Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 628 of 1013.
- CVE-2026-44832 Snipe-IT: Privilege Escalation via API Permissions Assignment
- CVE-2026-44831 Snipe-IT: XSS vulnerability in component notes
- CVE-2026-44830 Empty API_TOKEN disables authentication on network-reachable HTTP/SSE transport
- CVE-2026-4483 Missing authorization in MxGeneralIo
- CVE-2026-44829 Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filename
- CVE-2026-44828 Qexo initialization endpoint can reset setup state and expose stored credentials
- CVE-2026-44827 Diffusers: None.py Trust Remote Code Bypass
- CVE-2026-44826 Vvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totals
- CVE-2026-44825 Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
- CVE-2026-44824 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-44823 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-44822 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-44821 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-44820 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-4482 Insight Agent Private Key Information Disclosure via Inherited File Permissions
- CVE-2026-44819 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-44818 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-44817 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-44815 DHCP Client Service Remote Code Execution Vulnerability
- CVE-2026-44814 Windows DWM Core Library Information Disclosure Vulnerability
- CVE-2026-44813 Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2026-44812 Windows Graphics Component Remote Code Execution Vulnerability
- CVE-2026-44811 Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2026-44810 Microsoft Cryptographic Services Elevation of Privilege Vulnerability
- CVE-2026-44809 Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CVE-2026-44808 Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2026-44807 Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2026-44806 Windows Secure Channel Denial of Service Vulnerability
- CVE-2026-44805 Windows Network Controller (NC) Host Agent Denial of Service Vulnerability
- CVE-2026-44804 Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2026-44803 Windows Graphics Component Remote Code Execution Vulnerability
- CVE-2026-44802 Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2026-44801 Remote Desktop Client Remote Code Execution Vulnerability
- CVE-2026-44800 Windows Push Notifications Elevation of Privilege Vulnerability
- CVE-2026-4480 Samba: samba: remote code execution in printing subsystem via unescaped job description
- CVE-2026-44799 Remote Desktop Client Remote Code Execution Vulnerability
- CVE-2026-44798 Nautobot: GitRepository.current_head field should not be writable through REST API
- CVE-2026-44797 Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)
- CVE-2026-44796 Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)
- CVE-2026-44795 Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types
- CVE-2026-44794 Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference
- CVE-2026-44793 OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`
- CVE-2026-44792 n8n: Source Control Pull SQL Injection
- CVE-2026-44791 n8n: XML Node Prototype Pollution Patch Bypass
- CVE-2026-44790 n8n: Arbitrary File Read via Git Node
- CVE-2026-4479 Cross-site scripting in WholeSale Products Dynamic Pricing Management WooCommerce
- CVE-2026-44789 n8n: HTTP Request Node Pagination Prototype Pollution to RCE
- CVE-2026-44788 SharpCompress: Directory traversal via directory entries in WriteToDirectory (zip slip variant)
- CVE-2026-44787 Discourse: Signup-time primary_group_id assignment grants whisperer access
- CVE-2026-44786 Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users
- CVE-2026-44785 Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts
- CVE-2026-44784 Discourse: Non-staff group owners can see email password in plaintext through group history
- CVE-2026-44783 Discourse: Replying to a whisper lets non-whisperers create staff-only whisper posts
- CVE-2026-44782 Discourse: GroupPostSerializer leaks hidden full names through reaction post association
- CVE-2026-44780 Discourse: Category queue reviewers can read raw incoming emails from queued posts
- CVE-2026-4478 Yi Technology YI Home Camera HTTP Firmware Update ipc signature verification
- CVE-2026-44779 Discourse: Bot debug endpoints disclose whisper translation audit logs
- CVE-2026-44778 Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF
- CVE-2026-44777 jq: stack overflow in module loading on mutual `include`
- CVE-2026-44776 Kavita: IDOR in /api/Download/*
- CVE-2026-44775 Kavita: No authentication at /api/Reader/image
- CVE-2026-44774 Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false
- CVE-2026-44771 Missing Authorization check in SAP S/4HANA (Draft operation)
- CVE-2026-44770 Missing Authorization check in SAP S/4 HANA (Create Single Payment)
- CVE-2026-4477 Yi Technology YI Home Camera WPA/WPS hard-coded key
- CVE-2026-44769 SQL Injection vulnerability in SAP S/4HANA Project Management (PPM-PRO)
- CVE-2026-44768 Security misconfiguration in SAP CRM (WebClient UI)
- CVE-2026-44767 Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection
- CVE-2026-44766 SQL Injection vulnerability in SAP S/4HANA (Intercompany Matching and Reconciliation)
- CVE-2026-44765 Missing Authorization Check in SAP Manufacturing Integration and Intelligence
- CVE-2026-44764 Missing Authorization Check in SAP Manufacturing Integration and Intelligence
- CVE-2026-44763 Directory Traversal vulnerability in SAP Manufacturing Integration and Intelligence
- CVE-2026-44762 Security Misconfiguration in SAP Data Services Management Console
- CVE-2026-44761 Insecure Sample Credentials in SAP Commerce Cloud
- CVE-2026-44760 Cross-site scripting in SAP NetWeaver Application Server ABAP (applications based on Business Server Pages)
- CVE-2026-4476 Yi Technology YI Home Camera CGI Endpoint ipc missing authentication
- CVE-2026-44759 Cross Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
- CVE-2026-44758 Code Injection vulnerability in Manufacturing Integration and Intelligence
- CVE-2026-44757 Cross-Site Scripting (XSS) vulnerability in SAP Wily Introscope Enterprise Manager
- CVE-2026-44756 Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing
- CVE-2026-44755 Email Spoofing vulnerability in SAP Business Objects Business Intelligence Platform
- CVE-2026-44754 Missing caller identification check-in for ODP Data Replication APIs
- CVE-2026-44753 Information Disclosure vulnerability in SAP HANA Extended Application Services classic model (User Self Service)
- CVE-2026-44752 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configuration Wizard)
- CVE-2026-44751 Missing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform
- CVE-2026-44750 Missing Authorization check in SAP MDG (Review Match Groups Application)
- CVE-2026-4475 Yi Technology YI Home Camera ipc hard-coded credentials
- CVE-2026-44749 Information Disclosure vulnerability in SAP Gateway
- CVE-2026-44748 XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2026-44747 Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP
- CVE-2026-44746 Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS Java (JDBC Test Servlet)
- CVE-2026-44745 Open Redirect vulnerability in SAP Approuter
- CVE-2026-44744 SQL Injection vulnerability in SAP S/4HANA
- CVE-2026-44743 Security Misconfiguration vulnerability in SAP Business Objects
- CVE-2026-44742 Postorius is vulnerable to XSS
- CVE-2026-44741 Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter
- CVE-2026-44740 go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion
- CVE-2026-4474 itsourcecode University Management System admin_single_student_update.php cross site scripting
- CVE-2026-44739 Pimcore: SQL Injection in Custom Reports Column Configuration
- CVE-2026-44738 Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()