Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 686 of 1013.
- CVE-2026-3674 Freedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppProvider improper authorization
- CVE-2026-36738 Auth bypass in u-speed:t18-21k firmware
- CVE-2026-36734 EDIMAX BR-6428nS V3 1.15 is vulnerable to Command Injection.
- CVE-2026-3673 Frappe Framework 16.10.0 - Stored DOM XSS in Tag Pill Renderer
- CVE-2026-36728 A markdown based cross-site scripting (XSS) vulnerability in the AI assistant chat function of FastapiAdmin v2.2.0 allows attackers to execu
- CVE-2026-36727 An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.
- CVE-2026-36726 An arbitrary file deletion vulnerability in the /api/delete-temp-license/{file} endpoint of bookcars v8.3 allows unauthenticated attackers t
- CVE-2026-36725 A markdown based cross-site scripting (XSS) vulnerability in the /system/notice/create endpoint of FastapiAdmin v2.2.0 allows attackers to e
- CVE-2026-36724 An uncaught exception in the /application/job/update/{id} endpoint of FastapiAdmin v2.2.0 allows authenticated attackers with the module_tas
- CVE-2026-36723 An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3 allows authenticated attackers to leverage dire
- CVE-2026-36722 An authenticated arbitrary file upload vulnerability in the /api/create-car-image component of bookcars v8.3 allows attackers to execute arb
- CVE-2026-36721 A lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 allows attackers to bypass authenticatio
- CVE-2026-36720 Insecure permissions in bookcars v8.3 allows authenticated attackers to escalate privileges from user to admin via modifying their user type.
- CVE-2026-3672 JeecgBoot getDictItems isExistSqlInjectKeyword sql injection
- CVE-2026-36719 An information disclosure vulnerability in the /api/v1/user/info endpoint of AgentChat v2.3.0 allows unauthenticated attackers to obtain sen
- CVE-2026-3671 Freedom Factory dGEN1 org.ethereumphone.walletmanager.testing123 TokenBalanceContentProvider improper authorization
- CVE-2026-3670 Freedom Factory dGEN1 com.dgen.alarm improper authorization
- CVE-2026-36698 Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh.
- CVE-2026-3669 Freedom Factory dGEN1 com.dgen.alarm AlarmService improper authorization
- CVE-2026-3668 Freedom Factory dGEN1 org.ethosmobile.webpwaemul AndroidEthereum access control
- CVE-2026-36670 A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3
- CVE-2026-3667 Freedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppService improper authorization
- CVE-2026-36669 An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allows remote attackers to upload
- CVE-2026-3666 wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body
- CVE-2026-3665 xlnt-community xlnt XLSX File xlsx_consumer.cpp read_office_document null pointer dereference
- CVE-2026-3664 xlnt-community xlnt Encrypted XLSX File compound_document.cpp read_directory out-of-bounds
- CVE-2026-3663 xlnt-community xlnt XLSX File compound_document.cpp xsgetn out-of-bounds
- CVE-2026-3662 Wavlink WL-NU516U1 adm.cgi usb_p910 command injection
- CVE-2026-36618 Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 responds to version.bind CHAOS TXT queries, disclosing the DNS resolver software ve
- CVE-2026-36616 Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 contains hardcoded WiFi driver credentials including a RADIUS shared secret, WPS te
- CVE-2026-36615 Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 exposes an undocumented /agileconfigreset endpoint that returns internal buffer con
- CVE-2026-36613 Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized internal buffer contents when receiving HTTP POS
- CVE-2026-36612 Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lockout policy (60-second lockout after 10 attempts).
- CVE-2026-36611 Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAP
- CVE-2026-36610 Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with only Base64 encoding.
- CVE-2026-3661 Wavlink WL-NU516U1 adm.cgi ota_new_upgrade command injection
- CVE-2026-36609 Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source IP.
- CVE-2026-36608 Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own adm
- CVE-2026-36607 Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endp
- CVE-2026-36606 Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode.
- CVE-2026-36605 Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 is vulnerable to a HTTP denial of service via a low number of crafted incomp
- CVE-2026-36604 Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabling DNS rebinding attacks.
- CVE-2026-36603 Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, inclu
- CVE-2026-36602 Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 discloses kernel memory layout via the UPnP GetStatusInfo action.
