Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 752 of 1013.
- CVE-2026-27792 Seerr missing authentication on pushSubscription endpoints
- CVE-2026-27790 Denial of service in T-20 Readers
- CVE-2026-2779 Incorrect boundary conditions in the Networking: JAR component
- CVE-2026-27788 Privilege escalation in ServerView Agents for Windows
- CVE-2026-27787 Cross-site scripting in MATCHA SNS
- CVE-2026-27785 Milesight Cameras Use of Hard-coded Credentials
- CVE-2026-27784 NGINX ngx_http_mp4_module vulnerability
- CVE-2026-27783 Gitea issue-template APIs bypass repository unit authorization
- CVE-2026-27781 kernel_liteos_a has an integer overflow vulnerability
- CVE-2026-27780 Gitea pre-receive hook can miss branch-protection checks after scanner errors
- CVE-2026-2778 Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component
- CVE-2026-27779 Gitea forwarded-proto handling allows public URL spoofing
- CVE-2026-27778 ePower epower.ie Improper Restriction of Excessive Authentication Attempts
- CVE-2026-27777 Mobiliti e-mobi.hu Insufficiently Protected Credentials
- CVE-2026-27776 Deserialization in intra-mart Accel Platform
- CVE-2026-27775 Gitea pre-receive hook permission cache allows full repository write access
- CVE-2026-27774 Privilege escalation in Acronis True Image
- CVE-2026-27773 SWITCH EV swtchenergy.com Insufficiently Protected Credentials
- CVE-2026-27772 EV Energy ev.energy Missing Authentication for Critical Function
- CVE-2026-27771 Gitea Composer package source links use insufficient permission checks
- CVE-2026-27770 ePower epower.ie Insufficiently Protected Credentials
- CVE-2026-2777 Privilege escalation in the Messaging System component
- CVE-2026-27769 Connected Workspaces: Malicious remote server can manipulate arbitrary user's status
- CVE-2026-27768 SQL injection in Genetec Security Center
- CVE-2026-27767 SWITCH EV swtchenergy.com Missing Authentication for Critical Function
- CVE-2026-27766 multimedia_audio_framework has a Race Condition vulnerability
- CVE-2026-27765 Denial of service in vLLM Hardware Plugin for Intel(R) Gaudi(R) software
- CVE-2026-27764 Mobiliti e-mobi.hu Insufficient Session Expiration
- CVE-2026-27761 Gitea repository feeds bypass API token scope enforcement
- CVE-2026-27760 OpenCATS PHP Code Injection via installer AJAX endpoint
- CVE-2026-2776 Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software
- CVE-2026-27759 Featured Image from Content < 1.7 Authenticated SSRF via save_post
- CVE-2026-27758 SODOLA SL902-SWTGW124AS <= 200.1.20 Missing CSRF Protections
- CVE-2026-27757 SODOLA SL902-SWTGW124AS <= 200.1.20 Unverified Password Change
- CVE-2026-27756 SODOLA SL902-SWTGW124AS <= 200.1.20 Reflected XSS in Management Interface
- CVE-2026-27755 SODOLA SL902-SWTGW124AS <= 200.1.20 Predictable Session ID
- CVE-2026-27754 SODOLA SL902-SWTGW124AS <= 200.1.20 MD5 Session Token Generation
- CVE-2026-27753 SODOLA SL902-SWTGW124AS <= 200.1.20 Improper Login Rate Limiting
- CVE-2026-27752 SODOLA SL902-SWTGW124AS <= 200.1.20 Cleartext Credential Transmission
- CVE-2026-27751 SODOLA SL902-SWTGW124AS <= 200.1.20 Use of Default Credentials
- CVE-2026-27750 Avira Internet Security Optimizer TOCTOU
- CVE-2026-2775 Mitigation bypass in the DOM: HTML Parser component
- CVE-2026-27749 Avira Internet Security System Speedup Insecure Deserialization
- CVE-2026-27748 Avira Internet Security Arbitrary File Deletion via Improper Link Resolution
- CVE-2026-27747 SPIP interface_traduction_objets < 2.2.2 Authenticated SQL Injection
- CVE-2026-27746 SPIP jeux < 4.1.1 Reflected XSS via index Parameters
- CVE-2026-27745 SPIP interface_traduction_objets < 2.2.2 Authenticated RCE
- CVE-2026-27744 SPIP tickets < 4.3.3 Unauthenticated RCE
- CVE-2026-27743 SPIP referer_spam < 1.3.0 Unauthenticated SQL Injection
- CVE-2026-27742 Bludit <= 3.16.2 Stored XSS in Post Content
- CVE-2026-27741 Bludit <= 3.16.1 CSRF in Plugin and Theme Management Endpoints
- CVE-2026-27740 Discourse has Stored XSS in AI Triage Automation
- CVE-2026-2774 Integer overflow in the Audio/Video component
- CVE-2026-27739 Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline
- CVE-2026-27738 Angular SSR has an Open Redirect via X-Forwarded-Prefix
- CVE-2026-27737 BigBlueButton has Stored XSS in bbb-playback replay
- CVE-2026-27736 BigBlueButton has Open Redirect vulnerability in ApiController
- CVE-2026-27735 mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
- CVE-2026-27734 Beszel Vulnerable to Docker API Path Traversal via Unsanitized Container ID
- CVE-2026-27732 AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php
- CVE-2026-27730 esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route
- CVE-2026-2773 Incorrect boundary conditions in the Web Audio component
- CVE-2026-27729 Astro has memory exhaustion DoS due to missing request body size limit in Server Actions
- CVE-2026-27728 OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()
- CVE-2026-27727 mchange-commons-java: Remote Code Execution via JNDI Reference Resolution
- CVE-2026-27723 OpenProject: Insufficient access control leads to create Wiki objects belongs unpermitted projects
- CVE-2026-2772 Use-after-free in the Audio/Video: Playback component
- CVE-2026-27711 NanaZip UFS Archive Parser Memory Corruption via Unvalidated Directory Record Length
- CVE-2026-27710 NanaZip .NET Single-File Parser Integer Underflow Leads to Unbounded Allocation (DoS)
- CVE-2026-2771 Undefined behavior in the DOM: Core & HTML component
- CVE-2026-27709 NanaZip .NET Single-File Manifest Parser Vulnerable to Out-of-Bounds Read via Unchecked RelativePathLength
- CVE-2026-27708 FOSSBilling: IDOR in Servicecustom Client API allows cross-client data access
- CVE-2026-27707 Plex-configured Seerr instances vulnerable to unauthenticated account registration via Jellyfin authentication endpoint
- CVE-2026-27706 Plane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" Feature
- CVE-2026-27705 Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch
- CVE-2026-27704 Dart SDK and Flutter SDK have Zip slip in Dart Pub package extraction
- CVE-2026-27703 RIOT has an Out-of-Bounds Write in nanoCoAP Handler
- CVE-2026-27702 Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)
- CVE-2026-27701 LiveCodes vulnerable to JavaScript Injection via untrusted PR title in i18n-update-pull workflow
- CVE-2026-27700 Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
- CVE-2026-2770 Use-after-free in the DOM: Bindings (WebIDL) component
- CVE-2026-27699 Basic FTP has Path Traversal Vulnerability in its downloadToDir() method
- CVE-2026-27697 baserCMS: SQL injection vulnerability in blog post
- CVE-2026-27696 changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs
- CVE-2026-27695 zae-limiter: DynamoDB hot partition throttling enables per-entity Denial of Service
- CVE-2026-27694 traccar allows stored HTML injection in notification emails
- CVE-2026-27693 traccar allows XML injection in KML and GPX exports
- CVE-2026-27692 iccDEV has HBO in CIccTagTextDescription::Release()
- CVE-2026-27691 iccDEV has SIO in parse3DTable() at iccFromCube.cpp Line 218
- CVE-2026-27690 HTTP Request Smuggling in SAP Approuter
- CVE-2026-2769 Use-after-free in the Storage: IndexedDB component
- CVE-2026-27689 Denial of service (DOS) in SAP Supply Chain Management
- CVE-2026-27688 Missing Authorization check in SAP NetWeaver Application Server for ABAP
- CVE-2026-27687 Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal
- CVE-2026-27686 Missing Authorization check in SAP Business Warehouse (Service API)
- CVE-2026-27685 Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration
- CVE-2026-27684 SQL Injection Vulnerability in SAP NetWeaver (Feedback Notification)
- CVE-2026-27683 Reflected cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform
- CVE-2026-27682 Cross-site scripting in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages)
- CVE-2026-27681 SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse