Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 800 of 1013.
- CVE-2026-2230 Missing authorization in Booking Calendar
- CVE-2026-2229 undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation
- CVE-2026-22285 Information disclosure in Device Management Agent (DDMA)
- CVE-2026-22284 Command injection in SmartFabric OS10 Software
- CVE-2026-22283 Information disclosure in PowerFlex
- CVE-2026-22281 Race condition in PowerScale OneFS
- CVE-2026-22280 Misconfiguration in PowerScale OneFS
- CVE-2026-22279 Other in PowerScale OneFS
- CVE-2026-22278 Auth bypass in PowerScale OneFS
- CVE-2026-22277 Command injection in UnityVSA
- CVE-2026-22276 Information disclosure in ObjectScale
- CVE-2026-22275 Information disclosure in ObjectScale
- CVE-2026-22274 Information disclosure in ObjectScale
- CVE-2026-22273 Hardcoded credentials in ObjectScale
- CVE-2026-22271 Information disclosure in ObjectScale
- CVE-2026-22270 Privilege escalation in PowerScale OneFS,
- CVE-2026-2227 D-Link DCS-931L setSystemAdmin doSystem command injection
- CVE-2026-22269 Security feature bypass in PowerProtect Data Manager
- CVE-2026-22268 Privilege escalation in PowerProtect Data Manager
- CVE-2026-22267 Privilege escalation in PowerProtect Data Manager
- CVE-2026-22266 Security feature bypass in PowerProtect Data Manager
- CVE-2026-22265 Roxy-WI has a Command Injection via grep parameter in logs.py allows authenticated RCE
- CVE-2026-22264 Suricata detect/alert: heap-use-after-free on alert queue expansion
- CVE-2026-22263 Suricata http1: quadratic complexity in headers parsing over multiple packets
- CVE-2026-22262 Suricata datasets: stack overflow when saving a set
- CVE-2026-22261 Suricata eve/alert: http1 xff handling can lead to denial of service
- CVE-2026-22260 Suricata http1: infinite recursion in decompression
- CVE-2026-2226 DouPHP ZIP File file.php unrestricted upload
- CVE-2026-22259 Suricata dnp3: unbounded transaction growth
- CVE-2026-22258 Suricata DCERPC: unbounded fragment buffering leads to memory exhaustion
- CVE-2026-22257 Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names
- CVE-2026-22256 Salvo is vulnerable to reflected XSS in the list_html function
- CVE-2026-22255 iccDEV has heap-buffer-overflow in CIccCLUT::Init() at IccProfLib/IccTagLut.cpp
- CVE-2026-22254 Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager
- CVE-2026-22253 Soft Serve is missing an authorization check in LFS lock deletion
- CVE-2026-22252 LibreChat MCP Stdio Remote Command Execution
- CVE-2026-22251 wlc may leak API keys due to an insecure API key configuration
- CVE-2026-22250 wlc can skip SSL verification
- CVE-2026-2225 itsourcecode News Portal Project Administrator Login index.php sql injection
- CVE-2026-22249 Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip)
- CVE-2026-22248 GLPI affected by Remote Code Execution via malicious upload
- CVE-2026-22247 GLPI is Vulnerable to SSRF via Webhooks
- CVE-2026-22246 Local Mastodon users can enumerate and access severed relationships of every other local user
- CVE-2026-22245 Mastodon has SSRF Protection bypass
- CVE-2026-22244 OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE
- CVE-2026-22243 EGroupware has SQL Injection in Nextmatch Filter Processing
- CVE-2026-22242 CoreShop Vulnerable to SQL Injection via Admin Reports
- CVE-2026-22241 Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)
- CVE-2026-22240 Plaintext Passwords Vulnerability in BLUVOYIX
- CVE-2026-2224 code-projects Online Reviewer System btn_functions.php cross site scripting
- CVE-2026-22239 Email Sending Vulnerability in BLUVOYIX
- CVE-2026-22238 Administrator Account Creation Vulnerability in BLUVOYIX
