Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 760 of 1013.
- CVE-2026-26945 Other in Integrated Dell Remote Access Controller
- CVE-2026-26944 Auth bypass in PowerProtect Data Domain
- CVE-2026-26943 Command injection in PowerProtect Data Domain
- CVE-2026-26942 Command injection in PowerProtect Data Domain
- CVE-2026-26940 Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service
- CVE-2026-2694 Missing authorization in The Events Calendar
- CVE-2026-26939 Missing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration
- CVE-2026-26938 Code injection in Kibana
- CVE-2026-26937 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
- CVE-2026-26936 Inefficient Regular Expression Complexity in Kibana Leading to Denial of Service
- CVE-2026-26935 Improper Input Validation in Kibana Leading to Denial of Service
- CVE-2026-26934 Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service
- CVE-2026-26933 Improper Validation of Array Index in Packetbeat Leading to Denial of Service
- CVE-2026-26932 Improper Validation of Array Index in Packetbeat Leading to Denial of Service
- CVE-2026-26931 Memory Allocation with Excessive Size Value in Metricbeat Leading to Denial of Service
- CVE-2026-26930 Cross-site scripting in SmarterMail
- CVE-2026-2693 CoCoTeaNet CyreneAdmin System Info Endpoint getCount improper authorization
- CVE-2026-26929 Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata
- CVE-2026-26928 Lack of Dynamic Library Validation in SzafirHost
- CVE-2026-26927 URL (HTTP Origin) call location spoofing in Szafir SDK Web
- CVE-2026-2692 CoCoTeaNet CyreneAdmin Image getAvatar path traversal
- CVE-2026-2691 itsourcecode Event Management System manage_register.php sql injection
- CVE-2026-2690 itsourcecode Event Management System Admin Login ajax.php sql injection
- CVE-2026-26899 An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17).
- CVE-2026-26897 An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive informatio
- CVE-2026-26895 Information disclosure in enhancesoft:osticket
- CVE-2026-26892 SQL injection in oretnom23:simple logistic hub parcel\'s management system
- CVE-2026-26891 SQL injection in oretnom23:simple logistic hub parcel\'s management system
- CVE-2026-26890 SQL injection in oretnom23:pharmacy point of sale system
- CVE-2026-2689 itsourcecode Event Management System manage_booking.php sql injection
- CVE-2026-26889 SQL injection in oretnom23:pharmacy point of sale system
- CVE-2026-26888 SQL injection in oretnom23:pharmacy point of sale system
- CVE-2026-26887 SQL injection in oretnom23:pharmacy point of sale system
- CVE-2026-26886 SQL injection in oretnom23:simple online men\'s salon management system
- CVE-2026-26885 SQL injection in oretnom23:simple online men\'s salon management system
- CVE-2026-26884 SQL injection in oretnom23:simple online men\'s salon management system
- CVE-2026-26883 SQL injection in oretnom23:simple online men\'s salon management system
- CVE-2026-2688 CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass
- CVE-2026-2687 Reading progressbar < 1.3.1 - Admin+ Stored XSS
- CVE-2026-26862 CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage
- CVE-2026-26861 CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function
- CVE-2026-2686 SECCN Dingcheng G10 session_login.cgi qq os command injection
- CVE-2026-26846 Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the Ut
- CVE-2026-2684 Tsinghua Unigroup Electronic Archives System uploadFile.html unrestricted upload
- CVE-2026-26833 thumbler allows OS Command Injection
- CVE-2026-26832 node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter
- CVE-2026-26831 textract is vulnerable to OS Command Injection
- CVE-2026-26830 pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter
- CVE-2026-2683 Tsinghua Unigroup Electronic Archives System downLoad.html path traversal
- CVE-2026-26829 A NULL pointer dereference in the safe_atou64 function (src/misc.c) of owntone-server through commit c4d57aa allows attackers to cause a Den
- CVE-2026-26828 A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d1652d allows attackers to caus
- CVE-2026-26825 Memory corruption in libxls project:libxls
- CVE-2026-26824 Memory corruption in libxls project:libxls
- CVE-2026-2682 Tsinghua Unigroup Electronic Archives System prinReport.html sql injection
- CVE-2026-2681 A flaw was found in the blst cryptographic library.
- CVE-2026-26801 pdfmake is vulnerable to server-side request forgery (SSRF)
- CVE-2026-2680 Multiple vulnerabilities in A3factura software
- CVE-2026-26795 Command injection in gl-inet:ar300m16 firmware
- CVE-2026-26794 SQL injection in gl-inet:ar300m16 firmware
- CVE-2026-26793 Command injection in gl-inet:ar300m16 firmware
- CVE-2026-26792 Command injection in gl-inet:ar300m16 firmware
- CVE-2026-26791 Command injection in gl-inet:ar300m16 firmware
- CVE-2026-2679 Multiple vulnerabilities in A3factura software
- CVE-2026-2678 Multiple vulnerabilities in A3factura software
- CVE-2026-2677 Multiple vulnerabilities in A3factura software
- CVE-2026-2676 GoogTech sms-ssm API LoginInterceptor.java preHandle improper authorization
- CVE-2026-2675 Auth bypass in Connext Professional
- CVE-2026-26747 Business logic in monicahq:monica
- CVE-2026-26746 Path traversal in opensourcepos:open source point of sale
- CVE-2026-26745 SQL injection in opensourcepos:open source point of sale
- CVE-2026-26744 Information disclosure in formalms:formalms
- CVE-2026-26742 Security feature bypass in dronecode:px4 drone autopilot
- CVE-2026-26741 Business logic in dronecode:px4 drone autopilot
- CVE-2026-26740 Memory corruption in giflib project:giflib
- CVE-2026-2674 Memory corruption in Connext Professional
- CVE-2026-26738 Memory corruption in uderzo:spacesniffer
- CVE-2026-26736 Memory corruption in totolink:a3002ru firmware
- CVE-2026-26732 Memory corruption in totolink:a3002ru firmware
- CVE-2026-26731 Memory corruption in totolink:a3002ru firmware
- CVE-2026-2673 OpenSSL TLS 1.3 server may choose unexpected key agreement group
- CVE-2026-26725 Privilege escalation in edubusinesssolutions:print shop pro webdesk
- CVE-2026-26724 Cross-site scripting in keystorage:global facilities management software
- CVE-2026-26723 Cross-site scripting in keystorage:global facilities management software
- CVE-2026-26722 Privilege escalation in keystorage:global facilities management software
- CVE-2026-26721 Information disclosure in keystorage:global facilities management software
- CVE-2026-26720 Code injection in twenty:twenty
- CVE-2026-2672 Tsinghua Unigroup Electronic Archives System downLoad download path traversal
- CVE-2026-26719 Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET reques
- CVE-2026-26718 A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform una
- CVE-2026-26717 OpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function
- CVE-2026-26713 SQL injection in carmelo:simple food order system
- CVE-2026-26712 SQL injection in carmelo:simple food order system
- CVE-2026-26711 SQL injection in carmelo:simple food order system
- CVE-2026-26710 SQL injection in carmelo:simple food order system
- CVE-2026-2671 Mendi Neurofeedback Headset Bluetooth Low Energy cleartext transmission
- CVE-2026-26709 SQL injection in carmelo:simple gym management system
- CVE-2026-26708 SQL injection in oretnom23:pharmacy point of sale system
- CVE-2026-26707 SQL injection in oretnom23:pharmacy point of sale system
- CVE-2026-26706 SQL injection in oretnom23:pharmacy point of sale system
- CVE-2026-26705 SQL injection in oretnom23:pharmacy point of sale system