Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 692 of 1013.
- CVE-2026-35271 Missing authorization in PeopleSoft Enterprise PT PeopleTools
- CVE-2026-35270 Missing authorization in Oracle WebCenter Content
- CVE-2026-3527 AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022
- CVE-2026-35269 Missing authorization in Identity Manager
- CVE-2026-35268 Missing authorization in Identity Manager
- CVE-2026-35267 Missing authorization in Identity Manager
- CVE-2026-35266 Cross-site request forgery in Oracle REST Data Services
- CVE-2026-35265 Auth bypass in Identity Manager
- CVE-2026-35263 Missing authorization in WebLogic Server
- CVE-2026-35262 Missing authorization in Oracle Data Integrator
- CVE-2026-35261 Auth bypass in Oracle Access Manager
- CVE-2026-3526 File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021
- CVE-2026-35259 Open redirect in WebLogic Server
- CVE-2026-35258 Open redirect in WebLogic Server
- CVE-2026-35255 Code injection in Oracle Cloud Native Environment Command Line Interface
- CVE-2026-35254 Path traversal in Oracle OCI CLI of Oracle Open Source Projects
- CVE-2026-35253 Open redirect in Oracle Macaron Tool of Oracle Open Source Projects
- CVE-2026-35252 Missing authorization in Oracle Security Service
- CVE-2026-35251 Other in Oracle VM VirtualBox
- CVE-2026-35250 Denial of service in Oracle VM VirtualBox
- CVE-2026-3525 File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020
- CVE-2026-35249 Other in Oracle VM VirtualBox
- CVE-2026-35248 Other in Oracle VM VirtualBox
- CVE-2026-35247 Missing authorization in Oracle VM VirtualBox
- CVE-2026-35246 Other in Oracle VM VirtualBox
- CVE-2026-35245 Denial of service in Oracle VM VirtualBox
- CVE-2026-35244 Missing authorization in Oracle Hyperion Infrastructure Technology
- CVE-2026-35243 Missing authorization in Oracle Application Development Framework (ADF)
- CVE-2026-35242 Other in Oracle VM VirtualBox
- CVE-2026-35241 Missing authorization in PeopleSoft Enterprise CS Student Records
- CVE-2026-35240 Denial of service in MySQL Server
- CVE-2026-3524 Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check
- CVE-2026-35239 Denial of service in MySQL Server
- CVE-2026-35238 Denial of service in MySQL Server
- CVE-2026-35237 Denial of service in MySQL Server
- CVE-2026-35236 Denial of service in MySQL Server
- CVE-2026-35235 Denial of service in MySQL Server
- CVE-2026-35234 Denial of service in MySQL Server
- CVE-2026-35233 Memory corruption in Oracle Linux
- CVE-2026-35232 Missing authorization in Oracle Fusion Middleware
- CVE-2026-35231 Missing authorization in Oracle Financial Services Transaction Filtering
- CVE-2026-35230 Other in Oracle VM VirtualBox
- CVE-2026-3523 Apocalypse Meow <= 22.1.0 - Authenticated (Administrator+) SQL Injection via 'type' Parameter
- CVE-2026-35229 Missing authorization in Oracle Database Server
- CVE-2026-35228 SQL injection in Oracle MCP Server Helper Tool product of Oracle Open Source Projects
- CVE-2026-35227 Improper resource management in CODESYS Modbus TCP Server
- CVE-2026-35226 Out-of-bounds Write in CODESYS PROFINET Controller
- CVE-2026-35225 Improper timeout handling in CODESYS EtherNetIP
- CVE-2026-35223 Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints
- CVE-2026-35222 Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags
- CVE-2026-35221 Joomla! Core - [20260506] - Authenticated blind SQLi in com_finder
- CVE-2026-35220 Joomla! Core - [20260505] - CSRF in user activation endpoint
- CVE-2026-35219 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist
- CVE-2026-35218 Budibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command Palette
- CVE-2026-35217 NanoMQ Incorrectly Accepts a Malformed SUBSCRIBE and Can Be Driven into an ASAN-Detectable Out-of-Bounds Read
- CVE-2026-35216 Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
- CVE-2026-35215 Firebird: DoS via malicious slice descriptor in slice packet
- CVE-2026-35214 Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write
- CVE-2026-35213 Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing
- CVE-2026-35212 OpenCTI has XSS in the rendering of email-message observable body data
- CVE-2026-35211 Code injection in opencti
- CVE-2026-35210 OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection
- CVE-2026-35209 defu: Prototype pollution via `__proto__` key in defaults argument
- CVE-2026-35208 lichess.org has an Unsanitized Stream Title Injection on /streamer
- CVE-2026-35207 Security feature bypass in dde-control-center
- CVE-2026-35206 Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
- CVE-2026-35205 Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install
- CVE-2026-35204 Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
- CVE-2026-35203 ZLMediaKit VP9 RTP Parser Out-of-Bounds Read
- CVE-2026-35202 Pterodactyl has a database resource limit bypass via race condition in Client API
- CVE-2026-35201 Discount has an Out-of-bounds Read in rdiscount
- CVE-2026-35200 Parse Server has a file upload Content-Type override via extension mismatch
- CVE-2026-3520 Multer vulnerable to Denial of Service via uncontrolled recursion
- CVE-2026-35199 SymCrypt SymCryptXmssSign function - Heap overflow via 64->32-bit leaf-count truncation
- CVE-2026-35198 HeyForm vulnerable to stored XSS via form field titles
- CVE-2026-35197 Code injection in dye template expressions
- CVE-2026-35196 Chamilo LMS has OS Command Injection via export_all_certificates action
- CVE-2026-35195 Wasmtime has an out-of-bounds write or crash when transcoding component model strings
- CVE-2026-35194 Apache Flink: Remote code execution via SQL injection in code generation
- CVE-2026-35193 Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware
- CVE-2026-35192 Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
- CVE-2026-35191 QUIC Unvalidated Amplification Credit may be Over Accounted
- CVE-2026-3519 Command injection in ECS Connections Manager
- CVE-2026-35189 Excessive Memory Allocation in Relative CRLDP Processing
- CVE-2026-35188 Double-free When Checking OCSP Stapled Response
- CVE-2026-35187 pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter
- CVE-2026-35186 Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend
- CVE-2026-35185 HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses
- CVE-2026-35184 EcclesiaCRM has a Critical SQL Injection
- CVE-2026-35183 Brave CMS has an Insecure Direct Object Reference in Article Image Deletion
- CVE-2026-35182 Missing Authorization Privilege Escalation
- CVE-2026-35181 WWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.php
- CVE-2026-35180 WWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File Write
- CVE-2026-3518 Command injection in ECS Connections Manager
- CVE-2026-35179 WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php
- CVE-2026-35178 Workbench Affected by Remote Code Execution (RCE) via Malicious Cookie in Timezone Conversion
- CVE-2026-35177 Path traversal issue with zip.vim in Vim
- CVE-2026-35176 openFPGALoader has a heap buffer overflow in POFParser::parseSection() via crafted .pof file
- CVE-2026-35175 Ajenti has an authorization bypass during custom package installation
- CVE-2026-35174 Chyrp Lite has a Path Traversal to Remote Code Execution