Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 803 of 1013.
- CVE-2026-21930 Other in Oracle ZFS Storage Appliance Kit
- CVE-2026-2193 D-Link DI-7100G C1 set_jhttpd_info command injection
- CVE-2026-21929 Denial of service in MySQL Server
- CVE-2026-21928 Information disclosure in Oracle Solaris
- CVE-2026-21927 Other in Oracle Solaris
- CVE-2026-21926 Denial of service in Siebel CRM Deployment
- CVE-2026-21925 Other in Oracle GraalVM Enterprise Edition
- CVE-2026-21924 Other in Oracle Utilities Application Framework
- CVE-2026-21923 Other in Oracle Life Sciences Central Designer
- CVE-2026-21922 Other in Oracle Planning and Budgeting Cloud Service
- CVE-2026-21921 Use after free in Junos OS
- CVE-2026-21920 Junos OS: SRX Series: If a specific request is processed by the DNS subsystem flowd will crash
- CVE-2026-2192 Tenda AC9 formGetRebootTimer stack-based overflow
- CVE-2026-21919 Denial of service in Junos OS
- CVE-2026-21918 Junos OS: SRX and MX Series: When TCP packets occur in a specific sequence flowd crashes
- CVE-2026-21917 Junos OS: SRX Series: Specifically malformed SSL packet causes FPC crash
- CVE-2026-21916 Junos OS: A low privileged user can escalate their privileges so that they can login as root
- CVE-2026-21915 JSI Virtual Lightweight Collector: Shell escape allows privilege escalation to root
- CVE-2026-21914 Junos OS: SRX Series: A specifically malformed GTP message will cause an FPC crash
- CVE-2026-21913 Junos OS: EX4000: A high volume of traffic destined to the device leads to a crash and restart
- CVE-2026-21912 Junos OS: MX10k Series: 'show system firmware' CLI command may lead to LC480 or LC2101 line card reset
- CVE-2026-21911 Junos OS Evolved: Flapping management interface causes MAC learning on label-switched interfaces to stop
- CVE-2026-21910 Junos OS: EX4k Series, QFX5k Series: In an EVPN-VXLAN configuration link flaps cause Inter-VNI traffic drop
- CVE-2026-2191 Tenda AC9 formGetDdosDefenceList stack-based overflow
- CVE-2026-21909 Junos OS and Junos OS Evolved: Receipt of specific IS-IS update packet causes memory leak leading to RPD crash
- CVE-2026-21908 Use after free in Junos OS
- CVE-2026-21907 Junos Space: TLS/SSL server supports use of static key ciphers (ssl-static-key-ciphers)
- CVE-2026-21906 Denial of service in Junos OS
- CVE-2026-21905 Denial of service in Junos OS
- CVE-2026-21904 Junos Space: ilpFilter field on nLegacy.jsp is vulnerable to reflected cross-site script injection
- CVE-2026-21903 Junos OS: Subscribing to telemetry sensors at scale causes all FPCs to crash
- CVE-2026-21902 Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root
- CVE-2026-21901 Junos OS and Junos OS Evolved: Configuration of a specific SSH option results in mgd crash
- CVE-2026-21900 CryptoLib Has Out-of-Bounds Read in KMC Encrypt Metadata Parsing via Flawed strtok Pattern
- CVE-2026-2190 itsourcecode School Management System controller.php sql injection
- CVE-2026-21899 CryptoLib has an out-of-bounds read and crash vulnerability when decoding an empty Base64url string
- CVE-2026-21898 CryptoLib Has Out-of-bounds Read in Crypto_AOS_ProcessSecurity
- CVE-2026-21897 CryptoLib Has Out-of-Bounds Write in Crypto_Config_Add_Gvcid_Managed_Parameters
- CVE-2026-21896 Kirby is missing permission checks in the content changes API
- CVE-2026-21895 rsa crate has potential panic on a prime being equal to 1
- CVE-2026-21894 n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks
- CVE-2026-21893 n8n Vulnerable to Command Injection in Community Package Installation
- CVE-2026-21892 Parsl Monitoring Visualization Vulnerable to SQL Injection
- CVE-2026-21891 ZimaOS has Authentication Bypass via System-Level Username
- CVE-2026-2189 itsourcecode School Management System index.php sql injection
- CVE-2026-21889 Weblate leaks information via screenshots
- CVE-2026-21888 MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer()
- CVE-2026-21887 OpenCTI has a Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature
- CVE-2026-21886 OpenCTI's GraphQL Mutations Allow Deletion of Unrelated Entities
