Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 680 of 1013.
- CVE-2026-3911 Keycloak: Information disclosure of disabled user attributes via administrative endpoint
- CVE-2026-39109 SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 within the username parameter
- CVE-2026-39107 A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature.
- CVE-2026-39103 Memory corruption in gpac:gpac
- CVE-2026-3910 Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer
- CVE-2026-3909 Google Skia Out-of-Bounds Write
- CVE-2026-39087 ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function
- CVE-2026-39079 An issue in prestashop upsshipping all versions through at least 2.4.0 allows a remote attacker to obtain sensitive information via the /mod
- CVE-2026-39071 WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field.
- CVE-2026-39070 WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature.
- CVE-2026-3907 Hostel <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wphostel-book' Shortcode
- CVE-2026-3906 WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API
- CVE-2026-39054 Oinone Pamirs 7.0.0 contains a command injection vulnerability in CommandHelper.executeCommands.
- CVE-2026-39053 Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic.
- CVE-2026-39052 Oinone Pamirs 7.0.0 contains a code execution vulnerability via ScriptRunner.
- CVE-2026-39047 Buffer Overflow vulnerability in EPSON L14150 FL27PB allows a remote attacker to execute arbitrary code via the RAW Printing Service (JetDir
- CVE-2026-39042 An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a
- CVE-2026-39040 BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in ExpressionViewModal.jsx.
- CVE-2026-3904 Race condition in glibc
- CVE-2026-39039 In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the brow
- CVE-2026-39038 BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenericNumerixTable.jsx.
- CVE-2026-39031 Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials.
- CVE-2026-3903 Modular Connector <= 2.5.1 - Cross-Site Request Forgery via postConfirmOauth
- CVE-2026-39020 An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service via a crafted Wavefront OBJ file
- CVE-2026-3902 ASGI header spoofing via underscore/hyphen conflation
- CVE-2026-39007 An issue in Observeinc's Observe v.2026-01-28 and before allows a remote attacker to obtain sensitive information via the CSV Log export component.
- CVE-2026-39006 SNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component
- CVE-2026-38999 A Null Pointer Dereference in the mk_sched_event_close function (mk_server/mk_scheduler.c) of Monkey through commit 4fb0c16 allows attackers
- CVE-2026-38998 A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02.
- CVE-2026-38993 Cockpit is vulnerable to directory traversal
- CVE-2026-38992 Cockpit is vulnerable to arbitrary code execution
- CVE-2026-38991 Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type
- CVE-2026-38979 ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI.
- CVE-2026-38978 transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.
- CVE-2026-38976 mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() / OP_SUPER due to a missing runtime guard for top-level super.
- CVE-2026-38974 Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.
- CVE-2026-38973 mrubyc through release3.4.1 was found to contain an out-of-bounds read in builtin missing-method lookup inside mrbc_find_method().
- CVE-2026-38972 Other in rizonesoft:notepad3
- CVE-2026-38971 Memory corruption in ardupilot:arduplane
- CVE-2026-38970 pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go.
- CVE-2026-3897 Missing authorization in Livemesh Addons for Beaver Builder
- CVE-2026-38968 Weak cryptography in ntop:ntopng
- CVE-2026-38967 CrowCpp Crow through v1.3.1 HTTP is vulnerable to response header injection via unvalidated response header values.
- CVE-2026-38961 Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1)
- CVE-2026-3896 Livemesh SiteOrigin Widgets <= 3.9.2 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
- CVE-2026-38950 An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files.
- CVE-2026-3895 Missing authorization in WPBakery Page Builder Addons by Livemesh
- CVE-2026-38949 Cross-Site Scripting (XSS) vulnerability exists in HTMLy version 3.1.1 in the content creation functionality at the /add/content?type=image endpoint.
- CVE-2026-38948 Cross-Site Scripting (XSS) vulnerability exists in FUEL CMS v1.5.2 and before within the asset upload functionality.
- CVE-2026-38947 FluentCMS 1.2.3 is vulnerable to Cross Site Scripting (XSS) in TextHTML plugin.
