Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 731 of 1013.
- CVE-2026-31249 CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in
- CVE-2026-31248 Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks
- CVE-2026-31247 Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks
- CVE-2026-31246 GPT-Pilot contains a command injection vulnerability in the Executor.run() method
- CVE-2026-31245 mem0 server lacks authentication and authorization controls for its memory creation API endpoint
- CVE-2026-31244 Missing authorization in mem0:mem0
- CVE-2026-31243 Missing authorization in mem0:mem0
- CVE-2026-31242 Missing authorization in mem0:mem0
- CVE-2026-31241 mem0 server lacks authentication and authorization controls for its memory deletion API endpoint
- CVE-2026-31240 mem0 server lacks authentication and authorization controls for its memory management API endpoints
- CVE-2026-3124 Business logic in Download Monitor
- CVE-2026-31239 mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub
- CVE-2026-31238 Ludwig framework is vulnerable to insecure deserialization in its model serving component
- CVE-2026-31237 Ludwig framework is vulnerable to insecure deserialization through its predict() method.
- CVE-2026-31236 llm CLI tool contains a code injection vulnerability via `--functions` command-line argument
- CVE-2026-31235 imgaug contains an insecure deserialization vulnerability in BackgroundAugmenter class within multicore.py module
- CVE-2026-31234 Horovod contains an insecure deserialization vulnerability in its KVStore HTTP server component
- CVE-2026-31233 Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism
- CVE-2026-31232 The CosyVoice project thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (
- CVE-2026-31231 Cognee thru v0.4.0 contains a critical remote code execution vulnerability in its notebook cell execution API endpoint.
- CVE-2026-31230 The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a command-line argument injection vulnerability in its Kubeflow component (rob
- CVE-2026-31229 The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains an insecure deserialization vulnerability (CWE-502) in its Kubeflow component'
- CVE-2026-31228 The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a remote code execution vulnerability in its Kubeflow component.
- CVE-2026-31226 The TinyZero project thru commit 6652a63c57fa7e5ccde3fc9c598c7176ff15b839 (2025-58-24) contains a critical command injection vulnerability (
- CVE-2026-31225 Superduper: Remote code execution via unsafe eval in superduper query parsing
- CVE-2026-31224 Snorkel MultitaskClassifier.load uses an unsafe torch.load
- CVE-2026-31223 Snorkel BaseLabeler.load uses an unsafe pickle.load
- CVE-2026-31222 Snorkel Trainer.load uses an unsafe torch.load
- CVE-2026-31221 PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization
- CVE-2026-31220 PySyft server-side arbitrary Python execution after code approval
- CVE-2026-31219 The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f
- CVE-2026-31218 The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f
- CVE-2026-31217 Code injection in nebuly:optimate
- CVE-2026-31216 Missing authorization in nexent:nexent
- CVE-2026-31215 Missing authorization in nexent:nexent
- CVE-2026-31214 The torch-checkpoint-shrink.py script in the ml-engineering project in commit 0099885db36a8f06556efe1faf552518852cb1e0 (2025-20-27) contains
- CVE-2026-3121 Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission
- CVE-2026-31205 Cross Site Scripting vulnerability in Pluck CMS before v.4.7.21dev allows a remote attacker to escalate privileges via the editpage.php and
- CVE-2026-3120 RCE in Profelis Informatics' SambaBox
- CVE-2026-31196 OS command injection vulnerability in the traceroute diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre R
- CVE-2026-31195 OS command injection vulnerability in the ping diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre Router
- CVE-2026-31192 Missing authorization in raindrop:raindrop
- CVE-2026-3119 Authenticated query containing a TKEY record may cause named to terminate unexpectedly
