Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 776 of 1013.
- CVE-2026-24848 OpenEMR Arbitrary File Write leading to Remote Code Execution
- CVE-2026-24847 OpenEMR has Open Redirect in Eye Exam Form
- CVE-2026-24846 malcontent's archive extraction could write outside extraction directory
- CVE-2026-24845 malcontent's OCI image scanning could expose registry credentials
- CVE-2026-24844 melange pipeline working-directory could allow command injection
- CVE-2026-24843 melange QEMU runner could write files outside workspace directory
- CVE-2026-24842 node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
- CVE-2026-24841 Command injection in dokploy
- CVE-2026-24840 Dokploy uses hardcoded credentials in installation script, which could result in database access
- CVE-2026-2484 IBM InfoSphere Information Server Information Disclosure
- CVE-2026-24839 Dokploy has a clickjacking vulnerability - Missing X-Frame-Options and CSP frame-ancestors headers
- CVE-2026-24838 DotNetNuke.Core Vulnerable to Stored XSS via Module Title
- CVE-2026-24837 DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal
- CVE-2026-24836 DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes
- CVE-2026-24835 Podman Desktop Extension System Vulnerable to Authentication Bypass
- CVE-2026-24834 Kata Container to Guest micro VM privilege escalation
- CVE-2026-24833 DotNetNuke.Core Vulnerable to Stored XSS in Module Description
- CVE-2026-24832 Out-of-bounds write in ixray-1.6-stcop
- CVE-2026-24831 Infinite loop (DoS) in ixray-1.6-stcop
- CVE-2026-24830 Integer Overflow or Wraparound in IronOS
- CVE-2026-2483 IBM InfoSphere Information Server Cross-Site Scripting
- CVE-2026-24829 Out-of-bounds write in is-Engine
- CVE-2026-24828 Memory leak in is-Engine
- CVE-2026-24827 Out-of-bounds write in Commander-Genius
- CVE-2026-24826 Out-of-bounds write in turso3d
- CVE-2026-24825 Denial of service in ydb
- CVE-2026-24824 A XSS in yacy/yacy_search_server
- CVE-2026-24823 A heap-based buffer over-read or buffer overflow vulnerability in FASTSHIFT/X-TRACK
- CVE-2026-24822 a heap-based buffer overflow vulnerability in ttttupup/wxhelper via src/mongoose.
- CVE-2026-24821 A heap-based buffer over-read that might affect a system that compiles untrusted Lua code in turanszkij/WickedEngine.
- CVE-2026-24820 A stack overflow vulnerability in turanszkij/WickedEngine
- CVE-2026-2482 IBM WebSphere Application Server Liberty is affected by a cross-site request forgery
- CVE-2026-24819 An out-of-memory (OOM) issue in foxinmy/weixin4j
- CVE-2026-24818 A heap-based buffer over-read that might affect a system that compiles untrusted Lua code in praydog/UEVR
- CVE-2026-24817 A potential heap-buffer overflow in praydog/UEVR
- CVE-2026-24816 Cookie Security Vulnerabilities in datavane/tis
- CVE-2026-24815 A XStream Security Vulnerability in XML Deserialization in datavane/tis
- CVE-2026-24814 A integer overflow in swoole/swoole-src
- CVE-2026-24813 A null pointer dereference in abcz316/SKRoot-linuxKernelRoot
- CVE-2026-24812 An improper pointer arithmetic in root-project/root at builtins/zlib/inftrees.c
- CVE-2026-24811 An improper pointer arithmetic in root-project/root at builtins/zlib/inffast.c
- CVE-2026-24810 A buffer overflow in rethinkdb/rethinkdb
- CVE-2026-2481 Cross-site scripting in Beaver Builder Page Builder – Drag and Drop Website Builder
- CVE-2026-24809 Save stack space while handling errors in praydog/REFramework
- CVE-2026-24808 A possible integer overflow vulnerability in RawTherapee/RawTherapee
- CVE-2026-24807 Buffer Overflow Vulnerability in liuyueyi/quick-media
- CVE-2026-24806 Buffer Write Security Vulnerability in liuyueyi/quick-media
- CVE-2026-24805 Mishandles certain out-of-memory conditions in visualfc/liteide via liteidex/src/3rdparty/libvterm/src module
- CVE-2026-24804 A infinite loop vulnerability in coolsnowwolf/lede
- CVE-2026-24803 A possible infinite loop vulnerability in coolsnowwolf/lede
