Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 806 of 1013.
- CVE-2026-21520 Copilot Studio Information Disclosure Vulnerability
- CVE-2026-2152 D-Link DIR-615 Web Configuration adv_routing.php os command injection
- CVE-2026-21519 Microsoft Windows Type Confusion
- CVE-2026-21518 GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-21517 Windows App for Mac Installer Elevation of Privilege Vulnerability
- CVE-2026-21516 GitHub Copilot for Jetbrains Remote Code Execution Vulnerability
- CVE-2026-21515 Azure IoT Central Elevation of Privilege Vulnerability
- CVE-2026-21514 Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision
- CVE-2026-21513 Microsoft MSHTML Framework Protection Mechanism Failure
- CVE-2026-21512 Azure DevOps Server Cross-Site Scripting Vulnerability
- CVE-2026-21511 Microsoft Outlook Spoofing Vulnerability
- CVE-2026-21510 Microsoft Windows Shell Protection Mechanism Failure
- CVE-2026-2151 D-Link DIR-615 DMZ Host Feature adv_firewall.php os command injection
- CVE-2026-21509 Microsoft Office Security Feature Bypass
- CVE-2026-21508 Windows Storage Elevation of Privilege Vulnerability
- CVE-2026-21507 iccDEV is Vulnerable to Denial of Service via Infinite Loop in CalcProfileID()
- CVE-2026-21506 iccDEV is Vulnerable to Null Pointer Dereference in CIccProfileXml::ParseBasic() Leading to Denial of Service
- CVE-2026-21505 iccDEV has Undefined Behavior (UB) - Invalid Enum Value
- CVE-2026-21504 Heap Buffer Overflow in iccDEV ToneMap Parser
- CVE-2026-21503 iccDEV has Undefined Behavior - Null Pointer Passed to memcpy() in CIccTagSparseMatrixArray
- CVE-2026-21502 NULL Pointer Dereference in iccDEV XML Tag Parser
- CVE-2026-21501 Stack Overflow in iccDEV Calculator Parser
- CVE-2026-21500 Stack Overflow in iccDEV XML Calculator Macro Expansion
- CVE-2026-2150 SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System checkin.php cross site scripting
- CVE-2026-21499 NULL Pointer Dereference in iccDEV XML Parser
- CVE-2026-21498 NULL Pointer Dereference in iccDEV XML Calculator Parser
- CVE-2026-21497 NULL Pointer Dereference in iccDEV Unknown Tag Parser
- CVE-2026-21496 NULL Pointer Dereference in iccDEV Signature Parser
- CVE-2026-21495 Division by Zero in iccDEV TIFF Image Reader
- CVE-2026-21494 iccDEV has heap buffer overflow in CIccTagLut8::Validate()
- CVE-2026-21493 iccDEV has Type Confusion during XML Curve Serialization
- CVE-2026-21492 iccDEV ToneMap Writer has NULL Pointer Member Call
- CVE-2026-21491 iccDEV has unicode buffer overflow in CIccTagTextDescription
- CVE-2026-21490 iccDEV has heap buffer overflow in CIccTagLut16::Validate()
- CVE-2026-2149 SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System appointments.php cross site scripting
- CVE-2026-21489 iccDEV has Out-of-bounds Read and Integer Underflow (Wrap or Wraparound)
- CVE-2026-21488 iccDEV has Out-of-bounds Read, Heap-based Buffer Overflow and Improper Null Termination
- CVE-2026-21487 iccDEV has Out-of-bounds Read, Use of Out-of-range Pointer Offset and Improper Input Validation
- CVE-2026-21486 Use After Free and Heap-based Buffer Overflow and Integer Overflow or Wraparound and Out-of-bounds Write in iccDEV
- CVE-2026-21485 iccDEV Undefined Behavior (UB) and Out of Memory in CIccProfile::LoadTag()
- CVE-2026-21484 AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery
- CVE-2026-21483 listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover
- CVE-2026-2148 Tenda AC21 Web Management DownloadFlash information disclosure
- CVE-2026-2147 Tenda AC21 Web Management DownloadLog information disclosure
- CVE-2026-2146 guchengwuyue yshopmall co.yixiang.utils.FileUtil updateAvatar unrestricted upload
- CVE-2026-21452 MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation
- CVE-2026-21451 Bagisto has HTML Filter Bypass that Enables Stored XSS
