Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 761 of 1013.
- CVE-2026-26704 SQL injection in oretnom23:pharmacy point of sale system
- CVE-2026-26703 SQL injection in jon-remus-sevellejo:personnel property equipment system
- CVE-2026-26702 SQL injection in jon-remus-sevellejo:personnel property equipment system
- CVE-2026-26701 SQL injection in jon-remus-sevellejo:personnel property equipment system
- CVE-2026-26700 SQL injection in jon-remus-sevellejo:personnel property equipment system
- CVE-2026-2670 Advantech WISE-6610-NB Background Management openvpn_apply os command injection
- CVE-2026-26699 Code injection in jon-remus-sevellejo:personnel property equipment system
- CVE-2026-26698 SQL injection in carmelo:simple student alumni system
- CVE-2026-26697 SQL injection in carmelo:simple student alumni system
- CVE-2026-26696 SQL injection in carmelo:simple student alumni system
- CVE-2026-26695 SQL injection in carmelo:simple student alumni system
- CVE-2026-26694 SQL injection in carmelo:simple student alumni system
- CVE-2026-2669 Rongzhitong Visual Integrated Command and Dispatch Platform User delete access control
- CVE-2026-26682 Code injection in xjd2020:fastcms
- CVE-2026-2668 Rongzhitong Visual Integrated Command and Dispatch Platform User add access control
- CVE-2026-26673 Denial of service in dji:mavic mini firmware
- CVE-2026-2667 Rongzhitong Visual Integrated Command and Dispatch Platform api access control
- CVE-2026-2666 mingSoft MCMS Template Archive uploadTemplate.do unrestricted upload
- CVE-2026-2665 huanzi-qch base-admin JSP Parser SysFileController.java upload unrestricted upload
- CVE-2026-2664 Out of bounds read vulnerability in grpcfuse kernel module
- CVE-2026-2663 Alixhan xh-admin-backend Database Query query sql injection
- CVE-2026-2662 FascinatedBox lily lily_emitter.c count_transforms out-of-bounds
- CVE-2026-2661 Squirrel sqobject.h operator heap-based overflow
- CVE-2026-2660 FascinatedBox lily lily_symtab.c shorthash_for_name use after free
- CVE-2026-2659 Squirrel sqfuncstate.cpp PopTarget out-of-bounds
- CVE-2026-2658 newbee-ltd newbee-mall Multiple Endpoints cross-site request forgery
- CVE-2026-2657 wren-lang wren Error Message wren_compiler.c printError stack-based overflow
- CVE-2026-2656 ChaiScript type_info.hpp bare_equal use after free
- CVE-2026-2655 ChaiScript chaiscript_defines.hpp operator use after free
- CVE-2026-2654 huggingface smolagents LocalPythonExecutor requests.post server-side request forgery
- CVE-2026-2653 admesh normals.c stl_check_normal_vector heap-based overflow
- CVE-2026-2652 Authentication Bypass in mlflow/mlflow
- CVE-2026-26514 Command injection in xddxdd:bird-lg-go
- CVE-2026-2651 Missing Authorization Validation in mlflow/mlflow
- CVE-2026-2650 Memory corruption in Chrome
- CVE-2026-2649 Integer overflow in Chrome
- CVE-2026-26483 Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting (XSS) vulnerability in the template management functionality.
- CVE-2026-2648 Memory corruption in Chrome
- CVE-2026-26478 Command injection in mobvoi:tichome mini firmware
- CVE-2026-26477 Denial of service in DokuWiki
- CVE-2026-26464 Cross-site scripting in kashipara:society management system portal
- CVE-2026-26462 Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration.
- CVE-2026-26461 A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated attacker to execut
- CVE-2026-26460 A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0.
- CVE-2026-2646 Heap buffer overflow in session parsing with wolfSSL_d2i_SSL_SESSION() function
- CVE-2026-26459 ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a vulnerability in the option parsing logic that causes a segmentation fault when pr
- CVE-2026-26457 ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_dump_msg() function when proces
- CVE-2026-26456 A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5.
- CVE-2026-26453 ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_server_handle_session() functio
- CVE-2026-26452 ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 lcontains a vulnerability in the option parsing logic that causes a segmentation fault when p
- CVE-2026-2645 Acceptance of CertificateVerify Message before ClientKeyExchange in TLS 1.2
- CVE-2026-26449 In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a null pointer dereference (or
- CVE-2026-26448 Stomper 5e2741e is vulnerable to Use-After-Free.
