Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 746 of 1013.
- CVE-2026-28411 WeGIA Vulnerable to Authentication Bypass via `extract($_REQUEST)`
- CVE-2026-28410 The Graph: Revocable vesting contracts allows early access to locked tokens
- CVE-2026-28409 WeGIA Vulnerable to Remote Code Execution (RCE) via OS Command Injection
- CVE-2026-28408 WeGIA lacks authentication verification in adicionar_tipo_docs_atendido.php
- CVE-2026-28407 malcontent's nested archive extraction failure can drop content from scan inputs
- CVE-2026-28406 kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory
- CVE-2026-28405 MarkUs: Stored XSS in Submission HTML Preview Enables Instructor-Context Actions
- CVE-2026-28403 Textream Cross-Site WebSocket Hijacking (CSWSH) vulnerability
- CVE-2026-28402 nimiq/core-rs-albatross's nimiq-blockchain missing proposal body root verification
- CVE-2026-28401 NocoDB: Stored Cross-Site Scripting via Rich Text Cells
- CVE-2026-28400 Docker Model Runner Unauthenticated Runtime Flag Injection via _configure Endpoint
- CVE-2026-2840 Cross-site scripting in Email Encoder – Protect Email Addresses and Phone Numbers
- CVE-2026-28399 NocoDB: SQL Injection via DATEADD Formula
- CVE-2026-28398 NocoDB: Stored Cross-Site Scripting via Comments and Rich Text Cells
- CVE-2026-28397 NocoDB: Stored Cross-Site Scripting via Comments
- CVE-2026-28396 NocoDB: Refresh Tokens Not Revoked on Password Reset
- CVE-2026-28395 OpenClaw 2026.1.14-1 < 2026.2.12 - Unintended Public Binding of Chrome Extension Relay via Wildcard cdpUrl
- CVE-2026-28394 OpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch Tool
- CVE-2026-28393 OpenClaw 2.0.0-beta3 < 2026.2.14 - Arbitrary JavaScript Module Loading via Hook Transform Path Traversal
- CVE-2026-28392 OpenClaw < 2026.2.14 - Privilege Escalation in Slack Slash Command Handler via Direct Messages
- CVE-2026-28391 OpenClaw < 2026.2.2 - Command Injection via cmd.exe Parsing Bypass in Allowlist Enforcement
- CVE-2026-28390 Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo
- CVE-2026-2839 Missing authorization in Advanced Custom Fields: Extended
- CVE-2026-28389 Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo
- CVE-2026-28388 NULL Pointer Dereference When Processing a Delta CRL
- CVE-2026-28387 Potential Use-after-free in DANE Client Code
- CVE-2026-28386 Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 Support
- CVE-2026-28385 SSRF via image import from URL allows internal network probing by authenticated users
- CVE-2026-28384 Authenticated RCE via unsanitized compression_algorithm
- CVE-2026-28383 Grafana plugin resources can lead to unbounded memory allocation
- CVE-2026-28381 Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT
- CVE-2026-28380 BAC in Snapshot API allows deletion of unauthorized dashboard snapshots
- CVE-2026-2838 Cross-site scripting in Whole Enquiry Cart for WooCommerce
- CVE-2026-28379 Viewer-triggered race condition in Grafana Live leads to complete server crash
- CVE-2026-28378 Cross-Organization Public Dashboard Deletion via Missing Org Isolation
- CVE-2026-28377 S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern)
- CVE-2026-28376 Grafana Live push endpoint allows unbounded memory allocation leading to OOM
- CVE-2026-28375 Grafana Testdata datasource can issue unbounded memory allocations
- CVE-2026-28374 IDOR in Annotations API allows unprivileged users to DELETE annotation
- CVE-2026-28373 Path traversal in stackfield:stackfield
- CVE-2026-28372 Privilege escalation in inetutils
- CVE-2026-28370 OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection
- CVE-2026-2837 Ricerca – advanced search <= 1.1.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings
- CVE-2026-28369 Undertow: undertow: request smuggling via malformed http request headers
- CVE-2026-28368 Undertow: undertow: request smuggling via inconsistent header parsing
- CVE-2026-28367 Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator
- CVE-2026-28364 Memory corruption in OCaml
- CVE-2026-28363 Security feature bypass in OpenClaw