- CVE-2026-24802 Buffer Overflow Vulnerability in briandilley/jsonrpc4j
- CVE-2026-24801 A Potential SPA-vulnerability in Ralim/IronOS
- CVE-2026-24800 A heap-based buffer over-read or buffer overflow in tildearrow/furnace
- CVE-2026-2480 Cross-site scripting in WP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2026-24799 A heap-based buffer over-read or buffer overflow in davisking/dlib
- CVE-2026-24798 An Uninitialized stack variable vulnerability in GaijinEntertainment/DagorEngine
- CVE-2026-24797 An out of bounds write due to a missing bounds check in neka-nat/cupoch
- CVE-2026-24796 A Out-of-bounds Read vulnerability in CloverHackyColor/CloverBootloader
- CVE-2026-24795 An Out-of-bounds Write in CloverHackyColor/CloverBootloader
- CVE-2026-24794 Chunk Unloading Security Vulnerability in CardboardPowered/cardboard
- CVE-2026-24793 A heap-based buffer over-read or buffer overflow vulnerability in azerothcore/azerothcore-wotlk
- CVE-2026-24792 web_webview has a Race Condition vulnerability
- CVE-2026-24791 Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
- CVE-2026-24790 Welker OdorEyes EcoSystem Pulse Bypass System with XL4 Controller Missing Authentication for Critical Function
- CVE-2026-2479 Server-side request forgery in Responsive Lightbox & Gallery
- CVE-2026-24789 ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function
- CVE-2026-24788 RaspAP raspap-webgui contains an OS Command Injection vulnerability
- CVE-2026-24785 Clatter has a PSK Validity Rule Violation issue
- CVE-2026-24784 DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer
- CVE-2026-24783 soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives
- CVE-2026-24782 Kiteworks Secure Data Forms has a SQL Injection vulnerability
- CVE-2026-24781 vm2: Sandbox Breakout Through Inspect
- CVE-2026-24780 AutoGPT is Vulnerable to RCE via Disabled Block Execution
- CVE-2026-24779 vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`
- CVE-2026-24778 Ghost vulnerable to XSS via malicious Portal preview links
- CVE-2026-24777 OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts
- CVE-2026-24776 OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer
- CVE-2026-24775 Server-side request forgery in openproject
- CVE-2026-24774 Open eClass Business Logic Flaw Allows Students to Mark Attendance in Expired Activities
- CVE-2026-24773 Open eClass Unauthenticated IDOR Allows Access to Arbitrary User Files
- CVE-2026-24772 OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server
- CVE-2026-24771 Hono has a Cross-site Scripting vulnerability
- CVE-2026-24770 RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser
- CVE-2026-24769 NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload
- CVE-2026-24768 NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter
- CVE-2026-24767 NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality
- CVE-2026-24766 NocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoS
- CVE-2026-24765 PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling
- CVE-2026-24764 OpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions
- CVE-2026-24763 Authenticated Command Injection in OpenClaw Docker Execution via PATH Environment Variable
- CVE-2026-24762 RustFS Logs Sensitive Credentials in Plaintext
- CVE-2026-24761 Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key
- CVE-2026-2476 MS Teams plugin sensitive config values not properly masked in support packets
- CVE-2026-24756 Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key
- CVE-2026-24755 Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key
- CVE-2026-24754 Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting
- CVE-2026-24753 Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key
- CVE-2026-24752 Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting
- CVE-2026-24751 Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting
- CVE-2026-24750 Kiteworks Secure Data Forms vulnerable to Cross-site Scripting