Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 782 of 1013.
- CVE-2026-24201 Memory corruption in Virtual GPU Manager
- CVE-2026-24200 Use after free in Virtual GPU Manager
- CVE-2026-2420 LotekMedia Popup Form <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
- CVE-2026-24199 Race condition in GeForce
- CVE-2026-24198 Race condition in GeForce
- CVE-2026-24197 Misconfiguration in GeForce
- CVE-2026-24196 Memory corruption in GeForce
- CVE-2026-24195 Denial of service in Guest driver
- CVE-2026-24194 Privilege escalation in GeForce
- CVE-2026-24193 Memory corruption in GeForce
- CVE-2026-24192 Integer overflow in GeForce
- CVE-2026-24191 Race condition in GeForce
- CVE-2026-24190 Missing authorization in GeForce
- CVE-2026-2419 Path traversal in WP-DownloadManager
- CVE-2026-24189 Memory corruption in CUDA-Q
- CVE-2026-24188 Memory corruption in TensorRT
- CVE-2026-24187 Use after free in GeForce
- CVE-2026-24186 Deserialization in FLARE SDK
- CVE-2026-24185 Auth bypass in NVOS
- CVE-2026-24184 Memory corruption in Cumulus Linux GA
- CVE-2026-24183 Privilege escalation in Cumulus Linux GA
- CVE-2026-24182 Denial of service in GeForce
- CVE-2026-24181 Memory corruption in DALI
- CVE-2026-24180 Memory corruption in DALI
- CVE-2026-2418 Login with Salesforce <= 1.0.2 - Unauthenticated Authentication Bypass
- CVE-2026-24178 NVIDIA NVFlare Dashboard: Authorization bypass through user-controlled key via user management and authentication system
- CVE-2026-24177 Missing authorization in KAI Scheduler
- CVE-2026-24176 Missing authorization in KAI Scheduler
- CVE-2026-24175 Denial of service in Triton Inference Server
- CVE-2026-24174 Denial of service in Triton Inference Server
- CVE-2026-24173 Integer overflow in Triton Inference Server
- CVE-2026-24170 Auth bypass in Unified Fabric Manager Enterprise - GA
- CVE-2026-2417 Missing Authentication for Critical Function in Pharos Controls Mosaic Show Controller
- CVE-2026-24169 Command injection in Unified Fabric Manager Enterprise - GA
- CVE-2026-24168 Command injection in Unified Fabric Manager Enterprise - GA
- CVE-2026-24167 Command injection in Unified Fabric Manager Enterprise - GA
- CVE-2026-24166 Hardcoded credentials in Unified Fabric Manager Enterprise - GA
- CVE-2026-24165 Deserialization in BioNeMo Framework
- CVE-2026-24164 Deserialization in BioNeMo Framework
- CVE-2026-24163 Deserialization in TensorRT-LLM
- CVE-2026-24162 Deserialization in Merlin Transformers4Rec
- CVE-2026-24160 Null dereference in TensorRT-LLM
- CVE-2026-2416 Geo Mashup <= 1.13.17 - Unauthenticated SQL Injection via 'sort' Parameter
- CVE-2026-24159 NVIDIA NeMo Framework contains a vulnerability leading to Remote Code Execution
- CVE-2026-24158 Denial of service in Triton Inference Server
- CVE-2026-24157 NVIDIA NeMo Framework contains an RCE vulnerability in checkpoint loading
- CVE-2026-24156 Deserialization in DALI
- CVE-2026-24155 Code injection in NeMo Framework
- CVE-2026-24154 Command injection in Jetson Xavier Series, Jetson Orin Series and Jetson Thor
- CVE-2026-24153 Information disclosure in Jetson Xavier Series, Jetson Orin Series and Jetson Thor
- CVE-2026-24152 Deserialization in Megatron LM
- CVE-2026-24151 Deserialization in Megatron LM
- CVE-2026-24150 Deserialization in Megatron LM
- CVE-2026-2415 Unsafe variable evaluation in email templates
- CVE-2026-24149 Code injection in Megatron-LM
- CVE-2026-24148 Misconfiguration in Jetson Xavier Series and Jetson Orin Series
- CVE-2026-24147 Path traversal in Triton Inference Server
- CVE-2026-24146 Denial of service in Triton Inference Server
- CVE-2026-24142 Deserialization in TensorRT-LLM
- CVE-2026-24141 Deserialization in NVIDIA Model Optimizer
- CVE-2026-24140 MyTube has Mass Assignment via Settings Management
- CVE-2026-2414 Auth bypass in Server
- CVE-2026-24139 MyTube Allows Unauthorized Database Export by Guest Users
- CVE-2026-24138 FOG vulnerable to unauthenticated SSRF via `/fog/service/getversion.php`
- CVE-2026-24137 sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal
- CVE-2026-24136 Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API
- CVE-2026-24135 Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update
- CVE-2026-24134 StudioCMS has an Authorization Bypass Through User-Controlled Key
- CVE-2026-24133 jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
- CVE-2026-24132 Orval Mock Generation Code Injection via const
- CVE-2026-24131 pnpm has Path Traversal via arbitrary file permission modification
- CVE-2026-24130 Moonraker with LDAP Enabled Allows Malicious Search Filter Injection
- CVE-2026-2413 Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path
- CVE-2026-24129 Runtipi is Vulnerable to Authenticated Arbitrary Remote Code Execution
- CVE-2026-24128 XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages
- CVE-2026-24127 Typemill has Reflected XSS via login error view template
- CVE-2026-24126 Weblate has an argument injection in management console
- CVE-2026-24125 Path Traversal in @tinacms/graphql
- CVE-2026-24124 Dragonfly Manager Job API Allows Unauthenticated Access
- CVE-2026-24123 BentoML has a Path Traversal via Bentofile Configuration
- CVE-2026-24122 Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked
- CVE-2026-24120 vm2: Sandbox Breakout Through Promise Species
- CVE-2026-2412 Quiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter
- CVE-2026-24118 VM2 Sandbox Breakout Through __lookupGetter__
- CVE-2026-24117 Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL
- CVE-2026-24116 Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64
- CVE-2026-24115 Memory corruption in tenda:w20e firmware
- CVE-2026-24114 Memory corruption in tenda:w20e firmware
- CVE-2026-24113 Memory corruption in tenda:w20e firmware
- CVE-2026-24112 Memory corruption in tenda:w20e firmware
- CVE-2026-24111 Memory corruption in tenda:w20e firmware
- CVE-2026-24110 Memory corruption in tenda:w20e firmware
- CVE-2026-2411 Security feature bypass in zephyr
- CVE-2026-24109 Memory corruption in tenda:w20e firmware
- CVE-2026-24108 Memory corruption in tenda:w20e firmware
- CVE-2026-24107 Command injection in tenda:w20e firmware
- CVE-2026-24105 Command injection in tenda:ac15 firmware
- CVE-2026-24103 Memory corruption in tenda:ac15 firmware
- CVE-2026-24101 Command injection in tenda:ac15 firmware
- CVE-2026-2410 Disable Admin Notices – Hide Dashboard Notifications <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update