- CVE-2026-28361 NocoDB: Missing Ownership Validation in MCP Token Operations
- CVE-2026-28360 NocoDB: Plaintext Storage of Shared View Passwords
- CVE-2026-2836 Cache poisoning via insecure-by-default cache key
- CVE-2026-28359 NocoDB: Stored Cross-Site Scripting via Rich Text Field
- CVE-2026-28358 NocoDB: User Enumeration via Password Reset Endpoint
- CVE-2026-28357 NocoDB: Stored Cross-Site Scripting via Formula Cell
- CVE-2026-28356 ReDoS in multipart 1.3.0 - `parse_options_header()`
- CVE-2026-28355 "PWA" Canarytoken Vulnerable to Stored Self Cross-Site Scripting
- CVE-2026-28354 ClipBucket v5 has IDOR in Collection Item Management
- CVE-2026-28353 Trivy Vulnerability Scanner: Unauthorized AI Agent Execution Code Included in OpenVSX Extension Release
- CVE-2026-28352 Indico missing access check in event series management API
- CVE-2026-28351 Manipulated RunLengthDecode streams can exhaust RAM
- CVE-2026-28350 lxml_html_clean: <base> tag injection through default Cleaner configuration
- CVE-2026-2835 HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing
- CVE-2026-28348 lxml_html_clean: CSS @import Filter Bypass via Unicode Escapes
- CVE-2026-28343 CKEditor: Cross-site scripting (XSS) in the HTML Support package
- CVE-2026-28342 OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint
- CVE-2026-2834 Cross-site scripting in Age Verification & Identity Verification by Token of Trust
- CVE-2026-28338 PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages
- CVE-2026-28331 SolarWinds Patch Manager Sensitive Information Exposure Vulnerability
- CVE-2026-28330 SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability
- CVE-2026-2833 HTTP Request Smuggling via Premature Upgrade
- CVE-2026-28329 SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF)
- CVE-2026-28328 SolarWinds Observability Self-Hosted broken authorization schema
- CVE-2026-28326 SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability
- CVE-2026-28325 SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability
- CVE-2026-28324 SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability
- CVE-2026-28323 SolarWinds Web Help Desk SAML Authentication Bypass Vulnerability
- CVE-2026-28322 SolarWinds Database Performance Analyzer Stored Cross-Site Scripting Vulnerability
- CVE-2026-28321 SolarWinds Serv-U Broken Access Control Vulnerability
- CVE-2026-2832 Certain Samsung MultiXpress Multifunction Printers Firmware – Potential Information Disclosure
- CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption
- CVE-2026-28317 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
- CVE-2026-28316 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
- CVE-2026-28315 SolarWinds Serv-U Authenticated Stored Cross-site Scripting (XSS) Vulnerability
- CVE-2026-28314 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
- CVE-2026-28313 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
- CVE-2026-28312 SolarWinds Serv-U Privilege Escalation Vulnerability
- CVE-2026-28310 SolarWinds Serv-U Privilege Escalation Vulnerability
- CVE-2026-2831 MailArchiver <= 4.5.0 - Authenticated (Admininistrator+) SQL Injection via 'logid' Parameter
- CVE-2026-28309 SolarWinds Serv-U Broken Access Control Vulnerability
- CVE-2026-28308 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
- CVE-2026-28307 SolarWinds Serv-U Privilege Escalation Vulnerability
- CVE-2026-28306 SolarWinds Serv-U Privilege Escalation Vulnerability
- CVE-2026-28305 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
- CVE-2026-28304 SolarWinds Serv-U Remote Code Execution Vulnerability
- CVE-2026-28302 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
- CVE-2026-28301 SolarWinds Observability Self-Hosted Open Redirect Vulnerability
- CVE-2026-2830 WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'
- CVE-2026-28299 SolarWinds Web Help Desk Denial-of-Service Vulnerability
- CVE-2026-28298 SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability
- CVE-2026-28297 SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability