Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 744 of 1013.
- CVE-2026-28630 Other in Android
- CVE-2026-2863 feng_ha_ha/megagao ssm-erp/production_ssm FileServiceImpl.java deleteFile path traversal
- CVE-2026-28627 Security feature bypass in Android
- CVE-2026-28626 Privilege escalation in Android
- CVE-2026-28625 Privilege escalation in Android
- CVE-2026-28624 Privilege escalation in Android
- CVE-2026-28623 Missing authorization in Android
- CVE-2026-28622 Missing authorization in Android
- CVE-2026-28620 Missing authorization in Android
- CVE-2026-2862 Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-28618 Memory corruption in Android
- CVE-2026-28617 Denial of service in Android
- CVE-2026-28616 Privilege escalation in Android
- CVE-2026-28615 Missing authorization in Android
- CVE-2026-28614 Privilege escalation in Android
- CVE-2026-28613 Privilege escalation in Android
- CVE-2026-28612 Privilege escalation in Android
- CVE-2026-28611 Missing authorization in Android
- CVE-2026-2861 Foswiki Changes/Viewfile/Oops information disclosure
- CVE-2026-28609 Memory corruption in Android
- CVE-2026-28607 Privilege escalation in Android
- CVE-2026-28606 Auth bypass in Android
- CVE-2026-28604 Use after free in Android
- CVE-2026-28603 Privilege escalation in Android
- CVE-2026-28602 Privilege escalation in Android
- CVE-2026-28600 Privilege escalation in Android
- CVE-2026-2860 feng_ha_ha/megagao ssm-erp/production_ssm EmployeeController.java improper authorization
- CVE-2026-28599 Privilege escalation in Android
- CVE-2026-28596 Denial of service in Android
- CVE-2026-28594 Use after free in Android
- CVE-2026-28593 Security feature bypass in Android
- CVE-2026-28590 Weak cryptography in Android
- CVE-2026-2859 Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint
- CVE-2026-28587 Missing authorization in Android
- CVE-2026-28586 Missing authorization in Android
- CVE-2026-28584 Business logic in Android
- CVE-2026-28583 Memory corruption in Android
- CVE-2026-28582 Missing authorization in Android
- CVE-2026-28581 Business logic in Android
- CVE-2026-28580 Memory corruption in Android
- CVE-2026-2858 wren-lang wren Source File wren_compiler.c peekChar out-of-bounds
- CVE-2026-28578 Denial of service in Android
- CVE-2026-28577 Other in Android
- CVE-2026-28576 SQL injection in Android
- CVE-2026-28575 Denial of service in Android
- CVE-2026-28573 Missing authorization in Android
- CVE-2026-28572 Other in Android
- CVE-2026-28571 WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability
- CVE-2026-28570 WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability
- CVE-2026-2857 D-Link DWR-M960 Port Forwarding Configuration Endpoint formPortFw sub_423E00 stack-based overflow
- CVE-2026-28569 WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-28568 WordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-28567 WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability
- CVE-2026-28564 Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials
- CVE-2026-28563 Apache Airflow: DAG authorization bypass
- CVE-2026-28562 wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter
- CVE-2026-28561 wpForo Forum 2.4.14 Stored XSS via Unescaped Forum Description in Templates
- CVE-2026-28560 wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script
- CVE-2026-2856 D-Link DWR-M960 Filter Configuration Endpoint formFilter sub_424AFC stack-based overflow
- CVE-2026-28559 wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed
- CVE-2026-28558 wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload
- CVE-2026-28557 wpForo Forum < 2.4.16 Privilege Escalation via Role Synchronization Handler
- CVE-2026-28556 wpForo Forum 2.4.14 Missing Authorization via Topic Management Form Handlers
- CVE-2026-28555 wpForo Forum 2.4.14 Missing Authorization via Topic Close AJAX Handler
- CVE-2026-28554 wpForo Forum 2.4.14 Missing Authorization via Post Approval AJAX Handler
- CVE-2026-28553 Missing authorization in EMUI
- CVE-2026-28552 Memory corruption in EMUI
- CVE-2026-28551 Race condition in HarmonyOS
- CVE-2026-28550 Race condition in HarmonyOS
- CVE-2026-2855 D-Link DWR-M960 DDNS Settings formDdns sub_4648F0 stack-based overflow
- CVE-2026-28549 Race condition in HarmonyOS
- CVE-2026-28548 Privilege escalation in EMUI
- CVE-2026-28547 Memory corruption in HarmonyOS
- CVE-2026-28546 Memory corruption in HarmonyOS
- CVE-2026-28545 Race condition in HarmonyOS
- CVE-2026-28544 Race condition in HarmonyOS
- CVE-2026-28543 Race condition in HarmonyOS
- CVE-2026-28542 Security feature bypass in EMUI
- CVE-2026-28541 Missing authorization in HarmonyOS
- CVE-2026-28540 Memory corruption in HarmonyOS
- CVE-2026-2854 D-Link DWR-M960 NTP Configuration Endpoint formNtp sub_4611CC stack-based overflow
- CVE-2026-28539 Other in HarmonyOS
- CVE-2026-28538 Path traversal in HarmonyOS
- CVE-2026-28537 Memory corruption in HarmonyOS
- CVE-2026-28536 Auth bypass in HarmonyOS
- CVE-2026-28532 FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions
- CVE-2026-2853 D-Link DWR-M960 System Log Configuration Endpoint formSysLog sub_462E14 stack-based overflow
- CVE-2026-28529 cryptodev-linux <= 1.14 get_userbuf Use After Free LPE
- CVE-2026-28528 BlueKitchen BTstack < 1.8.1 AVRCP Browsing Target GET_FOLDER_ITEMS Handler OOB Read / Undefined Behavior
- CVE-2026-28527 BlueKitchen BTstack < 1.8.1 AVRCP Controller GET_PLAYER_APPLICATION_SETTING_*_TEXT Handlers OOB Read
- CVE-2026-28526 BlueKitchen BTstack < 1.8.1 AVRCP Controller LIST_PLAYER_APPLICATION_SETTING_* Handlers OOB Read
- CVE-2026-28525 SWUpdate Integer Underflow in Multipart Upload Parser
- CVE-2026-28522 arduino-TuyaOpen WiFiUDP Null Pointer Dereference Denial of Service
- CVE-2026-28521 arduino-TuyaOpen TuyaIoT Out-of-Bounds Memory Read Information Disclosure
- CVE-2026-28520 arduino-TuyaOpen WiFiMulti Single-Byte Buffer Overflow Remote Code Execution
- CVE-2026-2852 yeqifu warehouse Sales Endpoint SalesController.java deleteSales access control
- CVE-2026-28519 arduino-TuyaOpen DnsServer Heap-Based Buffer Overflow Remote Code Execution
- CVE-2026-28518 OpenViking .ovpack Import ZIP Slip Path Traversal
- CVE-2026-28517 openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter
- CVE-2026-28516 openDCIM <= 23.04 SQL Injection in Config::UpdateParameter