Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 851 of 1013.
- CVE-2026-16264 Newsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDOR
- CVE-2026-16263 WP Maps < 4.9.7 - Subscriber+ Local File Inclusion
- CVE-2026-16262 Estatik < 4.3.3 - Login CSRF
- CVE-2026-16261 Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover
- CVE-2026-16260 Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field
- CVE-2026-1626 Weak cryptography in SICK LMS1000
- CVE-2026-16259 Uix UserCenter <= 1.0.3 - Unauthenticated Privilege Escalation
- CVE-2026-16258 Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint
- CVE-2026-16257 Arvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling
- CVE-2026-16256 Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation
- CVE-2026-16255 Incorrect Authorization in GitLab
- CVE-2026-16254 Claircore: claircore: denial of service via out-of-bounds slice in claircore's apk installed-database parser
- CVE-2026-16253 Total Upkeep < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret
- CVE-2026-16252 Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System Staffshinel Ds.jsp sql injection
- CVE-2026-16251 Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering
- CVE-2026-16250 Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload
- CVE-2026-1625 D-Link DWR-M961 SMS Message formSmsManage sub_4250E0 command injection
- CVE-2026-16248 Tenda AC10 httpd/netctrl AdvSetLanip fromAdvSetLanip stack-based overflow
- CVE-2026-16247 Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN
- CVE-2026-16246 Insecure permission assignment due to execution of LogPathConfig.exe during setup
- CVE-2026-16244 itsourcecode Hospital Management System prescriptionorderreport.php sql injection
- CVE-2026-16243 Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero
- CVE-2026-16242 Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates
- CVE-2026-16241 PostgreSQL ECPG integer underflow can crash the client
- CVE-2026-1624 D-Link DWR-M961 formLtefotaUpgradeFibocom command injection
- CVE-2026-16239 PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code
- CVE-2026-16238 PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code
- CVE-2026-16236 Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2026-16235 Crypt::Password versions through 0.28 for Perl generate insecure random values for salts
- CVE-2026-16234 Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI
- CVE-2026-16233 Out-of-Bounds Write Vulnerability in NI LabVIEW when loading VI
- CVE-2026-16232 Check Point SmartConsole Improper Authentication
- CVE-2026-16231 hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass
- CVE-2026-16230 Formidable Digital Signatures <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field
- CVE-2026-1623 Totolink A7000R cstecgi.cgi setUpgradeFW command injection
- CVE-2026-16229 itsourcecode Courier Management System index.php cross site scripting
- CVE-2026-16228 SourceCodester Class and Exam Timetabling System edit_schoolyr.php sql injection
- CVE-2026-16227 SourceCodester Class and Exam Timetabling System edit_subject.php sql injection
- CVE-2026-16226 SourceCodester Pizzafy Ecommerce System admin_class_novo.php save_settings unrestricted upload
- CVE-2026-16225 davenardella snap7 s7_peer.cpp NegotiatePDULength out-of-bounds write
- CVE-2026-16224 jxxghp MoviePilot Application API improper authorization
- CVE-2026-16223 1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery
- CVE-2026-16222 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery
- CVE-2026-16221 fast-uri vulnerable to host confusion via literal backslash authority delimiter
- CVE-2026-16220 code-projects Online Examination System account.php cross site scripting
- CVE-2026-1622 Unredacted data exposure in query.log
- CVE-2026-16219 Croogo CMS Admin File Manager FileManager.php isEditable path traversal
- CVE-2026-16218 hunvreus devpush Storage Reset Failure storage.py reset_storage improper check or handling of exceptional conditions
- CVE-2026-16217 guohongze adminset Delivery Deployment Endpoint deli.py authorization
