Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 767 of 1013.
- CVE-2026-25776 Code injection in Movable Type
- CVE-2026-25775 SenseLive X3050 Missing authentication for critical function
- CVE-2026-25774 EV Energy ev.energy Insufficiently Protected Credentials
- CVE-2026-25773 Focalboard doesn't sanitize category IDs before incorporating them into dynamic SQL statements
- CVE-2026-25772 Wazuh Database Synchronization Vulnerable to Stack-based Buffer Overflow via snprintf Integer Underflow
- CVE-2026-25771 Wazuh Vulnerable to Denial of Service via Synchronous I/O Blocking in Asynchronous Authentication Middleware
- CVE-2026-25770 Wazuh has Privilege Escalation to Root via Cluster Protocol File Write
- CVE-2026-2577 Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge
- CVE-2026-25769 Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization
- CVE-2026-25768 LavinMQ is missing vhost access control
- CVE-2026-25767 LavinMQ has incomplete shovel configuration validation
- CVE-2026-25766 Echo has a Windows path traversal via backslash in middleware.Static default filesystem
- CVE-2026-25765 Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url
- CVE-2026-25764 OpenProject vulnerable to Stored HTML injection
- CVE-2026-25763 Command Injection on OpenProject repositories leads to Remote Code Execution
- CVE-2026-25762 AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection
- CVE-2026-25761 Command injection via crafted filenames in Super-linter Action
- CVE-2026-25760 Website Path Traversal / Arbitrary File Read (Authenticated) in Sliver
- CVE-2026-2576 Business Directory Plugin <= 6.4.21 - Unauthenticated SQL Injection via payment Parameter
- CVE-2026-25759 Statmatic affected by privilege escalation via stored cross-site scripting
- CVE-2026-25758 Spree allows unauthenticated users can access all guest addresses
- CVE-2026-25757 Unauthenticated Spree Commerce users can view completed guest orders by Order ID
- CVE-2026-25755 jsPDF has PDF Object Injection via Unsanitized Input in addJS Method
- CVE-2026-25754 AdonisJS multipart body parsing has Prototype Pollution issue
- CVE-2026-25753 PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)
- CVE-2026-25752 FUXA Unauthenticated Remote Arbitrary Device Tag Write
- CVE-2026-25751 FUXA Unauthenticated Exposure of Plaintext Database Credentials
- CVE-2026-25750 LangSmith Studio has URL Parameter Injection Vulnerability that Enables Token Theft via Malicious baseUrl
- CVE-2026-2575 Keycloak: keycloak: denial of service due to excessive samlrequest decompression
- CVE-2026-25749 Heap Overflow in Vim
- CVE-2026-25748 authentik has a forward authentication bypass with broken cookie
- CVE-2026-25747 Apache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDB
- CVE-2026-25746 OpenEMR has SQL Injection Vulnerability
- CVE-2026-25745 OpenEMR's Message Update Ignores Patient id
- CVE-2026-25744 OpenEMR: POST /api/.../vital Accepts Attacker-Supplied id and Overwrites Arbitrary Vitals
- CVE-2026-25743 OpenEMR has Stored XSS in Questionnaire answers
- CVE-2026-25742 Zulip: Anonymous File Access After Disabling Spectator Access
- CVE-2026-25741 Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users
- CVE-2026-25740 Privilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS module
- CVE-2026-25739 Indico affected by Cross-Site-Scripting via material uploads
- CVE-2026-25738 Indico has Server-Side Request Forgery (SSRF) in multiple places
- CVE-2026-25737 Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)
- CVE-2026-25736 Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute
- CVE-2026-25735 Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name
- CVE-2026-25734 Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata
- CVE-2026-25733 Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function
- CVE-2026-25732 NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
