Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 766 of 1013.
- CVE-2026-25891 Fiber has an Arbitrary File Read in Static Middleware on Windows
- CVE-2026-25890 File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL
- CVE-2026-2589 Information disclosure in Greenshift – animation and page builder blocks
- CVE-2026-25889 File Browser has an Authentication Bypass in User Password Update
- CVE-2026-25888 Chartbrew: Remote Code Execution (RCE) via Vulnerable API
- CVE-2026-25887 Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query
- CVE-2026-25885 PolarLearn allows Unauthenticated WebSocket access allows subscribing to and posting in arbitrary group chats
- CVE-2026-25884 Exiv2: Out-of-bounds read in CrwMap::decode0x0805
- CVE-2026-25883 Vexa Webhook Feature has a SSRF Vulnerability
- CVE-2026-25882 Fiber has a Denial of Service Vulnerability via Route Parameter Overflow
- CVE-2026-25881 @nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)
- CVE-2026-25880 Untrusted Search Path in SumatraPDF Reader (explorer.exe on Windows)
- CVE-2026-2588 Crypt::NaCl::Sodium versions through 2.001 for Perl has an integer overflow flaw on 32-bit systems
- CVE-2026-25879 Langroid has Prompt to SQL Injection, Leading to RCE
- CVE-2026-25878 FroshAdminer Adminer UI is accessible without admin session
- CVE-2026-25877 Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations
- CVE-2026-25876 PlaciPy is Missing Authorization on Assessment Results Endpoint
- CVE-2026-25875 PlaciPy Admin Privilege Escalation via Trusted JWT Claims
- CVE-2026-25874 LeRobot Unsafe Deserialization Remote Code Execution via gRPC
- CVE-2026-25873 OmniGen2-RL Reward Server Unsafe Deserialization RCE
- CVE-2026-25872 JUNG Smart Panel 5.1 KNX Unauthenticated Path Traversal
- CVE-2026-25870 DoraCMS <= 3.1 UEditor Remote Image Fetch SSRF
- CVE-2026-2587 GlassFish's gadget handler is vulnerable to RCE
- CVE-2026-25869 MiniGal Nano <= 0.3.5 Path Traversal via dir Parameter
- CVE-2026-25868 MiniGal Nano <= 0.3.5 Reflected XSS via dir Parameter
- CVE-2026-25866 MobaXterm < 26.1 Notepad++ Unquoted Service Path
- CVE-2026-25865 Punto Switcher 4.5.0.583 Unquoted Search Path via WinExec
- CVE-2026-25863 Conditional Fields for Contact Form 7 < 2.7.3 DoS via Uncontrolled Resource Consumption
- CVE-2026-25861 QloApps 1.7.0 Weak Password Hashing via MD5 in Tools.php
- CVE-2026-25860 OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler
- CVE-2026-2586 GlassFish's Administration Console is Vulnerable to RCE
- CVE-2026-25859 WeKan < 8.20 Migration Functionality Insufficient Permission Checks
- CVE-2026-25858 macrozheng mall <= 1.0.3 Unauthenticated Password Reset via OTP Disclosure
- CVE-2026-25857 Tenda G300-F Command Injection via formSetWanDiag
- CVE-2026-25856 OpenBullet2 0.3.2 Authenticated RCE via Job Configuration Interface
- CVE-2026-25855 OpenBullet2 0.3.2 Authenticated RCE via FileProxySource Script Upload
- CVE-2026-25854 Apache Tomcat: Occasionally open redirect
- CVE-2026-25852 Privilege escalation in Acronis DeviceLock DLP
- CVE-2026-25851 Chargemap chargemap.com Missing Authentication for Critical Function
- CVE-2026-25850 filemanagement_storage_service has an improper preservation of permissions vulnerability
- CVE-2026-2585 Cross-site scripting in Brizy – Page Builder
- CVE-2026-25848 Auth bypass in Hub
- CVE-2026-25847 Cross-site scripting in PyCharm
- CVE-2026-25846 Information disclosure in YouTrack
- CVE-2026-2584 SQL Injection in Ciser System SL firmware
- CVE-2026-25836 Command injection in FortiSandbox Cloud
- CVE-2026-25835 Weak cryptography in arm:mbed tls
- CVE-2026-25834 Weak cryptography in trustedfirmware:mbed tls
- CVE-2026-25833 Memory corruption in trustedfirmware:mbed tls
- CVE-2026-25832 Security feature bypass in Mbed TLS
- CVE-2026-2583 Blocksy <= 2.1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via `blocksy_meta` Fields
- CVE-2026-25828 grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS command injection because it does not sanitiz
- CVE-2026-25827 An issue was discovered in Keyfactor SignServer before 7.6.0.
