Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 828 of 1013.
- CVE-2026-19029 HDF5 scale-offset filter heap buffer over-read via crafted chunk
- CVE-2026-19028 HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read
- CVE-2026-19027 HDF5 out-of-bounds heap read in N-Bit filter decompression
- CVE-2026-19026 Nbit filter NULL/short parameter-array dereference
- CVE-2026-19025 HDF5 divide-by-zero (SIGFPE) via mismatched chunk-layout dimensionality and dataspace rank on dataset open
- CVE-2026-19024 HDF5 H5Pget_fill_value NULL Pointer Dereference via Malformed Fill Value Message
- CVE-2026-19023 HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets
- CVE-2026-19022 OpenHands send_pull_request.py initialize_repo command injection
- CVE-2026-19021 SourceCodester Computer Repair Shop Management System Master.php delete_product sql injection
- CVE-2026-19020 itsourcecode Hospital Management System servicetype.php sql injection
- CVE-2026-1902 Hammas Calendar <= 1.5.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'apix' Shortcode Attribute
- CVE-2026-19019 poco-ai poco-agent Claude File workspace.py WorkspaceManager._setup_session_persistence cleanup
- CVE-2026-19017 Consul vulnerable to partial arbitrary file read via Vault Connect CA provider
- CVE-2026-19016 Authorization bypass for session deletion in the transaction API
- CVE-2026-19015 Uncontrolled resource consumption in the Consul Connect CA roots endpoint
- CVE-2026-19014 Uncontrolled resource consumption in the Consul Connect authorization endpoint
- CVE-2026-19012 Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path
- CVE-2026-19011 TinyAGI agents.ts buildSystemPrompt file inclusion
- CVE-2026-19010 TinyAGI Message API Endpoint index.ts processMessage authorization
- CVE-2026-1901 QuestionPro Surveys <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-19009 TinyAGI Message API Endpoint response.ts collectFiles file inclusion
- CVE-2026-19008 mf-yang openclaw-cn apply_patch Tool sandbox-paths.ts assertNoSymlinkEscape link following
- CVE-2026-19007 mf-yang openclaw-cn reply-elevated.ts isApprovedElevatedSender privileges management
- CVE-2026-19006 mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization
- CVE-2026-19005 nanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management
- CVE-2026-19004 MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output Parameters
- CVE-2026-19003 Memory corruption in BI Connector ODBC Driver
- CVE-2026-19002 Crafted database metadata may cause memory corruption in MongoDB BI Connector ODBC Driver
- CVE-2026-19001 MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names
- CVE-2026-19000 JeecgBoot Anonymous Chat Attachment send server-side request forgery
- CVE-2026-1900 Link Whisper Free < 0.9.1 - Unauthenticated Settings and User Meta Update
- CVE-2026-18998 cosmicstack-labs mercury-agent delegate_task Tool sub-agent.ts SubAgent.run improper authorization
- CVE-2026-18997 cosmicstack-labs mercury-agent bg agent.ts Agent.handleBgCommand authorization
- CVE-2026-18996 cosmicstack-labs mercury-agent run_command permissions.ts PermissionManager.checkShellCommand privileges assignment
- CVE-2026-18995 netease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosure
- CVE-2026-18994 Missing authorization in File Manager Application
- CVE-2026-18993 NousResearch hermes-agent Memory Toolset model_tools.py access control
- CVE-2026-18992 zhayujie CowAgent Self-Evolution Review Agent executor.py _select_tools authorization
- CVE-2026-18991 nanocoai NanoClaw send_file core.ts path traversal
- CVE-2026-18990 letta-ai LettaBot API Status Route server.ts missing authentication
- CVE-2026-1899 Any Post Slider <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_type' Shortcode Attribute
- CVE-2026-18988 Cross-site scripting in Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ
- CVE-2026-18986 Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094
- CVE-2026-18985 Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093
- CVE-2026-18983 File upload in One User Avatar | User Profile Picture
- CVE-2026-18982 Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterroles
- CVE-2026-18980 nearai ironclaw shell.rs classify_command_risk command injection
- CVE-2026-1898 WeKan LDAP User Sync syncUser.js SyncLDAPBleed access control
