Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 683 of 1013.
- CVE-2026-3769 Tenda F453 WrlclientSet stack-based overflow
- CVE-2026-3768 Tenda F453 WrlExtraSet formWrlExtraSet stack-based overflow
- CVE-2026-3767 itsourcecode sanitize or validate this input teacher-attendance.php sql injection
- CVE-2026-3766 SourceCodester Web-based Pharmacy Product Management System edit-profile.php cross site scripting
- CVE-2026-3765 itsourcecode University Management System att_single_view.php sql injection
- CVE-2026-3764 SourceCodester Client Database Management System superadmin_user_update.php improper authorization
- CVE-2026-37637 An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the filemanager.php component
- CVE-2026-37630 An issue in QuickJS-NG v.0.12.1 allows an attacker to execute arbitrary code via the js_mapped_arguments_mark function
- CVE-2026-3763 code-projects Simple Flight Ticket Booking System showhistory.php cross site scripting
- CVE-2026-3762 SourceCodester Client Database Management System Endpoint superadmin_delete_manager.php improper authorization
- CVE-2026-3761 SourceCodester Client Database Management System Endpoint superadmin_user_delete.php improper authorization
- CVE-2026-37604 pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from th
- CVE-2026-37603 Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Social Dating CMS) through 19.2.0.
- CVE-2026-37602 SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/user/manage_user.php.
- CVE-2026-37601 SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/manage_appointment.php.
- CVE-2026-37600 SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/view_details.php.
- CVE-2026-3760 itsourcecode University Management System view_result.php sql injection
- CVE-2026-37598 SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to arbitrary code execution (RCE) via /scheduler/classes/SystemSettin
- CVE-2026-37597 SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/attendance_list.php.
- CVE-2026-37596 SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_department.php.
- CVE-2026-37595 SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_employee.php.
- CVE-2026-37594 SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/view_employee.php.
- CVE-2026-37593 SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/view_att.php.
- CVE-2026-37592 Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL in the file /storage/admin/maintenance/manage_pricing.php.
- CVE-2026-37591 Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL injection in the file /storage/admin/tenants/view_details.php.
- CVE-2026-37590 SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the file /storage/admin/rents/manage_rent.php.
- CVE-2026-3759 projectworlds Online Art Gallery Shop adminHome.php sql injection
- CVE-2026-37589 SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the file /storage/admin/maintenance/manage_storage_unit.php.
- CVE-2026-3758 projectworlds Online Art Gallery Shop adminHome.php sql injection
- CVE-2026-37579 An issue in SMSGate sms-core<=2.1.13.6 allows a remote attacker to execute arbitrary code via the Cmpp7FDeliverRequestMessageCodec.java comp
- CVE-2026-3757 projectworlds Online Art Gallery Shop pass sql injection
- CVE-2026-3756 SourceCodester Sales and Inventory System check_item_details.php sql injection
- CVE-2026-37555 Integer overflow in libsndfile project:libsndfile
- CVE-2026-37554 An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service.
- CVE-2026-37552 Deserialization in openmix:mix php
- CVE-2026-3755 SourceCodester Sales and Inventory System POST check_customer_details.php sql injection
- CVE-2026-37541 Memory corruption in openvehicles:open vehicle monitoring system firmware
- CVE-2026-37540 Integer overflow in linaro:openamp
- CVE-2026-3754 SourceCodester Sales and Inventory System add_stock.php sql injection
- CVE-2026-37539 Buffer overflow vulnerability in cannelloni v2.0.0 in CAN frame parsing in parser.cpp in function parseCANFrame, and decoder.cpp in function
- CVE-2026-37538 Buffer overflow vulnerability in socketcand 0.4.2 in file socketcand.c in function main allows attackers to cause a denial of service or oth
- CVE-2026-37537 collin80/Open-SAE-J1939 thru commit 744024d4306bc387857dfce439558336806acb06 (2023-03-08) contains an integer underflow leading to out-of-bo
- CVE-2026-37536 miaofng/uds-c commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a (2016-10-05) contains a stack buffer overflow in send_diagnostic_request.
