Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 794 of 1013.
- CVE-2026-22988 arp: do not assume dev_hard_header() does not change skb->head
- CVE-2026-22987 net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy
- CVE-2026-22986 gpiolib: fix race condition for gdev->srcu
- CVE-2026-22985 idpf: Fix RSS LUT NULL pointer crash on early ethtool operations
- CVE-2026-22984 libceph: prevent potential out-of-bounds reads in handle_auth_done()
- CVE-2026-22983 net: do not write to msg_get_inq in callee
- CVE-2026-22982 net: mscc: ocelot: Fix crash when adding interface under a lag
- CVE-2026-22981 idpf: detach and close netdevs while handling a reset
- CVE-2026-22980 nfsd: provide locking for v4_end_grace
- CVE-2026-2298 Command injection in Marketing Cloud Engagement
- CVE-2026-22979 net: fix memory leak in skb_segment_list for GRO packets
- CVE-2026-22978 wifi: avoid kernel-infoleak from struct iw_point
- CVE-2026-22977 net: sock: fix hardened usercopy panic in sock_recv_errqueue
- CVE-2026-22976 net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset
- CVE-2026-2297 SourcelessFileLoader does not use io.open_code()
- CVE-2026-2296 Code injection in Product Addons for Woocommerce – Product Options with Custom Fields
- CVE-2026-2295 Missing authorization in WPZOOM Addons for Elementor – Starter Templates & Widgets
- CVE-2026-2294 Missing authorization in UiPress lite | Effortless custom dashboards, admin themes and pages
- CVE-2026-2293 NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass
- CVE-2026-22927 Path traversal in Omnissa Workspace ONE® Tunnel for Windows
- CVE-2026-22926 Path traversal in Omnissa Workspace ONE® Assist for macOS
- CVE-2026-22925 Denial of service in SIMATIC CN 4100
- CVE-2026-22924 Missing authorization in SIMATIC CN 4100
- CVE-2026-22923 Memory corruption in NX
- CVE-2026-22922 Apache Airflow: Airflow externalLogUrl Permission Bypass
- CVE-2026-2292 Morkva UA Shipping <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field
- CVE-2026-22919 Cross-site scripting in TDC-X401GL
- CVE-2026-22918 Other in TDC-X401GL
- CVE-2026-22917 Denial of service in TDC-X401GL
- CVE-2026-22916 Missing authorization in TDC-X401GL
- CVE-2026-22915 Information disclosure in TDC-X401GL
- CVE-2026-22914 Privilege escalation in TDC-X401GL
- CVE-2026-22913 Cross-site scripting in TDC-X401GL
- CVE-2026-22912 Open redirect in TDC-X401GL
- CVE-2026-22911 Hardcoded credentials in TDC-X401GL
- CVE-2026-22910 Hardcoded credentials in TDC-X401GL
- CVE-2026-2291 CVE-2026-2291
- CVE-2026-22909 Missing authorization in TDC-X401GL
- CVE-2026-22908 File upload in TDC-X401GL
- CVE-2026-22907 Privilege escalation in TDC-X401GL
- CVE-2026-22906 Hardcoded Key Allows Credential Disclosure
- CVE-2026-22905 Authentication Bypass via URI Traversal
- CVE-2026-22904 Stack Overflow via Oversized Cookie Fields in lighttpd
- CVE-2026-22903 Stack Overflow via SESSIONID Cookie in lighttpd
- CVE-2026-22902 QuNetSwitch
- CVE-2026-22901 QuNetSwitch
- CVE-2026-22900 QuNetSwitch
- CVE-2026-2290 Server-side request forgery in Post Affiliate Pro
- CVE-2026-22899 File Station 5
- CVE-2026-22898 QVR Pro
- CVE-2026-22897 QuNetSwitch
- CVE-2026-22896 Stored XSS via Interface Name in Network & Virtual Switch App
- CVE-2026-22895 QuFTP Service
- CVE-2026-22894 File Station 5
- CVE-2026-22893 QTS, QuTS hero
- CVE-2026-22892 Insufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post Attachments
- CVE-2026-22891 Memory corruption in libbiosig
- CVE-2026-22890 EV2GO ev2go.io Insufficiently Protected Credentials
- CVE-2026-2289 Taskbuilder <= 5.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Block Emails' Field
- CVE-2026-22888 Other in Cybozu Garoon
- CVE-2026-22887 Memory corruption in Intel(R) PROSet/Wireless WiFi Software for Windows
- CVE-2026-22886 Hardcoded credentials in Eclipse OpenMQ
- CVE-2026-22885 EnOcean SmartServer IoT Out-of-bounds Read
- CVE-2026-22882 Memory corruption in Affinity
- CVE-2026-22881 Cross-site scripting in Cybozu Garoon
- CVE-2026-22880 Mobile SSO authentication flow allows credential theft via malicious server
- CVE-2026-2288 myLinksDump <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'link_title' Parameter
- CVE-2026-22879 Memory corruption in vtk
- CVE-2026-22878 Mobility46 mobility46.se Insufficiently Protected Credentials
- CVE-2026-22877 Copeland XWEB and XWEB Pro Path Traversal
- CVE-2026-22876 Path traversal in Multiple Network Cameras TRIFORA 3 series
- CVE-2026-22875 Cross-site scripting in Movable Type (Cloud Edition)
- CVE-2026-22874 Gitea webhook and migration allow-list filtering permits SSRF
- CVE-2026-22872 Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability
- CVE-2026-22871 GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
- CVE-2026-22870 GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS
- CVE-2026-2287 CVE-2026-2287
- CVE-2026-22869 Eigent Allows Arbitrary Code Execution via pull_request_target CI Workflow
- CVE-2026-22868 go-ethereum has a DoS via malicious p2p message
- CVE-2026-22867 LaSuite Doc affected by Stored XSS via Interlinking Block
- CVE-2026-22866 ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation
- CVE-2026-22865 Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts
- CVE-2026-22864 Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass
- CVE-2026-22863 Deno node:crypto doesn't finalize cipher
- CVE-2026-22862 go-ethereum has a DoS via malicious p2p message
- CVE-2026-22861 iccDEV has a heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cpp
- CVE-2026-22860 Rack has a Directory Traversal via Rack:Directory
- CVE-2026-2286 CVE-2026-2286
- CVE-2026-22859 FreeRDP has a heap-buffer-overflow in urb_select_configuration
- CVE-2026-22858 FreeRDP has a global-buffer-overflow in crypto_base64_decode
- CVE-2026-22857 FreeRDP has a heap-use-after-free in irp_thread_func
- CVE-2026-22856 FreeRDP has a heap-use-after-free in create_irp_thread
- CVE-2026-22855 FreeRDP has a heap-buffer-overflow in smartcard_unpack_set_attrib_call
- CVE-2026-22854 FreeRDP has a heap-buffer-overflow in drive_process_irp_read
- CVE-2026-22853 FreeRDP has a heap-buffer-overflow in ndr_read_uint8Array
- CVE-2026-22852 FreeRDP has a heap-buffer-overflow in audin_process_formats
- CVE-2026-22851 FreeRDP RDPGFX ResetGraphics race leads to use-after-free in SDL client (sdl->primary)
- CVE-2026-22850 SQL injection in koko-analytics
- CVE-2026-2285 CVE-2026-2285
- CVE-2026-22849 Saleor lacks proper HTML sanitization in rich text fields