Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 772 of 1013.
- CVE-2026-25267 Missing Authorization in Core
- CVE-2026-25266 Exposed dangerous function in windows host
- CVE-2026-25265 Creation of Temporary File with Insecure Permissions in Qualcomm Software Center
- CVE-2026-25264 Uncontrolled Search Path Element in Qualcomm Software Center
- CVE-2026-25263 Out of Bounds write in Linux Camera
- CVE-2026-25262 Write-what-where Condition in Primary Bootloader
- CVE-2026-25261 Untrusted Pointer Dereference in Camera
- CVE-2026-25260 Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service
- CVE-2026-2526 Wavlink WL-WN579A3 wireless.cgi multi_ssid command injection
- CVE-2026-25259 Out-of-bounds Write in DSP Service
- CVE-2026-25258 Out-of-bounds Read in DSP Service
- CVE-2026-25255 Exposed function in Qualcomm Package Manager and Qualcomm Software Center.
- CVE-2026-25254 Improper authorization in Qualcomm Software Center
- CVE-2026-25253 OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl
- CVE-2026-25250 Security feature bypass in EazyFix
- CVE-2026-2525 Free5GC PFCP UDP Endpoint denial of service
- CVE-2026-25244 WebdriverIO has Command Injection in the BrowserStack Service
- CVE-2026-25243 redis-server RESTORE invalid memory access may allow remote code execution
- CVE-2026-25242 Gogs allows unauthenticated file uploads
- CVE-2026-25241 PEAR is Vulnerable to SQL Injection in /get/<package>/<version> Endpoint
- CVE-2026-25240 PEAR is Vulnerable to SQL Injection in user::maintains() Role IN() Filter
- CVE-2026-2524 Open5GS MME mme_s11_handle_create_session_response denial of service
- CVE-2026-25239 PEAR is Vulnerable to SQL Injection in apidoc_queue Insert via Unescaped Filename
- CVE-2026-25238 PEAR is Vulnerable to SQL Injection in Bug Subscription Deletion via Weak Email Validation
- CVE-2026-25237 PEAR is Vulnerable to PHP Code Execution via preg_replace /e in Bug Update Emails
- CVE-2026-25236 PEAR is Vulnerable to SQL Injection in Damblan_Karma IN() Query via Literal Substitution
- CVE-2026-25235 PEAR Has a Predictable Verification Hash in Election Account Requests
- CVE-2026-25234 PEAR is Vulnerable to SQL Injection in Category Deletion
- CVE-2026-25233 PEAR Has a Roadmap Authorization Bypass via Operator Precedence Bug
- CVE-2026-25232 Gogs has a Protected Branch Deletion Bypass in Web Interface
- CVE-2026-25231 FileRise affected by an Unauthenticated File Read Due to Insufficient Access Control
- CVE-2026-25230 FileRise affected by HTML Injection using color property in file tags
- CVE-2026-2523 Open5GS SMF gn-handler.c smf_gn_handle_create_pdp_context_request assertion
- CVE-2026-25229 Gogs Authorization Bypass Allows Cross-Repository Label Modification
- CVE-2026-25228 SignalK Server has Path Traversal leading to information disclosure
- CVE-2026-25227 authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint
- CVE-2026-25224 Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream
- CVE-2026-25223 Fastify's Content-Type header tab character allows body validation bypass
- CVE-2026-25222 PolarLearn Affected by User Enumeration via Argon2 Timing Attack on Sign-In Endpoint
- CVE-2026-25221 PolarLearn has Multiple Login CSRFs via Missing OAuth state Parameter (GitHub & Google)
- CVE-2026-25220 OpenEMR Messages "Show All" Not Restricted to Admins
- CVE-2026-2522 Open5GS MME esm-build.c memory corruption
- CVE-2026-25219 Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access
- CVE-2026-25212 Privilege escalation in percona:monitoring and management
- CVE-2026-25211 Llama Stack exposes secret in initialization log
- CVE-2026-25210 Integer overflow in libexpat
- CVE-2026-2521 Open5GS SGW-C sgwc_s5c_handle_create_session_response memory corruption
- CVE-2026-25209 Memory corruption in Escargot
