Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 796 of 1013.
- CVE-2026-22727 Cloud Foundry unprotected internal endpoints
- CVE-2026-22726 Route Services Firewall Bypass
- CVE-2026-22723 UAA User Token Revocation logic error
- CVE-2026-22722 VMware Workstation for Windows null pointer dereference may allow an authenticated user to trigger a crash
- CVE-2026-22721 VMware Aria Operations privilege escalation vulnerability
- CVE-2026-22720 VMware Aria Operations stored cross-site scripting vulnerability
- CVE-2026-2272 Gimp: gimp: memory corruption due to integer overflow in ico file handling
- CVE-2026-22719 Broadcom VMware Aria Operations Command Injection
- CVE-2026-22718 Command injection vulnerability
- CVE-2026-22717 VMware Workstation out-of-bound read vulnerability
- CVE-2026-22716 VMware Workstation out-of-bounds write vulnerability
- CVE-2026-22715 VMware Workstation/Fusion NAT vulnerability
- CVE-2026-22714 i18n XSS, DoS and config SQLI in Monaco
- CVE-2026-22713 Stored XSS through edit summaries in GrowthExperiments
- CVE-2026-22712 ApprovedRevs allows bypassing the inline CSS sanitizer
- CVE-2026-22711 Stored XSS through system messages in WikiLove
- CVE-2026-22710 Stored XSS through autocomment system messages in Wikibase
- CVE-2026-2271 Gimp: gimp: denial of service via crafted psp image file
- CVE-2026-22709 vm2 has a Sandbox Escape
- CVE-2026-22708 Cursor has a Terminal Tool Allowlist Bypass via Environment Variables
- CVE-2026-22707 Strapi Upload Plugin MIME Validation Bypass via Content API
- CVE-2026-22706 Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
- CVE-2026-22705 RustCrypto: Signatures has timing side-channel in ML-DSA decomposition
- CVE-2026-22704 HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover
- CVE-2026-22703 Cosign verification accepts any valid Rekor entry under certain conditions
- CVE-2026-22702 virtualenv Has TOCTOU Vulnerabilities in Directory Creation
- CVE-2026-22701 filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock
- CVE-2026-22700 RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE
- CVE-2026-2270 StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
- CVE-2026-22699 RustCrypto SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt()
- CVE-2026-22698 RustCrypto SM2-PKE has 32-bit Biased Nonce Vulnerability
- CVE-2026-22697 Memory corruption in CryptoLib
- CVE-2026-22696 dcap-qvl has Missing Verification for QE Identity
- CVE-2026-22695 LIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from CVE-2025-65018 fix)
- CVE-2026-22694 AliasVault is Missing Origin Validation in Android Passkey Credential Provider
- CVE-2026-22693 Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS
- CVE-2026-22692 October CMS: Twig Sandbox Bypass via Collection Methods
- CVE-2026-22691 pypdf has possible long runtimes for malformed startxref
- CVE-2026-22690 pypdf has possible long runtimes for missing /Root object with large /Size values
- CVE-2026-2269 Server-side request forgery in Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
- CVE-2026-22689 Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails
- CVE-2026-22688 WeKnora has Command Injection in MCP stdio test
- CVE-2026-22687 WeKnora vulnerable to SQL Injection
- CVE-2026-22686 Sandbox Escape via Host Error Prototype Chain in enclave-vm
- CVE-2026-22685 DevToys Path Traversal (“Zip Slip”) Vulnerability in DevToys Extension Installation
- CVE-2026-22683 Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE
- CVE-2026-22682 OpenHarness Improper Access Control via File Tools
- CVE-2026-22681 OpenViking < 0.3.4 SSRF via /api/v1/resources
- CVE-2026-22680 OpenViking < 0.3.3 Missing Authorization via Task Polling
- CVE-2026-2268 Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action
- CVE-2026-22679 Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint
- CVE-2026-22678 Webmin < 2.641 Stored XSS via System and Server Status
- CVE-2026-22677 Hermes WebUI < 0.51.44 Path Traversal via Session Import Endpoint
- CVE-2026-22676 Barracuda RMM < 2025.2.2 Privilege Escalation via Insecure Directory Permissions
- CVE-2026-22675 OCS Inventory NG Server Stored XSS via User-Agent
- CVE-2026-22674 Hashgraph Guardian Stored XSS via branding companyName field
- CVE-2026-22666 Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()
- CVE-2026-22665 prompts.chat Identity Confusion via Case-Sensitive Username Handling
- CVE-2026-22664 prompts.chat SSRF via Fal.ai Media Status Polling
- CVE-2026-22663 prompts.chat Authorization Bypass Information Disclosure
- CVE-2026-22662 prompts.chat Blind SSRF via media-generate
- CVE-2026-22661 prompts.chat Path Traversal via Skill File Handling
- CVE-2026-22660 FlaskBB Logic Flaw Authorization Group Deletion via Bulk AJAX Endpoint
- CVE-2026-2266 Cross-site scripting in Enterprise Server
- CVE-2026-22659 FlaskBB Authorization Bypass via Topic ID Manipulation
- CVE-2026-2265 Replicator 1.0.5 is vulnerable to Remote Code Execution through Insecure Deserialization
- CVE-2026-22646 Information disclosure in Incoming Goods Suite
- CVE-2026-22645 Information disclosure in Incoming Goods Suite
- CVE-2026-22644 Information disclosure in Incoming Goods Suite
- CVE-2026-2264 Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.
- CVE-2026-2263 Missing authorization in Hustle – Email Marketing, Lead Generation, Optins, Popups
- CVE-2026-22629 Security feature bypass in FortiAnalyzer
- CVE-2026-22628 Command injection in FortiSwitchAXFixed
- CVE-2026-22627 Memory corruption in FortiSwitchAXFixed
- CVE-2026-22626 Other in HS-AFS-S1H1
- CVE-2026-22625 Path traversal in HS-AFS-S1H1
- CVE-2026-22624 Missing authorization in HS-AFS-S1H1
- CVE-2026-22623 Command injection in HS-AFS-S1H1
- CVE-2026-22622 Command injection in PADM
- CVE-2026-22621 Command injection in PADM
- CVE-2026-22620 Auth bypass in PADM
- CVE-2026-2262 Easy Appointments <= 3.12.21 - Unauthenticated Sensitive Information Exposure via REST API
- CVE-2026-22619 Other in IPP software
- CVE-2026-22618 Misconfiguration in IPP software
- CVE-2026-22617 Misconfiguration in IPP Software
- CVE-2026-22616 Auth bypass in IPP Software
- CVE-2026-22615 Command injection in IPP Software
- CVE-2026-22614 Weak cryptography in EasySoft
- CVE-2026-22613 Security feature bypass in Network M3
- CVE-2026-22612 Fickling vulnerable to detection bypass due to "builtins" blindness
- CVE-2026-22611 AWS SDK for .NET V4 adopted defense in depth enhancement for region parameter value
- CVE-2026-22610 Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
- CVE-2026-2261 blocklistd(8) socket leak
- CVE-2026-22609 Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist
- CVE-2026-22608 Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection
- CVE-2026-22607 Fickling Blocklist Bypass: cProfile.run()
- CVE-2026-22606 Fickling has a bypass via runpy.run_path() and runpy.run_module()
- CVE-2026-22605 OpenProject is Vulnerable to Insecure Direct Object Reference in Meetings
- CVE-2026-22604 OpenProject is vulnerable to user enumeration via the change password function
- CVE-2026-22603 OpenProject has no protection against brute-force attacks in the Change Password function