Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 687 of 1013.
- CVE-2026-3634 Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header
- CVE-2026-3633 Libsoup: libsoup: header and http request injection via crlf injection
- CVE-2026-36324 SourceCodester Doctor Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) due to improper handling of user supplied input in
- CVE-2026-3632 Libsoup: libsoup: http smuggling and server-side request forgery via malformed hostnames
- CVE-2026-3631 Buffer Over-read DoS Vulnerability in COMMGR2
- CVE-2026-3630 Stack-based Buffer Overflow Vulnerability in COMMGR2
- CVE-2026-3629 Privilege escalation in Import and export users and customers
- CVE-2026-3628 IBM Concert Software Information Disclosure
- CVE-2026-3627 Multiple Vulnerabilities in IBM Concert Software
- CVE-2026-3626 Multiple Vulnerabilities in IBM Concert Software
- CVE-2026-36239 PbootCMS v.3.2.11 contains a code injection vulnerability in its site configuration functionality
- CVE-2026-36236 SQL injection in janobe:engineers online portal
- CVE-2026-36235 SQL injection in itsourcecode:online student enrollment system
- CVE-2026-36234 SQL injection in itsourcecode:online student enrollment system
- CVE-2026-36233 SQL injection in itsourcecode:online student enrollment system
- CVE-2026-36232 SQL injection in itsourcecode:online student enrollment system
- CVE-2026-3623 Vulnerabilities exists in IBM Netezza Performance Server Replication Services
- CVE-2026-36228 Buffer Overflow vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary code vi
- CVE-2026-36227 Directory Traversal vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary cod
- CVE-2026-36226 Cross Site Scripting vulnerability in Advantech WebAccess/SCADA 8.0-2015.08.16 allows a remote attacker to obtain sensitive information via
- CVE-2026-3622 Denial-of-Service Vulnerability in UPnP Component of TP Link's TL-WR841N
- CVE-2026-36214 Cross-site scripting in osTicket
- CVE-2026-36213 An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.exe component.
- CVE-2026-3621 IBM WebSphere Application Server Liberty is affected by identity spoofing
- CVE-2026-3620 Word Replacer <= 0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Replacement' Parameter
- CVE-2026-3619 Sheets2Table <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titles' Shortcode Attribute
- CVE-2026-36189 Buffer Overflow vulnerability in Uncrustify Project Affected v.Uncrustify_d-0.82.0-132-bcc41cbdc and Fixed in commit 68e67b9a1435a1bb173b106
- CVE-2026-36182 GNCC GP5 v7.1.76 was discovered to utilize a weak hashing algorithm to protect the root password, possibly allowing attackers to obtain root
- CVE-2026-36180 A lack of runtime integrity in GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass file system read-only protections and modify
- CVE-2026-3618 Cross-site scripting in Columns by BestWebSoft – Additional Columns Plugin for Posts Pages and Widgets
- CVE-2026-36178 The factory reset functionality in GNCC GP5 v7.1.76 fails to clear sensitive cryptographic material in the JFFS2 configuration partition, po
- CVE-2026-36176 GNCC GP5 v7.1.76 was discovered to store pre-signed Backblaze B2 upload URLs (PUT requests) in plaintext to the serial console.
- CVE-2026-36175 An issue in the U-Boot component of GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass authentication and gain root access via
- CVE-2026-36174 GNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations to the serial console.
- CVE-2026-3617 Cross-site scripting in Paypal Shortcodes
- CVE-2026-36163 An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScri
- CVE-2026-36162 An authenticated stored cross-site scripting (XSS) vulnerability in the Upload File Shares API of LiquidFiles v4.2.7 allows attackers to exe
- CVE-2026-3616 DefaultFuction Jeson Customer Relationship Management System edit.php sql injection
- CVE-2026-3614 AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
- CVE-2026-3613 Wavlink WL-NU516U1 login.cgi sub_401A0C stack-based overflow
- CVE-2026-3612 Wavlink WL-NU516U1 OTA Online Upgrade adm.cgi sub_405AF4 command injection
- CVE-2026-3611 Honeywell IQ4x BMS Controller Missing authentication for critical function
- CVE-2026-36102 An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate priv
- CVE-2026-3610 HSC Cybersecurity Mailinspector URL mliUserValidation.php cross site scripting
- CVE-2026-3609 XIGNCODE3 xhunter1.sys kernel driver contains a Privilege Escalation Vulnerability
- CVE-2026-3608 Stack overflow in Kea daemons
- CVE-2026-3607 Access Control Check Implemented After Asset is Accessed in GitLab
- CVE-2026-3606 Ettercap etterfilter ef_output.c add_data_segment out-of-bounds
- CVE-2026-3605 Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service
- CVE-2026-36045 picoclaw is vulnerable to OS command injection via the ExecTool component
- CVE-2026-36044 @pensar/apex <= 0.0.58 is vulnerable to OS command injection via the smart_enumerate tool.