- CVE-2026-31181 Command injection in totolink:a3300r firmware
- CVE-2026-3118 Rhdh: graphql injection leading to platform-wide denial of service (dos) in rh developer hub orchestrator plugin
- CVE-2026-31179 Command injection in totolink:a3300r firmware
- CVE-2026-31178 Command injection in totolink:a3300r firmware
- CVE-2026-31177 Command injection in totolink:a3300r firmware
- CVE-2026-31176 Command injection in totolink:a3300r firmware
- CVE-2026-31175 Command injection in totolink:a3300r firmware
- CVE-2026-31174 Command injection in totolink:a3300r firmware
- CVE-2026-31173 Command injection in totolink:a3300r firmware
- CVE-2026-31172 Command injection in totolink:a3300r firmware
- CVE-2026-31171 Command injection in totolink:a3300r firmware
- CVE-2026-31170 Command injection in totolink:a3300r firmware
- CVE-2026-3117 Instance and webhook GitLab plugin commands were able to be run by non-admin users
- CVE-2026-31169 Command injection in totolink:a3300r firmware
- CVE-2026-31168 Command injection in totolink:a3300r firmware
- CVE-2026-31167 Command injection in totolink:a3300r firmware
- CVE-2026-31166 Command injection in totolink:a3300r firmware
- CVE-2026-31165 Command injection in totolink:a3300r firmware
- CVE-2026-31164 Command injection in totolink:a3300r firmware
- CVE-2026-31163 Command injection in totolink:a3300r firmware
- CVE-2026-31162 Command injection in totolink:a3300r firmware
- CVE-2026-31160 Command injection in totolink:a3300r firmware
- CVE-2026-3116 Improper Input Validation in Zoom Plugin Webhook Handler
- CVE-2026-31159 Command injection in totolink:a3300r firmware
- CVE-2026-31158 SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbitrary code via the Lo
- CVE-2026-31156 Path traversal in openplcproject:openplc v3 firmware
- CVE-2026-31153 A stored cross-site scripting (XSS) vulnerability in Bynder before 12 January 2026 allows attackers to execute arbitrary web scripts or HTML
- CVE-2026-31151 Auth bypass in kaleris:yard management solutions
- CVE-2026-31150 Missing authorization in kaleris:yard management solutions
- CVE-2026-3115 Guest users can view group member IDs without respecting view restrictions
- CVE-2026-3114 Zip Bomb Denial of Service via Unrestricted Archive Decompression
- CVE-2026-3113 mmctl export download command doesn’t restrict permissions to created file to file owner
- CVE-2026-3112 Arbitrary File Read via Advanced Logging Support Packet
- CVE-2026-3111 Multiple vulnerabilities on the Educativa Campus
- CVE-2026-3110 Multiple vulnerabilities on the Educativa Campus
- CVE-2026-3109 Missing timestamp validation in Zoom webhook handler
- CVE-2026-3108 Terminal Escape Injection in mmctl Report Posts Command
- CVE-2026-31072 APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization
- CVE-2026-31071 API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware.
- CVE-2026-31070 The LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated remote attackers to escalate privileges by self-assigning
- CVE-2026-3107 Multiple vulnerabilities in Teampass
- CVE-2026-31069 BillaBear is Vulnerable to SQL Injection in the EventRepository
- CVE-2026-31067 Command injection in utt:520w firmware
- CVE-2026-31066 Memory corruption in utt:810g firmware
- CVE-2026-31065 Memory corruption in utt:520w firmware
- CVE-2026-31063 Memory corruption in utt:1200gw firmware
- CVE-2026-31062 Memory corruption in utt:520w firmware
- CVE-2026-31061 Memory corruption in utt:810g firmware
- CVE-2026-31060 Memory corruption in utt:810g firmware
- CVE-2026-3106 Multiple vulnerabilities in Teampass
- CVE-2026-31059 Command injection in utt:520w firmware
- CVE-2026-31058 Memory corruption in utt:1200gw firmware
- CVE-2026-31053 Memory corruption in rizin:rizin
- CVE-2026-31052 An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of service via the Checkout Authentication Flow
- CVE-2026-31051 An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of service via the Client Balance component
- CVE-2026-31050 Cross Site Scripting vulnerability in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code
- CVE-2026-3105 SQL Injection in Contact Activity API Sorting