Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 825 of 1013.
- CVE-2026-19376 Uasoft Badaso File API api.php class permission
- CVE-2026-19375 dmitriiweb article-scraper-mcp server.py fetch_article server-side request forgery
- CVE-2026-19374 adafap api-mcp Proxy API Endpoint route.ts customAxios server-side request forgery
- CVE-2026-19373 PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery
- CVE-2026-19372 Handwriting-OCR handwriting-ocr-mcp-server upload_document index.ts fs.readFileSync path traversal
- CVE-2026-19371 Nikolaibibo claude-comfyui-mcp comfy_upload_image utils.ts copyFileSync path traversal
- CVE-2026-19370 bartekke8it56w2 new-mcp geminithinking index.ts fs.readFileSync path traversal
- CVE-2026-1937 Missing authorization in YayMail – WooCommerce Email Customizer
- CVE-2026-19369 KS-GEN-AI jira-mcp-server add_attachment_from_public_url index.ts axios.get server-side request forgery
- CVE-2026-19368 PV-Bhat gemsuite-mcp gemini_search unified-gemini.ts path traversal
- CVE-2026-19367 NocteDefensor LudusMCP read_range_config rangeConfig.ts server-side request forgery
- CVE-2026-19366 NocteDefensor LudusMCP insert_creds_range_config insertCredsRangeConfig.ts path traversal
- CVE-2026-19365 Ichigo3766 image-gen-mcp upscale_images index.ts path traversal
- CVE-2026-19364 itsourcecode Hospital Management System viewdoctorconsultancycharge.php sql injection
- CVE-2026-19363 lmammino oidc-authorizer Lambda Authorizer handler.rs log file
- CVE-2026-19362 Denial of service in oidc-authorizer
- CVE-2026-19361 macrozheng mall mall-portal getAuthCode password recovery
- CVE-2026-19360 wongcyrus ExcelLexBot Lambda Function ExcelLexBotS3TriggerFunction privileges management
- CVE-2026-19359 nxp-auto-goldvip gvip Lambda Function SitewiseCustomFunction access control
- CVE-2026-19358 3CORESec Trapdoor DefaultFunction access control
- CVE-2026-19357 MingSoft MCMS ms-mdiy get information disclosure
- CVE-2026-19356 MingSoft MCMS ms-mdiy list information disclosure
- CVE-2026-19355 MingSoft MCMS ms-mdiy list.do ModelDataImpl.queryDiyFormData sql injection
- CVE-2026-19354 lock-upme OPMS IN Clause message.go sql injection
- CVE-2026-19353 DedeCMS Installation Wizard index.php _4_Setup file inclusion
- CVE-2026-19352 mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request forgery
- CVE-2026-19351 dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection
- CVE-2026-19350 Dolibarr ERP TakePOS invoice.php fail authorization
- CVE-2026-1935 Missing authorization in Company Posts for LinkedIn
- CVE-2026-19349 Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication
- CVE-2026-19348 Shenzhen Aitemi M300 Wi-Fi Repeater protocol.csp sprintf command injection
- CVE-2026-19347 itsourcecode Hospital Management System viewdoctor.php sql injection
- CVE-2026-19346 Tenda CH22 CertListInfo formCertListInfo command injection
- CVE-2026-19345 code-projects Task Management System UpdateTaskStatus.php authorization
- CVE-2026-19344 code-projects Task Management System comment_count_user.php sql injection
- CVE-2026-19343 code-projects Task Management System AdminLogin.php sql injection
- CVE-2026-19342 code-projects Task Management System Login index.php improper authentication
- CVE-2026-19341 UTT HiPER 1200GW pptpSrvGlobalConfig strcpy stack-based overflow
- CVE-2026-19340 anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgery
- CVE-2026-1934 Missing authorization in Motors – Car Dealership & Classified Listings Plugin
- CVE-2026-19339 aliyun alibabacloud-dataworks-mcp-server initResources.ts ReadResourceRequestSchema server-side request forgery
- CVE-2026-19338 automateyournetwork MCPyATS generate_mermaid_markdown index.ts processGenerateRequest path traversal
- CVE-2026-19337 adenot mcp-google-search read_webpage index.ts server-side request forgery
- CVE-2026-19336 Pimzino spec-workflow-mcp approvals.ts ApprovalStorage.createApproval path traversal
- CVE-2026-19335 Jane-xiaoer skill-vision-control config.ts getSkillVersionsDir path traversal
- CVE-2026-19334 NightTrek Ollama-mcp index.ts command injection
- CVE-2026-19333 NightTrek Supabase-MCP generate_types command injection
