Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 763 of 1013.
- CVE-2026-26213 thingino-firmware api.cgi Unauthenticated Command Injection in Captive Portal
- CVE-2026-26212 Rara One Click Demo Import < 1.3.5 Arbitrary File Upload RCE
- CVE-2026-26211 Ekushey Project Manager CRM 5.0 Stored XSS via System Name Field
- CVE-2026-26210 KTransformers Unsafe Deserialization RCE via balance_serve
- CVE-2026-2621 Sciyon Koyuan Thermoelectricity Heat Network Management System AsyncTreeProxy.aspx sql injection
- CVE-2026-26209 cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads
- CVE-2026-26208 ADB Explorer Vulnerable to Remote Code Execution via Insecure Deserialization
- CVE-2026-26207 DIscourse's discourse-policy plugin lacks post access check
- CVE-2026-26206 Wazuh: API brute-force protection bypass via race condition in login attempt tracking
- CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`
- CVE-2026-26204 Wazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertData
- CVE-2026-26203 PJSIP's pjmedia-video has use-after-free in H264 packetizer when packetizing fragmented NAL
- CVE-2026-26202 Penpot has Arbitrary File Read via create-font-variant RPC endpoint
- CVE-2026-26201 emp3r0r Affected by Concurrent Map Access DoS (panic/crash)
- CVE-2026-26200 HDF5 Affected by H5T__conv_struct_opt Heap Buffer Overflow
- CVE-2026-2620 Huace Monitoring and Early Warning System ProjectRole.aspx sql injection
- CVE-2026-26199 Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zero
- CVE-2026-26198 ormar is vulnerable to SQL Injection through aggregate functions min() and max()
- CVE-2026-26197 Array full size, element count, and element size are not checked to make sure they match in H5Odtype.c
- CVE-2026-26196 Gogs: Access tokens get exposed through URL params in API requests
- CVE-2026-26195 Gogs: Stored XSS in branch and wiki views through author and committer names
- CVE-2026-26194 Gogs: Release tag option injection in release deletion
- CVE-2026-26193 Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages
- CVE-2026-26192 Open WebUI vulnerable to Stored XSS via iFrame in citations model
- CVE-2026-26191 Fleet vulnerable to OS command injection in software packages
- CVE-2026-26190 Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise
- CVE-2026-2619 Incorrect Authorization in GitLab
- CVE-2026-26189 Trivy Action has a script injection via sourced env file in composite action
- CVE-2026-26188 Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue
- CVE-2026-26187 lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access
- CVE-2026-26186 Fleet has a SQL injection via backtick escape in ORDER BY parameter
- CVE-2026-26185 Directus Affected by User Enumeration via Password Reset Timing Attack
- CVE-2026-26184 Windows Projected File System Elevation of Privilege Vulnerability
- CVE-2026-26183 Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability
- CVE-2026-26182 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-26181 Microsoft Brokering File System Elevation of Privilege Vulnerability
- CVE-2026-26180 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-2618 Beetel 777VR1 SSH Service risky encryption
- CVE-2026-26179 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-26178 Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability
- CVE-2026-26177 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-26176 Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability
- CVE-2026-26175 Windows Boot Manager Security Feature Bypass Vulnerability
- CVE-2026-26174 Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
- CVE-2026-26173 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-26172 Windows Push Notifications Elevation of Privilege Vulnerability
- CVE-2026-26171 .NET Denial of Service Vulnerability
- CVE-2026-26170 PowerShell Elevation of Privilege Vulnerability
