Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 655 of 1013.
- CVE-2026-41985 Use after free in HarmonyOS
- CVE-2026-41984 Use after free in HarmonyOS
- CVE-2026-41983 Null dereference in HarmonyOS
- CVE-2026-41982 Race condition in HarmonyOS
- CVE-2026-41981 Memory corruption in HarmonyOS
- CVE-2026-41980 Missing authorization in HarmonyOS
- CVE-2026-4198 hypermodel-labs mcp-server-auto-commit index.ts getGitChanges command injection
- CVE-2026-41979 Missing authorization in HarmonyOS
- CVE-2026-41978 Missing authorization in HarmonyOS
- CVE-2026-41977 Integer overflow in EMUI
- CVE-2026-41976 Missing authorization in EMUI
- CVE-2026-41975 Missing authorization in HarmonyOS
- CVE-2026-41974 Missing authorization in EMUI
- CVE-2026-41973 Missing authorization in EMUI
- CVE-2026-41972 Path traversal in HarmonyOS
- CVE-2026-41971 Missing authorization in HarmonyOS
- CVE-2026-41970 Memory corruption in EMUI
- CVE-2026-4197 D-Link DNS-1550-04 download_mgr.cgi RSS_Item_List command injection
- CVE-2026-41969 Missing authorization in EMUI
- CVE-2026-41968 Missing authorization in HarmonyOS
- CVE-2026-41967 Missing authorization in HarmonyOS
- CVE-2026-41966 Missing authorization in HarmonyOS
- CVE-2026-41965 Use after free in HarmonyOS
- CVE-2026-41964 Race condition in HarmonyOS
- CVE-2026-41963 Memory corruption in HarmonyOS
- CVE-2026-41962 Missing authorization in HarmonyOS
- CVE-2026-41961 Missing authorization in HarmonyOS
- CVE-2026-41960 Missing authorization in EMUI
- CVE-2026-4196 D-Link DNS-1550-04 remote_backup.cgi cgi_set_rsync_server command injection
- CVE-2026-41959 iControl and tmsh REST vulnerability
- CVE-2026-41958 Path traversal in visidata
- CVE-2026-41957 BIG-IP and BIG-IQ Configuration utility vulnerability
- CVE-2026-41956 BIG-IP TMM Vulnerability
- CVE-2026-41954 iControl REST and tmsh vulnerability
- CVE-2026-41953 BIG-IP Privilege Escalation vulnerability
- CVE-2026-41952 Privilege escalation in Acronis Cyber Protect Cloud Agent
- CVE-2026-41951 Path traversal in GROWI
- CVE-2026-41950 Dify < 1.14.0 Authorization Bypass via File UUID
- CVE-2026-4195 D-Link DNS-1550-04 wizard_mgr.cgi command injection
- CVE-2026-41949 Dify < 1.14.2 Authorization Bypass via File Preview Endpoint
- CVE-2026-41948 Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access
- CVE-2026-41947 Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints
- CVE-2026-41940 WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function
- CVE-2026-4194 D-Link DNS-1550-04 system_mgr.cgi cgi_set_wto access control
- CVE-2026-41939 Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly
- CVE-2026-41938 Vvveb < 1.0.8.2 RCE via Media Upload Handler
- CVE-2026-41937 Vvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload
- CVE-2026-41936 Vvveb < 1.0.8.2 XML External Entity Injection via Import
- CVE-2026-41935 Vvveb < 1.0.8.3 Uncontrolled Recursion Denial of Service
- CVE-2026-41934 Vvveb < 1.0.8.2 Authenticated RCE via Code Editor
- CVE-2026-41933 Vvveb < 1.0.8.3 Directory Listing Information Disclosure
- CVE-2026-41932 Vvveb < 1.0.8.3 Stored XSS via Signup Controller
- CVE-2026-41931 Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler
- CVE-2026-41930 Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin
- CVE-2026-4193 D-Link DIR-823G goahead UpdateClientInfo access control
- CVE-2026-41929 Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor
- CVE-2026-41928 Vvveb < 1.0.8.2 Information Disclosure via Cron Controller
