Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 824 of 1013.
- CVE-2026-19517 Denial of service in rlottie
- CVE-2026-19516 CVE-2026-19516 CVE Record
- CVE-2026-19515 OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution
- CVE-2026-19513 Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion
- CVE-2026-1951 No checking of the length of the buffer with the directory name in AS320T
- CVE-2026-19509 RDK WebUI DOS vulnerability
- CVE-2026-19508 RDK WebUI heap-based buffer overflow vulnerability
- CVE-2026-19507 RDK WebUI uncontrolled resource consumption
- CVE-2026-19506 RDK-B WebUI race condition vulnerability
- CVE-2026-19505 RDK-B WebUI improper cryptographic signature verification vulnerability
- CVE-2026-19504 Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability
- CVE-2026-19503 Insufficient OIDC endpoint validation could invoke unintended local protocol handlers
- CVE-2026-19502 Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI
- CVE-2026-19501 CVE-2026-19501
- CVE-2026-19500 SureForms contains an uncontrolled resource consumption vulnerability
- CVE-2026-1950 No checking of the length of the buffer with the file name in AS320T
- CVE-2026-19499 Buffer overflow in strfmon and strfmon_l right-justification padding
- CVE-2026-19498 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-19494 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-19493 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-19492 This Power System update is being released to address
- CVE-2026-19491 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-19490 Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel
- CVE-2026-1949 Incorrect calculation of buffer size on the stack in AS320T
- CVE-2026-19489 Memory corruption in ADC
- CVE-2026-19487 Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick pr
- CVE-2026-19486 SSRF in Gemini Enterprise Agent Platform App Builder
- CVE-2026-19485 Bucket Squatting in Vertex AI Search for Commerce
- CVE-2026-19484 @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
- CVE-2026-19483 Information disclosure in Storage Scale
- CVE-2026-19482 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-19481 @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
- CVE-2026-19480 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-1948 Missing authorization in NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2026-19479 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-19478 Improper Control of Generation of Code ('Code Injection') in GitLab
- CVE-2026-19477 Stack-based Buffer Overflow Vulnerability in Linux (uldaq)
- CVE-2026-19475 SQL Data Source Plugin: OOM DoS via $__timeGroup macro
- CVE-2026-19474 @fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload
- CVE-2026-19472 Rockwell Automation ArmorStart® LT Denial Of Service
- CVE-2026-19471 Rockwell Automation ArmorStart® LT Stored Cross-site scripting
- CVE-2026-1947 Missing authorization in NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2026-1946 Missing authorization in GW AI Website Builder
- CVE-2026-19454 JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download
- CVE-2026-19453 JetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selection
- CVE-2026-1945 WPBookit <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' Parameters
- CVE-2026-19449 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-19448 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-19447 Stored XSS in Fileorbis Informatics's FileOrbis
- CVE-2026-19446 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-19445 Use-after-free of a server-side SSLContext when sni_callback switches contexts
- CVE-2026-19444 Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes
- CVE-2026-19442 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-19441 Unauthenticated API Allows Analytics Data Manipulation in IKAS Technology's Rush
- CVE-2026-1944 CallbackKiller service widget <= 1.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update
- CVE-2026-19439 Missing authorization in Ultimate Gift Cards for WooCommerce
- CVE-2026-19438 Mint Workbench I Path traversal Vulnerability
- CVE-2026-19437 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-19436 Ultimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase
- CVE-2026-19435 Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure
- CVE-2026-19434 Stored Cross-site Scripting in Pentestify finding severity field
- CVE-2026-19433 Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export
- CVE-2026-19430 CatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via download-all
- CVE-2026-1943 YayMail <= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements
- CVE-2026-19426 FitSoft｜POS Sytstem - Missing Authentication
- CVE-2026-19425 Win Men Intermational｜Travel Agency Management System - SQL Injection
- CVE-2026-19424 Inventec Appliances｜Chiline Cloud - Insecure Direct Object Reference
- CVE-2026-19423 Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile Forms
- CVE-2026-1942 Missing authorization in Blog2Social: Social Media Auto Post & Scheduler
- CVE-2026-19418 TYPO3 CMS - Broken Access Control in Backend and Install Tool
- CVE-2026-19417 KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR
- CVE-2026-19416 KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR
- CVE-2026-19412 Hardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S Router
- CVE-2026-19411 Shim/dp.c library: null-pointer dereference in is_removable_media_path() when devicepathtostr() returns null
- CVE-2026-19410 Google Cloud Build Comment Control Bypass via Webhook Suppression
- CVE-2026-1941 WP Event Aggregator <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-19407 GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK
- CVE-2026-19406 Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing
- CVE-2026-19404 Missing authorization in Red Hat Directory Server 11
- CVE-2026-19401 Remote UDP DoS by sending multiple DNS Cookie options
- CVE-2026-1940 Gstreamer: incomplete fix of cve-2026-1940
- CVE-2026-19398 Memory corruption in FA507NU
- CVE-2026-19397 Auth bypass in Control Center Express Agent
- CVE-2026-19396 Weak cryptography in Router
- CVE-2026-19395 An empty <img> attribute value in styled text triggers a parser error that halts the device.
- CVE-2026-19391 Information disclosure in Pen Drive Powered by Red Hat Lightspeed
- CVE-2026-1939 Percent to Infograph <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-19389 Integer overflow in Red Hat Enterprise Linux 10
- CVE-2026-19387 Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder
- CVE-2026-19386 Memory corruption in Router
- CVE-2026-19385 PostgreSQL pg_dump heap buffer overflow executes arbitrary code
- CVE-2026-19384 SourceCodester Simple Doctors Appointment System ajax.php set_appointment sql injection
- CVE-2026-19383 saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload
- CVE-2026-19382 Almico Speedfan MSR Index speedfan.sys KiSystemCall64 memory leak
- CVE-2026-19381 Kingston FURY CTRL RGB Control Software Driver NTIOLib_KSFX.sys privileges management
- CVE-2026-19380 Mullvad wireguard.sys IOCTL AdapterState reference count
- CVE-2026-1938 Missing authorization in YayMail – WooCommerce Email Customizer
- CVE-2026-19379 EFM ipTIME AX8004M CGI Endpoint d.cgi popen os command injection
- CVE-2026-19378 code-projects Task Management System CommentSave.php cross site scripting
- CVE-2026-19377 Improper certificate validation in Cato Client tunnel handshake