Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 681 of 1013.
- CVE-2026-38718 Memory corruption in inhandnetworks:ir912l-fq58 firmware
- CVE-2026-38717 Command injection in inhandnetworks:ir912l-fq58 firmware
- CVE-2026-38716 Command injection in inhandnetworks:ir912l-fq58 firmware
- CVE-2026-38715 Command injection in inhandnetworks:ir912l-fq58 firmware
- CVE-2026-38714 Command injection in inhandnetworks:ir912l-fq58 firmware
- CVE-2026-38713 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2
- CVE-2026-38711 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2
- CVE-2026-38710 TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock interface.
- CVE-2026-3871 Memory corruption in VMG4005-B50B firmware
- CVE-2026-38709 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2
- CVE-2026-38708 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2
- CVE-2026-38707 Command injection in inhandnetworks:ir302 firmware
- CVE-2026-38704 Command injection in inhandnetworks:ir302 firmware
- CVE-2026-38703 Command injection in inhandnetworks:ir302 firmware
- CVE-2026-38702 Command injection in inhandnetworks:ir302 firmware
- CVE-2026-3870 Memory corruption in VMG4005-B50B firmware
- CVE-2026-3869 Auth bypass in Modicon M580
- CVE-2026-3868 Memory corruption in EDR-8010 Series
- CVE-2026-38671 Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed ve
- CVE-2026-3867 Information disclosure in EDR-8010 Series
- CVE-2026-38669 wCMS v.1.4 is vulnerable to Cross Site Scripting (XSS) when creating a new blog.
- CVE-2026-38651 Netmaker does not verify JWT signatures for host tokens
- CVE-2026-38641 An issue in the DSO::mmap_and_copy function of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via loading a crafted shared library.
- CVE-2026-38640 A reachable unwrap in the __assert_fail function (/assert/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS
- CVE-2026-3864 CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server
- CVE-2026-38639 An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of Service (DoS) via parsing a crafted input.
- CVE-2026-38638 An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2026-38637 An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2026-38636 An issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2026-38626 Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php.
- CVE-2026-3862 Cross-Site Scripting Vulnerability in SiteMinder Administrative UI
- CVE-2026-38615 DedeCMS V5.7.118 is vulnerable to Command Execution in file_manage_control.php.
- CVE-2026-3861 Denial of service in LINE client for iOS
- CVE-2026-38587 An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ONLYOFFICE DocSpace before 3.2.1.
- CVE-2026-38581 SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attackers to execute arbitrary SQL commands via
- CVE-2026-38579 Multiple reflected Cross-Site Scripting (XSS) vulnerabilities in damasac thaipalliative_lte through version 3.0 allow remote attackers to in
- CVE-2026-38577 Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access.
- CVE-2026-38571 Cleartext storage and exposure of WPA2 credentials, and missing authentication on the rr/wr memory read/write commands, in the unauthenticat
- CVE-2026-38570 bacnet_stack 1.3.1 contains an Out-of-bounds Read in bacnet_tag_number_decode which allows attackers to cause a denial of service.
- CVE-2026-3857 Cross-Site Request Forgery (CSRF) in GitLab
- CVE-2026-38569 HireFlow v1.2 is vulnerable to Cross Site Scripting (XSS) in candidate_detail.html via the Resume or Feedback Comment fields via POST /candi
- CVE-2026-38568 HireFlow v1.2 is vulnerable to Incorrect Access Control.
- CVE-2026-38567 HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints.
- CVE-2026-38566 HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint.
- CVE-2026-3856 IBM Db2 Recovery Expert Missing Integrity Check
- CVE-2026-3855 Improper Control of Resource Identifiers ('Resource Injection') in GitLab
- CVE-2026-3854 Remote code execution via git push option injection in GitHub Enterprise Server
- CVE-2026-38533 Missing authorization in snipeitapp:snipe-it
- CVE-2026-38532 Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php
- CVE-2026-38530 Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php
- CVE-2026-3853 Cross-site scripting in Divi
- CVE-2026-38529 Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php
- CVE-2026-38528 Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rotten_lead parameter at /Lead/LeadDataGrid.php.
- CVE-2026-38527 Webkul Krayin CRM has Server-Side Request Forgery (SSRF)
- CVE-2026-38526 An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to e
- CVE-2026-3852 Cross-site scripting in Divi
- CVE-2026-3851 Cross-site scripting in Divi
- CVE-2026-3850 Cross-site scripting in Divi
- CVE-2026-3849 Buffer Overflow in HPKE via Oversized ECH Config
- CVE-2026-3848 Improper Neutralization of CRLF Sequences ('CRLF Injection') in GitLab
- CVE-2026-38474 GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP l
- CVE-2026-38473 A Stored XSS vulnerability in the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 al
- CVE-2026-38472 A Stored XSS vulnerability in forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows
- CVE-2026-38470 A Broken access control vulnerability in the API user endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446
- CVE-2026-3847 Memory safety bugs fixed in Firefox 148.0.2
- CVE-2026-38469 A Stored XSS vulnerability in the custom bonus title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d1844644
- CVE-2026-38468 A SQL injection vulnerability in the country-code lookup endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18
- CVE-2026-38467 A SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows re
- CVE-2026-38466 A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864
- CVE-2026-38465 A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a48648
- CVE-2026-3846 Same-origin policy bypass in the CSS Parsing and Computation component
- CVE-2026-38450 An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitrary code via the name and description par
- CVE-2026-3845 Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android
- CVE-2026-38447 osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing.
- CVE-2026-38446 A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field.
- CVE-2026-38444 osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name.
- CVE-2026-3844 Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
- CVE-2026-38432 Cross-site scripting in frappe:erpnext
- CVE-2026-38431 Code injection in frappe:erpnext
- CVE-2026-3843 SQL Injection in Nefteprodukttekhnika BUK TS-G Allows Remote Code Execution
- CVE-2026-38429 OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplie
- CVE-2026-38428 SQL injection in kestra:kestra
- CVE-2026-38427 An issue in fetch_jpg() in xdrv_10_scripter.ino in Tasmota through 15.3.0.3 allows a remote attacker to cause heap buffer overflow.
- CVE-2026-38426 Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary code via the xdrv_10_sc
- CVE-2026-38422 Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary code via the tasmota/ta
- CVE-2026-3842 Qemu-kvm: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host oob write
- CVE-2026-3841 Command Injection Vulnerability in Telnet CLI on TP-Link TL-MR6400
- CVE-2026-3840 Path Traversal in kedro-org/kedro
- CVE-2026-3839 Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability
- CVE-2026-3838 Unraid Update Request Path Traversal Remote Code Execution Vulnerability
- CVE-2026-3837 Frappe Framework 16.10.0 - Stored DOM XSS in Multiple Field Formatters
- CVE-2026-38361 Denial of service in fohrloop:dash-uploader
- CVE-2026-38360 dash-uploader has a directory traversal vulnerability
- CVE-2026-38350 An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Den
- CVE-2026-3835 Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access
- CVE-2026-38349 An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial
- CVE-2026-38348 An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) v
- CVE-2026-38347 A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to caus
- CVE-2026-38346 An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial
- CVE-2026-38345 A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows atta