- CVE-2026-22237 Exposed Internal API Documentation Vulnerability in BLUVOYIX
- CVE-2026-22236 Improper Authentication Vulnerability in BLUVOYIX
- CVE-2026-22235 OPEXUS eComplaint IDOR
- CVE-2026-22234 OPEXUS eCasePortal unauthenticated IDOR
- CVE-2026-22233 OPEXUS eCASE Audit Project Cost stored XSS
- CVE-2026-22232 OPEXUS eCASE Audit Project Setup stored XSS
- CVE-2026-22231 OPEXUS eCASE Audit Document Check Out stored XSS
- CVE-2026-22230 OPEXUS eCASE Audit incorrect access control
- CVE-2026-2223 code-projects Online Reviewer System index.php sql injection
- CVE-2026-22229 Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and Deco BE25 v1.0
- CVE-2026-22228 Improper Input Validation Leading to DoS on TP-Link Archer BE230
- CVE-2026-22227 Command Injection Vulnerability on TP-Link Archer BE230 v1.2
- CVE-2026-22226 Command Injection Vulnerability on TP-Link Archer BE230 and AX73
- CVE-2026-22225 Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and AXE75 v1.0
- CVE-2026-22224 Command Injection Vulnerability on TP-Link Archer BE230 v1.2
- CVE-2026-22223 Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and BE3600 v1
- CVE-2026-22222 Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and AXE75 v2
- CVE-2026-22221 Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and BE3600 v1
- CVE-2026-22220 Improper Input Validation Leading to DoS on TP-Link Archer BE230
- CVE-2026-2222 code-projects Online Reviewer System btn_functions.php cross site scripting
- CVE-2026-22219 Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element
- CVE-2026-22218 Chainlit < 2.9.4 Arbitrary File Read via /project/element
- CVE-2026-22217 OpenClaw 2026.2.22 < 2026.2.23 - Arbitrary Binary Execution via $SHELL Environment Variable Trusted Prefix Fallback
- CVE-2026-22216 wpDiscuz before 7.6.47 - No Rate Limiting on Subscription Endpoints with LIKE Wildcard Bypass
- CVE-2026-22215 wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage
- CVE-2026-22214 RIOT OS <= 2026.01-devel-317 Stack-Based Buffer Overflow in ethos Serial Frame Parser
- CVE-2026-22213 RIOT OS <= 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility
- CVE-2026-22212 TinyOS <= 2.1.2 Stack-Based Buffer Overflow in mcp2200gpio
- CVE-2026-22211 TinyOS <= 2.1.2 Global Buffer Overflow in printfUART
- CVE-2026-22210 wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLs
- CVE-2026-2221 code-projects Online Reviewer System Login index.php sql injection
- CVE-2026-22209 wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Custom CSS in Style Tag
- CVE-2026-22208 OpenS100 Portrayal Engine Unrestricted Lua Standard Library Access
- CVE-2026-22207 OpenViking Missing root_api_key Allows Anonymous ROOT Access
- CVE-2026-22206 SPIP < 4.4.10 SQL Injection RCE via Union & PHP Tags
- CVE-2026-22205 SPIP < 4.4.10 Authentication Bypass via PHP Type Juggling
- CVE-2026-22204 wpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp_mail() Recipient
- CVE-2026-22203 wpDiscuz before 7.6.47 - Options Export Leaks OAuth Secrets in Plaintext
- CVE-2026-22202 wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email
- CVE-2026-22201 wpDiscuz before 7.6.47 - IP Address Spoofing in getIP()
- CVE-2026-22200 osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read
- CVE-2026-2220 code-projects Online Reviewer System btn_functions.php sql injection
- CVE-2026-22199 Voltronic Power SNMP Web Pro 1.1 Path Traversal via upload.cgi
- CVE-2026-22198 GestSup < 3.2.60 Stored XSS in API Error Logs
- CVE-2026-22197 GestSup < 3.2.60 Multiple SQL Injections in Asset List
- CVE-2026-22196 GestSup < 3.2.60 SQL Injection in Ticket Creation
- CVE-2026-22195 GestSup < 3.2.60 SQL Injection in Search Bar
- CVE-2026-22194 GestSup <= 3.2.60 CSRF Allows Privileged Actions