Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 682 of 1013.
- CVE-2026-38344 A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to caus
- CVE-2026-38343 An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (Do
- CVE-2026-38332 Memory corruption in TinyEXIF
- CVE-2026-3833 Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison
- CVE-2026-38329 Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin.
- CVE-2026-3832 Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response
- CVE-2026-3831 Missing authorization in Database for Contact Form 7, WPforms, Elementor forms
- CVE-2026-3830 Product Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQLi
- CVE-2026-3829 Missing authorization in WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan
- CVE-2026-3828 Command injection in DS-3E1310P-SI
- CVE-2026-3826 WellChoose｜IFTOP - Local File Inclusion
- CVE-2026-3825 WellChoose｜IFTOP - Reflected Cross-site Scripting
- CVE-2026-3824 WellChoose｜IFTOP - Open redirect
- CVE-2026-3823 Atop Technologies｜EHG2408 series switch - Stack-based Buffer Overflow
- CVE-2026-3822 Taipower｜Taipower APP(Android) - Improper Certificate Validation
- CVE-2026-3821 Supermicro SMASH service contain an Arbitrary code execution issue
- CVE-2026-3820 Supermicro BMC's SMTP service contains a command injection vulnerability
- CVE-2026-3819 SourceCodester Resort Reservation System Reservation Management page cross site scripting
- CVE-2026-3818 Tiandy Easy7 CMS Windows GetDBData.jsp sql injection
- CVE-2026-3817 SourceCodester Patients Waiting Area Queue Management System patient-search.php improper authorization
- CVE-2026-38165 A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows at
- CVE-2026-3816 OWASP DefectDojo SonarQubeParser/MSDefenderParser parser.py input_zip.read denial of service
- CVE-2026-38158 A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to access sensitive databa
- CVE-2026-3815 UTT HiPER 810G formApMail strcpy buffer overflow
- CVE-2026-38142 An unauthenticated command injection vulnerability in the /goform/fast_setting_internet_set endpoint of Tenda AC18 v15.03.05.05 allows attac
- CVE-2026-3814 UTT HiPER 810G getOneApConfTempEntry strcpy buffer overflow
- CVE-2026-3813 opencc JFlow WF_CCForm.java Calculate injection
- CVE-2026-3812 itsourcecode Payroll Management System manage_employee_allowances.php cross site scripting
- CVE-2026-3811 Tenda FH1202 P2pListFilter fromP2pListFilter stack-based overflow
- CVE-2026-3810 Tenda FH1202 DhcpListClient fromDhcpListClient stack-based overflow
- CVE-2026-38093 file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android implementation.
- CVE-2026-3809 Tenda FH1202 NatSaticSetting fromNatStaticSetting stack-based overflow
- CVE-2026-3808 Tenda FH1202 webtypelibrary formWebTypeLibrary stack-based overflow
- CVE-2026-38076 An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex commit cc37d0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2026-3807 Tenda FH1202 AdvSetWrlsafeset formWrlsafeset stack-based overflow
- CVE-2026-38065 Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_ims_on_with_apn via the ims_apn parameter.
- CVE-2026-38064 Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_dial_call via the dialNumber parameter.
- CVE-2026-38063 Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_radio_on_with_ia_apn via the ia parameter.
- CVE-2026-38062 Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_rat_mode via the ratMode parameter.
- CVE-2026-38061 Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_volume via the volume parameter.
- CVE-2026-38060 Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_unlock_sim via the pin parameter.