- CVE-2026-3604 Cross-site scripting in WP SEO Structured Data Schema
- CVE-2026-36035 Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows au
- CVE-2026-3603 IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML external entity injection (XXE) attack
- CVE-2026-36028 A protection mechanism failure in the Code 27 Companion Hub allows an attacker with physical access to completely bypass kiosk restrictions
- CVE-2026-36027 An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to execute arbitrary code via the USB debugging (
- CVE-2026-3602 IBM App Connect Enterprise and IBM Integration Bus for z/OS toolkit is vulnerable to an sql injection
- CVE-2026-3601 Missing authorization in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
- CVE-2026-3600 Cross-site scripting in Investi
- CVE-2026-3599 Riaxe Product Customizer <= 2.1.2 - Unauthenticated SQL Injection via 'options' Parameter Keys in product_data
- CVE-2026-3598 RustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of Encryption
- CVE-2026-3596 Missing authorization in Riaxe Product Customizer
- CVE-2026-3595 Riaxe Product Customizer <= 2.1.2 - Unauthenticated Arbitrary User Deletion via 'user_id' Parameter
- CVE-2026-3594 Riaxe Product Customizer <= 2.4 - Unauthenticated Sensitive Information Disclosure via '/orders' REST API Endpoint
- CVE-2026-3593 Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation
- CVE-2026-3592 Amplification vulnerabilities via self-pointed glue records
- CVE-2026-3591 A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass
- CVE-2026-35906 An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 allows unauthenticated attackers to execute a
- CVE-2026-35905 T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 were discovered to contain a hardcoded password for root access
- CVE-2026-35904 Incorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 allo
- CVE-2026-35903 Auth bypass in mercurycom:mipc252w firmware
- CVE-2026-35902 Denial of service in mercurycom:mipc252w firmware
- CVE-2026-35901 Denial of service in mercurycom:mipc252w firmware
- CVE-2026-3590 Race Condition in Guest Magic Link Authentication Allows Token Reuse
- CVE-2026-3589 WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF
- CVE-2026-3588 Server-Side Request Forgery (SSRF) in ikea dirigera
- CVE-2026-3587 Hidden CLI Function Allows Root Access
- CVE-2026-35869 A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC450M V4.0.0.
- CVE-2026-35868 A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC2100_AZ3 V1.0.4.
- CVE-2026-35867 Command injection in AC1900 firmware
- CVE-2026-3585 The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import
- CVE-2026-35847 An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file
- CVE-2026-3584 Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process
- CVE-2026-3583 Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
- CVE-2026-3582 Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scope
- CVE-2026-3581 Basic Google Maps Placemarks <= 1.10.7 - Missing Authorization to Unauthenticated Default Map Coordinate Update
- CVE-2026-3580 Compiler-induced timing leak in sp_256_get_entry_256_9 on RISC-V
- CVE-2026-3579 Non-constant time multiplication subroutine __muldi3 on RISC-V RV32I
- CVE-2026-3577 Keep Backup Daily <= 2.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Backup Title
- CVE-2026-3576 Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter
- CVE-2026-3574 Cross-site scripting in Experto Dashboard for WooCommerce
- CVE-2026-3573 AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028
- CVE-2026-3572 iTracker360 <= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itracker_license' Settings Field
- CVE-2026-35718 Path traversal in vivotek:fd8136 firmware
- CVE-2026-35717 Memory corruption in vivotek:fd8136 firmware
- CVE-2026-35716 Memory corruption in vivotek:fd8136 firmware
- CVE-2026-3571 Missing authorization in Pie Register – User Registration, Profiles & Content Restriction
- CVE-2026-3570 Smarter Analytics <= 2.0 - Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameter
- CVE-2026-3569 Missing authorization in Liaison Site Prober
- CVE-2026-35682 Anviz CX2 Lite Command Injection