Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 804 of 1013.
- CVE-2026-21822 A path traversal vulnerability has been identified in HCL AppScan 360° (CVE-2026-21822).
- CVE-2026-21821 HCL BigFix SCM Reporting is affected by vulnerabilities in jQuery
- CVE-2026-2182 UTT 进取 521G setSysAdm doSystem command injection
- CVE-2026-21812 Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)
- CVE-2026-21811 Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)
- CVE-2026-21810 Supply chain in BigFix Quantum Risk Analyzer
- CVE-2026-2181 Tenda RX3 openSchedWifi stack-based overflow
- CVE-2026-21809 HCL BigFix Quantum Risk Analyzer is affected by generating error messages with sensitive information
- CVE-2026-21808 HCL BigFix Quantum Risk Analyzer is affected by logging sensitive information
- CVE-2026-21807 HCL BigFix Quantum Risk Analyzer is affected by a stack-based buffer overflow
- CVE-2026-21806 HCL BigFix Service Management was affected with Admin Session Concurrency vulnerability (CVE-2026-21806)
- CVE-2026-2180 Tenda RX3 fast_setting_wifi_set stack-based overflow
- CVE-2026-21791 HCL Sametime for Android is affected by sensitive information disclosure
- CVE-2026-21790 HCL Traveler is susceptible to a weak default HTTP header validation vulnerability
- CVE-2026-2179 PHPGurukul Hospital Management System manage-users.php sql injection
- CVE-2026-21789 HCL Connections is vulnerable to broken access control
- CVE-2026-21788 HCL Connections is vulnerable to cross-site scripting (XSS)
- CVE-2026-21786 HCL Sametime for iOS is affected by sensitive information disclosure
- CVE-2026-21785 HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy
- CVE-2026-21784 HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
- CVE-2026-21783 HCL Traveler is affected by sensitive information disclosure
- CVE-2026-2178 r-huijts xcode-mcp-server run_lldb index.ts registerXcodeTools command injection
- CVE-2026-21770 HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking
- CVE-2026-2177 SourceCodester Prison Management System Login session fixiation
- CVE-2026-21768 HCL Verse for Android is susceptible to an injection vulnerability
- CVE-2026-21767 HCL BigFix Platform is affected by insufficient authentication
- CVE-2026-21766 HCL Digital Experience and Digital Experience Compose insufficiently protects credentials
- CVE-2026-21765 HCL BigFix Platform is affected by insecure permissions on private cryptographic keys
- CVE-2026-21764 Insufficient Input Validation in DevOps Loop
- CVE-2026-21762 Missing HTTP Security Headers in DevOps Loop
- CVE-2026-21761 CORS Misconfiguration in DevOps Loop
- CVE-2026-21760 Unauthorized Access to Admin Functionality via Forced Browsing
- CVE-2026-2176 code-projects Contact Management System index.py sql injection
- CVE-2026-21759 HCL Hive is affected by an information exposure vulnerability
- CVE-2026-21758 HCL Hive is affected by multiple security vulnerabilities.
- CVE-2026-21756 HCL Hive is affected by a broken access control vulnerability
- CVE-2026-21755 HCL Hive is affected by a missing rate limit
- CVE-2026-21754 HCL Hive is affected by multiple security vulnerabilities.
- CVE-2026-21753 HCL Hive is affected by multiple security vulnerabilities.
