Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 787 of 1013.
- CVE-2026-23673 Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
- CVE-2026-23672 Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
- CVE-2026-23671 Windows Bluetooth RFCOM Protocol Driver Elevation of Privilege Vulnerability
- CVE-2026-23670 Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability
- CVE-2026-2367 Cross-site scripting in Secure Copy Content Protection and Content Locking
- CVE-2026-23669 RPC Runtime Library Remote Code Execution Vulnerability
- CVE-2026-23668 Windows Graphics Component Elevation of Privilege Vulnerability
- CVE-2026-23667 Broadcast DVR Elevation of Privilege Vulnerability
- CVE-2026-23666 .NET Framework Denial of Service Vulnerability
- CVE-2026-23665 Linux Azure Diagnostic extension (LAD) Elevation of Privilege Vulnerability
- CVE-2026-23664 Azure IoT Explorer Information Disclosure Vulnerability
- CVE-2026-23663 Microsoft Global Secure Access (GSA) Information Disclosure Vulnerability
- CVE-2026-23662 Azure IoT Explorer Information Disclosure Vulnerability
- CVE-2026-23661 Azure IoT Explorer Information Disclosure Vulnerability
- CVE-2026-23660 Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability
- CVE-2026-2366 Keycloak: keycloak: information disclosure via authorization bypass in admin api
- CVE-2026-23659 Azure Data Factory Information Disclosure Vulnerability
- CVE-2026-23658 Azure DevOps: msazure Elevation of Privilege Vulnerability
- CVE-2026-23657 Microsoft Word Remote Code Execution Vulnerability
- CVE-2026-23656 Windows App Installer Spoofing Vulnerability
- CVE-2026-23655 Microsoft ACI Confidential Containers Information Disclosure Vulnerability
- CVE-2026-23654 GitHub: Zero Shot SCFoundation Remote Code Execution Vulnerability
- CVE-2026-23653 GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability
- CVE-2026-23652 Microsoft Power Pages Remote Code Execution Vulnerability
- CVE-2026-23651 Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability
- CVE-2026-2365 Fluent Forms Pro <= 6.1.17 - Unauthenticated Stored Cross-Site Scripting via Draft Form Submission
- CVE-2026-23648 Glory RBG-100 Recycler System Local Privilege Escalation via Insecure File Permissions
- CVE-2026-23647 Glory RBG-100 Recycler System Hard-coded OS Credentials
- CVE-2026-23646 OpenProject users can delete other user's session, causing them to be logged out
- CVE-2026-23645 SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload
- CVE-2026-23644 esm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages
- CVE-2026-23643 CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting
- CVE-2026-2364 CODESYS Installer TOCTOU Privilege Escalation
- CVE-2026-23638 Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key
- CVE-2026-23636 Kiteworks Secure Data Forms is vulnerable to an Unrestricted Upload of File with Dangerous Type
- CVE-2026-23635 Kiteworks Secure Data Forms has a potential Unprotected Transport of Credentials
- CVE-2026-23634 Pepr Overly Permissive RBAC ClusterRole in Admin Mode
- CVE-2026-23633 Gogs has arbitrary file read/write via path traversal in Git hook editing
- CVE-2026-23632 Gogs user can update repository content with read-only permission
- CVE-2026-23631 redis-server Lua use-after-free may allow remote code execution
- CVE-2026-23630 Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid rendering
- CVE-2026-2363 WP-Members Membership Plugin <= 3.5.5.1 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute
- CVE-2026-23627 OpenEMR has SQL Injection in Immunization Search/Report
- CVE-2026-23626 Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)
- CVE-2026-23625 OpenProject has stored XSS regression using attachments and script-src self
- CVE-2026-23624 GLPI is vulnerable to session stealing on externally authenticated user change
- CVE-2026-23623 Collabora Online vulnerable to Authorization Bypass
- CVE-2026-23622 CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover
- CVE-2026-23621 GFI MailEssentials AI < 22.4 ListServer.IsPathExist() Absolute Directory Traversal to File Enumeration
- CVE-2026-23620 GFI MailEssentials AI < 22.4 ListServer.IsDBExist() Absolute Directory Traversal to File Enumeration
