Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 717 of 1013.
- CVE-2026-32678 Auth bypass in BUFFALO Wi-Fi router products
- CVE-2026-32677 Path traversal in gaudi-container-runtime
- CVE-2026-32673 BIG-IP scripted monitor vulnerability
- CVE-2026-32669 Code injection in BUFFALO Wi-Fi router products
- CVE-2026-32666 Automated Logic WebCTRL Premium Server Authentication Bypass by Spoofing
- CVE-2026-32665 Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass
- CVE-2026-32663 IGL-Technologies eParking.fi Insufficient Session Expiration
- CVE-2026-32662 Gardyn Cloud API Active Debug Code
- CVE-2026-32661 Memory corruption in GUARDIANWALL Mail Security Cloud (SaaS version)
- CVE-2026-3266 Improper access control vulnerability has been discovered in OpenText™ Filr.
- CVE-2026-32658 Missing authorization in Automation Platform
- CVE-2026-32657 Privilege escalation in AppSync
- CVE-2026-32655 Privilege escalation in Alienware Command Center (AWCC)
- CVE-2026-32652 Hardcoded credentials in AIOps
- CVE-2026-32650 Anviz CrossChex Standard Algorithm Downgrade
- CVE-2026-3265 go2ismail Free-CRM Security API improper authorization
- CVE-2026-32649 Milesight Cameras OS Command Injection
- CVE-2026-32648 Anviz Products Missing Authorization
- CVE-2026-32647 NGINX ngx_http_mp4_module vulnerability
- CVE-2026-32646 Gardyn Cloud API Missing Authentication for Critical Function
- CVE-2026-32645 Red Lion Controls N-Tron 700 Series Use of Hard-Coded Credentials
- CVE-2026-32644 Milesight Cameras Use of Hard-coded Cryptographic Key
- CVE-2026-32643 BIG-IP and BIG-IQ privilege escalation vulnerability
- CVE-2026-32642 Apache Artemis: Unauthorized Temporary Address Creation via OpenWire Protocol
- CVE-2026-32641 Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware
- CVE-2026-32640 (SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.
- CVE-2026-3264 go2ismail Free-CRM Administrative redirect
- CVE-2026-32639 Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads
- CVE-2026-32638 StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
- CVE-2026-32637 Velero vulnerable to file path traversal when extracting from backup's tarball
- CVE-2026-32636 ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash
- CVE-2026-32635 Angular has XSS in i18n attribute bindings
- CVE-2026-32634 Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers
- CVE-2026-32633 Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`
- CVE-2026-32632 Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding
- CVE-2026-32631 Git for Windows: `git clone` from manipulated repositories can leak NTLM hashes to arbitrary servers
- CVE-2026-32630 file-type affected by ZIP Decompression Bomb DoS via [Content_Types].xml entry
- CVE-2026-3263 go2ismail Asp.Net-Core-Inventory-Order-Management-System Security API improper authorization
- CVE-2026-32629 phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor
- CVE-2026-32628 AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter
- CVE-2026-32627 cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy
- CVE-2026-32626 AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection
- CVE-2026-32625 LibreChat Exfiltrates Server Secrets via MCP Server URL Injection
- CVE-2026-32624 xrdp: Heap buffer overflow in xrdp_sec_process_logon_info() via incorrect g_strncat length calculation
- CVE-2026-32623 xrdp: Heap buffer overflow in NeutrinoRDP channel reassembly
- CVE-2026-32622 SQLBot: Remote Code Execution via Terminology Poisoning
- CVE-2026-32621 Apollo Federation has prototype pollution via incomplete key sanitization
- CVE-2026-32620 Discourse: Missing post-level authorization allows whisper metadata disclosure
- CVE-2026-3262 go2ismail Asp.Net-Core-Inventory-Order-Management-System Administrative redirect
- CVE-2026-32619 Discourse: Insufficient topic visibility check allows unauthorized poll manipulation in private categories
- CVE-2026-32618 Discourse: Unauthorized channel membership inference via excluded_memberships_channel_id
- CVE-2026-32617 AnythingLLM Permissable CORS policy