- CVE-2026-18978 LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- CVE-2026-18976 NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment
- CVE-2026-18974 heshengtao super-agent-party execute_tool_manually Endpoint server.py get_file_content information disclosure
- CVE-2026-18973 heshengtao super-agent-party extension_proxy Route server.py sanitize_proxy_url server-side request forgery
- CVE-2026-18972 Velociraptor authenticated identity-spoofing vulnerability
- CVE-2026-18970 Rongzhitong Visual Integrated Command and Dispatch Platform findAll sql injection
- CVE-2026-1897 WeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorization
- CVE-2026-18969 Rongzhitong Visual Integrated Command and Dispatch Platform upload unrestricted upload
- CVE-2026-18968 ttttonyhe OBlog tags.php cross site scripting
- CVE-2026-18967 Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow
- CVE-2026-18965 Missing Authorization in PayRange API
- CVE-2026-18964 Cross-site scripting in Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
- CVE-2026-18963 Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
- CVE-2026-18962 WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization
- CVE-2026-18961 Auth bypass in Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect
- CVE-2026-18960 Block User Account < 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords
- CVE-2026-1896 WeKan Migration Operation comprehensiveBoardMigration.js ComprehensiveBoardMigration MigrationBleed access control
- CVE-2026-18959 yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal
- CVE-2026-18958 imranrisal-dev Student-Management-System Login loginCheckTest.php sql injection
- CVE-2026-18957 Stored XSS in Menulux Software's Menulux Portal
- CVE-2026-18954 Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server
- CVE-2026-18953 Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server
- CVE-2026-18952 Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin
- CVE-2026-18951 Privilege escalation in Red Hat OpenShift AI 3.3
- CVE-2026-18950 Odh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creation
- CVE-2026-1895 WeKan Attachment Storage lists.js applyWipLimit ListWIPBleed access control
- CVE-2026-18949 Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources
- CVE-2026-18948 Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server
- CVE-2026-18947 Feast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materialization
- CVE-2026-18946 Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename
- CVE-2026-18945 Missing authorization in WP Helper Premium
- CVE-2026-18943 WPC Admin Columns < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure
- CVE-2026-18942 Feast-operator: feast: feast apply cronjob runs user python with feature-server sa — tenant code to sa token escalation
- CVE-2026-18941 Misconfiguration in Red Hat OpenShift AI (RHOAI)
- CVE-2026-1894 WeKan REST API checklistItems.js Checklist REST Bleed improper authorization
- CVE-2026-18938 Integer overflow in Red Hat Enterprise Linux 10
- CVE-2026-18937 Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection
- CVE-2026-18934 RSS Aggregator by Feedzy < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion
- CVE-2026-18933 wp-downloadmanager - Unrestricted File Upload via Missing Extension/MIME Validation and Path Traversal
- CVE-2026-18931 Hardcoded Credentials in TMT Machine's Talassoft Industrial Management Software
- CVE-2026-1893 Cross-site scripting in Orbisius Random Name Generator
- CVE-2026-18929 Resource Exhaustion in Carbone
- CVE-2026-18927 File upload in Student-Management-System
- CVE-2026-18924 HTTP/2 server push UAF
- CVE-2026-18922 Auth bypass in Red Hat Directory Server 11.5 E4S for RHEL 8
- CVE-2026-1892 WeKan REST API boards.js setBoardOrgs improper authorization
- CVE-2026-18918 OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed default
- CVE-2026-18917 Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow
- CVE-2026-18916 Remote TCP DoS by throttling the TCP receive window
- CVE-2026-18915 Exposure of OTP Secret Through Process Command-Line Arguments in TÜBİTAK BİLGEM's eta-otp-lock
- CVE-2026-18912 SQL injection in ManageEngine DataSecurity Plus
- CVE-2026-18911 Auth bypass in ManageEngine DataSecurity Plus