- CVE-2026-26447 Stomper 5e2741e is vulnerable to Use-After-Free.
- CVE-2026-26446 Stomper 5e2741e is vulnerable to Denial of Service.
- CVE-2026-26445 stomper 5e2741e is vulnerable to Denial of Service.
- CVE-2026-2644 niklasso minisat DIMACS File SolverTypes.h value out-of-bounds
- CVE-2026-26422 Misconfiguration in clash-verge-service-ipc
- CVE-2026-2642 ggreer the_silver_searcher search.c search_stream null pointer dereference
- CVE-2026-26418 Missing authorization in tcs:cognix platform
- CVE-2026-26417 Missing authorization in tcs:cognix platform
- CVE-2026-26416 Privilege escalation in tcs:cognix platform
- CVE-2026-2641 universal-ctags V Language v.c parseExprList recursion
- CVE-2026-2640 Privilege escalation in PC Manager
- CVE-2026-26399 A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0.
- CVE-2026-26396 OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/application/routers/workspace.py.
- CVE-2026-2638 X-VPN macOS website versions - Local Privilege Escalation
- CVE-2026-26379 Server-side request forgery in koha:koha
- CVE-2026-26378 Cross-site scripting in koha:koha
- CVE-2026-26377 Cross-site scripting in koha:koha
- CVE-2026-26370 Cross-site scripting in Survey Maker
- CVE-2026-2637 Privilege escalation in iBoysoft NTFS
- CVE-2026-26369 JUNG eNet SMART HOME server 2.2.1/2.3.1 Privilege Escalation via setUserGroup
- CVE-2026-26368 JUNG eNet SMART HOME server 2.2.1/2.3.1 Account Takeover via resetUserPassword
- CVE-2026-26367 JUNG eNet SMART HOME server 2.2.1/2.3.1 Arbitrary User Deletion via deleteUserAccount
- CVE-2026-26366 JUNG eNet SMART HOME server 2.2.1/2.3.1 Use of Default Credentials
- CVE-2026-26365 Other in Ghost
- CVE-2026-26362 Path traversal in PowerMax
- CVE-2026-26361 Path traversal in PowerMax
- CVE-2026-26360 Path traversal in PowerMax
- CVE-2026-2636 Denial of Service in Microsoft OS
- CVE-2026-26359 Path traversal in PowerMax
- CVE-2026-26358 Missing authorization in PowerMax
- CVE-2026-26357 Cross-site scripting in Unisphere for PowerMax 9.2.4.18
- CVE-2026-26355 Command injection in PowerProtect Data Domain
- CVE-2026-26354 Memory corruption in PowerProtect Data Domain
- CVE-2026-26352 Smoothwall Express < 3.1 Update 13 Stored XSS in vpnmain.cgi via VPN_IP Parameter
- CVE-2026-26351 GetSimpleCMS-CE < 3.3.22 Stored XSS via components.php
- CVE-2026-2635 MLflow Use of Default Password Authentication Bypass Vulnerability
- CVE-2026-26345 SPIP < 4.4.8 Cross-Site Scripting in Public Area
- CVE-2026-26342 Tattile Smart+ / Vega / Basic <= 1.181.5 Insufficient Session Token Expiration
- CVE-2026-26341 Tattile Smart+ / Vega / Basic <= 1.181.5 Default Credentials
- CVE-2026-26340 Tattile Smart+ / Vega / Basic <= 1.181.5 Unauthenticated RTSP Stream Disclosure
- CVE-2026-2634 Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS
- CVE-2026-26339 Hyland Alfresco Transformation Service Argument Injection RCE
- CVE-2026-26338 Hyland Alfresco Transformation Service SSRF
- CVE-2026-26337 Hyland Alfresco Transformation Service Absolute Path Traversal Arbitrary File Read and SSRF
- CVE-2026-26336 Hyland Alfresco Improper Authorization Arbitrary File Read
- CVE-2026-26335 Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCE
- CVE-2026-26334 Calero VeraSMART < 2026 R1 Hardcoded Static AES Keys Allow Decryption of Service Credentials