Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 646 of 1013.
- CVE-2026-42915 Microsoft Windows VMSwitch Denial of Service Vulnerability
- CVE-2026-42914 Windows Kerberos Denial of Service Vulnerability
- CVE-2026-42913 Remote Desktop Client Remote Code Execution Vulnerability
- CVE-2026-42912 Windows Telephony Service Elevation of Privilege Vulnerability
- CVE-2026-42911 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-42910 Windows Hotpatch Monitoring Service Elevation of Privilege Vulnerability
- CVE-2026-42909 Remote Desktop Client Remote Code Execution Vulnerability
- CVE-2026-42908 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
- CVE-2026-42907 Windows Shell Information Disclosure Vulnerability
- CVE-2026-42906 Windows Shell Information Disclosure Vulnerability
- CVE-2026-42905 Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2026-42904 Windows TCP/IP Elevation of Privilege Vulnerability
- CVE-2026-42903 Windows Kerberos Denial of Service Vulnerability
- CVE-2026-42902 Microsoft PowerToys Elevation of Privilege Vulnerability
- CVE-2026-42901 Microsoft Entra ID Elevation of Privilege Vulnerability
- CVE-2026-42900 Microsoft Windows App Store Elevation of Privilege Vulnerability
- CVE-2026-4290 WP Travel Pro <= 10.6.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators
- CVE-2026-42899 ASP.NET Core Denial of Service Vulnerability
- CVE-2026-42898 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
- CVE-2026-42897 Microsoft Exchange Server Cross-Site Scripting
- CVE-2026-42896 Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2026-42895 Microsoft Copilot Tampering Vulnerability
- CVE-2026-42893 Microsoft Outlook for iOS Tampering Vulnerability
- CVE-2026-42891 Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
- CVE-2026-42890 actual Allows Electron to Run As Node
- CVE-2026-4289 Tiandy Easy7 Integrated Management Platform getRecByTemplateId sql injection
- CVE-2026-42889 Relay Server WebSocket authentication bypass when token is omitted
- CVE-2026-42888 Audiobookshelf: Path Traversal vulnerability in the audiobookshelf project
- CVE-2026-42887 Audiobookshelf: Stored Cross-Site Scripting in Login Page Custom Message
- CVE-2026-42886 Audiobookshelf: Memory amplification DoS via oversized compressed details entry in backup upload
- CVE-2026-42885 Audiobookshelf: Path prefix bypass in filesystem existence check leaks out-of-scope file existence
- CVE-2026-42884 Audiobookshelf: Collection endpoints bypass library access controls exposing restricted library data
- CVE-2026-42883 Audiobookshelf: Cross-library file exfiltration via unscoped bulk download endpoint
- CVE-2026-42882 oxyno-zeta/s3-proxy: Security Issues in Resource Path Matching
- CVE-2026-42881 STIGQter: Arbitrary File Write leading to Local Code Execution via Export HTML
- CVE-2026-42880 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
- CVE-2026-4288 Tiandy Easy7 Integrated Management Platform Endpoint getDevDetailedInfo sql injection
- CVE-2026-42879 FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images
- CVE-2026-42878 FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts
- CVE-2026-42877 FacturaScripts: Stored XSS via product reference in sales/purchases
- CVE-2026-42876 External Secrets Operator: Privilege escalation with secret overwriting
- CVE-2026-42875 External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore
- CVE-2026-42874 Microdot: HTTP response splitting in Response.set_cookie()
- CVE-2026-42873 WeGIA: Error Handling Upload DocDependente
- CVE-2026-42872 WeGIA: Reflected XSS in listar_arquivos_etapa.php
- CVE-2026-42871 WeGIA: Error Handling familiar_docfamiliar
- CVE-2026-42870 WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao'
- CVE-2026-4287 Tiandy Easy7 Integrated Management Platform Endpoint queryResources sql injection
- CVE-2026-42869 Hardcoded credentials in CoPilot
- CVE-2026-42867 Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint
- CVE-2026-42866 Tookie: Arbitrary file write via path traversal in -u username / -U userfile output filename
- CVE-2026-42865 Inbox Zero: Cross-account cleaner email stream exposure
- CVE-2026-42864 FireFighter: Unauthenticated SSRF in Raid jira_bot endpoint allows IAM credential theft
- CVE-2026-42863 Flowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow Reassignment
- CVE-2026-42862 Flowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource Reassignment
- CVE-2026-42861 Flowise: Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource Reassignment
- CVE-2026-42860 Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint
- CVE-2026-4286 Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update
- CVE-2026-42859 Neat VNC: Buffer overflow due to oversized RSA public keys
- CVE-2026-42858 Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint
- CVE-2026-42857 Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization
- CVE-2026-42856 Network-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool calls
- CVE-2026-42855 arduino-esp32: Digest authentication URI mismatch bypass in WebServer allows cross-resource replay attack
- CVE-2026-42854 arduino-esp32: Stack buffer overflow in WebServer multipart boundary parsing leads to remote crash potential RCE
- CVE-2026-42853 @apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input
- CVE-2026-42851 @kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE
- CVE-2026-42850 Kitty has a shell command injection
- CVE-2026-4285 taoofagi easegen-admin Pdf2MdUtil.java recognizeMarkdown path traversal
- CVE-2026-42849 authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover
- CVE-2026-42847 ClipBucket: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- CVE-2026-42846 ClipBucket: Remote Play URL Command Injection
- CVE-2026-42845 Grav: Anonymous Page Content Overwrite via Form File Upload filename Override
- CVE-2026-42844 Grav: Low-privileged API users can create super-admin accounts via blueprint-upload
- CVE-2026-42843 grav-plugin-api: Grav API Privilege Escalation to Super Admin
- CVE-2026-42842 grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel
- CVE-2026-42841 Grav: Stored XSS via Markdown media attribute() action in Grav CMS
- CVE-2026-42840 ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals
- CVE-2026-4284 taoofagi easegen-admin PPT File PPTUtil.java downloadFile server-side request forgery
- CVE-2026-42839 ERPNext 16.16.0 - Stored XSS in POS cart item rendering
- CVE-2026-42838 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- CVE-2026-42837 Windows Projected File System Elevation of Privilege Vulnerability
- CVE-2026-42836 Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability
- CVE-2026-42835 Microsoft Teams for Android Information Disclosure Vulnerability
- CVE-2026-42834 Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability
- CVE-2026-42833 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
- CVE-2026-42832 Microsoft Office Spoofing Vulnerability
- CVE-2026-42831 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-42830 Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability
- CVE-2026-4283 WP DSGVO Tools (GDPR) <= 3.1.38 - Missing Authorization to Unauthenticated Account Destruction of Non-Admin Users
- CVE-2026-42829 Windows Administrator Protection Secure Feature Bypass Vulnerability
- CVE-2026-42828 Windows Projected File System Elevation of Privilege Vulnerability
- CVE-2026-42827 M365 Copilot Information Disclosure Vulnerability
- CVE-2026-42826 Azure DevOps Information Disclosure Vulnerability
- CVE-2026-42825 Windows Telephony Service Elevation of Privilege Vulnerability
- CVE-2026-42824 M365 Copilot Information Disclosure Vulnerability
- CVE-2026-42823 Azure Logic Apps Elevation of Privilege Vulnerability
- CVE-2026-42822 Azure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability
- CVE-2026-4282 Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw
- CVE-2026-42812 Apache Polaris: No protection on `write.metadata.path`
- CVE-2026-42811 Apache Polaris has an Improper Input Validation issue