Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 693 of 1013.
- CVE-2026-35173 Chyrp Lite has an IDOR via Mass Assignment in Post Model
- CVE-2026-35172 Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation
- CVE-2026-35171 Arbitrary Code Execution via Malicious Logging Configuration in Kedro
- CVE-2026-35170 openFPGALoader has a heap buffer overflow in BitParser::parseHeader() via crafted .bit file
- CVE-2026-3517 Command injection in ECS Connections Manager
- CVE-2026-35169 LORIS has potential cross-site scripting in help_editor module
- CVE-2026-35168 OpenSTAManager: SQL Injection via Aggiornamenti Module
- CVE-2026-35167 Kedro has a path traversal in versioned dataset loading via unsanitized version string
- CVE-2026-35166 Hugo does not properly escape some Markdown links
- CVE-2026-35165 LORIS has incorrect access checks in document_repository
- CVE-2026-35164 Brave CMS Sffected by Unrestricted File Upload via CKEditor Endpoint
- CVE-2026-35163 OctoPrint: XSS in Suppressed Command Notifications
- CVE-2026-35162 Missing authorization in PowerFlex
- CVE-2026-35161 Denial of service in PowerScale InsightIQ
- CVE-2026-35160 Command injection in SmartFabric OS10 Software
- CVE-2026-3516 Contact List <= 3.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_cl_map_iframe' Parameter
- CVE-2026-35159 Auth bypass in 14 Plus 2-in-1 DB04250
- CVE-2026-35157 Code injection in ECS
- CVE-2026-35155 Race condition in iDRAC10
- CVE-2026-35154 Privilege escalation in PowerProtect Data Domain appliances
- CVE-2026-35153 Command injection in PowerProtect Data Domain
- CVE-2026-35152 Apache Fineract: SQL injection in runreports endpoint
- CVE-2026-3515 Argument Injection in prefecthq/prefect
- CVE-2026-35149 HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation.
- CVE-2026-35148 HCL DFXServer is affected by a Missing Access Control vulnerability
- CVE-2026-35147 HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access.
- CVE-2026-35146 HCL DFXServer is affected by an Unencrypted Communication vulnerability.
- CVE-2026-35145 HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability.
- CVE-2026-35143 HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability.
- CVE-2026-35142 HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability.
- CVE-2026-35141 HCL DFXAnalytics is affected by a Login Replay Attack vulnerability
- CVE-2026-35140 HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability
- CVE-2026-3514 Authentication Bypass in prefecthq/prefect
- CVE-2026-3513 Cross-site scripting in TableOn – WordPress Posts Table Filterable
- CVE-2026-3512 Writeprint Stylometry <= 0.1 - Reflected Cross-Site Scripting via 'p' Parameter
- CVE-2026-3511 XML external entity in Autogram
- CVE-2026-35099 Race condition in SysTrack Agent
- CVE-2026-35098 Improper Restriction of Excessive Authentication Attempts in KTM System e-BOK
- CVE-2026-35097 Weak Password Requirements in KTM System e-BOK
- CVE-2026-35096 Cross-Site Request Forgery (CSRF) in KTM System e-BOK
- CVE-2026-35095 Session fixation in KTM System e-BOK
- CVE-2026-35094 Libinput: libinput: information disclosure via dangling pointer in lua plugin handling
- CVE-2026-35093 Libinput: libinput: unauthorized code execution and information disclosure through lua bytecode plugins
- CVE-2026-35092 Corosync: corosync: denial of service via integer overflow in join message validation
- CVE-2026-35091 Corosync: corosync: denial of service and information disclosure via crafted udp packet
- CVE-2026-35090 Authentication Bypass in Slican telephone exchanges
- CVE-2026-3509 CODESYS Control Audit Log Format String DoS
- CVE-2026-35089 Use of Weak Credentials in Slican telephone exchanges
- CVE-2026-35088 Inadequate Encryption Strength in Slican telephone exchanges
- CVE-2026-35087 Authentication Bypass in Slican telephone exchanges
- CVE-2026-35086 Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services
- CVE-2026-35085 Stack buffer overflow in method gdv-serverconfig
- CVE-2026-35084 Stack buffer overflow in method dali-devconfig
- CVE-2026-35083 Stack buffer overflow in method bac-deviceobject
- CVE-2026-35082 Local file inclusion vulnerability and deletion in ugw-logread method
- CVE-2026-35081 Arbitrary process termination vulnerability in method ugw-logstop
- CVE-2026-35080 Arbitrary file delete vulnerability in method ugw-restoreinfo
- CVE-2026-3508 Memory corruption in ASUS System Control Interface
- CVE-2026-35079 Arbitrary file delete vulnerability in method ugw-restore
- CVE-2026-35078 Arbitrary file delete vulnerability in method ugw-logstop
- CVE-2026-35077 Arbitrary file delete vulnerability in method ugw-delete-file
- CVE-2026-35076 Arbitrary file delete vulnerability in method bac-scanresult
- CVE-2026-35075 Hardcoded default Password for Service Account
- CVE-2026-35074 Command injection in PowerProtect Data Domain
- CVE-2026-35073 Command injection in PowerProtect Data Domain
- CVE-2026-35072 Command injection in PowerProtect Data Domain
- CVE-2026-35071 Command injection in PowerScale InsightIQ
- CVE-2026-35070 Command injection in SmartFabric Storage Software
- CVE-2026-35069 SQL injection in PowerFlex
- CVE-2026-35068 SQL injection in PowerFlex
- CVE-2026-35067 Missing authorization in PowerFlex
- CVE-2026-35066 Missing authorization in PowerFlex
- CVE-2026-35065 Auth bypass in PowerFlex
- CVE-2026-35064 SenseLive X3050 Missing authentication for critical function
- CVE-2026-35063 Missing Authorization in OpenPLC_V3
- CVE-2026-35062 iControl SOAP vulnerability
- CVE-2026-35061 Anviz Products Missing Authorization
- CVE-2026-3506 WP-Chatbot for Messenger <= 4.9 - Missing Authorization to Unauthenticated Chatbot Configuration Takeover
- CVE-2026-35058 Denial of service in OpenVPN
- CVE-2026-35057 XenForo Stored Cross-Site Scripting via Structured Text Mentions
- CVE-2026-35056 XenForo Remote Code Execution via Authenticated Admin
- CVE-2026-35055 XenForo Cross-Site Scripting via Lightbox in Posts
- CVE-2026-35054 XenForo Stored Cross-Site Scripting via BB Code Rendering
- CVE-2026-35053 OneUptime: Unauthenticated Workflow Execution via ManualAPI
- CVE-2026-35052 D-Tale affected by Remote Code Execution through redis/shelf storage
- CVE-2026-35051 Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth
- CVE-2026-35050 Path traversal in text-generation-webui
- CVE-2026-3505 Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.
- CVE-2026-35049 wire-ios has Persistent Remote DoS via Integer Underflow
- CVE-2026-35048 Piwigo RCE via PHP Code Injection into Config File in Installer
- CVE-2026-35047 Brave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpoint
- CVE-2026-35046 Tandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level)
- CVE-2026-35045 Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification
- CVE-2026-35044 BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generation
- CVE-2026-35043 BentoML: command injection in cloud deployment setup script (deployment.py)
- CVE-2026-35042 fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
- CVE-2026-35041 ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification
- CVE-2026-35040 fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)
- CVE-2026-3504 Information disclosure in Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
- CVE-2026-35039 fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)