- CVE-2026-21450 Bagisto has SSTI in parameter that can lead to RCE
- CVE-2026-2145 cym1102 nginxWebUI Web Management check cross site scripting
- CVE-2026-21449 Bagisto has SSTI via first and last name from low-privilege user (not admin)
- CVE-2026-21448 Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
- CVE-2026-21447 Bagisto has IDOR in Customer Order Reorder Functionality
- CVE-2026-21446 Bagisto Missing Authentication on Installer API Endpoints
- CVE-2026-21445 Langflow Missing Authentication on Critical API Endpoints
- CVE-2026-21444 libtpms returns wrong initialization vector when certain symmetric ciphers are used
- CVE-2026-21443 OpenEMR allows inconsistent escaping of translation function output
- CVE-2026-21441 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
- CVE-2026-21440 AdonisJS Path Traversal in Multipart File Handling
- CVE-2026-2144 Magic Login Mail or QR Code <= 2.05 - Unauthenticated Privilege Escalation via Insecure QR Code File Storage
- CVE-2026-21439 badkeys vulnerable to ASCII control character injection on console via malformed input
- CVE-2026-21438 webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Map
- CVE-2026-21437 eopkg vulnerable to package file list integrity bypass
- CVE-2026-21436 eopkg has Path Traversal: '../filedir' vulnerability
- CVE-2026-21435 webtransport-go CloseWithError can block indefinitely
- CVE-2026-21434 webtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule
- CVE-2026-21433 Emlog vulnerable to Server-Side Request Forgery (SSRF)
- CVE-2026-21432 Emlog has stored Cross-site Scripting issue that can lead to admin or another account ATO
- CVE-2026-21431 Emlog vulnerable to stored Cross-site Scripting via image name
- CVE-2026-21430 Emlog: CSRF chained with stored XSS leads to ATO
- CVE-2026-2143 D-Link DIR-823X DDNS Service set_ddns os command injection
- CVE-2026-21429 Emlog has Broken Access Control (BAC)
- CVE-2026-21428 cpp-httplib has CRLF injection in http headers
- CVE-2026-21427 Other in Stellanova APS-S301 series
- CVE-2026-21426 Privilege escalation in PowerScale OneFS
- CVE-2026-21425 Privilege escalation in PowerScale OneFS
- CVE-2026-21424 Privilege escalation in PowerScale OneFS
- CVE-2026-21423 Misconfiguration in PowerScale OneFS
- CVE-2026-21422 Security feature bypass in PowerScale OneFS
- CVE-2026-21421 Privilege escalation in PowerScale OneFS
- CVE-2026-21420 Privilege escalation in Repository Manager
- CVE-2026-2142 D-Link DIR-823X set_qos sub_420688 os command injection
- CVE-2026-21419 Privilege escalation in Display and Peripheral Manager (Windows)
- CVE-2026-21418 Command injection in Unity
- CVE-2026-21417 Information disclosure in CloudBoost Virtual Appliance
- CVE-2026-21413 Memory corruption in LibRaw
- CVE-2026-21411 Auth bypass in OpenBlocks IDM RX1 (FW5.0.x)
- CVE-2026-21410 InSAT MasterSCADA BUK-TS SQL Injection
- CVE-2026-2141 WuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization
- CVE-2026-21409 Missing authorization in RICOH Streamline NX
- CVE-2026-21408 Privilege escalation in beat-access for Windows
- CVE-2026-21404 NAVTOR NavBox Use of Hard-coded Credentials
- CVE-2026-21400 Security feature bypass in Intel(R) AI Reference Models
- CVE-2026-2140 Tenda TX9 setMacFilterCfg sub_4223E0 buffer overflow
- CVE-2026-21399 Memory corruption in Intel(R) Open Volume Kernel Library (Intel(R) Open VKL) library maintained by intel(R)
- CVE-2026-21393 Cross-site scripting in Movable Type (Cloud Edition)
- CVE-2026-21391 Improper Claim Validation in PingAM OIDC Provider
- CVE-2026-2139 Tenda TX9 fast_setting_wifi_set sub_432580 buffer overflow
- CVE-2026-21389 Copeland XWEB and XWEB Pro OS Command Injection
- CVE-2026-21388 Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint
- CVE-2026-21387 Security feature bypass in Intel(R) LLM Library for PyTorch