Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 823 of 1013.
- CVE-2026-19651 IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
- CVE-2026-19650 Cross-Site Request Forgery (CSRF) in GitLab
- CVE-2026-1965 bad reuse of HTTP Negotiate connection
- CVE-2026-19649 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
- CVE-2026-19646 Open redirect in Common Licensing
- CVE-2026-19645 Multiple vulnerabilities in IBM MQ Agent images
- CVE-2026-19644 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-19643 Out-of-bounds read in the Base64 decoder in Amazon aws-sdk-cpp on signed-char platforms
- CVE-2026-19642 Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp
- CVE-2026-19641 Denial of service in EOS
- CVE-2026-19640 Security Advisory 0170
- CVE-2026-1964 WeKan REST Endpoint boards.js BoardTitleRESTBleed access control
- CVE-2026-19639 Improper Access Control
- CVE-2026-19636 Insuffucient Protections Lead to Brute Force
- CVE-2026-19635 Local Privilege Escalation
- CVE-2026-19634 SQL injection in PostgreSQL Anonymizer
- CVE-2026-19633 PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries
- CVE-2026-19632 TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
- CVE-2026-19631 SQL Injection
- CVE-2026-19630 Amplified resource exhaustion in inbound message processing
- CVE-2026-1963 WeKan Attachment Storage attachments.js MoveStorageBleed access control
- CVE-2026-19629 Privilege Escalation
- CVE-2026-19628 Remote Code Execution
- CVE-2026-19627 IBM Planning Analytics Local is affected by security vulnerabilities
- CVE-2026-19626 Remote Code Execution
- CVE-2026-19625 IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
- CVE-2026-19624 NetworkManager-l2tp: local privilege escalation via ipsec.conf injection
- CVE-2026-19622 IBM Planning Analytics Local is affected by security vulnerabilities
- CVE-2026-19621 Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads
- CVE-2026-19620 IBM Planning Analytics Local is affected by security vulnerabilities
- CVE-2026-1962 WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control
- CVE-2026-19619 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-19617 Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser
- CVE-2026-19616 Information Disclosure in TBC Technology's KitLogistic
- CVE-2026-19615 Admin and Site Enhancements < 9.0.1 - Author+ Stored XSS via SVG Upload over XML-RPC
- CVE-2026-19614 XML External Entity (XXE) Injection in CyberELF NanoXML
- CVE-2026-19613 ECS < 4.3.10 - Contributor+ Arbitrary Post Meta Disclosure via Dynamic Repeater ACF Source
- CVE-2026-19612 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-19611 Weak cryptography in Red Hat Build of Apache Camel 3.33.3.SP2
- CVE-2026-19610 Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean
- CVE-2026-1961 Forman: foreman: remote code execution via command injection in websocket proxy
- CVE-2026-19608 Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies
- CVE-2026-19607 Keycloak-services: keycloak-services: broker-originated username collision causes account lockout
- CVE-2026-19603 Private channel ID disclosure via user status endpoints
- CVE-2026-19601 Disclosure of AD/LDAP bind password via Test Connection
- CVE-2026-19600 Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts
- CVE-2026-1960 Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes
- CVE-2026-19599 Remote Code Execution vulnerability
- CVE-2026-19598 Auth bypass in Pods – Custom Content Types and Fields
- CVE-2026-19596 OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host
- CVE-2026-19595 Zephyr RTIO syscall verifier validates output parameters for read instead of write access
- CVE-2026-19594 Path traversal in Snowflake Python APIs
- CVE-2026-19593 Code injection in Codex Desktop
- CVE-2026-19592 Code injection in Codex CLI
- CVE-2026-19591 Security feature bypass in Codex CLI
- CVE-2026-19590 Code injection in Codex Desktop
- CVE-2026-1959 Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes
- CVE-2026-19589 Packer vulnerable to arbitrary file write via crafted plugin archive during installation
- CVE-2026-19588 Integer overflow in rlottie
- CVE-2026-19587 Denial of service in rlottie
- CVE-2026-19586 Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways
- CVE-2026-19585 Go-getter vulnerable to a path traversal in S3/GCS directory download handling
- CVE-2026-19584 Velociraptor VQL injection during notebook restore from backup
- CVE-2026-19583 Velociraptor Required Permissions bypass by using client monitoring queries
- CVE-2026-1958 Hard-coded passwords in KlinikaXP
- CVE-2026-19579 Snipe-IT Checkout Request Cancellation IDOR
- CVE-2026-19577 Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer address
- CVE-2026-19576 Memory corruption in zephyr
- CVE-2026-19575 Type confusion in the device_deinit system call allows user-mode threads to execute arbitrary kernel code
- CVE-2026-19574 ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolation
- CVE-2026-19573 Affiliate Super Assistent <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function
- CVE-2026-19572 FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability
- CVE-2026-19571 Race condition in zephyr
- CVE-2026-19570 Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state
- CVE-2026-19569 Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap
- CVE-2026-19568 SVG File Parsing Memory Corruption Vulnerability in Autodesk 3ds Max
- CVE-2026-19566 Denial of service in Net::CIDR::Set
- CVE-2026-19565 Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey.
- CVE-2026-19560 Use after free in Chrome
- CVE-2026-19559 Use after free in Chrome
- CVE-2026-19558 Use after free in Chrome
- CVE-2026-19557 Use after free in Chrome
- CVE-2026-19556 Use after free in Chrome
- CVE-2026-19553 SSLContext.wrap_bio() missing validation of server_hostname parameter
- CVE-2026-19550 Missing authorization in Red Hat Enterprise Linux 10
- CVE-2026-19548 Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing
- CVE-2026-19547 Local Privilege Escalation in Ghostscript for Windows
- CVE-2026-19546 Dbi: incomplete fix for cve-2026-14380 dbi: arbitrary code execution via caller-influenced profile attribute
- CVE-2026-19543 Security feature bypass in Common Licensing
- CVE-2026-19542 Stack-based out-of-bounds write in tdelete during tree rebalancing
- CVE-2026-19541 Outgoing OAuth connection client secret exposure during connection validation
- CVE-2026-19539 IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion
- CVE-2026-19538 Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS
- CVE-2026-19535 Cross-site request forgery in EKI-1242EIMS
- CVE-2026-19534 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
- CVE-2026-19532 Path Traversal in HAVELSAN's Liman MYS
- CVE-2026-1953 Stored Cross Site Scripting(XSS) in Nukegraphic CMS V3.1.2
- CVE-2026-1952 Denial of service via the undocumented subfunction in AS320T
- CVE-2026-19519 Claircore: claircore: denial of service via unchecked type assertion in rpm header parser
- CVE-2026-19518 Other in rlottie