Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 735 of 1013.
- CVE-2026-30573 Business logic in senior-walter:web-based pharmacy product management system
- CVE-2026-30571 Cross-site scripting in ahsanriaz26gmailcom:inventory system
- CVE-2026-30570 Cross-site scripting in ahsanriaz26gmailcom:inventory system
- CVE-2026-3057 a54552239 pearProjectApi Backend Task.php dateTotalForProject sql injection
- CVE-2026-30569 Cross-site scripting in ahsanriaz26gmailcom:inventory system
- CVE-2026-30568 Cross-site scripting in ahsanriaz26gmailcom:inventory system
- CVE-2026-30567 Cross-site scripting in ahsanriaz26gmailcom:inventory system
- CVE-2026-30566 Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system
- CVE-2026-30565 Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system
- CVE-2026-30564 Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system
- CVE-2026-30563 Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system
- CVE-2026-30562 Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system
- CVE-2026-30561 Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system
- CVE-2026-30560 Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system
- CVE-2026-3056 Seraphinite Accelerator <= 2.28.14 - Missing Authorization to Authenticated (Subscriber+) Log Clearing
- CVE-2026-30559 Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system
- CVE-2026-30558 Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system
- CVE-2026-30557 Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system
- CVE-2026-30556 Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system
- CVE-2026-3055 Citrix NetScaler Out-of-Bounds Read
- CVE-2026-3054 Alinto SOGo cross site scripting
- CVE-2026-30534 SQL injection in oretnom23:online food ordering system
- CVE-2026-30533 SQL injection in oretnom23:online food ordering system
- CVE-2026-30532 SQL injection in oretnom23:online food ordering system
- CVE-2026-30531 SQL injection in oretnom23:online food ordering system
- CVE-2026-30530 SQL injection in oretnom23:online food ordering system
- CVE-2026-3053 DataLinkDC dinky OpenAPI Endpoint AppConfig.java addInterceptors missing authentication
- CVE-2026-30529 SQL injection in oretnom23:online food ordering system
- CVE-2026-30527 Cross-site scripting in oretnom23:online food ordering system
- CVE-2026-30526 Cross-site scripting in pushpam02:zoo management system
- CVE-2026-30523 Business logic in oretnom23:loan management system
- CVE-2026-30522 Business logic in oretnom23:loan management system
- CVE-2026-30521 Business logic in oretnom23:loan management system
- CVE-2026-30520 SQL injection in oretnom23:loan management system
- CVE-2026-3052 DataLinkDC dinky Flink Proxy Controller FlinkProxyController.java proxyUba server-side request forgery
- CVE-2026-30512 A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5.
- CVE-2026-3051 DataLinkDC dinky Project Name GitRepository.java getProjectDir path traversal
- CVE-2026-3050 horilla-opensource horilla Leads global.js cross site scripting
- CVE-2026-30498 A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the delete.php endpoint of Jason2605 AdminPanel 4.0.
- CVE-2026-30496 The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an HTTP API on TCP port 2345 that allows full unauthe
- CVE-2026-30495 The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP port 5555 over the
- CVE-2026-3049 horilla-opensource horilla Query Parameter global_search.py get redirect
- CVE-2026-30480 A Local File Inclusion (LFI) vulnerability in the NFSen module (nfsen.inc.php) of LibreNMS 22.11.0-23-gd091788f2 allows authenticated attack
- CVE-2026-3048 Nexus Repository 3 - Improper LDAP Referral Handling
- CVE-2026-30479 A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows attackers to execute arbitrary code via a crafted executable.
- CVE-2026-30478 A Dynamic-link Library Injection vulnerability in GatewayGeo MapServer for Windows version 5 allows attackers to escalate privileges via a crafted executable.
- CVE-2026-3047 Keycloak SAML Broken has Authentication Bypass by Primary Weakness
- CVE-2026-30463 SQL injection in thedaylightstudio:fuel cms
- CVE-2026-30462 A path traversal vulnerability in the Blocks module of Daylight Studio FuelCMS v1.5.2 allows attackers to execute a directory traversal.