- CVE-2026-37535 openxc/isotp-c thru commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09) contains an out-of-bounds read in the ISO-TP Single Frame r
- CVE-2026-37534 Integer underflow vulnerability in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (2025-11-30) in SAE_J1939_Read_Transp
- CVE-2026-37532 Memory corruption in linuxfoundation:automotive grade linux
- CVE-2026-37531 Path traversal in linuxfoundation:automotive grade linux
- CVE-2026-37530 Memory corruption in linuxfoundation:automotive grade linux
- CVE-2026-3753 SourceCodester Sales and Inventory System add_sales_print.php sql injection
- CVE-2026-37526 Missing authorization in linuxfoundation:automotive grade linux
- CVE-2026-37525 Privilege escalation in linuxfoundation:automotive grade linux
- CVE-2026-3752 SourceCodester Employee Task Management System GET Parameter daily-task-report.php sql injection
- CVE-2026-3751 SourceCodester Employee Task Management System GET Parameter daily-attendance-report.php sql injection
- CVE-2026-37505 SQL injection in v2board:v2board
- CVE-2026-37504 Information disclosure in v2board:v2board
- CVE-2026-37503 Cross-site scripting in v2board:v2board
- CVE-2026-3750 ContiNew Admin Storage Management S3ClientFactory.java URI.create server-side request forgery
- CVE-2026-3749 Bytedesk SVG File UploadRestService.java handleFileUpload unrestricted upload
- CVE-2026-3748 Bytedesk SVG File UploadRestController.java uploadFile unrestricted upload
- CVE-2026-37470 An issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the Authentication interface, login page endpoint and HTT
- CVE-2026-3747 itsourcecode University Management System add_result.php sql injection
- CVE-2026-37462 GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function
- CVE-2026-37461 GoBGP has an out-of-bounds read in the ParseIP6Extended function
- CVE-2026-37460 Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cau
- CVE-2026-3746 SourceCodester Simple Responsive Tourism Website Login Login.php sql injection
- CVE-2026-37459 An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a craft
- CVE-2026-37458 Denial of service in frrouting:frrouting
- CVE-2026-37457 Memory corruption in frrouting:frrouting
- CVE-2026-37454 Weak cryptography in msi:center
- CVE-2026-37453 Information disclosure in msi:center
- CVE-2026-37452 Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via
- CVE-2026-3745 code-projects Student Web Portal profile.php sql injection
- CVE-2026-3744 code-projects Student Web Portal signup.php valreg_passwdation sql injection
- CVE-2026-37431 Beauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via the aptnumber parameter in the /appointmen
- CVE-2026-37430 An arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang-wms commit 75c15a allows attackers to execu
- CVE-2026-3743 YiFang CMS D_singlePageGroup.php update cross site scripting
- CVE-2026-37429 qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysUserMapper.xml file.
- CVE-2026-37428 qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysDeptMapper.xml file.
- CVE-2026-3742 YiFang CMS D_singlePage.php update cross site scripting
- CVE-2026-3741 YiFang CMS D_friendLink.php update cross site scripting
- CVE-2026-3740 itsourcecode University Management System admin_search_student.php sql injection
- CVE-2026-3739 suitenumerique messages ThreadAccess serializers.py ThreadAccessSerializer improper authentication
- CVE-2026-3738 SourceCodester Pet Grooming Management Software Financial Report improper authorization
- CVE-2026-3737 SourceCodester Pet Grooming Management Software User Creation add_user.php improper authorization
- CVE-2026-3736 code-projects Simple Flight Ticket Booking System SearchResultRoundtrip.php sql injection
- CVE-2026-3735 code-projects Simple Flight Ticket Booking System SearchResultOneway.php sql injection
- CVE-2026-37347 SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_employee.php.
- CVE-2026-37346 SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_account.php?emp_id=.
- CVE-2026-37345 SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_park.php.
- CVE-2026-37344 SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_location.php.
- CVE-2026-37343 SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_user.php.
- CVE-2026-37342 SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/view_parked_details.php.
- CVE-2026-37341 SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_category.php.
- CVE-2026-37340 SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/edit_music.php.
- CVE-2026-3734 SourceCodester Client Database Management System Endpoint fetch_manager_details.php improper authorization
- CVE-2026-37339 SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_genre.php.
- CVE-2026-37338 SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_user.php.
- CVE-2026-37337 SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_playlist.php.
- CVE-2026-37336 SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_music.php.
- CVE-2026-3733 xuxueli xxl-job JobInfoController.java server-side request forgery