- CVE-2026-41927 WDR201A WiFi Extender Stack-Based Buffer Overflow via firewall.cgi
- CVE-2026-41926 WDR201A WiFi Extender OS Command Injection via firewall.cgi
- CVE-2026-41925 WDR201A WiFi Extender OS Command Injection via adm.cgi (reboot_time)
- CVE-2026-41924 WDR201A WiFi Extender OS Command Injection via makeRequest.cgi
- CVE-2026-41923 WDR201A WiFi Extender OS Command Injection via internet.cgi
- CVE-2026-41922 WDR201A WiFi Extender OS Command Injection via wireless.cgi
- CVE-2026-41921 Koha Stored XSS via Purchase Suggestion Handler
- CVE-2026-41920 Apache Traffic Server: SNI to Host header matching policy is not properly enforced
- CVE-2026-4192 AvinashBole quip-mcp-server index.ts setupToolHandlers command injection
- CVE-2026-41919 Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction
- CVE-2026-41918 Information disclosure in RUGGEDCOM RST2428P
- CVE-2026-41917 OpenKM 6.3.12 Local File Inclusion via Admin Scripting
- CVE-2026-41916 OpenClaw < 2026.4.8 - Stale Authentication State via Config Reload
- CVE-2026-41915 OpenClaw < 2026.4.8 - Git Environment Variable Injection via Unfiltered Exec Environment
- CVE-2026-41914 OpenClaw < 2026.4.8 - Server-Side Request Forgery in QQ Bot Media Fetch Paths
- CVE-2026-41913 OpenClaw < 2026.4.4 - Rate-Limit Bypass via Concurrent Async Authentication Attempts
- CVE-2026-41912 OpenClaw < 2026.4.8 - Server-Side Request Forgery Policy Bypass via Interaction-Triggered Navigation
- CVE-2026-41911 OpenClaw < 2026.4.8 - Workspace-Only Filesystem Policy Bypass via docx upload_file/upload_image
- CVE-2026-41910 OpenClaw < 2026.4.8 - Missing Owner-Only Enforcement in /allowlist Cross-Channel Writes
- CVE-2026-4191 JawherKl node-api-postgres Profile Picture index.js path.extname unrestricted upload
- CVE-2026-41909 OpenClaw < 2026.4.20 - Improper Authorization in Paired-Device Pairing Actions
- CVE-2026-41908 OpenClaw < 2026.4.20 - Scope Enforcement Bypass in Assistant-Media Route
- CVE-2026-41907 uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided
- CVE-2026-41906 FreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypass
- CVE-2026-41905 Server-side request forgery in freescout
- CVE-2026-41904 Cross-site scripting in freescout
- CVE-2026-41903 Missing authorization in freescout
- CVE-2026-41902 FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaks
- CVE-2026-41901 Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions
- CVE-2026-41900 OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment
- CVE-2026-4190 JawherKl node-api-postgres user.js User.getAll sql injection
- CVE-2026-41899 Coolify unauthenticated feedback endpoint allows Discord webhook abuse
- CVE-2026-41898 rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer
- CVE-2026-41897 MantisBT: Reflected XSS in Rendering Dynamic Custom Textarea Field
- CVE-2026-41896 Coolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secret
- CVE-2026-41895 changedetection.io: XXE vulnerability in the changedetection.io project
- CVE-2026-41894 SiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in `/export/` Endpoint
- CVE-2026-41893 Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)
- CVE-2026-41891 CI4MS: Deactivated User Session Bypass (active=0)
- CVE-2026-41890 CI4MS: Arbitrary Database Table Drop via Theme deleteProcess
- CVE-2026-4189 phpipam Section edit-result.php sql injection
- CVE-2026-41889 pgx: SQL Injection via placeholder confusion with dollar quoted string literals
- CVE-2026-41888 Distribution: Tag deletion bypasses `storage.delete.enabled` configuration