- CVE-2026-19332 NellyW8 MCP4EDA run_openlane/view_waveform command injection
- CVE-2026-19331 bazylhorsey obsidian-mcp-server CanvasService.ts writeCanvas path traversal
- CVE-2026-19330 angrysky56 advanced-reasoning-mcp index.ts switch_memory_library path traversal
- CVE-2026-1933 Samba: missing access check on reparse point operations
- CVE-2026-19329 andreahaku codex_mcp ask MCP Tool codex-process-simple.ts command injection
- CVE-2026-19328 aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal
- CVE-2026-19327 abracadabra50 claude-sesh enricher.ts enrichSession path traversal
- CVE-2026-19326 Jevon-Zhong Ai-doctor filemanagement.service.ts deleteImage path traversal
- CVE-2026-19325 Path traversal in roo-code-memory-bank-mcp-server
- CVE-2026-19324 HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal
- CVE-2026-19323 azer react-analyzer-mcp analyze-projec index.ts generateProjectDocs path traversal
- CVE-2026-19321 Power System Integer Overflow
- CVE-2026-1932 Missing authorization in Appointment Booking Calendar Plugin – Bookr
- CVE-2026-19318 Fireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code Execution
- CVE-2026-19317 Fireware OS Pre-Authentication Out-of-Bounds Read in iked Allows Denial of Service (DoS)
- CVE-2026-19316 Fireware OS Pre-Authentication Double Free in iked Allows Denial of Service (DoS)
- CVE-2026-19315 Fireware OS Pre-Authentication Type Confusion in iked Allows Remote Code Execution
- CVE-2026-19314 Fireware OS Integer Underflow in iked Allows Unauthenticated Denial of Service (DoS)
- CVE-2026-19313 Fireware OS Pre-Authentication Heap Buffer Overflow in iked Allows Remote Code Execution
- CVE-2026-19311 Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin
- CVE-2026-1931 Rent Fetch <= 0.32.4 - Unauthenticated Stored Cross-Site Scripting via 'keyword' Parameter
- CVE-2026-19306 Path traversal in Langflow OSS
- CVE-2026-19305 Server-side request forgery in Langflow OSS
- CVE-2026-19304 Server-side request forgery in Langflow OSS
- CVE-2026-19303 Path traversal in Langflow OSS
- CVE-2026-19302 Path traversal in Langflow OSS
- CVE-2026-19301 Server-side request forgery in Langflow OSS
- CVE-2026-19300 Information disclosure in Langflow OSS
- CVE-2026-1930 Emailchef <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion
- CVE-2026-19299 Path traversal in Langflow OSS
- CVE-2026-19298 Code injection in Langflow OSS
- CVE-2026-19297 Insufficient Authentication Brute Force Protection on Login Endpoint
- CVE-2026-19295 Code injection in Langflow OSS
- CVE-2026-19294 Missing authorization in Langflow OSS
- CVE-2026-19293 SMP security request
- CVE-2026-19292 Bluetooth re-pairing with legitimate device can use lower security level
- CVE-2026-19291 Bluetooth re-pairing can use a lower security level than previous
- CVE-2026-19290 IBM Sterling File Gateway is Vulnerable to Improper Access Control
- CVE-2026-1929 Advanced Woo Labels <= 2.37 - Authenticated (Contributor+) Remote Code Execution via 'callback' Parameter
- CVE-2026-19288 astralisone rive-mcp-server-core importRiveFile Flow importRiveFile.ts path traversal
- CVE-2026-19287 abrinsmead mindpilot-mcp HistoryService path traversal
- CVE-2026-19286 Code injection in Langflow OSS
- CVE-2026-19285 aaronsb memory-graph memoryTools.ts JsonMemoryStorage.saveMemories path traversal
- CVE-2026-19284 MauricioMilano coder-api Projects Endpoint projects.ts createProject command injection
- CVE-2026-19283 IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image
- CVE-2026-19282 andreahaku llm_memory_mcp GitHooksManager.ts auto.capture command injection
- CVE-2026-19281 adolfosalasgomez3011 slidev-builder-mcp generateAssets Tool generateAssets.ts generateChart command injection
- CVE-2026-19280 IBM i is Affected By Multiple Vulnerabilities in PASE [, ]
- CVE-2026-1928 Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution
- CVE-2026-19279 MIMICLab mcp-pdf-vision index.ts load_pdf command injection
- CVE-2026-19278 Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings
- CVE-2026-19274 IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image
- CVE-2026-19273 The Dashboard of IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to Improper Access Control