Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 736 of 1013.
- CVE-2026-30286 Path traversal in funambol:zefiro
- CVE-2026-30285 Path traversal in zora:zora
- CVE-2026-30284 Path traversal in uxgroupllc:voice recorder
- CVE-2026-30283 Path traversal in peaksel:animal sounds and ringtones
- CVE-2026-30282 Path traversal in uxgroupllc:cast to tv
- CVE-2026-30281 Path traversal in maru:neo.maru
- CVE-2026-30280 File upload in rareprob:video player
- CVE-2026-3028 erzhongxmu JEEWMS JeecgListDemoController.java doAdd cross site scripting
- CVE-2026-30279 Path traversal in squareapps:my location
- CVE-2026-30278 Path traversal in funair:fly is fun
- CVE-2026-30277 Path traversal in triumph-adler:mobile print
- CVE-2026-30276 Path traversal in deftpdf:document translator
- CVE-2026-30273 SQL injection in gabrieleventuri:pandasai
- CVE-2026-3027 erzhongxmu JEEWMS UEditor getContent.jsp cross site scripting
- CVE-2026-30269 Privilege escalation in doorman:doorman
- CVE-2026-30266 Misconfiguration in deepcool:deepcreative
- CVE-2026-3026 erzhongxmu JEEWMS UEditor getRemoteImage.jsp server-side request forgery
- CVE-2026-30252 Cross-site scripting in interzen:zencrm
- CVE-2026-30251 Cross-site scripting in interzen:zenshare suite
- CVE-2026-30250 Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW!
- CVE-2026-3025 ShuoRen Smart Heating Integrated Management Platform ExampleNodeService.asmx unrestricted upload
- CVE-2026-30247 WeKnora: SSRF via Redirection
- CVE-2026-30246 github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters
- CVE-2026-30244 Plane: Unauthenticated Workspace Member Information Disclosure
- CVE-2026-30242 Plane: SSRF via Incomplete IP Validation in Webhook URL Serializer
- CVE-2026-30241 Mercurius: queryDepth limit bypassed for WebSocket subscriptions
- CVE-2026-30240 Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets
- CVE-2026-3024 Stored Cross-Site Scripting (XSS) vulnerability in the Wakyma application web
- CVE-2026-30239 OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets
- CVE-2026-30238 Group-Office: Reflected XSS in JavaScript context
- CVE-2026-30237 Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)
- CVE-2026-30236 OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly rate
- CVE-2026-30235 Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobbering
- CVE-2026-30234 OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR)
- CVE-2026-30233 OliveTin: View permission not being checked when returning dashboards
- CVE-2026-30232 Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs
- CVE-2026-30231 Flare: Private File IDOR via raw/direct endpoints
- CVE-2026-30230 Flare: Password‑Protected Thumbnail Bypass
- CVE-2026-3023 Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma application web
- CVE-2026-30229 Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user
- CVE-2026-30228 Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction
- CVE-2026-30227 MimeKit: CRLF Injection in Quoted Local-Part Enables SMTP Command Injection and Email Forgery
- CVE-2026-30226 devalue has prototype pollution in devalue.parse and devalue.unflatten
- CVE-2026-30225 OliveTin: RestartAction always runs actions as guest
- CVE-2026-30224 OliveTin: Session Fixation - Logout Fails to Invalidate Server-Side Session
- CVE-2026-30223 OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes
- CVE-2026-3022 Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma application web
- CVE-2026-3021 Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma application web
- CVE-2026-3020 Identity based authorization bypass vulnerability (IDOR) in the Wakyma application web
- CVE-2026-3018 Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter
- CVE-2026-3017 Deserialization in Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts
- CVE-2026-30162 Cross-site scripting in auntvt:timo
- CVE-2026-3016 UTT HiPER 810G formP2PLimitConfig strcpy buffer overflow
- CVE-2026-3015 UTT HiPER 810G formPolicyRouteConf strcpy buffer overflow
- CVE-2026-30141 An issue was discovered in bitbank2 AnimatedGIF v2.2.0.
- CVE-2026-30140 Missing authorization in tenda:w15e firmware
- CVE-2026-3014 Remote Code Execution by administrative user on the Management Server
- CVE-2026-30139 Silverpeas Core has a reflected cross-site scripting vulnerability
- CVE-2026-3013 Path Traversal in Coppermine Photo Gallery
- CVE-2026-30121 Remotion: arbitrary file write vulnerability
- CVE-2026-30120 Remotion: remote code execution (RCE) vulnerability
- CVE-2026-3012 Samba: group policy certificate enrollment uses http:// without validation
- CVE-2026-30118 scalar/astro v0.1.13 was discovered to contain a Server-Side Request Forgery (SSRF) in the scalar_url query parameter of the Scalar Proxy endpoint.
- CVE-2026-30117 scalar/astro v0.1.13 was discovered to contain an arbitrary file upload vulnerability in the the scalar_url query parameter of the Scalar Proxy endpoint.
- CVE-2026-3011 Recipe Card Blocks Lite <= 3.4.13 - Authenticated (Author+) Stored Cross-Site Scripting via 'summary' and 'notes'
- CVE-2026-3010 TimePictra Stored Cross-Site Scripting
- CVE-2026-3009 Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator
- CVE-2026-30082 Multiple stored cross-site scripting (XSS) vulnerabilities in the Edit feature of the Software Package List page of IngEstate Server v11.14.
- CVE-2026-30080 Security feature bypass in openairinterface:oai-cn5g-amf
- CVE-2026-3008 Vulnerability in Notepad++
- CVE-2026-30079 Auth bypass in openairinterface:oai-cn5g-amf
- CVE-2026-30078 Denial of service in openairinterface:oai-cn5g-amf
- CVE-2026-30077 Denial of service in openairinterface:openairinterface
- CVE-2026-30075 Memory corruption in openairinterface:oai-cn5g-amf
- CVE-2026-30073 An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- CVE-2026-30072 A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted payload.
- CVE-2026-30071 An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2026-30070 An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2026-3007 Stored Cross-Site Scripting (XSS) Vulnerability
- CVE-2026-30069 A NULL pointer dereference in the UDMC registration handler component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS)
- CVE-2026-30068 Improper input validation in the HandleUpdate function (/sbi/parameter_provision.go) of free5gc v4.0.1 allows attackers to cause a Denial of
- CVE-2026-30067 An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of S
- CVE-2026-30064 Improper input validation in the buildFilter function (processor/processor.go) of free5gc v4.0.1 allows attackers to cause a Denial of Servi
- CVE-2026-30063 An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted snssais query.
- CVE-2026-30062 An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU.
- CVE-2026-30060 An issue in free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) when parsing crafted SUCI data during UE registration.
- CVE-2026-3006 Race Condition Vulnerability
- CVE-2026-30059 An issue in the NAS decoder component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted Registration Request message.
- CVE-2026-30058 Improper Input Validation in the HTTPModifySubscription handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2026-30057 An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request.
- CVE-2026-30056 A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via su
- CVE-2026-30051 An issue in the CreateUEContextProcedure function (/v1/ue-contexts/{supi}) of free5gc v4.1.0 allows attackers to cause a Denial of Service (
- CVE-2026-30050 An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Den
- CVE-2026-3005 List category posts <= 0.94.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'catlist' Shortcode
- CVE-2026-30048 NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability
- CVE-2026-30047 A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of
- CVE-2026-30046 A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via sup
- CVE-2026-30045 An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows attackers to cause a Denial of Service (DoS) via su
- CVE-2026-30041 An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrary code or cause a Denial o
- CVE-2026-30040 A heap overflow in the FSViewer.exe process of FastStone Image Viewer v8.3 allows attackers to cause a execute arbitrary code in the context