- CVE-2026-25208 Integer overflow in Escargot
- CVE-2026-25207 Memory corruption in Escargot
- CVE-2026-25206 Memory corruption in Escargot
- CVE-2026-25205 Memory corruption in Escargot
- CVE-2026-25204 Deserialization in Escargot
- CVE-2026-25203 Misconfiguration in MagicINFO 9 Server
- CVE-2026-25202 Hardcoded credentials in MagicINFO 9 Server
- CVE-2026-25201 File upload in MagicINFO 9 Server
- CVE-2026-25200 File upload in MagicINFO 9 Server
- CVE-2026-2520 Missing authorization in Online Scheduling and Appointment Booking System – Bookly
- CVE-2026-25199 Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access
- CVE-2026-25198 web2py has an Open Redirect Vulnerability
- CVE-2026-25197 Gardyn Cloud API Authorization Bypass Through User-Controlled Key
- CVE-2026-25196 Copeland XWEB and XWEB Pro OS Command Injection
- CVE-2026-25195 Copeland XWEB and XWEB Pro OS Command Injection
- CVE-2026-25194 Memory corruption in Intel(R) Slim Bootloader may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
- CVE-2026-25193 Information disclosure in Active Directory Sync
- CVE-2026-25192 CTEK Chargeportal Missing Authentication for Critical Function
- CVE-2026-25191 Other in FinalCode Ver.5 series
- CVE-2026-25190 Windows GDI Remote Code Execution Vulnerability
- CVE-2026-2519 Online Scheduling and Appointment Booking System – Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'
- CVE-2026-25189 Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2026-25188 Windows Telephony Service Elevation of Privilege Vulnerability
- CVE-2026-25187 Winlogon Elevation of Privilege Vulnerability
- CVE-2026-25186 Windows Accessibility Infrastructure (ATBroker.exe) Information Disclosure Vulnerability
- CVE-2026-25185 Windows Shell Link Processing Spoofing Vulnerability
- CVE-2026-25184 Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability
- CVE-2026-25181 GDI+ Information Disclosure Vulnerability
- CVE-2026-25180 Windows Graphics Component Information Disclosure Vulnerability
- CVE-2026-2518 FastX <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and Activation
- CVE-2026-25179 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-25178 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-25177 Active Directory Domain Services Elevation of Privilege Vulnerability
- CVE-2026-25176 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-25175 Windows NTFS Elevation of Privilege Vulnerability
- CVE-2026-25174 Windows Extensible File Allocation Table Elevation of Privilege Vulnerability
- CVE-2026-25173 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
- CVE-2026-25172 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
- CVE-2026-25171 Windows Authentication Elevation of Privilege Vulnerability
- CVE-2026-25170 Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2026-2517 Open5GS SMF types.c ogs_gtp2_parse_tft denial of service
- CVE-2026-25169 Windows Graphics Component Denial of Service Vulnerability
- CVE-2026-25168 Windows Graphics Component Denial of Service Vulnerability
- CVE-2026-25167 Microsoft Brokering File System Elevation of Privilege Vulnerability
- CVE-2026-25166 Windows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution Vulnerability
- CVE-2026-25165 Performance Counters for Windows Elevation of Privilege Vulnerability
- CVE-2026-25164 OpenEMR's Document and Insurance REST Endpoints Skip ACL
- CVE-2026-25161 Alist vulnerable to Path Traversal in multiple file operation handlers
- CVE-2026-25160 Alist has Insecure TLS Config
- CVE-2026-2516 Unidocs ezPDF DRM Reader/ezPDF Reader SHFOLDER.dll uncontrolled search path
- CVE-2026-25157 OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand
- CVE-2026-25156 HotCRP vulnerable to stored XSS via comment attachments