Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 834 of 1013.
- CVE-2026-18295 GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2026-18294 OriginLab Origin Viewer OGW File Parsing Memory Corruption Remote Code Execution Vulnerability
- CVE-2026-18293 OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2026-18292 OriginLab OriginPro OGG File Parsing Memory Corruption Remote Code Execution Vulnerability
- CVE-2026-18291 OriginLab OriginPro OGW File Parsing Memory Corruption Remote Code Execution Vulnerability
- CVE-2026-18290 OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2026-1829 Content Visibility for Divi Builder <= 4.02 - Authenticated (Contributor+) Remote Code Execution
- CVE-2026-18289 OriginLab OriginPro OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2026-18288 OriginLab OriginPro OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2026-18287 Aeon load_time_series_segmentation_benchmark Code Injection Remote Code Execution Vulnerability
- CVE-2026-18286 Aeon load_human_activity_segmentation_datasets Code Injection Remote Code Execution Vulnerability
- CVE-2026-18285 Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2026-18284 Sony XAV-9500ES Crash Dump Handler Command Injection Local Privilege Escalation Vulnerability
- CVE-2026-18283 Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability
- CVE-2026-18282 Sony XAV-9500ES AVRCP_Br_Response_Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-18281 Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-18280 Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability
- CVE-2026-18279 Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-18278 Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read Information Disclosure Vulnerability
- CVE-2026-18277 Missing Authorization in eScriptorium
- CVE-2026-18276 Missing Authorization in eScriptorium
- CVE-2026-18275 Authorization Bypass Through User-Controlled Key in eScriptorium
- CVE-2026-18274 Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability
- CVE-2026-18273 Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability
- CVE-2026-18272 Kenwood DNR1007XR startUpdateProcess Command Injection Vulnerability
- CVE-2026-18271 Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability
- CVE-2026-18270 Kenwood DNR1007XR udhcpd Incorrect Permission Assignment Local Privilege Escalation Vulnerability
- CVE-2026-1827 Cross-site scripting in IDE Micro code-editor
- CVE-2026-18269 Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write Code Execution Vulnerability
- CVE-2026-18268 Kenwood DNR1007XR JKGenService Command Injection Local Privilege Escalation Vulnerability
- CVE-2026-18267 Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability
- CVE-2026-18266 Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability
- CVE-2026-18265 OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability
- CVE-2026-18264 NoMachine getstat Command Injection Remote Code Execution Vulnerability
- CVE-2026-18263 Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability
- CVE-2026-18262 Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability
- CVE-2026-18261 Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092
- CVE-2026-18260 Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110
- CVE-2026-1826 OpenPOS Lite <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-18259 Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090
- CVE-2026-18258 Authorization Bypass Through User-Controlled Key in eScriptorium
- CVE-2026-18257 Improper Certificate Validation in S2OPC
- CVE-2026-18256 Private team metadata disclosure via the team search API
- CVE-2026-18255 Quay: quay: global read-only superuser can view robot account tokens
- CVE-2026-18252 Inclusion of Functionality from Untrusted Control Sphere in GitLab
- CVE-2026-18251 IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.
- CVE-2026-18250 IBM i is Affected By Multiple Vulnerabilities in Navigator for i
- CVE-2026-1825 Show YouTube video <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
- CVE-2026-18249 IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime
- CVE-2026-18248 @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header
- CVE-2026-18247 DOM-Based Cross-Site Scripting in BlackBerry AtHoc Web Portals
- CVE-2026-18246 IBM i is Affected By security restrictions bypass in Navigator for i
- CVE-2026-18245 Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react
- CVE-2026-18244 Missing Authorization in GitLab
- CVE-2026-18243 HP DesignJet T3500 - Potential Cross-Site Scripting (XSS)
- CVE-2026-1824 Cross-site scripting in Infomaniak Connect for OpenID
- CVE-2026-18238 OOBR in rpcap client in libpcap before 1.10.7
- CVE-2026-18236 Google-ADK Continuation Forgery
- CVE-2026-18235 IBM i is Affected By Multiple Vulnerabilities in Navigator for i
- CVE-2026-18234 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet
- CVE-2026-18233 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion
- CVE-2026-18232 WP Directory Kit <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map_infowindow
- CVE-2026-18231 WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user
- CVE-2026-18230 WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter
- CVE-2026-1823 Consensus Embed <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute
- CVE-2026-18228 Hyperscale Path Traversal
- CVE-2026-18223 Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access
- CVE-2026-18221 IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [, ]
- CVE-2026-18220 Binutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processing
- CVE-2026-1822 WP NG Weather <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-18218 Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero
- CVE-2026-18217 Other in Red Hat Build of Keycloak
- CVE-2026-18216 Backup Migration < 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-Login
- CVE-2026-18215 Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant
- CVE-2026-18214 Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction
- CVE-2026-18212 Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state
- CVE-2026-18211 Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains
- CVE-2026-18210 SQL Injection in TRtek Technological Products's Store
- CVE-2026-1821 Microtango <= 0.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-18209 Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check
- CVE-2026-18208 Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim
- CVE-2026-18207 Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching
- CVE-2026-18206 Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass
- CVE-2026-18205 XSS in Ticimax Informatics' Ticimax E-Commerce Platform
- CVE-2026-18203 Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes
- CVE-2026-18202 JetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload
- CVE-2026-18201 Missing authorization in Red Hat Data Grid 8
- CVE-2026-18200 FoodBoxBooker < 1.0.8 - Subscriber+ Arbitrary User Profile Update
- CVE-2026-1820 Cross-site scripting in Media Library Alt Text Editor
- CVE-2026-18198 SQL Injection in TAC Information's GoldenHorn
- CVE-2026-18197 Cross-site scripting in Link Library
- CVE-2026-18193 IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime
- CVE-2026-18192 Vacron｜IP Camera - Arbitrary File Read
- CVE-2026-18191 Vacron｜IP Camera - Hidden Functionality
- CVE-2026-1819 Stored XSS in Karel Electronics' ViPort
- CVE-2026-18188 A format string vulnerability was found in the Rsync Backup on the ADM
- CVE-2026-18187 A format string vulnerability was found in the Internal Backup on the ADM
- CVE-2026-18186 A stored format string vulnerability was found in the FTP Backup on the ADM
- CVE-2026-18185 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
- CVE-2026-18184 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities