Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 737 of 1013.
- CVE-2026-3004 Snow Monkey Blocks <= 24.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-slick' Attribute
- CVE-2026-3003 Vagaro Booking Widget <= 0.3 - Unauthenticated Stored Cross-Site Scripting via 'vagaro_code'
- CVE-2026-3002 Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks
- CVE-2026-3001 Gutenverse <= 3.4.6 - Reflected Cross-Site Scripting via 's' Parameter
- CVE-2026-30007 Use after free in xnview:nconvert
- CVE-2026-30006 Memory corruption in xnview:nconvert
- CVE-2026-3000 Changing｜IDExpert Windows Logon Agent - Remote Code Execution
- CVE-2026-2999 Changing｜IDExpert Windows Logon Agent - Remote Code Execution
- CVE-2026-29988 Information disclosure in AM102/102L V2
- CVE-2026-2998 eAI Technologies｜ERP - DLL Hijacking
- CVE-2026-29976 Memory corruption in zerbea:hcxtools
- CVE-2026-29975 lwjson 1.8.1 contains an improper input validation vulnerability in the streaming JSON parser (lwjson_stream.c).
- CVE-2026-29974 An issue was discovered in kosma minmea 0.3.0.
- CVE-2026-29972 nanoMODBUS through v1.22.0 has a stack-based buffer overflow in recv_read_registers_res() in nanomodbus.c.
- CVE-2026-29971 A reflected cross-site scripting (XSS) vulnerability exists in WebFileSys version before 2.32.0 and fixed in v.2.32.0.
- CVE-2026-2997 WisdomGarden｜Tronclass - Insecure Direct Object Reference
- CVE-2026-29969 Cross-site scripting in workflowfirst:staffwiki
- CVE-2026-29965 Cross-site scripting in hsclabs:mailinspector
- CVE-2026-29964 Cross-site scripting in hsclabs:mailinspector
- CVE-2026-29963 Path traversal in hsclabs:mailinspector
- CVE-2026-29962 Path traversal in hsclabs:mailinspector
- CVE-2026-2996 Business logic in Advanced Product Fields (Product Addons) for WooCommerce
- CVE-2026-29955 Command injection in cloudark:kubeplus
- CVE-2026-29954 Server-side request forgery in cloudark:kubeplus
- CVE-2026-29953 SQL injection in schemahero:schemahero
- CVE-2026-2995 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab
- CVE-2026-2994 Concrete CMS below 9.4.8 is vulnerable to CSRF by a Rogue Admin using the Anti-Spam Allowlist Group
- CVE-2026-29934 Cross-site scripting in lightcms project:lightcms
- CVE-2026-29933 Cross-site scripting in yzmcms:yzmcms
- CVE-2026-2993 AI Chatbot & Workflow Automation by AIWU <= 1.4.17 - Unauthenticated SQL Injection in getListForTbl()
- CVE-2026-29925 Server-side request forgery in invoiceninja:invoice ninja
- CVE-2026-29924 XML external entity in getgrav:grav
- CVE-2026-29923 The pstrip64.sys driver in EnTech Taiwan PowerStrip <=3.90.736 allows local users to escalate privileges to SYSTEM via a crafted IOCTL reque
- CVE-2026-2992 KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard
- CVE-2026-2991 Auth bypass in KiviCare – Clinic & Patient Management System (EHR)
- CVE-2026-29909 Missing authorization in mrcms:mrcms
- CVE-2026-29905 Denial of service in getkirby:kirby
- CVE-2026-2988 Cross-site scripting in PowerPress Podcasting plugin by Blubrry
- CVE-2026-29872 Information disclosure in theunwindai:awesome llm apps
- CVE-2026-29871 Path traversal in theunwindai:awesome llm apps
- CVE-2026-29870 A directory traversal vulnerability in the agentic-context-engine project versions up to 0.7.1 allows arbitrary file writes via the checkpoi
- CVE-2026-2987 Simple Ajax Chat <= 20260217 - Unauthenticated Stored Cross-Site Scripting via 'c'
- CVE-2026-29861 PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php.
- CVE-2026-2986 Contextual Related Posts <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes'
- CVE-2026-29859 File upload in aapanel:aapanel
- CVE-2026-29858 Path traversal in aapanel:aapanel
- CVE-2026-29856 Denial of service in aapanel:aapanel
- CVE-2026-2985 Tiandy Video Surveillance System 视频监控平台 CLSBODownLoad.java downloadImage server-side request forgery
- CVE-2026-29840 Cross-site scripting in jizhicms:jizhicms
- CVE-2026-2984 SourceCodester Student Result Management System drop_user.php denial of service
- CVE-2026-29839 Cross-site request forgery in dedecms:dedecms
- CVE-2026-2983 SourceCodester Student Result Management System Bulk Import import_users.php access control
- CVE-2026-29828 Cross-site scripting in dootask:dootask
- CVE-2026-29812 Other in CyberPanel
- CVE-2026-29811 Other in CyberPanel
- CVE-2026-29810 Business logic in CyberPanel
- CVE-2026-2981 UTT HiPER 810G formTaskEdit_ap strcpy buffer overflow
- CVE-2026-2980 UTT HiPER 810G setSysAdm strcpy buffer overflow
- CVE-2026-29797 Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check
- CVE-2026-29796 IGL-Technologies eParking.fi Missing Authentication for Critical Function
- CVE-2026-29795 stellar-xdr: `StringM::from_str` bypasses max length validation
- CVE-2026-29794 Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers
- CVE-2026-29793 NoSQL Injection via WebSocket id Parameter in MongoDB Adapter
- CVE-2026-29792 Feathersjs has an OAuth Callback Account Takeover
- CVE-2026-29791 Agentgateway: Missing parameter sanitization in MCP to OpenAPI conversion
- CVE-2026-29790 dbt-common: commonprefix() doesn't protect against path traversal
- CVE-2026-2979 FastApiAdmin Scheduled Task API controller.py user_avatar_upload_controller unrestricted upload
- CVE-2026-29789 Vito: Cross-project privilege escalation in workflow site-creation actions allows unauthorized server modification
- CVE-2026-29788 TSPortal: Anyone can forge self-deletion requests of any user
- CVE-2026-29787 mcp-memory-service: System Information Disclosure via Health Endpoint
- CVE-2026-29786 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath
- CVE-2026-29785 NATS Server panic via malicious compression on leafnode port
- CVE-2026-29784 Ghost: Incomplete CSRF protections around OTC use
- CVE-2026-29783 GitHub Copilot CLI allows for dangerous shell expansion patterns that enable arbitrary command execution
- CVE-2026-29782 OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2
- CVE-2026-29781 Sliver: Authenticated Nil-Pointer Dereference in Handlers
- CVE-2026-29780 eml_parser: Path Traversal in Official Example Script Leading to Arbitrary File Write
- CVE-2026-2978 FastApiAdmin Scheduled Task API controller.py upload_file_controller unrestricted upload
- CVE-2026-29779 UptimeFlare: Montior config / Credentials in `workerConfig` exposed in client-side JavaScript bundle
- CVE-2026-29778 pyLoad: Arbitrary File Write via Path Traversal in edit_package()
- CVE-2026-29777 Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values
- CVE-2026-29776 FreeRDP has an Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library
- CVE-2026-29775 FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId
- CVE-2026-29774 FreeRDP has a heap-buffer-overflow in avc420_yuv_to_rgb via OOB regionRects
- CVE-2026-29773 kubewarden-controller cross-namespace data exfiltration via deprecated host callback binding
- CVE-2026-29772 Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
- CVE-2026-29771 Netmaker: Denial of Service via Server Shutdown Endpoint
- CVE-2026-2977 FastApiAdmin Scheduled Task API controller.py upload_controller unrestricted upload
- CVE-2026-2976 FastApiAdmin Download Endpoint controller.py download_controller information disclosure
- CVE-2026-2975 FastApiAdmin Custom Documentation Endpoint init_app.py reset_api_docs information disclosure
- CVE-2026-2974 AliasVault App Backup aliasvault.xml backup
- CVE-2026-2973 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-2972 a466350665 Smart-SSO Role Edit UserController.java save cross site scripting
- CVE-2026-2971 a466350665 Smart-SSO Login login.html cross site scripting
- CVE-2026-2970 datapizza-labs datapizza-ai cache.py RedisCache deserialization
- CVE-2026-2969 datapizza-labs datapizza-ai Jinja2 Template prompt.py ChatPromptTemplate special elements used in a template engine
- CVE-2026-2968 Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification
- CVE-2026-2967 Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source
- CVE-2026-2966 Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values
- CVE-2026-2965 07FLYCMS/07FLY-CMS/07FlyCRM System Extension edit.html cross site scripting