- CVE-2026-38945 Command injection in Raynet rvia version 12.6 Update 8 and previous versions allows adversaries to execute arbitrary code via a crafted path
- CVE-2026-38940 Cross Site Scripting vulnerability in RafyMrX TOKO-ONLINE-ROTI v.1.0 allows a remote attacker to execute arbitrary code via the detail_produ
- CVE-2026-3894 Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.
- CVE-2026-38939 Cross Site Scripting vulnerability in andrewtch88 mvc-ecommerce v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitiv
- CVE-2026-38936 A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains
- CVE-2026-38935 A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/view.php via the doctype parameter
- CVE-2026-38934 Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5.
- CVE-2026-38931 A stored cross-site scripting (XSS) vulnerability in the /admin/config-module.php component of creatorsofcode simplephp GitHub commit 5184cf
- CVE-2026-38930 OpenRapid RapidCMS v1.3.1 was discovered to contain an authentication bypass in the /template/default/menu.php component.
- CVE-2026-3893 Carlson Software VASCO-B GNSS Receiver Missing Authentication for Critical Function
- CVE-2026-38924 Misconfiguration in Serena
- CVE-2026-3892 Path traversal in Motors – Car Dealership & Classified Listings Plugin
- CVE-2026-3891 Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
- CVE-2026-38891 An improper input validation in the gazebo_ros_diff_drive.cpp component of gazebo_plugins v3.9.0 allows attackers to cause a Denial of Servi
- CVE-2026-3889 Spoofing issue in Thunderbird
- CVE-2026-3888 Local Privilege Escalation in snapd
- CVE-2026-3885 Cross-site scripting in Shortcodes Ultimate – Content Elements
- CVE-2026-3884 Cross-site scripting in spin.js
- CVE-2026-38835 Command injection in tenda:w30e firmware
- CVE-2026-38834 Command injection in tenda:w30e firmware
- CVE-2026-38822 Command injection in openNDS
- CVE-2026-38821 Memory corruption in openNDS
- CVE-2026-38820 Command injection in openNDS
- CVE-2026-38819 Denial of service in openNDS
- CVE-2026-38812 RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint.
- CVE-2026-3881 Performance Monitor <= 1.0.6 - Unauthenticated Blind SSRF
- CVE-2026-38808 SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /O
- CVE-2026-38807 Insecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attacker to escalate privileges via the UserController.java component
- CVE-2026-3880 Stored XSS Vulnerability
- CVE-2026-3879 Stored XSS Vulnerability
- CVE-2026-3878 WP Docs <= 2.2.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]'
- CVE-2026-3877 Reflected Cross-Site Scripting in Dashboard Search
- CVE-2026-38766 An issue in Unistal Systems Pvt.
- CVE-2026-38765 An issue in Unistal Systems Pvt.
- CVE-2026-38764 An issue in Unistal Systems Pvt.
- CVE-2026-38763 An issue in Unistal Systems Pvt.
- CVE-2026-3876 Prismatic <= 3.7.3 - Unauthenticated Stored Cross-Site Scripting via 'prismatic_encoded' Pseudo-Shortcode
- CVE-2026-38755 Memory corruption in BusyBox
- CVE-2026-38754 Memory corruption in BusyBox
- CVE-2026-38753 Use after free in BusyBox
- CVE-2026-38752 Memory corruption in BusyBox
- CVE-2026-38751 OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality
- CVE-2026-3875 BetterDocs <= 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-38743 Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities
- CVE-2026-38740 Foscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of Sensitive Information.
- CVE-2026-3873 Legacy built-in user account
- CVE-2026-38728 smtp-server's command parser memory exhaustion denial-of-service
- CVE-2026-38725 xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and cont
- CVE-2026-3872 Keycloak: keycloak: information disclosure due to redirect_uri validation bypass
- CVE-2026-38719 OpENer v2.3-558-g1e99582 contains an out-of-bounds read vulnerability in the Common Packet Format (CPF) parser, specifically in CreateCommon