- CVE-2026-3660 IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Authentication Bypass
- CVE-2026-36590 Denial of service in emqx:nanomq
- CVE-2026-3659 WP Circliful <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
- CVE-2026-3658 Appointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter
- CVE-2026-36576 An OS command injection vulnerability in the app.py component of openlabs docker-wkhtmltopdf-aas up to commit 9f50579 allows attackers to ex
- CVE-2026-36574 A DLL hijacking vulnerability in Wassimulator (GitHub) CactusViewer v2.3.0 allows attackers to escalate privileges and execute arbitrary code via a crafted DLL.
- CVE-2026-3657 My Sticky Bar <= 2.8.6 - Unauthenticated SQL Injection via 'stickymenu_contact_lead_form' Action
- CVE-2026-3655 Auth bypass in OTP Login With Phone Number, OTP Verification
- CVE-2026-36540 Netis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection via the /cgi-bin/skk_set.cgi endpoint.
- CVE-2026-36539 Netis AC1200 Router NC21 V4.0.1.4296 exposes a CGI endpoint /cgi-bin/skk_get.cgi that returns the entire router configuration as a JSON resp
- CVE-2026-36538 Netis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded root credential stored in /etc/shadow.sample.
- CVE-2026-36537 ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange.
- CVE-2026-36521 PublicCMS V5.202506.d has a Cross Site Scripting (XSS) vulnerability in the site configuration management module.
- CVE-2026-3652 ARForms <= 7.1.3 - Unauthenticated Stored Cross-Site Scripting via 'value' Parameter
- CVE-2026-3651 Missing authorization in Build App Online
- CVE-2026-36501 An issue in the Externalizable.readExternal() component of Controller v12.0.5 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2026-36500 An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to execute a directory traversal via a crafted request.
- CVE-2026-3650 Grassroots DICOM Missing release of memory after effective lifetime
- CVE-2026-36499 A missing upper-bound check in the udpif_set_threads() function of Open vSwitch v3.6.90 allows an attacker with OVSDB write access to reques
- CVE-2026-3649 Missing authorization in Katalogportal-pdf-sync Widget
- CVE-2026-36478 An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of service via the DnsServerApp.exe, DnsServe
- CVE-2026-36472 CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS).
- CVE-2026-36471 Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbi
- CVE-2026-36470 CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php.
- CVE-2026-36469 CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload
- CVE-2026-36468 Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL param
- CVE-2026-36467 Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access
- CVE-2026-36460 Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability.
- CVE-2026-3646 LTL Freight Quotes – R+L Carriers Edition <= 3.3.13 - Missing Authorization to Unauthenticated Settings Update
- CVE-2026-36458 ChestnutCMS v1.5.10 has a SQL injection vulnerability.
- CVE-2026-36453 Missing authorization in Rhymix
- CVE-2026-3645 Missing authorization in Punnel – Landing Page Builder
- CVE-2026-3644 Incomplete control character validation in http.cookies
- CVE-2026-36438 An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain sensitive information via password reset f
- CVE-2026-36436 An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface.
- CVE-2026-36433 An issue in Actions Semiconductor Co.
- CVE-2026-3643 Missing authorization in Accessibly – WordPress Website Accessibility
- CVE-2026-36425 An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031.
- CVE-2026-3642 e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Form Settings Modification via AJAX
- CVE-2026-36418 JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling of Aviator expressions.
- CVE-2026-3641 Appmax <= 1.0.3 - Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint
- CVE-2026-3640 STRABL <= 4.5 - Unauthenticated Arbitrary Webhook Creation via REST API Endpoint
- CVE-2026-36392 FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS).
- CVE-2026-3639 Cross-site scripting in PPWP – Password Protect Pages
- CVE-2026-36388 A Cross-Site Scripting (XSS) vulnerability was found in PHPGurukal Hospital Management System v4.0 in the /hospital/hms/edit-profile.php page.
- CVE-2026-36387 A Remote Code Execution vulnerability was found in CODEASTRO Membership Management System v1.0 in /add_members.php.
- CVE-2026-3638 Missing authorization in Server
- CVE-2026-3637 Mattermost fails to enforce create_post permission when editing posts
- CVE-2026-36365 An issue in Lymphatus caesium-image-compressor All versions up to and including commit 02da2c6 allows a local attacker to execute arbitrary
- CVE-2026-3636 Sanitize team member data returned by API
- CVE-2026-36358 Cross Site Scripting vulnerability in Juzaweb CMS v.5.0.0 allows a remote attacker via execute arbitrary code via a crafted script to the Ad
- CVE-2026-36356 The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injec
- CVE-2026-36355 The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access contro
- CVE-2026-3635 fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections
- CVE-2026-36341 Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint
- CVE-2026-36340 Krayin CRM allows a remote attacker to execute arbitrary code via compose email function