- CVE-2026-16216 geex-arts django-jet OAuth cross-site request forgery
- CVE-2026-16215 geex-arts django-jet OAuth Credential Revoke authorization
- CVE-2026-16214 geex-arts django-jet Dashboard views.py authorization
- CVE-2026-16213 Fantomas42 django-blog-zinnia Protected Entry Password entry_protection.py cleartext storage
- CVE-2026-16212 awesto django-shop Purchase Stock inventory.py race condition
- CVE-2026-16211 allegro Hostname Allocation assets.py AssetLastHostname.increment_hostname race condition
- CVE-2026-16210 newpanjing simpleui AjaxAdmin AJAX Endpoint admin.py self.get_action missing authentication
- CVE-2026-1621 Register Bypass in Universal Sotware's E-Municipality
- CVE-2026-16209 Gerapy Project Upload Endpoint views.py missing authentication
- CVE-2026-16208 django-tastypie throttle.py CacheDBThrottle race condition
- CVE-2026-16207 django-tastypie authentication.py ApiKeyAuthentication get request method with sensitive query strings
- CVE-2026-16206 django-oauth django-oauth-toolkit oauth2_validators.py _load_id_token session expiration
- CVE-2026-16205 Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting
- CVE-2026-16204 zevorn rt-claw Telegram-to-AI Tool Execution Flow script.c tool_run_script_execute code injection
- CVE-2026-16203 SourceCodester Class and Exam Timetabling System forCYS.php cross site scripting
- CVE-2026-16202 SourceCodester Class and Exam Timetabling System CYS.php cross site scripting
- CVE-2026-16201 zevorn rt-claw http_request net.c claw_net_post information disclosure
- CVE-2026-16200 zevorn rt-claw RPC swarm.c claw_tool_invoke authorization
- CVE-2026-1620 Livemesh Addons by Elementor <= 9.0 - Authenticated (Contributor+) Local File Inclusion via Widget Template Parameter
- CVE-2026-16199 nextlevelbuilder GoClaw credentialed_exec.go ExecTool.Execute improper authorization
- CVE-2026-16198 Sipeed PicoClaw First Run Setup access_control.go authentication bypass
- CVE-2026-16197 Sipeed PicoClaw Group Message feishu_64.go handleMessageReceive authorization
- CVE-2026-16196 Sipeed PicoClaw web_fetch web.go isPrivateOrRestrictedIP server-side request forgery
- CVE-2026-16195 Sipeed PicoClaw Group Message wecom.go dispatchIncoming authorization
- CVE-2026-16194 zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery
- CVE-2026-16192 IBM WebSphere Application Server Liberty is affected by a denial of service
- CVE-2026-16190 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- CVE-2026-1619 IDOR in Universal Sotware's FlexCity/Kiosk
- CVE-2026-16189 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- CVE-2026-16188 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- CVE-2026-16187 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- CVE-2026-16186 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- CVE-2026-16185 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- CVE-2026-16184 IBM WebSphere Application Server is affected by an authentication bypass
- CVE-2026-16182 IBM DataPower Gateway NULL Pointer Dereference
- CVE-2026-16181 IBM DataPower Gateway Improper Authorization
- CVE-2026-16180 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
- CVE-2026-1618 Admin Account Takeover in Universal Sotware's FlexCity/Kiosk
- CVE-2026-16179 IBM DataPower Gateway Buffer Underwrite
- CVE-2026-16178 IBM DataPower Gateway Out-of-bounds Write
- CVE-2026-16177 IBM DataPower Gateway Out-of-bounds Read
- CVE-2026-16176 IBM DataPower Gateway Denial of Service
- CVE-2026-16174 Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow
- CVE-2026-16172 Netskope Endpoint DLP Service Out-of-Bounds Read Leading to Process Crash
- CVE-2026-16170 IBM DataPower Gateway Out-of-bounds Write
- CVE-2026-1617 SQLi in Turkmesh's Turkhotspot 5651 Loglama
- CVE-2026-16169 IBM DataPower Gateway Denial of Service
- CVE-2026-16167 IBM DataPower Gateway Out-of-bounds Write
- CVE-2026-16165 IBM DataPower Gateway NULL Pointer Dereference
- CVE-2026-16164 IBM DataPower Gateway Out-of-bounds Write
- CVE-2026-16163 IBM DataPower Gateway Out-of-bounds Write