Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 645 of 1013.
- CVE-2026-43027 netfilter: nf_conntrack_helper: pass helper to expect cleanup
- CVE-2026-43026 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
- CVE-2026-43025 netfilter: ctnetlink: ignore explicit helper on new expectations
- CVE-2026-43024 netfilter: nf_tables: reject immediate NF_QUEUE verdict
- CVE-2026-43023 Bluetooth: SCO: fix race conditions in sco_sock_connect()
- CVE-2026-43022 Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
- CVE-2026-43021 Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails
- CVE-2026-43020 Bluetooth: MGMT: validate LTK enc_size on load
- CVE-2026-4302 WowOptin: Next-Gen Popup Maker <= 1.4.29 - Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST API
- CVE-2026-43019 Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
- CVE-2026-43018 Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
- CVE-2026-43017 Bluetooth: MGMT: validate mesh send advertising payload length
- CVE-2026-43016 bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready().
- CVE-2026-43015 net: macb: fix clk handling on PCI glue driver removal
- CVE-2026-43014 net: macb: properly unregister fixed rate clocks
- CVE-2026-43013 net/mlx5: lag: Check for LAG device before creating debugfs
- CVE-2026-43012 net/mlx5: Fix switchdev mode rollback in case of failure
- CVE-2026-43011 net/x25: Fix potential double free of skb
- CVE-2026-43010 bpf: Reject sleepable kprobe_multi programs at attach time
- CVE-2026-4301 Missing authorization in Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings
- CVE-2026-43009 bpf: Fix incorrect pruning due to atomic fetch precision tracking
- CVE-2026-43008 gpio: qixis-fpga: Fix error handling for devm_regmap_init_mmio()
- CVE-2026-43007 accel/qaic: Handle DBC deactivation if the owner went away
- CVE-2026-43006 io_uring/rsrc: reject zero-length fixed buffer import
- CVE-2026-43005 hwmon: (tps53679) Fix array access with zero-length block read
- CVE-2026-43004 spi: stm32-ospi: Fix resource leak in remove() callback
- CVE-2026-43003 OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere
- CVE-2026-43002 OpenStack Horizon has Incorrect Behavior Order
- CVE-2026-43001 OpenStack Keystone has an Incorrect Authorization Issue
- CVE-2026-43000 OpenStack Keystone has an Incorrect Authorization issue
- CVE-2026-4300 Robo Gallery <= 5.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Loading Label' Setting
- CVE-2026-42999 OpenStack Keystone has an Authorization Bypass
- CVE-2026-42998 OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential
- CVE-2026-42997 OpenStack Ironic has an Incorrect Resource Transfer Between Spheres
- CVE-2026-42996 Memory corruption in JS8Call
- CVE-2026-42994 Supply chain in Bitwarden CLI
- CVE-2026-42993 Remote Desktop Client Remote Code Execution Vulnerability
- CVE-2026-42992 Remote Desktop Client Remote Code Execution Vulnerability
- CVE-2026-42991 Windows Push Notifications Elevation of Privilege Vulnerability
- CVE-2026-42990 SQL Server ODBC driver Elevation of Privilege Vulnerability
- CVE-2026-4299 Missing authorization in MainWP Child Reports
- CVE-2026-42989 Winlogon Elevation of Privilege Vulnerability
- CVE-2026-42987 Windows Deployment Services (WDS) Remote Code Execution
- CVE-2026-42986 Microsoft Graphics Component Elevation of Privilege Vulnerability
- CVE-2026-42985 Remote Desktop Client Remote Code Execution Vulnerability
- CVE-2026-42984 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-42983 Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2026-42982 Windows Secure Kernel Mode Elevation of Privilege Vulnerability
