Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 820 of 1013.
- CVE-2026-19977 EFM ipTIME A3004T Session Validation httpcon_check_session_url improper authentication
- CVE-2026-19976 COMFAST CF-N1-S mbox-config sub_44A968 command injection
- CVE-2026-19975 Azuriom CMS Money Transfer ProfileController.php transferMoney toctou
- CVE-2026-19974 treefrogframework treefrog-framework Session Cookie tsessioncookiestore.cpp strncmp improper authentication
- CVE-2026-19973 itsourcecode Hospital Management System viewpaymentreport.php sql injection
- CVE-2026-19972 itsourcecode Hospital Management System viewpatient.php sql injection
- CVE-2026-19971 LB-Link WR1210M Backup Endpoint backup.cgi main missing authentication
- CVE-2026-19970 Open Asset Import Library Assimp Node MDLLoader.cpp AddBonesToNodeGraph_3DGS_MDL7 heap-based overflow
- CVE-2026-1997 Certain HP OfficeJet Pro Printers - Information Disclosure
- CVE-2026-19969 Memory corruption in Assimp
- CVE-2026-19968 Open Asset Import Library Assimp 3DGS MDL7 Model LWOLoader.h ReadFaces_3DGS_MDL7 heap-based overflow
- CVE-2026-19967 Open Asset Import Library Assimp File Compression.cpp decompressBlock heap-based overflow
- CVE-2026-19966 CodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorization
- CVE-2026-19965 automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy
- CVE-2026-19964 Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injection
- CVE-2026-19963 Edimax EW-7478APC stainfo command injection
- CVE-2026-19962 Edimax EW-7478APC setWAN command injection
- CVE-2026-19961 Edimax EW-7478APC formWlSiteSurvey buffer overflow
- CVE-2026-19960 Edimax EW-7478APC formWlbasic command injection
- CVE-2026-1996 Certain HP OfficeJet Pro Printers – Denial of Service
- CVE-2026-19959 Edimax EW-7478APC formWanTcpipSetup stack-based overflow
- CVE-2026-19958 iatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injection
- CVE-2026-19957 graphlit graphlit-mcp-server ssrf-test Endpoint tools.ts fetch server-side request forgery
- CVE-2026-19956 gomarble-ai facebook-ads-mcp-server server.py fetch_pagination_url server-side request forgery
- CVE-2026-19955 TrailDB TOC Validation tdb.c tdb_open out-of-bounds
- CVE-2026-19954 Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names.
- CVE-2026-19953 URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep.
- CVE-2026-19952 Path traversal in Frontend Admin by DynamiApps
- CVE-2026-1995 IDrive Cloud Backup Client for Windows contains a privilege escalation vulnerability
- CVE-2026-19949 SQL injection in All-in-One WP Migration and Backup
- CVE-2026-19948 Missing authorization in Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates
- CVE-2026-19947 Missing authorization in zephyr
- CVE-2026-19946 Missing authorization in Awesome Support – WordPress HelpDesk & Support Plugin
- CVE-2026-19945 WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
- CVE-2026-19944 WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta
- CVE-2026-19943 Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute
- CVE-2026-19942 Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta
- CVE-2026-19941 checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof
- CVE-2026-19940 Use after free in zephyr
- CVE-2026-1994 s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover
- CVE-2026-19939 Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruption
- CVE-2026-19938 Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails
- CVE-2026-19937 Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses
- CVE-2026-19936 Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference
- CVE-2026-19935 Use after free in zephyr
- CVE-2026-19934 itsourcecode Hospital Management System vieworder.php sql injection
- CVE-2026-19933 DefaultFuction Customer-Relationship-Management-In-C-Project Customer Search gets stack-based overflow
- CVE-2026-19932 DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection
- CVE-2026-19931 Negotiate ambient user conn reuse
- CVE-2026-19930 Dolibarr User Cloning card.php ldap injection
- CVE-2026-1993 Privilege escalation in ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
- CVE-2026-19929 OpenBoxes Template Processing DocumentController.groovy buildZebraTemplate special elements in template engine
- CVE-2026-19928 OpenBoxes Role Interceptor RoleInterceptor.groovy needManager privileges management
- CVE-2026-19927 OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery
- CVE-2026-19926 Evergreen open-ils.fielder OpenSRF Service osrf-gateway-v1 sql injection
- CVE-2026-19925 SourceCodester Stock Management System Master.php delete_supplier sql injection
- CVE-2026-19924 Tenda AC10 httpd R7WebsSecurityHandler improper authentication
- CVE-2026-19923 code-projects Online Shopping System checkout_process.php sql injection
- CVE-2026-19922 code-projects Online Shopping System checkout.php cross site scripting
- CVE-2026-19921 code-projects Online Shopping System homeaction.php sql injection
- CVE-2026-19920 code-projects Online Shopping System action.php sql injection
- CVE-2026-1992 ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation
- CVE-2026-19919 code-projects Online Shopping System Login login.php sql injection
- CVE-2026-19918 SpaceX Starlink Router Gen 3 gRPC Management get_status access control
- CVE-2026-19917 code-projects Online Food Order System delete_food_items1.php sql injection
- CVE-2026-19916 code-projects Online Food Order System edit_food_items.php cross site scripting
- CVE-2026-19915 HP Support Assistant - Local Escalation of Privilege
- CVE-2026-19914 Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter
- CVE-2026-19913 CVE-2026-19913
- CVE-2026-19912 CVE-2026-19912
- CVE-2026-19910 PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability
- CVE-2026-1991 libuvc UVC Descriptor device.c uvc_scan_streaming null pointer dereference
- CVE-2026-19909 PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability
- CVE-2026-19908 PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability
- CVE-2026-19906 pkp pkp-lib API Key Generation APIProfileForm.php setData entropy
- CVE-2026-19905 Jinher OA attendance_out_approve.aspx sql injection
- CVE-2026-19904 SourceCodester Online Book Store System System Settings index.php site_settings cross site scripting
- CVE-2026-19903 SourceCodester Online Clothing Store SQL Database Backup shopping.sql file access
- CVE-2026-19902 Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)
- CVE-2026-19901 LB-LINK X-PRO easycwmp hard-coded credentials
- CVE-2026-19900 LB-LINK X-PRO shadow hard-coded credentials
- CVE-2026-1990 oatpp Type.hpp ObjectWrapper null pointer dereference
- CVE-2026-19899 SourceCodester Class and Exam Timetabling System edit_teacher.php sql injection
- CVE-2026-19898 VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication
- CVE-2026-19897 mangroup dtale Login Endpoint auth.py login excessive authentication
- CVE-2026-19896 mangroup dtale Flask Session Cookie app.py build_secret_key random values
- CVE-2026-19895 opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication
- CVE-2026-19894 itsourcecode Hospital Management System viewmedicine.php sql injection
- CVE-2026-19893 D-Link DIR-842 vsftpd vsftpd.conf default permission
- CVE-2026-19892 InfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure
- CVE-2026-19891 TRENDnet TEW-WLC100 IKE Phase 1 Aggressive Mode racoon.conf missing encryption
- CVE-2026-1989 IDOR in PAVO Inc.'s PAVO Pay
- CVE-2026-19889 Server-Side Request Forgery (SSRF) in GitLab AI Gateway
- CVE-2026-19888 NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer
- CVE-2026-19887 Deserialization in Welcart e-Commerce
- CVE-2026-19886 OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability
- CVE-2026-19885 OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2026-19884 Code injection in Eclipse Theia
- CVE-2026-19883 Privilege escalation in WPeMatico RSS Feed Fetcher
- CVE-2026-19880 Incomplete protection against CVE-2025-11226