Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 786 of 1013.
- CVE-2026-23786 Race condition in Exynos 1280 firmware
- CVE-2026-23782 Missing authorization in bmc:control-m\/managed file transfer
- CVE-2026-23781 Hardcoded credentials in bmc:control-m\/managed file transfer
- CVE-2026-23780 SQL injection in bmc:control-m\/managed file transfer
- CVE-2026-2378 Address bar spoofing risk in ArcSearch on Android
- CVE-2026-23779 Command injection in PowerProtect Data Domain
- CVE-2026-23778 Command injection in PowerProtect Data Domain
- CVE-2026-23777 Information disclosure in PowerProtect Data Domain
- CVE-2026-23776 Security feature bypass in PowerProtect Data Domain
- CVE-2026-23775 Information disclosure in PowerProtect Data Domain appliances
- CVE-2026-23774 Command injection in PowerProtect Data Domain
- CVE-2026-23773 Server-side request forgery in Disk Library for mainframe DLm2700
- CVE-2026-23772 Privilege escalation in Storage Manager
- CVE-2026-2377 Mirror-registry: quay: quay: server-side request forgery via log export functionality
- CVE-2026-23769 Cross-site scripting in lucy-xss-filter
- CVE-2026-23768 Server-side request forgery in lucy-xss-filter
- CVE-2026-23767 Missing authorization in ESC/POS
- CVE-2026-23764 VB-Audio Voicemeeter & Matrix Drivers DoS via Corrupted IoAllocateMdl Length
- CVE-2026-23763 VB-Audio Matrix Drivers Local Privilege Escalation via Kernel Memory Exposure
- CVE-2026-23762 VB-Audio Voicemeeter & Matrix Drivers DoS via MmMapLockedPagesSpecifyCache
- CVE-2026-23761 VB-Audio Voicemeeter & Matrix Drivers DoS via Improper FILE_OBJECT FsContext Initialization
- CVE-2026-23760 SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel
- CVE-2026-2376 Mirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interface
- CVE-2026-23759 Perle IOLAN STS/SCS Authenticated Command Injection via 'shell ps'
- CVE-2026-23758 GFI HelpDesk < 4.99.9 Stored XSS via editsubject Parameter
- CVE-2026-23757 GFI HelpDesk < 4.99.10 Stored XSS via Reports Module
- CVE-2026-23756 GFI HelpDesk < 4.99.9 Stored XSS via Troubleshooter Step Subject
- CVE-2026-23755 D-Link D-View 8 Installer DLL Preloading via Uncontrolled Search Path
- CVE-2026-23754 D-Link D-View 8 IDOR Allows Credential Disclosure and Account Takeover
- CVE-2026-23753 GFI HelpDesk < 4.99.9 Stored XSS via charset Parameter
- CVE-2026-23752 GFI HelpDesk < 4.99.9 Stored XSS via companyname Parameter
- CVE-2026-23751 Kofax Capture 6.0.0.0 Unauthenticated File Read/Write & SMB Coercion via .NET Remoting
- CVE-2026-23750 Golioth Pouch (prior to commit 1b2219a1) BLE GATT Heap-based Buffer Overflow
- CVE-2026-2375 Privilege escalation in App Builder – Create Native Android & iOS Apps On The Flight
- CVE-2026-23749 Golioth Firmware SDK < 0.22.0 Blockwise Transfer Path Out-of-Bounds Read
- CVE-2026-23748 Golioth Firmware SDK < 0.22.0 LightDB State Out-of-Bounds Read
- CVE-2026-23747 Golioth Firmware SDK < 0.22.0 Payload Utils Stack-based Buffer Overflow
- CVE-2026-23746 Entrust Instant Financial Issuance (IFI) SmartCardController Service .NET Remoting RCE
- CVE-2026-23745 node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
- CVE-2026-23744 REC in MCPJam inspector due to HTTP Endpoint exposes
- CVE-2026-23743 Discourse allows permalinks to restricted resources to leak resource slugs to unauthorized users
- CVE-2026-23742 Skipper arbitrary code execution through lua filters
- CVE-2026-23741 Privilege escalation in asterisk
- CVE-2026-23740 Asterisk vulnerable to potential privilege escalation
- CVE-2026-2374 Login No Captcha reCAPTCHA <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via PHP_SELF
- CVE-2026-23739 Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
- CVE-2026-23738 Cross-site scripting in asterisk
- CVE-2026-23737 seroval Affected by Remote Code Execution via JSON Deserialization
