Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 801 of 1013.
- CVE-2026-22193 wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions()
- CVE-2026-22192 Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage
- CVE-2026-22191 Beghelli Sicuro24 SicuroWeb AngularJS Template Injection
- CVE-2026-22190 Panda3D <= 1.10.16 egg-mkfont Format String Information Disclosure
- CVE-2026-2219 Denial of service in dpkg
- CVE-2026-22189 Panda3D <= 1.10.16 egg-mkfont Stack Buffer Overflow
- CVE-2026-22188 Panda3D <= 1.10.16 Deploy-Stub Stack Exhaustion via Unbounded alloca()
- CVE-2026-22187 Bio-Formats <= 8.3.0 Memoizer Unsafe Deserialization via .bfmemo Cache Files
- CVE-2026-22186 Bio-Formats <= 8.3.0 XXE in Leica XLEF Metadata Parser
- CVE-2026-22185 OpenLDAP LMDB mdb_load Heap Buffer Underflow in readline()
- CVE-2026-22184 zlib <= 1.3.1.2 untgz Global Buffer Overflow in TGZfname()
- CVE-2026-22183 wpDiscuz before 7.6.47 - Stored Cross-Site Scripting in Inline Comment Preview
- CVE-2026-22182 wpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType
- CVE-2026-22181 OpenClaw < 2026.3.2 - DNS Pinning Bypass via Environment Proxy Configuration in web_fetch
- CVE-2026-22180 OpenClaw < 2026.3.2 - Path Confinement Bypass in Browser Output and File Write Operations
- CVE-2026-2218 D-Link DCS-933L alphapd setSystemAdmin command injection
- CVE-2026-22179 OpenClaw < 2026.2.22 - Allowlist Bypass via Command Substitution in system.run
- CVE-2026-22178 OpenClaw < 2026.2.19 - ReDoS and Regex Injection via Unescaped Feishu Mention Metadata
- CVE-2026-22177 OpenClaw < 2026.2.21 - Environment Variable Injection via Config env.vars
- CVE-2026-22176 OpenClaw has a Command Injection via unescaped environment assignments in Windows Scheduled Task script generation
- CVE-2026-22175 OpenClaw < 2026.2.23 - Exec Approval Bypass via Unrecognized Multiplexer Shell Wrappers
- CVE-2026-22174 OpenClaw < 2026.2.22 - Gateway Token Disclosure via Chrome CDP Probe
- CVE-2026-22172 OpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth Connections
- CVE-2026-22171 OpenClaw < 2026.2.19 - Path Traversal in Feishu Media Temporary File Naming
- CVE-2026-22170 OpenClaw < 2026.2.22 BlueBubbles - Access Control Bypass via Empty allowFrom Configuration
- CVE-2026-2217 itsourcecode Event Management System manage_user.php sql injection
- CVE-2026-22169 OpenClaw < 2026.2.22 - Allowlist Bypass via sort Configuration in safeBins
- CVE-2026-22168 OpenClaw < 2026.2.21 - Command Injection via cmd.exe /c Trailing Arguments in system.run
- CVE-2026-22167 GPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memory
- CVE-2026-22166 GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable
- CVE-2026-22165 GPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBs
- CVE-2026-22164 GPU DDK - Kernel heap OOB write in DevmemIntComputeVirtualIndicesFromLogical
- CVE-2026-22163 GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU
- CVE-2026-2216 rachelos WeRSS we-mp-rss tools.py download_export_file path traversal
- CVE-2026-22155 Information disclosure in FortiSOAR PaaS
- CVE-2026-22154 Cross-site scripting in FortiSOAR PaaS
- CVE-2026-22153 Auth bypass in FortiOS
- CVE-2026-2215 rachelos WeRSS we-mp-rss JWT auth.py default key
- CVE-2026-2214 code-projects for Plugin AdminAddAlbum.php cross site scripting
- CVE-2026-2213 code-projects Online Music Site AdminAddAlbum.php unrestricted upload
- CVE-2026-2212 code-projects Online Music Site AdminEditCategory.php sql injection
- CVE-2026-2211 code-projects Online Music Site AdminDeleteCategory.php sql injection
- CVE-2026-22104 Improper access control in Hashtopolis server chunk activity component
- CVE-2026-22103 Command injection in NPC start web endpoint
- CVE-2026-22102 Arbitrary file overwrite through certificate update functionality
- CVE-2026-22101 Sensitive information leak through hidden menu
- CVE-2026-22100 Comnand injection in OCPP ReserveLogin message
- CVE-2026-2210 D-Link DIR-823X set_filtering sub_4211C8 os command injection
