Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 830 of 1013.
- CVE-2026-18775 NousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side request forgery
- CVE-2026-18774 Server-side request forgery in hermes-agent
- CVE-2026-18773 NousResearch hermes-agent Quick run.py _check_slash_access authorization
- CVE-2026-18772 Denial of service in rlottie
- CVE-2026-18771 Missing Authentication for Critical Function in TMT Machine's Talassoft Industrial Management Software
- CVE-2026-18770 vibesurf-ai VibeSurf Python Validation code code injection
- CVE-2026-1877 Auto Post Scheduler <= 1.84 - Cross-Site Request Forgery to Stored Cross-Site Scripting via aps_options_page
- CVE-2026-18766 chetans9 core-php-admin-panel customers.php sql injection
- CVE-2026-18765 SQL Injection in Teracity Sotware's Teracity E-OSB Platform
- CVE-2026-1876 Denial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series Ethernet module
- CVE-2026-18759 An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.
- CVE-2026-18756 HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering
- CVE-2026-18755 GV-ASManager DLL hijacking vulnerability
- CVE-2026-18754 Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)
- CVE-2026-18753 Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-ASManager)
- CVE-2026-18752 Persistent Login <= 3.1.0 - Authenticated (Subscriber+) SQL Injection via 'wppl_device_id' Cookie
- CVE-2026-18751 Citrix Workspace App for Mac Security Bulletin for CVE-2026-18751
- CVE-2026-18750 CVE-2026-18750
- CVE-2026-1875 Denial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series EtherNet/IP module
- CVE-2026-18749 CVE-2026-18749
- CVE-2026-18748 Out-of-bounds read in Bluetooth Classic A2DP codec information element handling
- CVE-2026-18747 Integer underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read
- CVE-2026-18746 NULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhausted
- CVE-2026-18744 CVE-2026-18744
- CVE-2026-18743 Popt-devel: popt-static: short realloc in poptconfigfiletostring
- CVE-2026-18741 Worksuite SaaS version prior to 6.0.14 Stored XSS via Asset Management Location and Description Fields
- CVE-2026-18740 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-1874 Denial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series EtherNet/IP module and Ethernet module
- CVE-2026-18739 Popt-devel: popt-static: off-by-one in poptstuffargs
- CVE-2026-18738 Shlink CSV Formula Injection via Visit Export CLI
- CVE-2026-18737 Shlink Blind SQL Injection via tags/stats orderBy Parameter
- CVE-2026-18736 Shlink Server-Side Request Forgery via Short URL Title Auto-Resolution
- CVE-2026-18733 Prompt injection bypasses shell tool consent gate in Strands Agents Tools
- CVE-2026-18730 Server-side request forgery in Enterprise Server
- CVE-2026-18729 Code injection in Langflow OSS
- CVE-2026-18728 Open-iscsi: open-iscsi: integer underflow in iscsiuio ipv4 dhcp parsing
- CVE-2026-18727 Open-iscsi: open-iscsi: integer underflow in iscsiuio dhcpv6 parsing
- CVE-2026-18726 Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing
- CVE-2026-18723 diaowen DWSurvey Survey Status up-survey-status.do improper authorization
- CVE-2026-18722 diaowen DWSurvey dev-survey.do in DwDeisgnSurveyController.devSurvey. authorization
- CVE-2026-18721 kalcaddle kodbox SSO API Login apiLogin redirect
- CVE-2026-18720 kalcaddle kodbox msgWarning Plugin action improper authorization
- CVE-2026-18719 cemtan sar2html Search sar2html.py sql injection
- CVE-2026-18718 Ghidra Swift Demangler Analyzer Arbitrary Code Execution via Project State
- CVE-2026-18717 Improper Certificate Validation in ASE 2000
- CVE-2026-18716 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-18715 IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty
- CVE-2026-18713 IBM i is Affected By Multiple Vulnerabilities in Navigator for i
- CVE-2026-18712 Missing authorization in MongoDB Server
- CVE-2026-18711 Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure
- CVE-2026-18710 Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization
- CVE-2026-1871 Authenticated Stack-based Buffer Overflow in RTSP Authentication of Tapo C200
- CVE-2026-18709 Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency
- CVE-2026-18708 Code injection in MongoDB Server
- CVE-2026-18707 Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service
- CVE-2026-18706 Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution
- CVE-2026-18705 Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data
- CVE-2026-18704 Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations
- CVE-2026-18703 Auth bypass in MongoDB Server
- CVE-2026-18702 Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings
- CVE-2026-18701 Type Confusion in MongoDB Query Subsystem Leads to Denial of Service
- CVE-2026-18700 Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service
- CVE-2026-1870 Thim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure
- CVE-2026-18699 Improper Input Validation in MongoDB Query Planner Leads to Denial of Service
- CVE-2026-18698 Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command
- CVE-2026-18697 Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos
- CVE-2026-18696 Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections
- CVE-2026-18695 Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service
- CVE-2026-18694 Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disclosure
- CVE-2026-18693 Memory corruption in MongoDB Server
- CVE-2026-18692 Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution
- CVE-2026-18691 Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure
- CVE-2026-18690 Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections
- CVE-2026-1869 User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass
- CVE-2026-18688 Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure
- CVE-2026-18687 Integer overflow in MongoDB Server
- CVE-2026-18686 GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection
- CVE-2026-18685 GL.iNet GL-MT3000 modem.so glc set_upgrade command injection
- CVE-2026-18684 GL.iNet GL-MT3000 modem.so glc remove_profile command injection
- CVE-2026-18683 IBM i is Affected By privilege escalation in Navigator for i
- CVE-2026-18682 OpenAkita File Upload API upload cross site scripting
- CVE-2026-18681 This Power System Buffer Overflow
- CVE-2026-1868 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
- CVE-2026-18679 Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured
- CVE-2026-18678 Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured
- CVE-2026-18677 Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity
- CVE-2026-18676 Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin
- CVE-2026-18675 Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid
- CVE-2026-18674 Security feature bypass in Kong Mesh
- CVE-2026-18673 Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication
- CVE-2026-18672 RadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-18671 IBM i is Affected By Multiple Vulnerabilities in NetServer
- CVE-2026-18670 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-1867 WP Front User Submit < 5.0.6 - Unauthenticated Sensitive Information Exposure
- CVE-2026-18669 IBM i is Affected By A Privilege Escalation Vulnerability []
- CVE-2026-18667 Sensor Proxy Version 1.4.2 Fixes One Vulnerability
- CVE-2026-18666 Library Management System < 3.6.7 - Subscriber+ SQL Injection via Filter Value
- CVE-2026-18664 Wrong interpretation of ACL ranges
- CVE-2026-18663 Memory corruption in Red Hat Directory Server 11
- CVE-2026-18662 In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http