Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 777 of 1013.
- CVE-2026-2475 Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-24749 Silverstripe Assets Module has a DBFile::getURL() permission bypass
- CVE-2026-24748 Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access
- CVE-2026-24747 PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files
- CVE-2026-24746 InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
- CVE-2026-24745 InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
- CVE-2026-24744 InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
- CVE-2026-24743 InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
- CVE-2026-24742 Discourse staff action logs expose sensitive information to moderators
- CVE-2026-24741 ConvertX Vulnerable to Arbitrary File Deletion via Path Traversal in `POST /delete`
- CVE-2026-24740 Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access
- CVE-2026-2474 Integer overflow in Crypt::URandom
- CVE-2026-24739 Symfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operations
- CVE-2026-24738 gmrtd ReadFile Vulnerable to Denial of Service via Excessive TLV Length Values
- CVE-2026-24737 jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution
- CVE-2026-24736 Squidex has Server-Side Request Forgery (SSRF) Issue in Webhook Configuration
- CVE-2026-24735 Apache Answer: Revision API Improper Access Control leads to Information Disclosure
- CVE-2026-24734 Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass
- CVE-2026-24733 Apache Tomcat: Security constraint bypass with HTTP/0.9
- CVE-2026-24732 Improper permission checks in Extension:NSFileRepo
- CVE-2026-24731 EV2GO ev2go.io Missing Authentication for Critical Function
- CVE-2026-2473 Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.
- CVE-2026-24729 Interinfo DreamMaker - Unrestricted Upload of File with Dangerous Type
- CVE-2026-24728 Interinfo DreamMaker - Missing Authentication for Critical Function
- CVE-2026-24727 SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type
- CVE-2026-24724 File Station 5
- CVE-2026-24723 NULL Pointer Dereference in utilRequest.cgi
- CVE-2026-24722 Null Pointer Dereference in File Station 5
- CVE-2026-24721 Null Pointer Dereference in File Station 5
- CVE-2026-24720 File Station 5
- CVE-2026-2472 Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization
- CVE-2026-24719 QTS, QuTS hero
- CVE-2026-24718 Path Traversal Vulnerability in Qsync Central's qsyncsrv.cgi
- CVE-2026-24717 QTS, QuTS hero
- CVE-2026-24716 QTS, QuTS hero
- CVE-2026-24715 Lack of Reproducible Vulnerability Evidence in QNAP Report
- CVE-2026-24714 Security feature bypass in NETGEAR products
- CVE-2026-24713 Apache IoTDB: JEXL Expression Injection Vulnerability
- CVE-2026-24712 Command injection in northern.tech:cfengine
- CVE-2026-24711 Missing authorization in northern.tech:cfengine
- CVE-2026-24710 Cross-site scripting in northern.tech:cfengine
- CVE-2026-2471 WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field
- CVE-2026-24708 OpenStack Nova calls qemu-img without format restrictions for resize
- CVE-2026-24700 Command injection in cisco:rv110w firmware
- CVE-2026-2470 Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'
- CVE-2026-24699 Command injection in cisco:rv110w firmware
- CVE-2026-24698 Command injection in cisco:rv110w firmware
- CVE-2026-24697 Command injection in cisco:rv110w firmware
- CVE-2026-24696 Everon api.everon.io Improper Restriction of Excessive Authentication Attempts
- CVE-2026-24695 Copeland XWEB and XWEB Pro OS Command Injection
- CVE-2026-24694 Other in Roland Cloud Manager
- CVE-2026-24693 Security feature bypass in Intel(R) oneCCL Bindings for PyTorch
- CVE-2026-24692 Guest users can bypass read permissions via search API
- CVE-2026-24690 Gitea pull-request branch updates use insufficient permission checks