- CVE-2026-30461 Command injection in thedaylightstudio:fuel cms
- CVE-2026-30460 Code injection in thedaylightstudio:fuel cms
- CVE-2026-3046 itsourcecode E-Logbook with Health Monitoring System for COVID-19 check_profile_old.php sql injection
- CVE-2026-30459 Business logic in thedaylightstudio:fuel cms
- CVE-2026-30458 Business logic in thedaylightstudio:fuel cms
- CVE-2026-30457 Code injection in thedaylightstudio:dwoo
- CVE-2026-30452 Missing authorization in textpattern:textpattern
- CVE-2026-3045 Missing authorization in Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- CVE-2026-3044 Tenda AC8 Httpd Service UploadCfg webCgiGetUploadFile stack-based overflow
- CVE-2026-3043 itsourcecode Event Management System navbar.php cross site scripting
- CVE-2026-3042 itsourcecode Event Management System index.php sql injection
- CVE-2026-3041 xingfuggz BaykeShop Article Sidebar custom.html cross site scripting
- CVE-2026-30405 GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute
- CVE-2026-30404 Server-side request forgery in wgstart:wgcloud
- CVE-2026-30403 Path traversal in wgstart:wgcloud
- CVE-2026-30402 Code injection in wgstart:wgcloud
- CVE-2026-3040 DrayTek Vigor 300B Web Management uploadlangs cgiGetFile os command injection
- CVE-2026-3039 BIND 9 server memory exhaustion during GSS-API TKEY negotiation
- CVE-2026-3038 Local DoS and possible privilege escalation via routing sockets
- CVE-2026-3037 Copeland XWEB and XWEB Pro OS Command Injection
- CVE-2026-30368 Auth bypass in Lightspeed Classroom
- CVE-2026-30364 CentSDR commit e40795 was discovered to contain a stack overflow in the "Thread1" function.
- CVE-2026-30363 flipperzero-firmware commit ad2a80 was discovered to contain a stack overflow in the "Main" function.
- CVE-2026-30352 A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execu
- CVE-2026-30351 A path traversal vulnerability in the UI/static component of leonvanzyl autocoder commit 79d02a allows attackers to read arbitrary files via
- CVE-2026-30350 An issue in the /store/items/search endpoint of Agent Protocol server commit e9a89f allows attackers to cause a Denial of Service (DoS) via
- CVE-2026-3035 Authentication Bypass Using an Alternate Path or Channel in GitLab
- CVE-2026-30346 An open redirect in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2 allows attackers to redirect users to malicious sites via
- CVE-2026-30345 A zip slip vulnerability in the Admin import functionality of CTFd v3.8.1-18-gdb5a18c4 allows attackers to write arbitrary files outside the
- CVE-2026-3034 Cross-site scripting in OoohBoi Steroids for Elementor
- CVE-2026-30332 A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escala
- CVE-2026-30314 Command injection in ridvay:auto-approval module
- CVE-2026-30313 Command injection in cline:cline
- CVE-2026-30312 DSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechani
- CVE-2026-30311 Command injection in ridvay:auto-approval module
- CVE-2026-30310 In its design for automatic terminal command execution, Sixth offers two options: Execute safe commands and Execute all commands.
- CVE-2026-3031 Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library
- CVE-2026-30309 Command injection in tokfinity:infcode
- CVE-2026-30308 Code injection in presidio:hai build
- CVE-2026-30307 Command injection in roocode:roo code
- CVE-2026-30306 Code injection in rahmanazhar:sakadev
- CVE-2026-30305 Command injection in orangecat:syntx
- CVE-2026-30304 Security feature bypass in tianguaduizhang:ai code
- CVE-2026-30303 Command injection in matterai:axon code
- CVE-2026-30302 Command injection in coderider-kilo:coderider
- CVE-2026-30292 An arbitrary file overwrite vulnerability in Docudepot PDF Reader: PDF Viewer APP v1.0.34 allows attackers to overwrite critical internal fi
- CVE-2026-30291 An arbitrary file overwrite vulnerability in Ora Tools PDF Reader ' Reader & Editor APPv4.3.5 allows attackers to overwrite critical interna
- CVE-2026-30290 Path traversal in intouchapp:intouch contacts \& caller id
- CVE-2026-3029 CVE-2026-3029
- CVE-2026-30289 Path traversal in tinybeans:private family album
- CVE-2026-30287 Path traversal in deepthought.industries:ace scanner