Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 846 of 1013.
- CVE-2026-16841 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16840 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-1684 Free5GC SMF PFCP UDP Endpoint pfcp_reports.go HandleReports denial of service
- CVE-2026-16839 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16838 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16837 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16836 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16835 Power System Improper Certificate Validation
- CVE-2026-16834 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16833 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16832 Power System Buffer Overflow
- CVE-2026-16831 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16830 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-1683 Free5GC SMF PFCP handler.go HandlePfcpSessionReportRequest denial of service
- CVE-2026-16829 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16828 Power System Out-of-bounds Read
- CVE-2026-16827 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16826 IBM i is Affected By Multiple Vulnerabilities in Debug Server
- CVE-2026-16825 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16824 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16823 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-16822 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16821 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-1682 Free5GC SMF PFCP UDP Endpoint handler.go HandlePfcpAssociationReleaseRequest null pointer dereference
- CVE-2026-16819 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16818 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16817 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16816 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16815 IBM i is Affected By Multiple Vulnerabilities in Simple Mail Transfer Protocol
- CVE-2026-16814 Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-16812 Arista VeloCloud Orchestrator On-Prem OS Command Injection
- CVE-2026-16811 ShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
- CVE-2026-16810 Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter
- CVE-2026-1681 net: Stack Overflow with Ping (to own IP Address) via Shell
- CVE-2026-16809 LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering
- CVE-2026-16807 Memory corruption in Chrome
- CVE-2026-16806 Use after free in Chrome
- CVE-2026-16805 Use after free in Chrome
- CVE-2026-16804 Use after free in Chrome
- CVE-2026-16802 Information disclosure in PowerShell Universal
- CVE-2026-16801 Code injection in PowerShell Universal
- CVE-2026-16800 Code injection in PowerShell Universal
- CVE-2026-1680 Local Privilege Escalation in Local Admin Service
- CVE-2026-16799 Missing authorization in PowerShell Universal
- CVE-2026-16798 Information disclosure in PowerShell Universal
- CVE-2026-16797 Missing authorization in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
- CVE-2026-16796 Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
- CVE-2026-16794 Missing Authorization in GitLab
- CVE-2026-16793 Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator
- CVE-2026-16792 Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator
- CVE-2026-16791 Predictable Temporary File Symlink Vulnerability in Lenovo XClarity Essentials OneCLI
- CVE-2026-1679 net: eswifi socket send payload length not bounded
- CVE-2026-16788 Cross-site scripting in Live Composer – Free WordPress Website Builder
- CVE-2026-16787 Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode
- CVE-2026-16786 Cross-site scripting in Live Composer – Free WordPress Website Builder
- CVE-2026-16783 ABC File Parsing Out-of-Bounds Write Vulnerability in Autodesk 3ds Max
- CVE-2026-16782 SVG File Parsing Out-of-Bounds Read Vulnerability in Autodesk 3ds Max
- CVE-2026-16781 SVG File Parsing Stack Exhaustion Vulnerability in Autodesk 3ds Max
- CVE-2026-1678 dns: memory‑safety issue in the DNS name parser
- CVE-2026-16779 Missing authorization in Kubio AI Page Builder
- CVE-2026-16778 Cross-site scripting in Live Composer – Free WordPress Website Builder
- CVE-2026-16777 Path traversal in Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers
- CVE-2026-16776 MP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-16775 Cross-site scripting in Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
- CVE-2026-16774 WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action
- CVE-2026-16773 WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action
- CVE-2026-16772 CVE-2026-16772
- CVE-2026-16771 CVE-2026-16771
- CVE-2026-16770 Command injection in PDF::WebKit
- CVE-2026-1677 net: TLS 1.2 connections allowed on TLS 1.3 sockets
- CVE-2026-16769 RS9116W/SiWx917 plaintext pause encryption request causes DOS
- CVE-2026-16768 Gdk-pixbuf: out-of-bounds read in ico parser
- CVE-2026-16767 Ne-Lexa php-zip ZIP ZipFile.php extractTo path traversal
- CVE-2026-16766 Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options
- CVE-2026-16765 CodeAstro Online Classroom loginlinkadmin.php sql injection
- CVE-2026-16764 OWASP DefectDojo API/Web serializers.py UserSerializer privileges management
- CVE-2026-16763 localstack serverless-localstack Configuration index.js os command injection
- CVE-2026-16762 Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt
- CVE-2026-16759 Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters
- CVE-2026-16758 Snippet Shortcodes <= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-16756 Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service
- CVE-2026-16755 Information disclosure in Smart Camera C33
- CVE-2026-16754 Security feature bypass in Smart Camera C33
- CVE-2026-16753 CVE-2026-16753
- CVE-2026-16751 Ente Museum Server Authorization Bypass Vulnerability
- CVE-2026-16750 Missing authorization in Motors – Car Dealership & Classified Listings Plugin
- CVE-2026-1675 Advanced Country Blocker <= 2.3.1 - Unauthenticated Authorization Bypass via Insecure Default Secret Key
- CVE-2026-16747 Kirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions
- CVE-2026-16746 MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint
- CVE-2026-16745 Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation
- CVE-2026-16743 Accountsservice: accountsservice: arbitrary file read via seticonfile for systemd-homed users
- CVE-2026-16742 systemd-homed: local privilege escalation via missing home-record signature verification on the authenticate path
- CVE-2026-16741 OS Command in TR7 Cyber Defense's TR7 ASP
- CVE-2026-16740 Missing Authentication for Critical Function in TR7 Cyber Defense's TR7 ASP
- CVE-2026-1674 Missing authorization in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder
- CVE-2026-16739 Epeken All Kurir <= 2.1.4 - Unauthenticated Order Payment Confirmation Forgery
- CVE-2026-16738 Conekta Payment Gateway < 6.2.2 - Unauthenticated Order Payment Completion via Webhook Forgery
- CVE-2026-16737 WP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart
- CVE-2026-16736 User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled
- CVE-2026-16735 release-it conventional-changelog Changelog File index.js writeChangelog os command injection