- CVE-2026-42981 Windows Performance Monitor Remote Code Execution Vulnerability
- CVE-2026-42980 NT OS Kernel Elevation of Privilege Vulnerability
- CVE-2026-4298 DSGVO All in one for WP <= 4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
- CVE-2026-42979 Windows Push Notifications Elevation of Privilege Vulnerability
- CVE-2026-42978 Windows Push Notifications Elevation of Privilege Vulnerability
- CVE-2026-42977 Windows Push Notifications Elevation of Privilege Vulnerability
- CVE-2026-42976 Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability
- CVE-2026-42975 Windows Bluetooth Port Driver Remote Code Execution
- CVE-2026-42974 Windows Performance Monitor Remote Code Execution Vulnerability
- CVE-2026-42973 Windows Push Notification Information Disclosure Vulnerability
- CVE-2026-42972 Windows Hyper-V Information Disclosure Vulnerability
- CVE-2026-42971 Windows Push Notification Information Disclosure Vulnerability
- CVE-2026-42970 Windows Push Notification Information Disclosure Vulnerability
- CVE-2026-4297 Missing authorization in Welcome Software Publishing
- CVE-2026-42969 Windows Push Notification Information Disclosure Vulnerability
- CVE-2026-42968 Windows Telephony Server Information Disclosure Vulnerability
- CVE-2026-42965 Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation
- CVE-2026-42961 Cross-site request forgery in WAB-BE187-M
- CVE-2026-42960 Possible cache poisoning via promiscuous records for the authority section
- CVE-2026-4296 Auth bypass in Enterprise Server
- CVE-2026-42959 Crash during DNSSEC validation of malicious content
- CVE-2026-42958 Use After Free in Labcenter Proteus
- CVE-2026-42955 Business logic in Unbound
- CVE-2026-42953 Out-of-bounds write in Labcenter Proteus
- CVE-2026-42952 Hydro-Québec Le Circuit Electrique charging station backend Improper Restriction of Excessive Authentication Attempts
- CVE-2026-42951 MacGregor Voyage Data Recorder (VDR) G4e Insufficiently Protected Credentials
- CVE-2026-42950 Other in WAB-BE187-M
- CVE-2026-4295 Arbitrary code execution via crafted project files in Kiro IDE
- CVE-2026-42949 Missing authorization in Frangoteam
- CVE-2026-42948 Cross-site scripting in WAB-BE187-M
- CVE-2026-42947 Naxclow IoT Platform Authorization bypass through User-Controlled key
- CVE-2026-42946 NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability
- CVE-2026-42945 NGINX ngx_http_rewrite_module vulnerability
- CVE-2026-42944 Heap overflow with multiple NSID, COOKIE, PADDING EDNS options
- CVE-2026-42941 MacGregor Voyage Data Recorder (VDR) G4e Use of Default Credentials
- CVE-2026-42937 iControl REST and tmsh vulnerability
- CVE-2026-42936 Other in HYPER SBI 2
- CVE-2026-42934 NGINX ngx_http_charset_module vulnerability
- CVE-2026-42933 Unintended Proxy or Intermediary in Panduit IntraVUE by Pronetiqs
- CVE-2026-42932 Naxclow IoT Platform Generation of Predictable Numbers or Identifiers
- CVE-2026-42931 Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
- CVE-2026-42930 Appliance mode iControl REST vulnerability
- CVE-2026-4293 Kieback & Peter DDC Building Controllers Cross-site Scripting
- CVE-2026-42929 MacGregor Voyage Data Recorder (VDR) G4e Use of Hard-coded Credentials
- CVE-2026-42926 NGINX ngx_http_proxy_v2_module vulnerability
- CVE-2026-42924 BIG-IP iControl SOAP vulnerability
- CVE-2026-42923 Degradation of service with unbounded NSEC3 hash calculations
- CVE-2026-42922 Missing authorization in Frangoteam
- CVE-2026-42920 BIG-IP DTLS Vulnerability
- CVE-2026-4292 Privilege abuse in ModelAdmin.list_editable
- CVE-2026-42919 F5 BIG-IP Appliance Mode Vulnerability
- CVE-2026-42916 NT OS Kernel Elevation of Privilege Vulnerability