- CVE-2026-21752 HCL Hive is affected by a use of vulnerable third-party components
- CVE-2026-21751 HCL Hive is affected by use of a cryptographic primitive with a risky implementation
- CVE-2026-2175 D-Link DIR-823X set_upnp sub_420618 os command injection
- CVE-2026-21743 Missing authorization in FortiAuthenticator
- CVE-2026-21742 Information disclosure in FortiSOAR PaaS
- CVE-2026-21741 Open redirect in FortiNAC-F
- CVE-2026-2174 code-projects Contact Management System CRUD Endpoint improper authentication
- CVE-2026-21736 GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled
- CVE-2026-21734 GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation
- CVE-2026-21733 Security feature bypass in Graphics DDK
- CVE-2026-21732 GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation
- CVE-2026-21730 Stored XSS in Verba
- CVE-2026-2173 code-projects Online Examination System login.php sql injection
- CVE-2026-21729 Loki detected_fields query limits results in unbounded memory allocation
- CVE-2026-21728 Tempo query limit results in unbounded memory allocation
- CVE-2026-21727 Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record
- CVE-2026-21726 Loki Path Traversal - CVE-2021-36156 Bypass
- CVE-2026-21725 Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name
- CVE-2026-21724 Missing Protected-field Authorization in Provisioning Contact Points API
- CVE-2026-21723 CVE-2026-21723 Record
- CVE-2026-21722 Public Dashboards time range restriction on annotations can be bypassed
- CVE-2026-21721 Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation
- CVE-2026-21720 Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out
- CVE-2026-2172 code-projects Online Application System for Admission Login Endpoint index.php sql injection
- CVE-2026-21719 Command injection in CubeCart
- CVE-2026-21718 Copeland XWEB and XWEB Pro Use of a Broken or Risky Cryptographic Algorithm
- CVE-2026-21717 Denial of service in node
- CVE-2026-21716 Missing authorization in node
- CVE-2026-21715 Security feature bypass in node
- CVE-2026-21714 Denial of service in node
- CVE-2026-21713 Weak cryptography in node
- CVE-2026-21712 Denial of service in node
- CVE-2026-21711 Security feature bypass in node
- CVE-2026-21710 Denial of service in node
- CVE-2026-2171 code-projects Online Student Management System Login accounts.php sql injection
- CVE-2026-21709 Security feature bypass in Backup and Replication
- CVE-2026-21708 SQL injection in Backup and Replication
- CVE-2026-21697 axios4go's Race Condition in Shared HTTP Client Allows Proxy Configuration Leak
- CVE-2026-21696 Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered
- CVE-2026-21695 Titra API Contains Mass Assignment Vulnerability
- CVE-2026-21694 Titra APIs have Improper Access Control
- CVE-2026-21693 iccDEV has Type Confusion in CIccSegmentedCurveXml::ToXml() at IccXML/IccLibXML/IccMpeXml.cpp
- CVE-2026-21692 iccDEV has Type Confusion in ToXmlCurve() at IccXML/IccLibXML/IccMpeXml.cpp
- CVE-2026-21691 iccDEV has Type Confusion in CIccTag:IsTypeCompressed()
- CVE-2026-21690 iccDEV has Type Confusion in CIccTagXmlTagData::ToXml()
- CVE-2026-2169 D-Link DWR-M921 formLtefotaUpgradeFibocom command injection
- CVE-2026-21689 iccDEV has Type Confusion in CIccProfileXml::ParseBasic() at IccXML/IccLibXML/IccProfileXml.cpp
- CVE-2026-21688 iccDEV has Type Confusion in SIccCalcOp::ArgsPushed() at IccProfLib/IccMpeCalc.cpp
- CVE-2026-21687 iccDEV has Undefined Behavior in CIccTagCurve::CIccTagCurve()
- CVE-2026-21686 iccDEV has Undefined Behavior in CIccTagLutAtoB::Validate()
- CVE-2026-21685 iccDEV has Undefined Behavior in CIccTagLut16::Read()
- CVE-2026-21684 iccDEV has Undefined Behavior in CIccTagSpectralViewingConditions()
- CVE-2026-21683 iccDEV has Type Confusion in icStatusCMM::CIccEvalCompare::EvaluateProfile()
- CVE-2026-21682 iccDEV has heap-buffer-overflow in CIccXmlArrayType::ParseText()
- CVE-2026-21681 iccDEV has Undefined Behavior runtime error: nan is outside the range .. IccProfLib/IccTagBasic.cpp
- CVE-2026-21680 iccDEV has Null Pointer Dereference in CIccProfile::CheckTagTypes()
- CVE-2026-2168 D-Link DWR-M921 formLtefotaUpgradeQuectel sub_419920 command injection
- CVE-2026-21679 iccDEV has heap-buffer-overflow vulnerability in CIccLocalizedUnicode::GetText()
- CVE-2026-21678 iccDEV has heap-buffer-overflow vulnerability on IccTagXml()
- CVE-2026-21677 iccDEV has Undefined Behavior in CIccCLUT::Init()
- CVE-2026-21676 iccDEV has a Heap-based Buffer Overflow in its CIccMBB::Validate() function