Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 701 of 1013.
- CVE-2026-34315 Open redirect in Oracle WebLogic Server
- CVE-2026-34314 Missing authorization in Oracle Financial Services Analytical Applications Infrastructure
- CVE-2026-34313 Information disclosure in Oracle Financial Services Analytical Applications Infrastructure
- CVE-2026-34312 Missing authorization in Oracle Database Server
- CVE-2026-34311 Other in Oracle Hospitality OPERA 5 Property Services
- CVE-2026-34310 Missing authorization in Oracle Financial Services Analytical Applications Infrastructure
- CVE-2026-3431 Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion
- CVE-2026-34309 Missing authorization in PeopleSoft Enterprise PeopleTools
- CVE-2026-34308 Denial of service in MySQL Server
- CVE-2026-34307 Missing authorization in PeopleSoft Enterprise PeopleTools
- CVE-2026-34306 Missing authorization in PeopleSoft Enterprise FIN Project Costing
- CVE-2026-34305 Information disclosure in Oracle WebLogic Server
- CVE-2026-34304 Denial of service in MySQL Server
- CVE-2026-34303 Denial of service in MySQL Server
- CVE-2026-34302 Missing authorization in Oracle Workflow
- CVE-2026-34301 Missing authorization in PeopleSoft Enterprise FIN Maintenance Management
- CVE-2026-34300 Information disclosure in PeopleSoft Enterprise FIN Contracts
- CVE-2026-3430 Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi
- CVE-2026-34299 Missing authorization in PeopleSoft Enterprise FIN Maintenance Management
- CVE-2026-34298 Missing authorization in Oracle Applications Framework
- CVE-2026-34297 Information disclosure in Oracle HCM Common Architecture
- CVE-2026-34296 Information disclosure in Oracle Agile Product Lifecycle Management for Process
- CVE-2026-34295 Missing authorization in PeopleSoft Enterprise SCM Purchasing
- CVE-2026-34294 Missing authorization in Oracle Identity Manager Connector
- CVE-2026-34293 Denial of service in MySQL Server
- CVE-2026-34292 Missing authorization in Oracle WebLogic Server
- CVE-2026-34291 Missing authorization in Oracle HTTP Server
- CVE-2026-34290 Denial of service in Oracle Identity Manager Connector
- CVE-2026-3429 Keycloak: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API
- CVE-2026-34289 Missing authorization in Oracle Identity Manager Connector
- CVE-2026-34288 Missing authorization in Oracle Identity Manager Connector
- CVE-2026-34287 Missing authorization in Oracle Identity Manager Connector
- CVE-2026-34286 Missing authorization in Oracle Identity Manager Connector
- CVE-2026-34285 Missing authorization in Oracle Identity Manager Connector
- CVE-2026-34284 Open redirect in Oracle Business Process Management Suite
- CVE-2026-34283 Open redirect in Oracle Identity Manager
- CVE-2026-34282 Denial of service in Oracle GraalVM Enterprise Edition
- CVE-2026-34281 Denial of service in Oracle Solaris
- CVE-2026-34280 Missing authorization in PeopleSoft Enterprise HCM Human Resources
- CVE-2026-3428 Race condition in Member Center(华硕大厅)
- CVE-2026-34279 Missing authorization in Oracle Enterprise Manager Base Platform
- CVE-2026-34278 Denial of service in MySQL Server
- CVE-2026-34277 Other in PeopleSoft Enterprise PeopleTools
- CVE-2026-34276 Denial of service in MySQL Server
- CVE-2026-34275 Missing authorization in Oracle Advanced Inbound Telephony
- CVE-2026-34274 Missing authorization in Oracle Configurator
- CVE-2026-34273 Information disclosure in Oracle GoldenGate
- CVE-2026-34272 Denial of service in MySQL Server
- CVE-2026-34271 Denial of service in MySQL Server
- CVE-2026-34270 Denial of service in MySQL Server
- CVE-2026-3427 Yoast SEO <= 27.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block Attribute
- CVE-2026-34269 Missing authorization in PeopleSoft Enterprise PeopleTools
- CVE-2026-34268 Information disclosure in Oracle GraalVM Enterprise Edition
- CVE-2026-34267 Denial of service in MySQL Server
- CVE-2026-34266 Missing authorization in PeopleSoft Enterprise HCM Absence Management
- CVE-2026-34265 Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform
- CVE-2026-34264 Information Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA
- CVE-2026-34263 Missing authentication check in SAP Commerce cloud configuration
- CVE-2026-34262 Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer
- CVE-2026-34261 Missing Authorization check in SAP Business Analytics and SAP Content Management
- CVE-2026-34260 SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP)
- CVE-2026-3426 Missing authorization in RTMKit
- CVE-2026-34259 OS Command Injection Vulnerability in SAP Forecasting & Replenishment
- CVE-2026-34258 Content Spoofing vulnerability in SAPUI5 (Search UI)
- CVE-2026-34257 Open Redirect vulnerability in SAP NetWeaver Application Server ABAP
- CVE-2026-34256 Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)
- CVE-2026-34253 A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in function remotethread in remote.c.
- CVE-2026-3425 RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'
- CVE-2026-34248 Zammad has an information disclosure in ticket detail view of customers in shared organizations
- CVE-2026-34247 AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications
- CVE-2026-34246 CtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML Output
- CVE-2026-34245 AVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking
- CVE-2026-34244 Weblate: SSRF via Project-Level Machinery Configuration
- CVE-2026-34243 wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`
- CVE-2026-34242 Weblate: Arbitrary File Read via Symlink
- CVE-2026-34241 CtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking
- CVE-2026-34240 jose vulnerable to untrusted JWK header key acceptance during signature verification
- CVE-2026-3424 kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter
- CVE-2026-34239 Chamilo Authenticated Remote Code Execution
- CVE-2026-34238 ImageMagick: Integer overflow in despeckle operation causes heap buffer overflow on 32-bit builds
- CVE-2026-34237 MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)
- CVE-2026-34236 Auth0 PHP SDK Insufficient Entropy in Cookie Encryption
- CVE-2026-34235 PJSIP: Heap OOB read in VPX unpacketizer
- CVE-2026-34234 CtrlPanel: Unauthenticated RCE using installer script
- CVE-2026-34233 CtrlPanel has Missing Authentication Checks in Datatable Admin Endpoints
- CVE-2026-34232 Firebird: DoS via `op_response` packet from client
- CVE-2026-34231 Slippers: Cross-Site Scripting (XSS) in `attrs` Template Tag
- CVE-2026-34230 Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header
- CVE-2026-3423 Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description
- CVE-2026-34229 Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypass
- CVE-2026-34228 Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Write
- CVE-2026-34227 Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface
- CVE-2026-34226 Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies
- CVE-2026-34225 Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality
- CVE-2026-34224 Parse Server: MFA single-use token bypass via concurrent authData login requests
- CVE-2026-34223 Code injection in Desigo CC ClickOnce Client V6
- CVE-2026-34222 Open WebUI has Broken Access Control in Tool Valves
- CVE-2026-34221 MikroORM has Prototype Pollution in Utils.merge
- CVE-2026-34220 MikroORM is vulnerable to SQL Injection via specially crafted object
- CVE-2026-3422 e-Excellence｜U-Office Force - Insecure Deserialization