- CVE-2026-32616 Pigeon has a Host Header Injection in email verification flow
- CVE-2026-32615 Discourse: Category group moderators can perform actions on topics in restricted categories without read access
- CVE-2026-32614 Go ShangMi SM9 Infinity-Point Ciphertext Forgery Vulnerability
- CVE-2026-32613 Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling
- CVE-2026-32612 Statamic: privilege escalation via stored cross-site scripting
- CVE-2026-32611 Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements
- CVE-2026-32610 Glances's Default CORS Configuration Allows Cross-Origin Credential Theft
- CVE-2026-3261 itsourcecode School Management System Setting index.php sql injection
- CVE-2026-32609 Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials
- CVE-2026-32608 Glances has a Command Injection via Process Names in Action Command Templates
- CVE-2026-32607 Discourse: Stored XSS via unescaped assignee name
- CVE-2026-32606 IncusOS has a LUKS encryption bypass due to insufficient TPM policy
- CVE-2026-32605 Nimiq: Remote crash via off-by-one signer bounds check in proposal buffer
- CVE-2026-32604 Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
- CVE-2026-32603 Sandboxie kernel driver denial of service via malformed IOCTL from sandboxed process
- CVE-2026-32602 Homarr has a Race Condition in Invite Token Registration (TOCTOU)
- CVE-2026-32600 xml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
- CVE-2026-32599 Netmaker has a boolean‑based SQL Injection
- CVE-2026-32598 OneUptime: Password Reset Token Logged at INFO Level
- CVE-2026-32597 PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
- CVE-2026-32596 Glances exposes the REST API without authentication
- CVE-2026-32595 Traefik: BasicAuth Middleware Timing Attack Allows Username Enumeration
- CVE-2026-32594 Parse Server GraphQL WebSocket endpoint bypasses security middleware
- CVE-2026-32593 Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax
- CVE-2026-32591 Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration
- CVE-2026-32590 Mirror-registry: remote code execution using pickle deserialization
- CVE-2026-3259 Sensitive Data Disclosure in BigQuery via Materialized View Error Messages
- CVE-2026-32589 Mirror-registry: quay: insecure direct object reference in blobupload
- CVE-2026-32588 Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing
- CVE-2026-32587 WordPress WP EasyPay plugin <= 4.2.11 - Broken Access Control vulnerability
- CVE-2026-32586 WordPress Booster for WooCommerce plugin < 7.11.3 - Broken Access Control vulnerability
- CVE-2026-32585 WordPress Airano MCP Bridge plugin <= 2.11.0 - Broken Access Control vulnerability
- CVE-2026-32584 Information disclosure in Smart One Click Setup – Complete Demo Import & Export
- CVE-2026-32583 WordPress Modern Events Calendar plugin <= 7.29.0 - Broken Access Control vulnerability
- CVE-2026-32582 WordPress IATO MCP plugin <= 1.12.0 - Broken Access Control vulnerability
- CVE-2026-32581 WordPress Mooberry Book Manager plugin 4.16.2 - SQL Injection vulnerability
- CVE-2026-32580 WordPress WooCommerce Lottery plugin <= 2.2.9 - SQL Injection vulnerability
- CVE-2026-32579 WordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerability
- CVE-2026-32578 WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability
- CVE-2026-32577 WordPress Frontend File Manager plugin <= 23.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32576 WordPress Faktur Pro for WooCommerce plugin <= 3.2.2 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-32575 WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32574 WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32573 WordPress Nelio AB Testing plugin <= 8.2.7 - Remote Code Execution (RCE) vulnerability
- CVE-2026-32572 WordPress WP User Frontend Pro plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32571 WordPress Ohio Extra plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32570 WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-3257 UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library