Data Manager
- CVE-2026-46737 Other in PowerProtect Data Manager
- CVE-2026-46735 Command injection in Display and Peripheral Manager
- CVE-2026-46734 Security feature bypass in Display and Peripheral Manager
- CVE-2026-46733 Missing authorization in Display and Peripheral Manager
- CVE-2026-46732 Race condition in Display and Peripheral Manager
- CVE-2026-46731 Auth bypass in Display and Peripheral Manager (DDPM Windows)
- CVE-2026-46730 Missing authorization in PowerProtect Data Domain
- CVE-2026-4673 Memory corruption in Chrome
- CVE-2026-46729 Apache HTTP Server: mod_heartmonitor denial of service
- CVE-2026-46728 Security feature bypass in U-Boot
- CVE-2026-46727 Use after free in Ruby
- CVE-2026-46726 Apache Camel-Vertx-Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy
- CVE-2026-46725 Remote Code Execution in extension "Content Element Selector" (ceselector)
- CVE-2026-46724 Path Traversal in extension "Faceted Search" (ke_search)
- CVE-2026-46723 Information Disclosure in extension "Faceted Search" (ke_search)
- CVE-2026-46722 XML External Entity Injection in extension "Faceted Search" (ke_search)
- CVE-2026-46721 Broken Access Control in extension "Frontend User Registration" (sf_register)
- CVE-2026-46720 Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections
- CVE-2026-4672 Missing Authorization in GitLab
- CVE-2026-46719 Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections
- CVE-2026-46718 Apache Calcite: A user-controled model can load arbitrary classes, leading to code execution
- CVE-2026-46717 Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification
- CVE-2026-46716 Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron
- CVE-2026-46715 Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance
- CVE-2026-46714 Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation
- CVE-2026-46713 Misskey: JSON-LD signature validation + compaction may lead to improper activity handling
- CVE-2026-46712 Misskey: Lack of proper permission checks in Direct Messaging feature
- CVE-2026-46711 Missing authorization in security
- CVE-2026-46710 Notepad++: Privilege Escalation in the Installer via Uncontrolled Executable Search Path
- CVE-2026-4671 justhtml before 1.18.0 Denial of Service via CSS Selector
- CVE-2026-46709 Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)
- CVE-2026-46708 EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record
- CVE-2026-46705 russh server userauth state is not reset when authentication principal changes
- CVE-2026-46703 BoxLite: Path Traversal Vulnerability in boxlite Leads to Arbitrary File Write on the Host
- CVE-2026-46702 Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets
- CVE-2026-46701 Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
- CVE-2026-46700 @actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
- CVE-2026-4670 Improper Authentication vulnerability in Progress MOVEit Automation
- CVE-2026-46699 Business logic in conda-smithy
- CVE-2026-46698 Fediverse Embeds: Public-nonce SSRF via ftf_get_site_info AJAX action
- CVE-2026-46697 Fediverse Embeds: Unauthenticated SSRF / open proxy via REST media-proxy endpoint
- CVE-2026-46696 October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls
- CVE-2026-46695 BoxLite: Permission Bypass in boxlite Allows Modification of Read-Only Files
- CVE-2026-46694 EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes
- CVE-2026-46693 ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking
- CVE-2026-46692 ImageMagick: Heap Buffer Over-Write in distributed pixel cache server
- CVE-2026-46691 EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users
- CVE-2026-46690 unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race
- CVE-2026-46689 Kanidm: Unauthenticated process abort via SCIM filter stack exhaustion
- CVE-2026-46688 Meeting Room Booking System has an unauthenticated open redirect