- CVE-2026-21885 Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources
- CVE-2026-21884 React Router SSR XSS in ScrollRestoration
- CVE-2026-21883 Bokeh server applications have Incomplete Origin Validation in WebSockets
- CVE-2026-21882 theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution
- CVE-2026-21881 Kanboard is Vulnerable to Reverse Proxy Authentication Bypass
- CVE-2026-21880 Kanboard LDAP Injection Vulnerability can Lead to User Enumeration and Information Disclosure
- CVE-2026-2188 UTT 进取 521G formPdbUpConfig sub_446B18 os command injection
- CVE-2026-21879 Kanboard vulnerable to Open Redirect via protocol-relative URLs
- CVE-2026-21878 BACnet Stack Improperly Limits Pathnames to a Restricted Directory
- CVE-2026-21877 n8n is vulnerable to Remote Code Execution via Arbitrary File Write
- CVE-2026-21876 OWASP CRS has multipart bypass using multiple content-type parts
- CVE-2026-21875 ClipBucket v5 Vulnerable to Blind SQL Injection through Channel Comments
- CVE-2026-21874 NiceGUI has Redis connection leak via tab storage causes service degradation
- CVE-2026-21873 Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages`
- CVE-2026-21872 NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links
- CVE-2026-21871 NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
- CVE-2026-21870 The BACnet Protocol Stack library has an Off-by-one Stack-based Buffer Overflow in tokenizer_string
- CVE-2026-2187 Tenda RX3 formSetQosBand set_qosMib_list stack-based overflow
- CVE-2026-21869 llama.cpp has Out-of-bounds Write in llama-server
- CVE-2026-21868 Flag Forge has ReDoS Vulnerability in User Profile Lookup API
- CVE-2026-21866 Dify - Stored XSS in chat
- CVE-2026-21865 Discourse topic conversion permission vulnerability for moderators
- CVE-2026-21864 Remote DoS from malformed RESTORE command
- CVE-2026-21863 Malformed Valkey Cluster bus message can lead to Remote DoS
- CVE-2026-21862 RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers
- CVE-2026-21861 baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)
- CVE-2026-21860 Werkzeug safe_join() allows Windows special device names with compound extensions
- CVE-2026-2186 Tenda RX3 SetIpMacBind fromSetIpMacBind stack-based overflow
- CVE-2026-21859 Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)
- CVE-2026-21858 n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
- CVE-2026-21857 Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
- CVE-2026-21856 Tarkov Data Manager has Authenticated SQL Injection
- CVE-2026-21855 Tarkov Data Manager has Unauthenticated Reflected XSS
- CVE-2026-21854 Tarkov Data Manager Authentication Bypass vulnerability
- CVE-2026-21853 AFFiNE: One-click Remote Code Execution through Custom URL Handling
- CVE-2026-21852 Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation
- CVE-2026-21851 MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download
- CVE-2026-2185 Tenda RX3 MAC Filtering Configuration Endpoint setBlackRule set_device_name stack-based overflow
- CVE-2026-21848 HCL BigFix Service Management is affected by multiple security vulnerabilities.
- CVE-2026-21840 HCL BigFix Platform is affected by a user enumeration vulnerability
- CVE-2026-2184 Great Developers Certificate Generation System csv.php os command injection
- CVE-2026-21837 HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API
- CVE-2026-21836 HCL DominoIQ is affected by broken access control
- CVE-2026-21833 HCL AION is susceptible to a Missing "Content-Security-Policy" header Vulnerability (CVE-2026-21833)
- CVE-2026-21832 HCL AION is affected by multiple security vulnerabilities.
- CVE-2026-21830 HCL BigFix AEX is affected by multiple security vulnerabilities.
- CVE-2026-2183 Great Developers Certificate Generation System csv.php unrestricted upload
- CVE-2026-21827 HCL Connections is vulnerable to an information disclosure vulnerability
- CVE-2026-21826 HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection
- CVE-2026-21825 HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center
- CVE-2026-21824 A privilege escalation vulnerability affects HCL Commerce