Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 852 of 1013.
- CVE-2026-16161 IBM DataPower Gateway Out-of-bounds Read
- CVE-2026-1616 osim: Path Traversal via query parameters in Nginx configuration
- CVE-2026-16159 IBM DataPower Gateway Out-of-bounds Write
- CVE-2026-16158 @fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision
- CVE-2026-16157 Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability
- CVE-2026-16156 SourceCodester Class and Exam Timetabling System forexam.php cross site scripting
- CVE-2026-16155 SourceCodester Class and Exam Timetabling System schoolyr.php cross site scripting
- CVE-2026-16154 SourceCodester Class and Exam Timetabling System edit_room1.php sql injection
- CVE-2026-16152 SourceCodester Class and Exam Timetabling System edit_rooma.php sql injection
- CVE-2026-16151 CartoDB carto-api-client filters.ts addFilter prototype pollution
- CVE-2026-16150 RobinHerbots Inputmask Internal Deep Merge Helper extend.js extendAliases prototype pollution
- CVE-2026-1615 jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions
- CVE-2026-16149 Missing authorization in Security Hardener
- CVE-2026-16148 Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item
- CVE-2026-16147 it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption
- CVE-2026-16146 Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Values
- CVE-2026-16145 Invisible Anti-Spam & CAPTCHA <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter
- CVE-2026-16144 Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter
- CVE-2026-16143 VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting
- CVE-2026-16142 Missing authorization in TrueBooker – Appointment Booking and Scheduler System
- CVE-2026-16141 OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value
- CVE-2026-16140 OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1
- CVE-2026-1614 Cross-site scripting in Rise Blocks – A Complete Gutenberg Page Builder
- CVE-2026-16139 Path traversal in ShareFile Storage Zones Controller
- CVE-2026-16138 Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service
- CVE-2026-16137 Path traversal in ShareFile Storage Zones Controller
- CVE-2026-16133 LiuMengxuan04 MiniCode mcp.ts child_process.spawn command injection
- CVE-2026-16131 itsourcecode Hospital Management System prescriptionrecord.php sql injection
- CVE-2026-16130 nearai ironclaw write_file path_utils.rs validate_path link following
- CVE-2026-1613 Wonka Slide <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2026-16129 princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist
- CVE-2026-16128 zevorn rt-claw http_request swarm.c receiver_thread server-side request forgery
- CVE-2026-16127 zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery
- CVE-2026-16126 zevorn rt-claw Swarm RPC Receiver swarm.c handle_rpc_request authorization
- CVE-2026-16125 zevorn rt-claw http_request net.c claw_net_post server-side request forgery
- CVE-2026-16124 nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery
- CVE-2026-16123 nextlevelbuilder GoClaw Invoke Endpoint tools_invoke.go ToolsInvokeHandler.ServeHTTP authorization
- CVE-2026-16122 nextlevelbuilder GoClaw exec_approval.go matchesAllowlist authorization
- CVE-2026-16121 nextlevelbuilder GoClaw exec_approval.go isSafeBin improper authorization
- CVE-2026-16120 nextlevelbuilder GoClaw exec_approval.go extractBin name resolution
- CVE-2026-1612 Hard-coded AWS Key in AL-KO Robolinho Update Software
- CVE-2026-16119 nextlevelbuilder GoClaw WebSocket Approval Endpoint exec_approval.go RequestApproval authorization
- CVE-2026-16118 Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c
- CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters
- CVE-2026-16111 IBM DataPower Gateway Type Confusion
- CVE-2026-1611 Wikiloops Track Player <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2026-16108 Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2
- CVE-2026-16107 TS4500 CLI tool addresses security vulnerability
- CVE-2026-16106 Missing authorization in Red Hat Data Grid 8
- CVE-2026-16105 Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints
- CVE-2026-16104 Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins
- CVE-2026-16103 Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption
- CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
- CVE-2026-16101 forced re-pairing with already bonded device
- CVE-2026-16100 Denial of service in Red Hat Data Grid 8
- CVE-2026-1610 Tenda AX12 Pro V2 Telnet Service hard-coded credentials
- CVE-2026-16099 Deserialization in Podlove Podcast Publisher
- CVE-2026-16098 File upload in ProSolution WP Client
- CVE-2026-16097 Shibby Tomato Scheduler Name sub_42537C stack-based overflow
- CVE-2026-16096 Shibby Tomato webmon_recent_domains sub_40BB50 stack-based overflow
- CVE-2026-16095 Shibby Tomato rc setup_conntrack out-of-bounds write
- CVE-2026-16094 Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter
- CVE-2026-16093 Security feature bypass in Red Hat Data Grid 8
- CVE-2026-16092 Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter
- CVE-2026-16091 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode
- CVE-2026-16090 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode
- CVE-2026-1609 Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users
- CVE-2026-16089 Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session
- CVE-2026-16088 halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal
- CVE-2026-16087 Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter
- CVE-2026-16085 Sipeed PicoClaw context.go NewContextBuilder inclusion of functionality from untrusted control sphere
- CVE-2026-16084 Sipeed PicoClaw web.go web_fetch server-side request forgery
- CVE-2026-16083 Sipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay
- CVE-2026-16082 Sipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctou
- CVE-2026-16081 Sipeed PicoClaw auth.go cross-site request forgery
- CVE-2026-16080 Image Uploader for Welcart <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter
- CVE-2026-1608 Video Onclick <= 0.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2026-16079 Fullscreen Galleria <= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Content
- CVE-2026-16078 WCPOS <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameter
- CVE-2026-16077 AstrBotDevs AstrBot Filesystem Computer-Use Tool fs.py _normalize_rw_path link following
- CVE-2026-16076 AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing
- CVE-2026-16075 AstrBotDevs AstrBot session-listing Endpoint open_api.py OpenApiRoute.get_chat_sessions authorization
- CVE-2026-16074 AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery
- CVE-2026-16073 AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross site scripting
- CVE-2026-16072 Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation
- CVE-2026-16071 Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary
- CVE-2026-16070 Brizy - Page Builder < 2.8.19 - Contributor+ Template Type Update via IDOR
- CVE-2026-1607 Surbma | Booking.com <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2026-16069 Brizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point
- CVE-2026-16068 Brizy - Page Builder < 2.8.19 - Author+ Stored XSS via brizy_set_project Global Project Code Asset
- CVE-2026-16067 Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket Price
- CVE-2026-16066 Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name
- CVE-2026-16065 Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import
- CVE-2026-16064 Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event
- CVE-2026-16063 Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content
- CVE-2026-16062 Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content
- CVE-2026-16061 Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name}
- CVE-2026-16060 Insert or Embed Articulate Content into WordPress <= 4.3000000027 - Editor+ Arbitrary File Upload
- CVE-2026-1606 Improper Control of Generation of Code ('Code Injection') in GitLab
- CVE-2026-16058 YayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration