Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 805 of 1013.
- CVE-2026-21675 iccDEV has a Use After Free vulnerability in CIccCmm class via improper hint manager object deletion
- CVE-2026-21674 iccDEV has a Memory Leak in its CIccProfileXml::ParseTag() Error Path
- CVE-2026-21673 iccDEV has Integer Overflow/Underflow in CIccXmlArrayType::ParseTextCountNum()
- CVE-2026-21672 Privilege escalation in Backup and Replication
- CVE-2026-21671 Code injection in Software Appliance
- CVE-2026-21670 Information disclosure in Backup and Replication
- CVE-2026-2167 Totolink WA300 cstecgi.cgi setAPNetwork os command injection
- CVE-2026-21669 Code injection in Backup and Replication
- CVE-2026-21668 Missing authorization in Backup and Replication
- CVE-2026-21667 Missing authorization in Backup and Replication
- CVE-2026-21666 Missing authorization in Backup and Replication
- CVE-2026-21665 Deserialization in Originate Loans Peripherals (formerly Velocity Services) -- Print Service component
- CVE-2026-21664 Cross-site scripting in Revive Adserver
- CVE-2026-21663 Cross-site scripting in Revive Adserver
- CVE-2026-21662 FMS Employee Allows Upload of Unrestricted Files
- CVE-2026-21661 AC2000 Uncontrolled Search Path Element
- CVE-2026-21660 Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware
- CVE-2026-2166 code-projects Online Reviewer System Login index.php sql injection
- CVE-2026-21659 Path traversal in Frick Controls Quantum HD
- CVE-2026-21658 Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
- CVE-2026-21657 Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
- CVE-2026-21656 Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
- CVE-2026-21655 C-CURE 9000 and Victor application server - Deserialization of Untrusted Data
- CVE-2026-21654 Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
- CVE-2026-21653 CCure and Victor Application Server - Server Side Request Forgery
- CVE-2026-2165 detronetdip E-commerce Account Creation Endpoint add_seller.php missing authentication
- CVE-2026-21643 Fortinet FortiClient EMS SQL Injection
- CVE-2026-21642 Cross-site scripting in Revive Adserver
- CVE-2026-21641 Missing authorization in Revive Adserver
- CVE-2026-21640 Code injection in Revive Adserver
- CVE-2026-2164 detronetdip E-commerce addadhar.php unrestricted upload
- CVE-2026-21639 Command injection in airFiber AF60
- CVE-2026-21638 Command injection in UBB
- CVE-2026-21637 Denial of service in node
- CVE-2026-21636 Security feature bypass in node
- CVE-2026-21635 Missing authorization in UniFi Connect EV Station Lite
- CVE-2026-21634 Memory corruption in UniFi Protect Application
- CVE-2026-21633 Auth bypass in UniFi Protect Application
- CVE-2026-21632 Joomla! Core - [20260304] - XSS vectors in various article title outputs
- CVE-2026-21631 Joomla! Core - [20260303] - XSS vector in com_associations comparison view
- CVE-2026-21630 Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint
- CVE-2026-2163 D-Link DIR-600 ssdp.cgi command injection
- CVE-2026-21629 Joomla! Core - [20260301] - ACL hardening in com_ajax
- CVE-2026-21628 Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla
- CVE-2026-21627 Missing authorization in Advanced Custom Fields
- CVE-2026-21626 Extension - stackideas.com - Information disclosure in post custom fields in EasyDiscuss 1.0.0-5.0.15 for Joomla
- CVE-2026-21625 Extension - stackideas.com - Lack of mime type validation in EasyDiscuss component 1.0.0-5.0.15 for Joomla
- CVE-2026-21624 Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla
- CVE-2026-21623 Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla
- CVE-2026-21622 Password Reset Tokens Do Not Expire
- CVE-2026-21621 Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access
- CVE-2026-21620 TFTP Path Traversal
- CVE-2026-2162 itsourcecode News Portal Project aboutus.php sql injection
- CVE-2026-21619 Unsafe Deserialization of Erlang Terms in hex_core
- CVE-2026-21618 Cross-site scripting (XSS) in OAuth Device Authorization screen
- CVE-2026-2161 itsourcecode Directory Management System forget-password.php sql injection
- CVE-2026-2160 SourceCodester Simple Responsive Tourism Website Master.php cross site scripting
- CVE-2026-2159 SourceCodester Simple Responsive Tourism Website Registration Master.php cross site scripting
- CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties
- CVE-2026-21588 Denial of service in Confluence Data Center
- CVE-2026-21587 Missing authorization in Jira Service Management Data Center
- CVE-2026-21586 Missing authorization in Confluence Data Center
- CVE-2026-21584 Missing authorization in Bamboo Data Center
- CVE-2026-21582 Auth bypass in Crowd Data Center
- CVE-2026-21580 Cross-site scripting in Confluence Data Center
- CVE-2026-2158 code-projects Student Web Portal check_user.php sql injection
- CVE-2026-21579 Information disclosure in Confluence Data Center
- CVE-2026-21577 Denial of service in Confluence Data Center
- CVE-2026-21575 Code injection in Sourcetree for Mac
- CVE-2026-21571 Command injection in Bamboo Data Center
- CVE-2026-21570 Code injection in Bamboo Data Center
- CVE-2026-2157 D-Link DIR-823X set_static_route_table sub_4175CC os command injection
- CVE-2026-21569 XML external entity in Crowd Data Center
- CVE-2026-2156 code-projects Online Student Management System Announcement Management index.php cross site scripting
- CVE-2026-21555 Denial of service in UDX710
- CVE-2026-21554 Denial of service in UDX710
- CVE-2026-21553 Denial of service in T8100/T9100/T8200/T8300
- CVE-2026-21552 Denial of service in T8100/T9100/T8200/T8300
- CVE-2026-21551 Denial of service in T8100/T9100/T8200/T8300
- CVE-2026-21550 Denial of service in T8100/T9100/T8200/T8300
- CVE-2026-2155 D-Link DIR-823X Configuration set_dmz sub_4208A0 os command injection
- CVE-2026-21549 Denial of service in T8100/T9100/T8200/T8300
- CVE-2026-21548 Denial of service in T8100/T9100/T8200/T8300
- CVE-2026-2154 Cross-site scripting in Patients Waiting Area Queue Management System
- CVE-2026-21537 Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability
- CVE-2026-21536 Microsoft Devices Pricing Program Remote Code Execution Vulnerability
- CVE-2026-21535 Microsoft Teams Information Disclosure Vulnerability
- CVE-2026-21533 Microsoft Windows Improper Privilege Management
- CVE-2026-21532 Azure Function Information Disclosure Vulnerability
- CVE-2026-21531 Azure SDK for Python Remote Code Execution Vulnerability
- CVE-2026-21530 Windows Rich Text Edit Elevation of Privilege Vulnerability
- CVE-2026-2153 mwielgoszewski doorman views.py is_safe_url redirect
- CVE-2026-21529 Azure HDInsight Spoofing Vulnerability
- CVE-2026-21528 Azure IoT Explorer Information Disclosure Vulnerability
- CVE-2026-21527 Microsoft Exchange Server Spoofing Vulnerability
- CVE-2026-21525 Microsoft Windows NULL Pointer Dereference
- CVE-2026-21524 Azure Data Explorer Information Disclosure Vulnerability
- CVE-2026-21523 GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability
- CVE-2026-21522 Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability
- CVE-2026-21521 Word Copilot Information Disclosure Vulnerability