- CVE-2026-22099 Missing authentication for Bluetooth communication
- CVE-2026-22098 Sensitive information is written to logs
- CVE-2026-22097 Missing firmware validation allows remote code execution
- CVE-2026-22096 Missing authentication for webserver endpoints
- CVE-2026-22095 Command injection in diagnosis web endpoint
- CVE-2026-22094 Weak root password in EVbee DC 80
- CVE-2026-22093 Adversary-in-the-Middle (AitM) attack vulnerability in EVbee Service app
- CVE-2026-2209 WeKan Custom Translation translationBody.js setCreateTranslation improper authorization
- CVE-2026-22082 Insecure Session ID Management Vulnerability in Tenda Wireless Routers
- CVE-2026-22081 Cookie without HTTPOnly Flag Vulnerability in Tenda Wireless Routers
- CVE-2026-22080 Insecure Transmission Vulnerability in Tenda Wireless Routers
- CVE-2026-2208 WeKan Rules rules.js RulesBleed authorization
- CVE-2026-22079 Cleartext Transmission Vulnerability in Tenda Wireless Routers
- CVE-2026-22078 O+ Connect's lack of authentication for IPC channels led to a local privilege escalation vulnerability.
- CVE-2026-22077 Sensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO Wallet
- CVE-2026-22072 Arbitrary URL Loading in WebView Leading to Token Leakage Risk
- CVE-2026-22070 ColorOS Assistant Path Traversal Vulnerability
- CVE-2026-2207 WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure
- CVE-2026-22068 Apache Traffic Server: Regex mappings match with malicious domain names
- CVE-2026-22063 CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products
- CVE-2026-22061 CVE-2026-22061 Debug Log Information Disclosure Vulnerability in Trident
- CVE-2026-2206 WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control
- CVE-2026-22056 CVE-2026-22056 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)
- CVE-2026-22055 Hardcoded credentials in Active IQ OneCollect
- CVE-2026-22054 Hardcoded credentials in Active IQ Config Advisor
- CVE-2026-22052 Information disclosure in ONTAP 9
- CVE-2026-22051 Missing authorization in StorageGRID (formerly StorageGRID Webscale)
- CVE-2026-22050 Business logic in ONTAP 9
- CVE-2026-2205 WeKan Meteor Publication cards.js CardPubSubBleed information disclosure
- CVE-2026-22049 Auth bypass in ONTAP 9
- CVE-2026-22048 Server-side request forgery in StorageGRID (formerly StorageGRID Webscale)
- CVE-2026-22047 iccDEV has heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cpp
- CVE-2026-22046 iccDEV has heap-buffer-overflow in CIccProfileXml::ParseBasic() at IccXML/IccLibXML/IccProfileXml.cpp
- CVE-2026-22045 Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall
- CVE-2026-22044 GLPI is Vulnerable to Authenticated SQL Injection
- CVE-2026-22043 RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting
- CVE-2026-22042 RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation
- CVE-2026-22041 loggingredactor converts non-string types to string types in logs
- CVE-2026-22040 NanoMQ 0.24.6 Use-After-Free Leading to Heap Corruption and Broker Crash
- CVE-2026-22039 Kyverno Cross-Namespace Privilege Escalation via Policy apiCall
- CVE-2026-22038 AutoGPT's API Keys and Secrets Logged in Plaintext in Stagehand Integration Blocks
- CVE-2026-22037 @fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)
- CVE-2026-22036 Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion
- CVE-2026-22035 Greenshot Vulnerable to OS Command Injection via ExternalCommand Plugin
- CVE-2026-22034 Snuffleupagus vulnerable to RCE on instances with upload validation enabled but without the VLD package
- CVE-2026-22033 Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field
- CVE-2026-22032 Directus has open redirect in SAML
- CVE-2026-22031 Fastify Middie Middleware Path Bypass
- CVE-2026-22030 React Router has CSRF issue in Action/Server Action Request Processing
- CVE-2026-2203 Tenda AC8 Embedded Httpd Service fast_setting_wifi_set buffer overflow
- CVE-2026-22029 React Router vulnerable to XSS via Open Redirects
- CVE-2026-22028 Preact has JSON VNode Injection issue