Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 764 of 1013.
- CVE-2026-26118 Azure MCP Server Tools Elevation of Privilege Vulnerability
- CVE-2026-26117 Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability
- CVE-2026-26116 SQL Server Elevation of Privilege Vulnerability
- CVE-2026-26115 SQL Server Elevation of Privilege Vulnerability
- CVE-2026-26114 Microsoft SharePoint Server Remote Code Execution Vulnerability
- CVE-2026-26113 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-26112 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-26111 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
- CVE-2026-26110 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-2611 Improper Origin Validation in mlflow/mlflow
- CVE-2026-26109 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-26108 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-26107 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-26106 Microsoft SharePoint Server Remote Code Execution Vulnerability
- CVE-2026-26105 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-26104 Udisks: missing authorization check allows unprivileged users to back up luks headers via udisks d-bus api
- CVE-2026-26103 Udisks: missing authorization check allows unprivileged users to restore luks headers via udisks d-bus api
- CVE-2026-26102 Incorrect Permission Assignment for Critical Resource in Owl opds
- CVE-2026-26101 Incorrect Permission Assignment for Critical Resource in Owl opds
- CVE-2026-26100 Incorrect Permission Assignment for Critical Resource in Owl opds
- CVE-2026-26099 Uncontrolled Search Path Element in Owl opds
- CVE-2026-26098 Uncontrolled Search Path Element in Owl opds
- CVE-2026-26097 Uncontrolled Search Path Element in Owl opds
- CVE-2026-26096 Incorrect Permission Assignment for Critical Resource in Owl opds
- CVE-2026-26095 Incorrect Permission Assignment for Critical Resource in Owl opds
- CVE-2026-26093 Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds
- CVE-2026-26084 Missing authorization in FortiSandbox
- CVE-2026-26083 Missing authorization in FortiSandbox
- CVE-2026-26081 Memory corruption in HAProxy
- CVE-2026-26080 Denial of service in HAProxy
- CVE-2026-2608 Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization
- CVE-2026-26079 Cross-site scripting in Webmail
- CVE-2026-26078 Discourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint
- CVE-2026-26077 Discourse doesn't ensure webhooks require a token
- CVE-2026-26076 ntpd-rs affected by excessive CPU load from malformed packets
- CVE-2026-26075 Cross-Site Request Forgery (CSRF) in FastGPT
- CVE-2026-26074 EVerest: OCPP201 startup event_queue lock mismatch leads to std::map/std::queue data race
- CVE-2026-26073 EVerest: OCPP 1.6 heap corruption caused by lock-free insertion in event_queue
- CVE-2026-26072 EVerest has race-condition-induced std::map corruption in OCPP 1.6 evse_soc_map
- CVE-2026-26071 EVerest: OCPP 2.0.1 EVCCID Data Race Leads to Heap Use‑After‑Free
- CVE-2026-26070 EVerest: OCPP 2.0.1 EV SoC Update Race Causes Charge Point Crash
- CVE-2026-2607 Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
- CVE-2026-26069 Scraparr Readarr Integration exposes sensitive values as metric labels.
- CVE-2026-26068 emp3r0r Agent-Controlled Metadata to Operator RCE (tmux Command Injection)
- CVE-2026-26067 October: Safe Mode Bypass via CSS Preprocessor Compilers
- CVE-2026-26066 ImageMagick has infinite loop when writing IPTCTEXT leads to denial of service via crafted profile
- CVE-2026-26065 calibre: Path Traversal can Lead to Arbitrary File Write and Potential Code Execution
- CVE-2026-26064 calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution
- CVE-2026-26063 CediPay Affected by Improper Input Validation in Payment Processing
- CVE-2026-26062 Fleet server may terminate unexpectedly when handling certain gRPC requests
- CVE-2026-26061 Fleet's unbounded request body read allows remote Denial of Service
- CVE-2026-26060 Fleet: Password reset tokens remain valid after password change for 24 hours
- CVE-2026-2606 IBM webMethods API Management fails to validate user input and enables unauthorized arbitrary file read
- CVE-2026-26059 ChurchCRM has Stored Cross-Site Scripting (XSS) in GroupEditor.php
- CVE-2026-26058 Zulip: Path Traversal in Import
- CVE-2026-26057 Skill Scanner Unsecured Network Binding Vulnerability
- CVE-2026-26056 Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC
- CVE-2026-26055 Unauthenticated Admission Webhook Endpoints in Yoke ATC
- CVE-2026-26054 SumatraPDF: Heap out-of-bounds read in MOBI header parser.
- CVE-2026-26053 Privilege escalation in Command Centre Server
- CVE-2026-26051 Mobiliti e-mobi.hu Missing Authentication for Critical Function
- CVE-2026-26050 Other in ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール
- CVE-2026-2605 Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS.
- CVE-2026-26049 Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected Credentials
- CVE-2026-26048 Jinan USR IOT Technology Limited (PUSR) USR-W610 Missing Authentication for Critical Function
- CVE-2026-26047 Moodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of service
- CVE-2026-26046 Moodle: moodle: improper input sanitization in tex filter administration setting
- CVE-2026-26045 Moodle: moodle: improper validation in file restore functionality leading to remote code execution
- CVE-2026-2604 Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling
- CVE-2026-26035 Auth bypass in FortiWeb
- CVE-2026-26034 Privilege escalation in UPS Multi-UPS Management Console (MUMC)
- CVE-2026-26033 Privilege escalation in UPS Multi-UPS Management Console (MUMC)
- CVE-2026-26032 Apache Ivy: PackagerResolver path traversal vulnerability
- CVE-2026-26031 Frappe LMS affected by unauthorised user was able to access the full list of batch enrolled students
- CVE-2026-26030 Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution
- CVE-2026-2603 Keycloak: keycloak: unauthorized authentication via disabled saml identity provider
- CVE-2026-26029 sf-mcp-server has a Command Injection in query_records tool due to unsafe use of child_process.exec
- CVE-2026-26028 CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSS
- CVE-2026-26027 GLPI has an Unauthenticated Stored XSS via inventory
- CVE-2026-26026 GLPI has a Server-Side Template Injection via Double-Compilation
- CVE-2026-26025 Null dereference in smf
- CVE-2026-26024 Null dereference in smf
- CVE-2026-26023 Client‑side DOM XSS in the web chat app of Dify when using echarts
- CVE-2026-26022 Gogs: Stored XSS via data URI in issue comments
- CVE-2026-26021 Prototype pollution in set-in
- CVE-2026-26020 AutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__)
- CVE-2026-2602 Twentig <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'featuredImageSizeWidth'
- CVE-2026-26019 @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation
- CVE-2026-26018 CoreDNS Loop Detection Denial of Service Vulnerability
- CVE-2026-26017 CoreDNS ACL Bypass
- CVE-2026-26016 Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization
- CVE-2026-26015 Unauthenticated RCE in DocsGPT MCP STDIO Configuration
- CVE-2026-26014 Pion DTLS uses random nonce generation with AES GCM ciphers risks leaking the authentication key
- CVE-2026-26013 LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
- CVE-2026-26012 vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions
- CVE-2026-26011 Memory corruption in navigation2
- CVE-2026-26010 Leaky JWTs in OpenMetadata exposing highly-privileged bot users
- CVE-2026-2601 Missing Authorization in GitLab
- CVE-2026-26009 Catalyst Affected by Remote Code Execution as Root via Containerized Install Script Execution
- CVE-2026-26008 EVerest has OOB via EVSE ID Indexing Mismatch in OCPP 2.0.1 UpdateAllowedEnergyTransferModes