- CVE-2026-2617 Beetel 777VR1 Telnet Service/SSH Service insecure default initialization of resource
- CVE-2026-26169 Windows Kernel Memory Information Disclosure Vulnerability
- CVE-2026-26168 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-26167 Windows Push Notifications Elevation of Privilege Vulnerability
- CVE-2026-26166 Windows Shell Elevation of Privilege Vulnerability
- CVE-2026-26165 Windows Shell Elevation of Privilege Vulnerability
- CVE-2026-26164 M365 Copilot Information Disclosure Vulnerability
- CVE-2026-26163 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-26162 Windows OLE Elevation of Privilege Vulnerability
- CVE-2026-26161 Windows Sensor Data Service Elevation of Privilege Vulnerability
- CVE-2026-26160 Remote Desktop Licensing Service Elevation of Privilege Vulnerability
- CVE-2026-2616 Beetel 777VR1 Web Management hard-coded credentials
- CVE-2026-26159 Remote Desktop Licensing Service Elevation of Privilege Vulnerability
- CVE-2026-26158 Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries
- CVE-2026-26157 Busybox: busybox: arbitrary file overwrite and potential code execution via incomplete path sanitization
- CVE-2026-26156 Windows Hyper-V Remote Code Execution Vulnerability
- CVE-2026-26155 Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
- CVE-2026-26154 Windows Server Update Service (WSUS) Tampering Vulnerability
- CVE-2026-26153 Windows Encrypted File System (EFS) Elevation of Privilege Vulnerability
- CVE-2026-26152 Microsoft Cryptographic Services Elevation of Privilege Vulnerability
- CVE-2026-26151 Remote Desktop Spoofing Vulnerability
- CVE-2026-26150 Microsoft Purview eDiscovery Elevation of Privilege Vulnerability
- CVE-2026-2615 Wavlink WL-NU516U1 firewall.cgi singlePortForwardDelete command injection
- CVE-2026-26149 Microsoft Power Apps Desktop Client Spoofing Vulnerability
- CVE-2026-26148 Microsoft Azure AD SSH Login extension for Linux Elevation of Privilege Vulnerability
- CVE-2026-26147 Azure Stack HCI Information Disclosure Vulnerability
- CVE-2026-26145 Microsoft Azure Synapse Elevation of Privilege Vulnerability
- CVE-2026-26144 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-26143 Microsoft PowerShell Security Feature Bypass Vulnerability
- CVE-2026-26142 Nuance PowerScribe Remote Code Execution Vulnerability
- CVE-2026-26141 Hybrid Worker Extension (Arc‑enabled Windows VMs) Elevation of Privilege Vulnerability
- CVE-2026-2614 Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow
- CVE-2026-26139 Microsoft Purview Elevation of Privilege Vulnerability
- CVE-2026-26138 Microsoft Purview Elevation of Privilege Vulnerability
- CVE-2026-26137 Microsoft Exchange Elevation of Privilege Vulnerability
- CVE-2026-26136 Microsoft Copilot Information Disclosure Vulnerability
- CVE-2026-26135 Azure Custom Locations Resource Provider (RP) Elevation of Privilege Vulnerability
- CVE-2026-26134 Microsoft Office Elevation of Privilege Vulnerability
- CVE-2026-26133 M365 Copilot Information Disclosure Vulnerability
- CVE-2026-26132 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-26131 .NET Elevation of Privilege Vulnerability
- CVE-2026-26130 ASP.NET Core Denial of Service Vulnerability
- CVE-2026-26129 M365 Copilot Information Disclosure Vulnerability
- CVE-2026-26128 Windows SMB Server Elevation of Privilege Vulnerability
- CVE-2026-26127 .NET Denial of Service Vulnerability
- CVE-2026-26125 Payment Orchestrator Service Elevation of Privilege Vulnerability
- CVE-2026-26124 Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability
- CVE-2026-26123 Microsoft Authenticator Information Disclosure Vulnerability
- CVE-2026-26122 Microsoft ACI Confidential Containers Information Disclosure Vulnerability
- CVE-2026-26121 Azure IOT Explorer Spoofing Vulnerability
- CVE-2026-26120 Microsoft Bing Tampering Vulnerability
- CVE-2026-26119 Windows Admin Center Elevation of Privilege Vulnerability