- CVE-2026-2362 WP Accessibility <= 2.3.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'alt' Attribute
- CVE-2026-23619 GFI MailEssentials AI < 22.4 General Settings Local Domains Domain Description Stored XSS
- CVE-2026-23618 GFI MailEssentials AI < 22.4 Anti-Spam Spam Keyword Checking Subject Condition Stored XSS
- CVE-2026-23617 GFI MailEssentials AI < 22.4 Anti-Spam Spam Keyword Checking Body Condition Stored XSS
- CVE-2026-23616 GFI MailEssentials AI < 22.4 Anti-Spam Anti-Spoofing Description Stored XSS
- CVE-2026-23615 GFI MailEssentials AI < 22.4 Anti-Spam Sender Policy Framework Email Exceptions Description Stored XSS
- CVE-2026-23614 GFI MailEssentials AI < 22.4 Anti-Spam Sender Policy Framework IP Exceptions Description Stored XSS
- CVE-2026-23613 GFI MailEssentials AI < 22.4 Anti-Spam URI DNS Blocklist Domain Stored XSS
- CVE-2026-23612 GFI MailEssentials AI < 22.4 Anti-Spam IP DNS Blocklist Domain Stored XSS
- CVE-2026-23611 GFI MailEssentials AI < 22.4 Anti-Spam IP Blocklist Description Stored XSS
- CVE-2026-23610 GFI MailEssentials AI < 22.4 POP2Exchange POP3 Server Login Stored XSS
- CVE-2026-2361 Privilege escalation in PostgreSQL Anonymizer
- CVE-2026-23609 GFI MailEssentials AI < 22.4 General Settings Perimeter SMTP Servers Description Stored XSS
- CVE-2026-23608 GFI MailEssentials AI < 22.4 Email Management Mail Monitoring Rule Stored XSS
- CVE-2026-23607 GFI MailEssentials AI < 22.4 Anti-Spam Whitelist Description Stored XSS
- CVE-2026-23606 GFI MailEssentials AI < 22.4 Advanced Content Filtering Rule Stored XSS
- CVE-2026-23605 GFI MailEssentials AI < 22.4 Attachment Filtering Rule Stored XSS
- CVE-2026-23604 GFI MailEssentials AI < 22.4 Keyword Filtering Rule Stored XSS
- CVE-2026-23603 Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
- CVE-2026-23601 Frame Injection via Shared GTK Allows Traffic Spoofing and Client Compromise
- CVE-2026-23600 Auth bypass in HPE AutoPass License Server (APLS)
- CVE-2026-2360 Privilege escalation in PostgreSQL Anonymizer
- CVE-2026-23599 Local Privilege Escalation Vulnerability in HPE Aruba Networking Clear Pass Policy Manager OnGuard for Linux
- CVE-2026-23598 Unauthenticated Information Disclosure in application API allows sensitive system information exposure
- CVE-2026-23597 Unauthenticated Information Disclosure in application API allows sensitive system information exposure
- CVE-2026-23596 Unauthenticated Improper Access Control in management API allows unauthorized service disruption
- CVE-2026-23595 Unauthenticated Authentication Bypass in application API allows unauthorized administrative account creation
- CVE-2026-23593 Unauthenticated Limited File Read allows Data Exposure in Web Interface
- CVE-2026-23592 Insecure File Handling allows Remote Code Execution in Backup Functionality
- CVE-2026-2359 Multer vulnerable to Denial of Service via resource exhaustion
- CVE-2026-2358 WP ULike <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute
- CVE-2026-23573 Cross-site scripting in FortiOS
- CVE-2026-23572 Improper Access Control in TeamViewer clients
- CVE-2026-23571 Command Injection in 1E-Nomad-RunPkgStatusRequest Instruction in TeamViewer DEX
- CVE-2026-23570 Log timestamp tampering vulnerability in Content Distribution Service
- CVE-2026-2357 Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2026-23569 Out-of-bounds read vulnerability in Content Distribution Service
- CVE-2026-23568 Out-of-bounds read vulnerability in Content Distribution Service
- CVE-2026-23567 Integer underflow in Content Distribution Service UDP handler
- CVE-2026-23566 Log Injection in Content Distribution Service UDP Handler
- CVE-2026-23565 Denial-of-Service in Content Distribution Service
- CVE-2026-23564 Transmission of Unencrypted Data in Content Distribution Service
- CVE-2026-23563 Privilege escalation in TeamViewer DEX via DeleteFileByPath instruction
- CVE-2026-23562 Multiple RBAC issues in XAPI
- CVE-2026-23561 Multiple RBAC issues in XAPI
- CVE-2026-23560 Multiple RBAC issues in XAPI
- CVE-2026-2356 User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion
- CVE-2026-23559 Multiple RBAC issues in XAPI
- CVE-2026-23558 grant table v2 race in status page mapping
- CVE-2026-23557 Xenstored DoS via XS_RESET_WATCHES command