- CVE-2026-23736 seroval Affected by Prototype Pollution via JSON Deserialization
- CVE-2026-23735 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in graphql-modules
- CVE-2026-23734 XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash
- CVE-2026-23733 Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE)
- CVE-2026-23732 FreeRDP has heap-buffer-overflow in Glyph_Alloc
- CVE-2026-23731 WeGIA Clickjacking Vulnerability
- CVE-2026-23730 Open redirect in WeGIA
- CVE-2026-2373 Missing authorization in Royal Addons for Elementor – Addons and Templates Kit for Elementor
- CVE-2026-23729 Open redirect in WeGIA
- CVE-2026-23728 Open redirect in WeGIA
- CVE-2026-23727 Open redirect in WeGIA
- CVE-2026-23726 Open redirect in WeGIA
- CVE-2026-23725 WeGIA Stored Cross-Site Scripting (XSS) – nome Parameter on Adopters Information Page
- CVE-2026-23724 WeGIA Stored Cross-Site Scripting (XSS) – atendido_idatendido Parameter on Occurrence Registration Page
- CVE-2026-23723 WeGIA has a Critical SQL Injection in Atendido_ocorrenciaControle via id_memorando parameter
- CVE-2026-23722 WeGIA has a Reflected Cross-Site Scripting (XSS) vulnerability allowing arbitrary code execution and UI redressing.
- CVE-2026-23721 OpenProject users with "View Members" permission in any project can view all Group memberships
- CVE-2026-23720 Memory corruption in Simcenter Femap
- CVE-2026-23719 Memory corruption in Simcenter Femap
- CVE-2026-23718 Memory corruption in Simcenter Femap
- CVE-2026-23717 Memory corruption in Simcenter Femap
- CVE-2026-23716 Memory corruption in Simcenter Femap
- CVE-2026-23715 Memory corruption in Simcenter Femap
- CVE-2026-2371 Missing authorization in Greenshift – animation and page builder blocks
- CVE-2026-23708 Auth bypass in FortiSOAR PaaS
- CVE-2026-23707 SQL injection in FortiAnalyzer
- CVE-2026-23706 SQL injection in FortiAnalyzer
- CVE-2026-23705 SQL injection in FortiAnalyzer
- CVE-2026-23704 File upload in Movable Type (Cloud Edition)
- CVE-2026-23703 Misconfiguration in FinalCode Ver.5 series
- CVE-2026-23702 Copeland XWEB and XWEB Pro OS Command Injection
- CVE-2026-2370 Improper Handling of Parameters in GitLab
- CVE-2026-23699 Command injection in AP180(JA) V1.xx
- CVE-2026-23698 Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload
- CVE-2026-23697 Vtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents Module
- CVE-2026-23696 Windmill < 1.603.3 File Ownership Handling SQLi RCE
- CVE-2026-23695 Cockpit CMS 2.14.0 Stored XSS via Set Field Display Template
- CVE-2026-23694 Aruba HiSpeed Cache < 3.0.5 CSRF in Multiple Administrative AJAX Actions
- CVE-2026-23693 ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint
- CVE-2026-2369 Libsoup: libsoup: buffer overread due to integer underflow when handling zero-length resources
- CVE-2026-23689 Denial of service (DOS) in SAP Supply Chain Management
- CVE-2026-23688 Missing Authorization check in SAP Fiori App (Manage Service Entry Sheets - Lean Services)
- CVE-2026-23687 XML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2026-23686 CRLF Injection vulnerability in SAP NetWeaver Application Server Java
- CVE-2026-23685 Insecure Deserialization vulnerability in SAP NetWeaver (JMS service)
- CVE-2026-23684 Race condition vulnerability in SAP Commerce Cloud
- CVE-2026-23683 Missing Authorization check in SAP Fiori App (Intercompany Balance Reconciliation)
- CVE-2026-23681 Missing Authorization check in a function module in SAP Support Tools Plug-In
- CVE-2026-2368 Security feature bypass in FileZ
- CVE-2026-23679 libusb < 1.0.30 NULL Pointer Dereference in parse_interface()
- CVE-2026-23678 Binardat 10G08-0800GSM Network Switch Traceroute CLI Command Injection
- CVE-2026-23674 MapUrlToZone Security Feature Bypass Vulnerability