- CVE-2026-25826 An issue was discovered in Keyfactor SignServer before 7.6.0.
- CVE-2026-25825 An issue was discovered in Keyfactor SignServer before 7.6.0.
- CVE-2026-25823 HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 ha
- CVE-2026-2582 Germanized for WooCommerce <= 3.20.5 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2026-25819 HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 al
- CVE-2026-25818 HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 ha
- CVE-2026-25817 HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 ha
- CVE-2026-25815 Weak cryptography in FortiOS
- CVE-2026-25814 NoSQL Injection Risk via Unsanitized Query Parameters
- CVE-2026-25813 PlaciPy Exposes Sensitive Data via Application Logs
- CVE-2026-25812 PlaciPy is Missing CSRF Protection on State-Changing Endpoints
- CVE-2026-25811 PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)
- CVE-2026-25810 PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts
- CVE-2026-2581 Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS
- CVE-2026-25809 PlaciPy Code Execution Allowed Without Assessment Active State Validation
- CVE-2026-25808 Hollo DMs get leaked and can be seen on Webfinger Browser
- CVE-2026-25807 Unauthenticated Remote Code Execution via P2P Sharing in ZAI-Shell
- CVE-2026-25806 PlaciPy has Missing Authorization Checks on Student Management Endpoints (IDOR)
- CVE-2026-25805 Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning.
- CVE-2026-25804 Antrea has invalid enforcement order for network policy rules caused by integer overflow
- CVE-2026-25803 3DP-MANAGER Uses Hard-coded Credentials
- CVE-2026-25802 New API has Potential XSS in its MarkdownRenderer component
- CVE-2026-25800 quinn-proto has remote memory exhaustion from unbounded out-of-order stream reassembly
- CVE-2026-2580 SQL injection in WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters
- CVE-2026-25799 ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crash
- CVE-2026-25798 ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image
- CVE-2026-25797 ImageMagick vulnerable to Code injection via PostScript header in ps coders
- CVE-2026-25796 ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths
- CVE-2026-25795 ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)
- CVE-2026-25794 ImageMagick has heap-buffer-overflow via signed integer overflow in WriteUHDRImage when writing UHDR images with large dimensions
- CVE-2026-25793 Nebula Has Possible Blocklist Bypass via ECDSA Signature Malleability
- CVE-2026-25792 Greenshot Vulnerable to OS Command Injection via ExternalCommand Plugin
- CVE-2026-25791 Sliver has a DNS C2 OTP Bypass Allows Unauthenticated Session Flooding and Denial of Service
- CVE-2026-25790 Wazuh has Stack-Based Buffer Overflow in Security Configuration Assessment JSON Parser
- CVE-2026-2579 SQL injection in WowStore – Store Builder & Product Blocks for WooCommerce
- CVE-2026-25789 Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF
- CVE-2026-25787 Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF
- CVE-2026-25786 Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF
- CVE-2026-25785 Path traversal in Lanscope Endpoint Manager (On-Premises) Sub-Manager Server
- CVE-2026-25784 Misconfiguration in BlueSpice
- CVE-2026-25783 Denial of service via malformed User-Agent header in getBrowserVersion
- CVE-2026-25782 Gitea tracked-time deletion can target entries from another issue
- CVE-2026-25781 kernel_liteos_a has an out-of-bounds write vulnerability
- CVE-2026-25780 Memory Exhaustion via Malformed DOC File Upload
- CVE-2026-2578 Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts
- CVE-2026-25779 Gitea redirect handling permits open redirects through backslash paths
- CVE-2026-25778 SWITCH EV swtchenergy.com Insufficient Session Expiration