Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 734 of 1013.
- CVE-2026-30820 Flowise Authorization Bypass via Spoofed x-request-from Header
- CVE-2026-3082 GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-30819 Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter
- CVE-2026-30818 OS Command Injection Vulnerability in dnsmasq Module in TP-Link AX53
- CVE-2026-30817 Arbitrary File Reading Vulnerability in dnsmasq Module in TP-Link AX53
- CVE-2026-30816 Arbitrary File Reading Vulnerability in OpenVPN Module in TP-Link AX53
- CVE-2026-30815 OS Command Injection Vulnerability in OpenVPN Module in TP-Link AX53
- CVE-2026-30814 Buffer Overflow Vulnerability in TP-Link AX53
- CVE-2026-30813 SQL Injection in Module Search leads to Database Compromise
- CVE-2026-30812 Stored Cross-Site Scripting in Event Comments via Filter Bypass
- CVE-2026-30811 Missing Authorization in Configuration Ajax Endpoint leads to Information Disclosure
- CVE-2026-30810 Server-Side Request Forgery in API Checker leads to Privilege Escalation
- CVE-2026-3081 GStreamer H.266 Codec Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-30809 OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution
- CVE-2026-30808 Session Fixation in Authentication leads to Session Hijacking
- CVE-2026-30807 Cross-Site Request Forgery on Extension Pages
- CVE-2026-30806 OS Command Injection in Network Report leads to Remote Code Execution
- CVE-2026-30805 Insecure Default Initialization in API Authentication leads to Authentication Bypass
- CVE-2026-30804 Unrestricted File Upload in Extension Uploader leads to Remote Code Execution
- CVE-2026-30803 Integer Underflow (Wrap or Wraparound) vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers.
- CVE-2026-30802 Out-of-bounds Read vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers.
- CVE-2026-30799 Auth bypass in Connext Professional
- CVE-2026-30798 RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payload
- CVE-2026-30797 RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server
- CVE-2026-30796 RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Sync
- CVE-2026-30795 RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure
- CVE-2026-30793 RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation
- CVE-2026-30792 RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings
- CVE-2026-30791 RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validation
- CVE-2026-3079 LearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter
- CVE-2026-30789 RustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-Force
- CVE-2026-30785 RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305)
- CVE-2026-30783 RustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL Policies
- CVE-2026-30778 SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information
- CVE-2026-30777 Auth bypass in EC-CUBE 4.1 series
- CVE-2026-30769 Privilege escalation in entechtaiwan:tvicport
- CVE-2026-30761 An arbitrary file upload vulnerability in the pages/admin.uploadmapimg.php component of SourceBans Material Admin v1.1.6 allows attackers to
- CVE-2026-30760 An issue in SourceBans Material Admin before v.1.1.6 (3ecd95e) allows attackers to manipulate arbitrary user data in the web app via a crafted XAJAX call.
- CVE-2026-30754 Memory corruption in ffmpeg:ffmpeg
- CVE-2026-3075 WordPress Simple Ajax Chat plugin <= 20251121 - Sensitive Data Exposure vulnerability
- CVE-2026-30741 Code injection in openclaw:openclaw
- CVE-2026-3074 Authorization Bypass Through User-Controlled Key in GitLab
- CVE-2026-3073 Authorization Bypass Through User-Controlled Key in GitLab
- CVE-2026-3072 Missing authorization in Media Library Assistant
- CVE-2026-30711 Devome GRR v4.5.0 was discovered to contain multiple authenticated SQL injection vulnerabilities in the include/session.inc.php file via the
- CVE-2026-3071 Deserialization in Flair
- CVE-2026-30707 An issue was discovered in SpeedExam Online Examination System (SaaS) after v.FEV2026.
- CVE-2026-30704 The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) exposes an unprotected UART interface through accessible hardware pads on the PCB
- CVE-2026-30703 A command injection vulnerability exists in the web management interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02).
- CVE-2026-30702 The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) implements a broken authentication mechanism in its web management interface.