- CVE-2026-25731 Calibre Affected by Arbitrary Code Execution via Server-Side Template Injection in Calibre HTML Export
- CVE-2026-2573 GutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'
- CVE-2026-25729 DeepAudit Affected by User Enumeration via Broken Access Control
- CVE-2026-25728 ClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race Condition
- CVE-2026-25727 time affected by a stack exhaustion denial of service attack
- CVE-2026-25726 Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)
- CVE-2026-25725 Claude Code Has Sandbox Escape via Persistent Configuration Injection in settings.json
- CVE-2026-25724 Claude Code Has Permission Deny Bypass Through Symbolic Links
- CVE-2026-25723 Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions
- CVE-2026-25722 Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection
- CVE-2026-25721 Copeland XWEB and XWEB Pro OS Command Injection
- CVE-2026-25720 SenseLive X3050 Insufficient session expiration
- CVE-2026-25718 Gitea template repository generation mishandles symlinked paths
- CVE-2026-25716 BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users
- CVE-2026-25715 Jinan USR IOT Technology Limited (PUSR) USR-W610 Weak Password Requirements
- CVE-2026-25714 Gitea user organization API bypasses public-only token filtering
- CVE-2026-25713 Memory corruption in MediaInfoLib
- CVE-2026-25712 Gitea organization permission APIs expose private visibility information
- CVE-2026-25711 Chargemap chargemap.com Insufficient Session Expiration
- CVE-2026-25710 Privilege escalation in plasma-login-manager
- CVE-2026-2571 Missing authorization in Download Manager
- CVE-2026-25707 Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp
- CVE-2026-25706 yast2-samba-client: OS command injection via attacker-controlled Organizational Unit (Active Directory-supplied)
- CVE-2026-25705 Rancher Extensions have arbitrary file access via path traversal
- CVE-2026-25704 Incomplete privilege drop for com.system76.CosmicGreeter.GetUserData
- CVE-2026-25703 Potential information leakage from manager /network/graph API in NeuVector
- CVE-2026-25702 nftables disabled due to incorrect kernel backport
- CVE-2026-25701 Race condition in sdbootutil
- CVE-2026-25700 Apache Answer: AdminToken not invalidated after admin deactivation
- CVE-2026-25699 Apache Answer: Authorization Bypass in Timeline API
- CVE-2026-25691 Path traversal in FortiSandbox
- CVE-2026-25690 Command injection in FortiDeceptor
- CVE-2026-2569 Dear Flipbook <= 2.4.20 - Authenticated (Auhtor+) Stored Cross-Site Scripting via PDF Page Labels
- CVE-2026-25689 Command injection in FortiDeceptor
- CVE-2026-25688 Apache Answer: XSS in AI Answer Rendering
- CVE-2026-25687 ZCC race condition in ZPA tunnel handler
- CVE-2026-25684 File Type Control rule bypass
- CVE-2026-25681 Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
- CVE-2026-25680 Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
- CVE-2026-2568 Cross-site scripting in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
- CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url
- CVE-2026-25676 Other in M-Track Duo HD
- CVE-2026-25674 Potential incorrect permissions on newly created file system objects
- CVE-2026-25673 Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows
- CVE-2026-2567 Wavlink WL-NU516U1 nas.cgi sub_401218 stack-based overflow
- CVE-2026-25667 Denial of service in microsoft:.net
- CVE-2026-25660 Authentication bypass for certain API calls
- CVE-2026-2566 Wavlink WL-NU516U1 adm.cgi sub_406194 stack-based overflow
- CVE-2026-25659 Ericsson Packet Core Gateway (PCG) - Improper handling of missing values Vulnerability
- CVE-2026-25658 Ericsson Packet Core Gateway (PCG) - Improper handling of missing values Vulnerability
- CVE-2026-25657 Ericsson Packet Core Gateway (PCG) - Improper Handling of Syntactically Invalid Structure Vulnerability
- CVE-2026-25656 Privilege escalation in SINEC NMS
- CVE-2026-25655 Privilege escalation in SINEC NMS