- CVE-2026-2469 ImapEngine affected by command injection via the ID command parameters
- CVE-2026-24689 Copeland XWEB and XWEB Pro OS Command Injection
- CVE-2026-24688 pypdf has possible Infinite Loop when processing outlines/bookmarks
- CVE-2026-24687 Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac
- CVE-2026-24686 go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names
- CVE-2026-24685 OpenProject has Argument Injection on Repository module that allows Arbitrary File Write
- CVE-2026-24684 FreeRDP has a Heap-use-after-free in play_thread
- CVE-2026-24683 FreeRDP has a heap-use-after-free in ainput_send_input_event
- CVE-2026-24682 FreeRDP has a Heap-buffer-overflow in audio_formats_free
- CVE-2026-24681 FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb
- CVE-2026-24680 FreeRDP has a heap-use-after-free in update_pointer_new(SDL)
- CVE-2026-2468 Quentn WP <= 1.2.12 - Unauthenticated SQL Injection via 'qntn_wp_access' Cookie
- CVE-2026-24679 FreeRDP has a heap-buffer-overflow in urb_select_interface
- CVE-2026-24678 FreeRDP has a Heap-use-after-free in cam_v4l_stream_capture_thread
- CVE-2026-24677 FreeRDP has a heap-buffer-overflow in ecam_encoder_compress_h264
- CVE-2026-24676 FreeRDP has a heap-use-after-free in audio_format_compatible
- CVE-2026-24675 FreeRDP has a Heap-use-after-free in urb_select_interface
- CVE-2026-24674 Open eClass is Vulnerable to Reflected Cross-Site Scripting (XSS) in Multiple Endpoints
- CVE-2026-24673 Open eClass Has File Upload Filter Bypass via ZIP Archive Extraction
- CVE-2026-24672 Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in User Profile Fields
- CVE-2026-24671 Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in Multiple High-Privilege User Fields
- CVE-2026-24670 Open eClass Has Broken Access Control in Course Units Module Allows Students to Create Units
- CVE-2026-2467 Memory corruption in Connext Professional
- CVE-2026-24669 Open eClass Insecure Password Reset Token Reuse Enables Account Takeover
- CVE-2026-24668 Open eClass Broken Access Control Allows Students to Add Content to Course Units
- CVE-2026-24667 Open eClass's Active Sessions Not Invalidated After Password Change Allow Persistent Account Access
- CVE-2026-24666 Open eClass is Vulnerable to CSRF in Teacher-Restricted Endpoints Allows Unauthorized Actions
- CVE-2026-24665 Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) via Student Assignment Upload
- CVE-2026-24664 Open eClass is Vulnerable to Username Enumeration via Login Response Discrepancies
- CVE-2026-24663 Copeland XWEB and XWEB Pro OS Command Injection
- CVE-2026-24662 Cross-site scripting in Musetheque V4 Information Disclosure for IPKNOWLEDGE
- CVE-2026-24661 Unbounded Request Body Read in MS Teams Plugin {{/changes}} Webhook Endpoint
- CVE-2026-24660 Memory corruption in LibRaw
- CVE-2026-2466 DukaPress <= 3.2.4 - Reflected XSS
- CVE-2026-24656 Apache Karaf: Decanter log-socket collector has deserialization vulnerability
- CVE-2026-2465 Improper Authorization in E-Kalite's Turboard FOR-S
- CVE-2026-24641 Null dereference in FortiWeb
- CVE-2026-24640 Memory corruption in FortiWeb
- CVE-2026-2464 Directory Traversal in AMR Printer Management by AMR
- CVE-2026-24639 WordPress Photo Block plugin <= 1.7.1 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-24638 WordPress RepairBuddy plugin <= 4.1121 - Broken Access Control vulnerability
- CVE-2026-24637 WordPress PowerPress Podcasting plugin <= 11.15.10 - SQL Injection vulnerability
- CVE-2026-24636 WordPress Sugar Calendar (Lite) plugin <= 3.9.1 - Broken Access Control vulnerability
- CVE-2026-24635 WordPress EduBlink Core plugin <= 2.0.7 - Local File Inclusion vulnerability
- CVE-2026-24634 WordPress Ultimate Reviews plugin <= 3.2.16 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-24633 WordPress Add Expires Headers & Optimized Minify plugin <= 3.2.0 - Broken Access Control vulnerability