Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 829 of 1013.
- CVE-2026-1891 Simple Football Scoreboard <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-18909 Memory corruption in ELAN Smart-Pad
- CVE-2026-18907 PathTravelsal Vulnerability in com.talpa.hibrowser
- CVE-2026-18905 IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation
- CVE-2026-18904 Auth bypass in Langflow OSS
- CVE-2026-18903 yeqifu warehouse FileController.java path traversal
- CVE-2026-18902 H3C NX15 esps repeaterproc command injection
- CVE-2026-18901 H3C NX15 Web API esps service.add routine
- CVE-2026-18900 H3C NX15 Backend RPC esps file.exec os command injection
- CVE-2026-1890 LeadConnector < 3.0.22 - Unauthenticated Rest Call
- CVE-2026-18899 Path traversal in Langflow OSS
- CVE-2026-18898 UTT HiPER 1200GW ConfigAdvideo strcpy stack-based overflow
- CVE-2026-18897 UTT HiPER 1250GW getOneApConfTempEntry strcpy stack-based overflow
- CVE-2026-18896 lavkush-maurya Student-Registration-System changepass.php sql injection
- CVE-2026-18895 UTT HiPER 1250GW APSecurity_5g strcpy stack-based overflow
- CVE-2026-18894 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-18891 Auth bypass in Langflow OSS
- CVE-2026-1889 Outgrow <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'outgrow' Shortcode 'id' Attribute
- CVE-2026-18888 Memory corruption in BI Connector ODBC Driver
- CVE-2026-18887 IBM i is Affected By Sensitive Information Exposure Vulnerability in PASE []
- CVE-2026-18886 Unauthenticated Privilege Escalation via System Configuration Image Upload Processor
- CVE-2026-18885 Unauthenticated Remote Code Execution in GraphQL Composite Data API
- CVE-2026-18884 WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters
- CVE-2026-18881 TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter
- CVE-2026-1888 Docus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-18875 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
- CVE-2026-18874 Code injection in Red Hat Advanced Cluster Management for Kubernetes 2.11
- CVE-2026-18872 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
- CVE-2026-18871 Power System Buffer Overflow
- CVE-2026-18870 This Power System update is being released to address
- CVE-2026-18869 IBM i is Affected By Denial of Service and Security Restriction Bypass Vulnerabilities in FTP [, ]
- CVE-2026-18860 Velociraptor incorrect Org deletion permissions check
- CVE-2026-1886 Cross-site scripting in Go Night Pro | WordPress Dark Mode Plugin
- CVE-2026-18859 ESAFENET CDG usbkey;logindojojs sql injection
- CVE-2026-18858 IBM i is Affected By Obtaining Sensitive Information Vulnerability in OpenSSH []
- CVE-2026-18857 This Power System update is being released to address
- CVE-2026-18856 Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery
- CVE-2026-18855 Link Library <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter
- CVE-2026-18854 Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql injection
- CVE-2026-18853 ZomboDroid Meme Generator App com.zombodroid.MemeGenerator t5.l.c path traversal
- CVE-2026-18852 epsilla-cloud vectordb Filter expr.cpp ShuntingYard unusual condition
- CVE-2026-18851 Missing authorization in Endpoint Manager Mobile
- CVE-2026-1885 Cross-site scripting in Slideshow Wp
- CVE-2026-18849 IBM OpenBMC Code Execution
- CVE-2026-18848 Power System Cross-Site Request Forgery (CSRF)
- CVE-2026-18847 IBM i is Affected By Multiple Vulnerabilities in Navigator for i
- CVE-2026-18846 IBM i is Affected By Multiple Vulnerabilities in Host Servers
- CVE-2026-18844 Pulsetto Vagus Nerve Stimulator Hidden Functionality
- CVE-2026-18843 Cross-site scripting in Beaver Builder Plugin (Starter Version)
- CVE-2026-18842 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-18840 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-1884 ZenTao Webhook model.php fetchHook server-side request forgery
- CVE-2026-18839 Popt-devel: popt-static: size_t underflow in singleoptionhelp
- CVE-2026-18835 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-18832 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-18830 Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API
- CVE-2026-1883 Wicked Folders <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion
- CVE-2026-18828 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-18825 Origin validation error in the connect-xcors npm package
- CVE-2026-18824 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-18822 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-18821 Power System Out-of-bounds Write
- CVE-2026-18819 RackTables cross-site request forgery
- CVE-2026-18818 Ehco1996 django-sspanel Support Ticket views.py TicketDetailView authorization
- CVE-2026-18817 Baserow Inactive Non-Staff User serializers.py BaserowImpersonateAuthTokenSerializer improper authorization
- CVE-2026-18816 Baserow 2FA Verify Endpoint views.py verify improper authentication
- CVE-2026-18814 H3C NX15 esps reload.reload_config command injection
- CVE-2026-18813 H3C NX15 esps delete command injection
- CVE-2026-18812 H3C NX15 esps esps.ipv6.wan command injection
- CVE-2026-18811 H3C NX15 esps add command injection
- CVE-2026-18810 H3C NX15 networkSetup missing authentication
- CVE-2026-1881 Broadstreet <= 1.52.2 - Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta
- CVE-2026-18809 Information disclosure in Firefox for Android and Firefox Focus for Android
- CVE-2026-18808 Unauthenticated Remote Code Execution via Code Injection in Klemsan's KIO
- CVE-2026-18807 ECS < 4.3.13 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers
- CVE-2026-18806 Arbitrary Block Device Write via Missing Validation in TÜBİTAK BİLGEM's pardus-image-writer
- CVE-2026-18801 Stored Clickhouse SQL Injection Through Customer Usage Attribution
- CVE-2026-1880 Race condition in DriverHub
- CVE-2026-18799 Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users
- CVE-2026-18798 QUIC Server May Trigger Double Free When Processing INITIAL Packet
- CVE-2026-18796 QSPI flash encryption side-channel leakage
- CVE-2026-18795 Missing server side validation allowed user to quarantine a DM and GM post
- CVE-2026-18794 OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite
- CVE-2026-18790 Systerel S2OPC DeleteMonitoredItemsRequest state_machine.c out-of-bounds
- CVE-2026-1879 Harvard University IQSS Dataverse Theme Customization ThemeAndWidgets.xhtml unrestricted upload
- CVE-2026-18789 Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes
- CVE-2026-18788 Trippo ResponsiveFilemanager dialog.php unrestricted upload
- CVE-2026-18787 GL.iNet AX1800 RPC Endpoint oui-rpc.lua remove_rule command injection
- CVE-2026-18786 CheckView < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass
- CVE-2026-18785 o6 open62541 client_types_custom.c UA_Client_getRemoteDataTypes use after free
- CVE-2026-18784 o6 open62541 ua_client_highlevel.c UA_Client_readNodeClassAttribute heap-based overflow
- CVE-2026-18783 Missing Server-Side Authentication on REST API Endpoint in Trex Digital Manufacturing's Trex MES
- CVE-2026-18782 SQL Injection in Trex Digital Manufacturing's Trex MES
- CVE-2026-18781 File upload in Drag and Drop Multiple File Upload for Contact Form 7
- CVE-2026-18780 CSRF in TMT Machine's Talassoft Industrial Management Software
- CVE-2026-1878 Race condition in Driver( Headset )
- CVE-2026-18779 Missing authorization in TrueBooker
- CVE-2026-18778 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX Actions
- CVE-2026-18777 Missing authorization in TrueBooker
- CVE-2026-18776 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions