Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 857 of 1013.
- CVE-2026-15565 Denial of service in Red Hat Data Grid 8
- CVE-2026-15564 Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization
- CVE-2026-15563 Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos
- CVE-2026-15562 Jboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authentication denial of service
- CVE-2026-15561 Undertow-core: oom via missing limits in chunked trailer in eap's undertow
- CVE-2026-15560 Openjdk-orb: unauthed class loading via iiop in eap
- CVE-2026-1556 Information disclosure via file URI overwrite in File (Field) Paths
- CVE-2026-15559 CodeAstro Simple Online Leave Management System POST accept.php sql injection
- CVE-2026-15558 CodeAstro Simple Online Leave Management System deletemp.php sql injection
- CVE-2026-15557 waooAI waoowaoo Internal Task Header api-auth.ts requireProjectAuthLight improper authentication
- CVE-2026-15556 Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions
- CVE-2026-15555 Deserialization in Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
- CVE-2026-15554 Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery
- CVE-2026-15553 Ragic｜Enterprise Cloud Database - Arbitrary File Upload
- CVE-2026-15552 Ragic｜Enterprise Cloud Database - Stored Cross-Site Scripting
- CVE-2026-15551 Integer overflow in rlottie
- CVE-2026-15550 Missing authorization in Ninja Forms - Save Progress
- CVE-2026-1555 WebStack <= 1.2024 - Unauthenticated Arbitrary File Upload
- CVE-2026-15548 Shibby Tomato DNS List Rendering httpd sub_407220 stack-based overflow
- CVE-2026-15547 Shibby Tomato CIFS Mount sub_2D048 os command injection
- CVE-2026-15546 Shibby Tomato start_jffs2 sub_2D568 os command injection
- CVE-2026-15545 Shibby Tomato apcupsd tomatodata.cgi main out-of-bounds write
- CVE-2026-15544 Shibby Tomato apcupsd tomatodata.cgi getupsvar stack-based overflow
- CVE-2026-15543 Tenda CH22 CertListInfo formCertListInfo buffer overflow
- CVE-2026-15542 will-moss Isaiah Websocket Connection Authentication main.go improper authentication
- CVE-2026-15541 will-moss Isaiah Master Websocket server.go Server.Handle authorization
- CVE-2026-15540 SourceCodester Online Book Store System Administrative index.php php file inclusion
- CVE-2026-1554 Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007
- CVE-2026-15539 SourceCodester Online Book Store System Book Image Upload Feature index.php books unrestricted upload
- CVE-2026-15538 primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution
- CVE-2026-15537 SourceCodester Online Book Store System login.php sql injection
- CVE-2026-15536 itsourcecode Hospital Management System patviewprescription.php sql injection
- CVE-2026-15535 AkariAsai self-rag retrieval_lm index.py Indexer.deserialize_from deserialization
- CVE-2026-15534 Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.
- CVE-2026-15533 DedeCMS Column Management search.php code injection
- CVE-2026-15532 SourceCodester Online Book Store System User Management cross site scripting
- CVE-2026-15531 yashbhalgat HashNeRF-pytorch Checkpoint File run_nerf.py torch.load deserialization
- CVE-2026-15530 WuzhiCMS Attachment API index.php listimage information disclosure
- CVE-2026-1553 Drupal Canvas - Moderately critical - Access bypass - SA-CONTRIB-2026-006
- CVE-2026-15529 yzhao062 pyod persistence.py pyod.utils.persistence.load deserialization
- CVE-2026-15528 lamaalrajih kicad-mcp path_validator.py protection mechanism
- CVE-2026-15527 better-auth better-icons scan_project_icons/sync_icon path traversal
- CVE-2026-15526 augmnt augments-mcp-server scan_project_deps scan-project-deps.ts scanProjectDeps path traversal
- CVE-2026-15525 kLOsk adloop write.py _validate_urls server-side request forgery
- CVE-2026-15524 alioshr memory-bank-mcp list-project-files-validation-factory.ts path traversal
- CVE-2026-15523 CodeAstro Simple Online Leave Management System dashboard.php sql injection
- CVE-2026-15522 tugcantopaloglu godot-mcp run_project index.js validatePath path traversal
- CVE-2026-15521 makafeli n8n-workflow-builder update_node_from_file server.cjs path traversal
- CVE-2026-15520 GNU LibreDWG R2004 Section Decompression decode.c decompress_R2004_section heap-based overflow
- CVE-2026-1552 SEMCMS SEMCMS_Info.php sql injection
- CVE-2026-15519 usestrix PyPI system_prompt.jinja inclusion of functionality from untrusted control sphere
- CVE-2026-15518 AREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted upload
- CVE-2026-15517 Jinher OA PlanGiveOut.aspx sql injection
- CVE-2026-15516 MacCMS Pro Installation Index.php step5 authorization
- CVE-2026-15515 Tencent PC Manager QMUDisk Driver qmudisk64.sys uncontrolled search path
- CVE-2026-15514 Metasoft 美特软件 MetaCRM PHPRPC Remote Call rpc.jsp RPCService.query sql injection
- CVE-2026-15513 Wavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injection
- CVE-2026-15512 pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection
- CVE-2026-15511 Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection
- CVE-2026-15510 Leantime API saveSetting improper authorization
- CVE-2026-1551 itsourcecode School Management System controller.php sql injection
- CVE-2026-15509 Leantime JSON-RPC Endpoint addUser improper authorization
- CVE-2026-15508 Helicone ai-gateway AWS Metadata Service service.rs build_target_url server-side request forgery
- CVE-2026-15507 coollabsio Coolify Policy Policies authorization
- CVE-2026-15506 SecureAge CatchPulse Driver saappctl.sys heap-based overflow
- CVE-2026-15505 vnotex vnote YAML Frontmatter markdownit.js cross site scripting
- CVE-2026-15502 AojiaoZero Antaris PayPal IPN Payment ipn.php _rewardPurchase sql injection
- CVE-2026-15501 AstrBotDevs AstrBot MCP Test Endpoint tools.py ToolsRoute.test_mcp_connection server-side request forgery
- CVE-2026-15500 AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery
- CVE-2026-1550 PHPGurukul Hospital Management System Admin Dashboard adminviews.py improper authorization
- CVE-2026-15499 AstrBotDevs AstrBot Scheduled Task cron_tools.py FutureTaskTool.call improper authorization
- CVE-2026-15498 sergomanov SmartHomeAdatum Login users.php sql injection
- CVE-2026-15497 SonicCloudOrg sonic-agent JWT Authentication Filter ExchangeController.java code injection
- CVE-2026-15496 SonicCloudOrg sonic-agent Groovy Script GroovyScriptImpl.java evalIsFailed os command injection
- CVE-2026-15495 SonicCloudOrg sonic-agent Android WebSocket Server AndroidWSServer.java os command injection
- CVE-2026-15494 AMTT Hotel Broadband Operation System switch_status.php sql injection
- CVE-2026-15493 Akpali9 Attendance-Management-System absent.php cross site scripting
- CVE-2026-15492 igweze wizgrade studentConductManager.php cross site scripting
- CVE-2026-15491 RafyMrX TOKO-ONLINE-ROTI missing authentication
- CVE-2026-15490 RafyMrX TOKO-ONLINE-ROTI add.php sql injection
- CVE-2026-1549 jishenghua jshERP PluginController uploadPluginConfigFile path traversal
- CVE-2026-15489 RafyMrX TOKO-ONLINE-ROTI login.php sql injection
- CVE-2026-15488 hcr707305003 shiroiAdmin FileController.php upload unrestricted upload
- CVE-2026-15487 TRENDnet TEW-821DAP Firmware Update system_ntp sub_41FBD0 os command injection
- CVE-2026-15486 TRENDnet TEW-821DAP Firmware Update tools_ddns sub_42026C os command injection
- CVE-2026-15485 TRENDnet TEW-821DAP DNS Lookup tools_nslookup sub_43F2C4 os command injection
- CVE-2026-15484 TRENDnet TEW-821DAP ssi tools_nslookup sub_41EC14 buffer overflow
- CVE-2026-15483 TRENDnet TEW-821DAP ssi tools_nslookup sub_41EC14 buffer overflow
- CVE-2026-15482 Aster Telecom Azcall HTTP sis.php sql injection
- CVE-2026-15481 Trendnet TEW-635BRM IPoA WAN Connection Setup rc ipoa_test command injection
- CVE-2026-15480 Trendnet TEW-635BRM Web Service rc start_httpd stack-based overflow
- CVE-2026-1548 Totolink A7000R cstecgi.cgi CloudACMunualUpdateUserdata command injection
- CVE-2026-15479 H3C NX15 Administrator Password Modification Endpoint modify change_passwd password recovery
- CVE-2026-15478 IceHRM UserReport Endpoint EmployeeAttendanceReport.php sql injection
- CVE-2026-15477 Bahmni bahmnicore Search Endpoint sql additionalParams sql injection
- CVE-2026-15476 QILING Disk Master Kernel Driver diskbckp.sys access control
- CVE-2026-15475 MiniTool Partition Wizard Signed Kernel Driver pwdrvio.sys access control
- CVE-2026-15474 Eleveo Call Recording Software audio.jsp improper authorization
- CVE-2026-15473 Eleveo Call Recording Software Recorded Calls restoreCallAction.do improper authorization
- CVE-2026-15472 Eleveo Call Recording Software composeEmailAction.do improper authorization