- CVE-2026-30701 The web interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) contains hardcoded credential disclosure mechanisms (in the
- CVE-2026-3070 SourceCodester Modern Image Gallery App upload.php cross site scripting
- CVE-2026-30695 A Cross-Site Scripting (XSS) vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices, includ
- CVE-2026-30694 Code injection in dedecms:dedecms
- CVE-2026-30691 @cyntler/react-doc-viewer's TXTRenderer fails to sanitize file content and explicitly casts raw data as a ReactNode
- CVE-2026-3069 itsourcecode Document Management System edtlbls.php sql injection
- CVE-2026-30689 Missing authorization in Blog.Core
- CVE-2026-3068 itsourcecode Document Management System deluser.php sql injection
- CVE-2026-3067 HummerRisk Archive Extraction CommandUtils.java extractZip path traversal
- CVE-2026-30662 ConcreteCMS is vulnerable to Denial of Service During Bulk Downloads
- CVE-2026-30661 Cross-site scripting in idreamsoft:icms
- CVE-2026-3066 HummerRisk Cloud Compliance Scanning PlatformUtils.java fixedCommand command injection
- CVE-2026-30656 A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdp_pli option.
- CVE-2026-30655 SQL injection in esiclivre:esiclivre
- CVE-2026-30653 Denial of service in free5gc:free5gc
- CVE-2026-30652 Memory corruption in vivotek:fd8136 firmware
- CVE-2026-30650 Memory corruption in vivotek:fd8136 firmware
- CVE-2026-3065 HummerRisk Cloud Task Dry-run CloudTaskService.java CommandUtils.commonExecCmdWithResult command injection
- CVE-2026-30649 Memory corruption in vivotek:fd8136 firmware
- CVE-2026-30643 Code injection in dedecms:dedecms
- CVE-2026-3064 HummerRisk Cloud Task Scheduler ResourceCreateService.java command injection
- CVE-2026-30637 Server-side request forgery in otcms:otcms
- CVE-2026-30635 automagik-genie has a command injection vulnerability
- CVE-2026-30633 Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the get_doc and update_doc tools.
- CVE-2026-30632 Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the create_doc tool.
- CVE-2026-30631 An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 (2025-09-11) allowing attackers to execute arbitrar
- CVE-2026-3063 Cross-site scripting in Chrome
- CVE-2026-30625 Upsonic: remote code execution vulnerability in its MCP server/task creation functionality
- CVE-2026-30624 Command injection in agent-zero:agent-zero
- CVE-2026-30623 LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality.
- CVE-2026-3062 Memory corruption in Chrome
- CVE-2026-30618 xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling.
- CVE-2026-30617 LangChain-ChatChat 0.3.1 contains a remote code execution vulnerability in its MCP STDIO server configuration and execution handling.
- CVE-2026-30616 Jaaz 1.0.30 contains a remote code execution vulnerability in its MCP STDIO command execution handling.
- CVE-2026-30615 A prompt injection vulnerability in Windsurf 1.9544.26 allows remote attackers to execute arbitrary commands on a victim system.
- CVE-2026-30613 An information disclosure vulnerability exists in AZIOT 1 Node Smart Switch (16amp)- WiFi/Bluetooth Enabled Software Version: 1.1.9 due to i
- CVE-2026-30612 An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a
- CVE-2026-3061 Memory corruption in Chrome
- CVE-2026-30603 An issue in the firmware update mechanism of Qianniao QN-L23PA0904 v20250721.1640 allows attackers to gain root access, install backdoors, a
- CVE-2026-3060 CVE-2026-3060
- CVE-2026-3059 CVE-2026-3059
- CVE-2026-30587 Seafile Server has multiple stored XSS vulnerabilities
- CVE-2026-30586 Cross Site Scripting vulnerability in usememos Memos v.0.26.0 allows a remote attacker to obtain sensitive information via the SANITIZE_SCHE
- CVE-2026-30580 Path traversal in leefish:file thingie
- CVE-2026-3058 Missing authorization in Seraphinite Accelerator
- CVE-2026-30579 Cross-site scripting in leefish:file thingie
- CVE-2026-30578 Cross-site scripting in leefish:file thingie
- CVE-2026-30576 Business logic in senior-walter:web-based pharmacy product management system
- CVE-2026-30575 Business logic in senior-walter:web-based pharmacy product management system
- CVE-2026-30574 Business logic in senior-walter:web-based pharmacy product management system