Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 668 of 1013.
- CVE-2026-40503 OpenHarness Path Traversal Information Disclosure via /memory show
- CVE-2026-40502 OpenHarness Remote Administrative Command Injection via Gateway Handler
- CVE-2026-40501 Cherry Studio RCE via SearchService nodeIntegration Misconfiguration
- CVE-2026-40499 radare2 < 6.1.4 Command Injection via PDB Parser print_gvars()
- CVE-2026-40498 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron
- CVE-2026-40497 FreeScout Vulnerable to CSS Injection via Stored Style Tag in Mailbox Signature (CSRF Token Exfiltration)
- CVE-2026-40496 FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force
- CVE-2026-40495 FOSSBilling version exposed via asset cache buster
- CVE-2026-40494 SAIL has heap buffer overflow in TGA RLE decoder — raw packet path missing bounds check
- CVE-2026-40493 SAIL has heap buffer overflow in PSD decoder — bpp mismatch in LAB 16-bit mode
- CVE-2026-40492 SAIL has heap buffer overflow in XWD decoder — bits_per_pixel vs pixmap_depth type confusion in byte-swap
- CVE-2026-40491 gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall
- CVE-2026-40490 AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects
- CVE-2026-40489 editorconfig-core-c has incomplete fix for CVE-2023-0341
- CVE-2026-40488 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution
- CVE-2026-40487 Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS
- CVE-2026-40486 Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate
- CVE-2026-40485 ChurchCRM: Username Enumeration via Differential Response in Public Login API
- CVE-2026-40484 ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function
- CVE-2026-40483 ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field
- CVE-2026-40482 ChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanString}`
- CVE-2026-40481 monetr: Unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation
- CVE-2026-40480 ChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}`
- CVE-2026-4048 Command injection in ECS Connections Manager
- CVE-2026-40479 Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget
- CVE-2026-40478 Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf
- CVE-2026-40477 Improper restriction of the scope of accessible objects in Thymeleaf expressions
- CVE-2026-40476 graphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation
- CVE-2026-40474 wger has Broken Access Control in the Global Gym Configuration Update Endpoint
- CVE-2026-40473 Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP
- CVE-2026-40472 Hackage package metadata stored XSS vulnerability
- CVE-2026-40471 Hackage CSRF vulnerability
- CVE-2026-40470 Hackage package and doc upload stored XSS vulnerability
- CVE-2026-40469 Heap buffer overflow in gawk
- CVE-2026-40468 Heap buffer overflow in gawk
- CVE-2026-40467 Use after free in gawk
- CVE-2026-40466 Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection
- CVE-2026-40465 An Open Re-direct Vulnerability in Nokia NSP
- CVE-2026-40464 A Stored Cross-Site Scripting (XSS) Vulnerability in Nokia NSP
- CVE-2026-40463 An Insufficient Role-based Access Control Vulnerability in WaveSuite
- CVE-2026-40462 iControl REST and tmsh vulnerability
- CVE-2026-40461 Anviz Products Missing Authentication for Critical Function
- CVE-2026-40460 NGINX ngx_quic_module vulnerability
- CVE-2026-4046 iconv crash due to assertion failure with untrusted input
- CVE-2026-40459 LDAP Injection in PAC4J
- CVE-2026-40458 Cross-Site Request Forgery in PAC4J
- CVE-2026-40457 Reflected XSS in LMS
- CVE-2026-40456 OS Command Injection in LMS
- CVE-2026-40455 SQL Injection in LMS
- CVE-2026-40454 Memory corruption in Apache IoTDB C++ client
- CVE-2026-40453 Apache Camel has an incomplete fix for CVE-2025-27636
- CVE-2026-40452 Missing authorization in Apache IoTDB
- CVE-2026-40451 Cross-site scripting in Chrome browser extension
- CVE-2026-40450 Integer overflow in ONE
- CVE-2026-4045 projectsend Auth.php response discrepancy
- CVE-2026-40449 Integer overflow in ONE
- CVE-2026-40448 Integer overflow in ONE
- CVE-2026-40447 Integer overflow in Escargot
- CVE-2026-40446 Memory corruption in Escargot
- CVE-2026-4044 projectsend Delete import-orphans.php realpath path traversal
- CVE-2026-40436 ZTE ZXEDM iEMS product has a password reset vulnerability
- CVE-2026-40435 BIG-IP httpd access control vulnerability
- CVE-2026-40434 Anviz CrossChex Standard Improper Verification of Source of a Communication Channel
- CVE-2026-40431 SenseLive X3050 Cleartext transmission of sensitive information
- CVE-2026-40430 Plaintext Storage of a Password in Panduit IntraVUE by Pronetiqs
- CVE-2026-4043 Tenda i12 wifiSSIDget formwrlSSIDget stack-based overflow
- CVE-2026-40425 MacGregor Voyage Data Recorder (VDR) G4e Files or Directories Accessible to External Parties
- CVE-2026-40423 BIG-IP SIP profile vulnerability
- CVE-2026-40422 Windows File Explorer Information Disclosure Vulnerability
- CVE-2026-40421 Microsoft Word Information Disclosure Vulnerability
- CVE-2026-40420 Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
- CVE-2026-4042 Tenda i12 WifiMacFilterGet formWifiMacFilterGet stack-based overflow
- CVE-2026-40419 Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
- CVE-2026-40418 Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
- CVE-2026-40417 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
- CVE-2026-40416 Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
- CVE-2026-40415 Windows TCP/IP Remote Code Execution Vulnerability
- CVE-2026-40414 Windows TCP/IP Denial of Service Vulnerability
- CVE-2026-40413 Windows TCP/IP Denial of Service Vulnerability
- CVE-2026-40412 Azure Orbital Spatio Remote Code Execution Vulnerability
- CVE-2026-40411 Azure Virtual Network Gateway Remote Code Execution Vulnerability
- CVE-2026-40410 Windows SMB Client Elevation of Privilege Vulnerability
- CVE-2026-4041 Tenda i12 exeCommand vos_strcpy stack-based overflow
- CVE-2026-40409 Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
- CVE-2026-40408 Windows WAN ARP Driver Elevation of Privilege Vulnerability
- CVE-2026-40407 Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CVE-2026-40406 Windows TCP/IP Information Disclosure Vulnerability
- CVE-2026-40405 Windows TCP/IP Denial of Service Vulnerability
- CVE-2026-40404 Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
- CVE-2026-40403 Windows Graphics Component Remote Code Execution Vulnerability
- CVE-2026-40402 Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2026-40401 Windows TCP/IP Denial of Service Vulnerability
- CVE-2026-40400 Windows PowerShell Remote Code Execution Vulnerability
- CVE-2026-4040 OpenClaw File Existence tools.exec.safeBins information exposure
- CVE-2026-40399 Windows TCP/IP Elevation of Privilege Vulnerability
- CVE-2026-40398 Windows Remote Desktop Services Elevation of Privilege Vulnerability
- CVE-2026-40397 Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CVE-2026-40396 Denial of service in Varnish Cache
- CVE-2026-40395 Denial of service in Varnish Enterprise
- CVE-2026-40394 Denial of service in Varnish Cache