- CVE-2026-3806 SourceCodester/janobe Resort Reservation System room_rates.php sql injection
- CVE-2026-38059 ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function
- CVE-2026-38058 ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere
- CVE-2026-38057 ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery
- CVE-2026-38056 ST Engineering iDirect iQ-Series Terminals Missing Authorization
- CVE-2026-3805 use after free in SMB connection reuse
- CVE-2026-3804 Tenda i3 WifiMacFilterSet formWifiMacFilterSet stack-based overflow
- CVE-2026-3803 Tenda i3 WifiMacFilterGet formWifiMacFilterGet stack-based overflow
- CVE-2026-3802 Tenda i3 exeCommand formexeCommand stack-based overflow
- CVE-2026-3801 Tenda i3 setAutoPing formSetAutoPing stack-based overflow
- CVE-2026-3800 SourceCodester/janobe Resort Reservation System controller.php doInsert unrestricted upload
- CVE-2026-3799 Tenda i3 setcfm formSetCfm stack-based overflow
- CVE-2026-37982 Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay
- CVE-2026-37981 Keycloak Account Resources user lookup contains broken access control
- CVE-2026-37980 Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
- CVE-2026-3798 Comfast CF-AC100 Request Path mbox-config sub_44AC14 command injection
- CVE-2026-37979 Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass
- CVE-2026-37978 Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api
- CVE-2026-37977 Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim
- CVE-2026-3797 Tiandy Video Surveillance System 视频监控平台 CLS_REST_File.java uploadFile unrestricted upload
- CVE-2026-3796 Qi-ANXIN QAX Virus Removal Mini Filter Driver QKSecureIO_Imp.sys ZwTerminateProcess access control
- CVE-2026-3795 doramart DoraCMS v1.js createFileBypath path traversal
- CVE-2026-3794 doramart DoraCMS Email API send improper authentication
- CVE-2026-3793 SourceCodester Sales and Inventory System GET Parameter sales_invoice1.php sql injection
- CVE-2026-3792 SourceCodester Sales and Inventory System GET Parameter purchase_invoice.php sql injection
- CVE-2026-3791 SourceCodester Sales and Inventory System Search dashboard.php sql injection
- CVE-2026-3790 SourceCodester Sales and Inventory System POST Parameter check_supplier_details.php sql injection
- CVE-2026-3789 Bytedesk SpringAIGiteeRestController SpringAIGiteeRestService.java getModels server-side request forgery
- CVE-2026-3788 Bytedesk SpringAIOpenrouterRestController SpringAIOpenrouterRestService.java getModels server-side request forgery
- CVE-2026-3787 UltraVNC Windows Service cryptbase.dll uncontrolled search path
- CVE-2026-3786 EasyCMS Request Parameter RbacuserAction.class.php sql injection
- CVE-2026-3785 EasyCMS Request Parameter RbacnodeAction.class.php sql injection
- CVE-2026-3784 wrong proxy connection reuse with credentials
- CVE-2026-3783 token leak with redirect and netrc
- CVE-2026-3781 Attendance Manager <= 0.6.2 - Authenticated (Subscriber+) SQL Injection via 'attmgr_off' Parameter
- CVE-2026-3780 Foxit PDF Editor/Reader Installer Uncontrolled Search Path Privilege Escalation
- CVE-2026-3779 Foxit PDF Editor/Reader List Box Calculate Array Use-After-Free Vulnerability
- CVE-2026-3778 Stack exhaustion caused by cyclic references in Foxit PDF Editor/Reader
- CVE-2026-3777 Use after free of view cache in Foxit PDF Editor/Reader
- CVE-2026-3776 Null pointer dereference in Foxit PDF Editor/Reader when accessing stamp annotation
- CVE-2026-37751 An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attac
- CVE-2026-37750 A reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1 allows unauthenticated remote attackers to ex
- CVE-2026-3775 Foxit PDF Editor/Reader Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
- CVE-2026-37749 A SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote unauthenticated attackers to bypass authen
- CVE-2026-37748 File upload in sanjay1313:visitor management system
- CVE-2026-3774 Self-Modifications Affecting Altered Printing and Redaction in Foxit PDF Editor
- CVE-2026-37737 sanic-cors contains an improper regular expression in the try_match() function
- CVE-2026-37736 An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2026-3773 Accessibility Suite by Ability, Inc <= 4.20 - Authenticated (Subscriber+) SQL Injection via 'scan_id' Parameter
- CVE-2026-3772 WP Editor <= 1.2.9.2 - Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor
- CVE-2026-37719 An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.
- CVE-2026-37713 An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/
- CVE-2026-37712 An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/
- CVE-2026-37711 An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/
- CVE-2026-37710 Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL
- CVE-2026-3771 SourceCodester/janobe Resort Reservation System accomodation.php sql injection
- CVE-2026-37709 Snipe-IT has insecure permissions in file uploads
- CVE-2026-37700 Cross Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensitive information via the Backend page file
- CVE-2026-3770 SourceCodester Computer Laboratory Management System cross-site request forgery