Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 849 of 1013.
- CVE-2026-16485 SourceCodester Class and Exam Timetabling System class.php cross site scripting
- CVE-2026-16484 SourceCodester Class and Exam Timetabling System edit_subjecta.php sql injection
- CVE-2026-16482 rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter
- CVE-2026-16481 Server-side request forgery in MCP Toolbox for Databases (googleapis/mcp-toolbox)
- CVE-2026-16480 Missing authorization in Db2
- CVE-2026-1648 Performance Monitor <= 1.0.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter
- CVE-2026-16477 Insecure Deserialization of .cleanshot Files in CleanShot X
- CVE-2026-16473 Sbc: sbc: heap out-of-bounds read via crafted sbc audio frame
- CVE-2026-16471 Broken Access Control in Dolusoft Software's Sonlogger
- CVE-2026-1647 Comment Genius <= 1.2.5 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
- CVE-2026-16469 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-16468 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-16467 Broken Access Control in Dolusoft Software's Fortilogger
- CVE-2026-16466 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-16465 DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD
- CVE-2026-16463 DXF File Parsing Heap-Based Overflow in Autodesk AutoCAD
- CVE-2026-16462 SQL injection via unauthenticated GetGridData endpoint
- CVE-2026-16461 Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbdump() short-mode version-list formatting
- CVE-2026-16460 Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization
- CVE-2026-1646 Advance Block Extend <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleColor Block Attribute
- CVE-2026-16459 Timing side-channel in RSA PKCS#1 v1.5 decryption in Oberon PSA Crypto
- CVE-2026-16458 Timing side-channel in RSA PKCS#1 v1.5 decryption in ocrypto
- CVE-2026-16456 Odh-model-controller: odh-model-controller: cross-namespace secret read via nim account crd confused deputy
- CVE-2026-16455 Local privilege escalation via improper input sanitization in execl() call
- CVE-2026-16454 Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration
- CVE-2026-16453 Mattermost SAML RelayState forgery allows unauthorized team membership
- CVE-2026-16451 zsadmin2025 ZS-Admin com.zs.file.controller.SysFileController upload unrestricted upload
- CVE-2026-16450 zsadmin2025 ZS-Admin MyBatis-Plus Tenant Plugin page getTenantId authorization
- CVE-2026-1645 Cross-site scripting in Hostel
- CVE-2026-16449 zsadmin2025 ZS-Admin com.zs.sys.dept.controller.SysDeptController page OrderItem.desc sql injection
- CVE-2026-16448 D-Link DNS-1550-04 remote_backup.cgi cgi_check_rsync_rw command injection
- CVE-2026-16447 D-Link DNS-320 multi_uploadify.php unrestricted upload
- CVE-2026-16445 Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module
- CVE-2026-16444 Improper Validation of File Paths in TeamViewer Desktop Clients
- CVE-2026-16443 Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation
- CVE-2026-16442 Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction
- CVE-2026-16441 Eclipse OpenJ9 : Method resolution default method precedence failure
- CVE-2026-16440 Denial of service in Eclipse OpenJ9
- CVE-2026-1644 WP Frontend Profile <= 1.3.8 - Cross-Site Request Forgery to Unauthorized User Account Approval or Rejection
- CVE-2026-16439 Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow
- CVE-2026-16438 An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64
- CVE-2026-16437 Auth bypass in AnalytiX
- CVE-2026-16436 Auth bypass in AnalytiX
- CVE-2026-16435 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- CVE-2026-16434 Adminer before 5.5.1 X-Forwarded-Prefix Backslash Bypass
- CVE-2026-16432 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-1643 MP-Ukagaka <= 1.5.2 - Reflected Cross-Site Scripting
- CVE-2026-16428 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-16426 Multiple Vulnerabilities in IBM Concert Software
- CVE-2026-16424 Use after free in Chrome
- CVE-2026-16423 Use after free in Chrome
- CVE-2026-16422 Security feature bypass in Chrome
- CVE-2026-16421 Code injection in Chrome
- CVE-2026-16420 Memory corruption in Chrome
- CVE-2026-1642 NGINX vulnerability
- CVE-2026-16419 Memory corruption in Chrome
- CVE-2026-16418 Memory corruption in Chrome
- CVE-2026-16417 Information disclosure in Chrome
- CVE-2026-16416 Integer overflow in Chrome
- CVE-2026-16415 Other in Chrome
- CVE-2026-16414 Security feature bypass in Chrome
- CVE-2026-16413 Memory corruption in Chrome
- CVE-2026-16412 Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153
- CVE-2026-16411 Memory safety bugs fixed in Thunderbird 153
- CVE-2026-16410 JIT miscompilation in the JavaScript Engine: JIT component
- CVE-2026-1641 Server-side request forgery in Wow Elements Addons for Elementor
- CVE-2026-16409 Invalid pointer in the Security: PSM component
- CVE-2026-16408 Integer overflow in the Audio/Video: Playback component
- CVE-2026-16407 Mitigation bypass in the DOM: Service Workers component
- CVE-2026-16406 Mitigation bypass in the Networking component
- CVE-2026-16405 Information disclosure in the Networking: WebSockets component
- CVE-2026-16404 Spoofing issue in Firefox for Android
- CVE-2026-16403 Spoofing issue in the Address Bar component
- CVE-2026-16402 Integer overflow in the Graphics: ImageLib component
- CVE-2026-16401 Privilege escalation in the Data Loss Prevention component
- CVE-2026-16400 Information disclosure in the DOM: Security component
- CVE-2026-1640 Taskbuilder <= 5.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Project/Task Comment Creation
- CVE-2026-16399 Site isolation issue in the DOM: Navigation component
- CVE-2026-16398 Site isolation issue in the Graphics component
- CVE-2026-16397 Clickjacking issue in the WebExtensions component in Firefox for Android
- CVE-2026-16396 Privilege escalation in WebExtensions
- CVE-2026-16395 Integer overflow in the Audio/Video component
- CVE-2026-16394 Mitigation bypass in the DOM: Security component
- CVE-2026-16393 Incorrect boundary conditions in the Graphics: WebGPU component
- CVE-2026-16392 JIT miscompilation in the JavaScript Engine: JIT component
- CVE-2026-16391 Information disclosure in the Storage: IndexedDB component
- CVE-2026-16390 Mitigation bypass in the Enterprise Policies component
- CVE-2026-1639 Taskbuilder <= 5.0.2 - Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters
- CVE-2026-16389 Incorrect boundary conditions, integer overflow in the Libraries component in NSS
- CVE-2026-16388 Sandbox escape in the DOM: Networking component
- CVE-2026-16387 Site isolation issue in the Networking component
- CVE-2026-16386 Information disclosure due to uninitialized memory in the Graphics: WebGPU component
- CVE-2026-16385 Information disclosure due to uninitialized memory in the Graphics: WebGPU component
- CVE-2026-16384 Information disclosure due to uninitialized memory in the Graphics: WebGPU component
- CVE-2026-16383 Mitigation bypass in the DOM: Networking component
- CVE-2026-16382 Mitigation bypass in the DOM: Service Workers component
- CVE-2026-16381 Same-origin policy bypass in the Networking: DNS component
- CVE-2026-16380 Mitigation bypass in the Networking component
- CVE-2026-1638 Tenda AC21 mDMZSetCfg command injection
- CVE-2026-16379 Privilege escalation in the DOM: Content Processes component