Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 864 of 1013.
- CVE-2026-14825 Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR
- CVE-2026-14824 Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar Question
- CVE-2026-14823 Event Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOR
- CVE-2026-14822 Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation
- CVE-2026-14821 Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion
- CVE-2026-14820 Quiz And Survey Master < 11.1.3 - Unauthenticated User Enumeration and Password Oracle via Quiz Login
- CVE-2026-1482 Out-of-band SQL injection in Quatuor Performance Evaluation
- CVE-2026-14819 Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move
- CVE-2026-14818 Path traversal in ATP series firmware
- CVE-2026-14817 Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes
- CVE-2026-14816 The GDPR Framework < 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Requests Spam
- CVE-2026-14814 Permissive Regular Expression in GitLab
- CVE-2026-14812 Premium SEO - Unauthenticated Backdoor (Admin Creation / RCE / SSRF / Content Injection)
- CVE-2026-1481 Out-of-band SQL injection in Quatuor Performance Evaluation
- CVE-2026-14809 PROG MIS｜Prog Management System - SQL Injection
- CVE-2026-14808 PROG MIS｜Prog Management System - Exposure of Sensitive Information
- CVE-2026-14807 PROG MIS｜ERP App - Use of Hard-coded Credentials
- CVE-2026-14805 Consulting - Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX
- CVE-2026-14804 Hardcoded Cryptographic Key in Bilin Software's HUMANIST Digital Human Resources
- CVE-2026-14803 Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder
- CVE-2026-14802 react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injection
- CVE-2026-14801 GPAC TeXML File load_text.c txtin_probe_duration divide by zero
- CVE-2026-14800 imhamzaazam ecommerceFlask cross-site request forgery
- CVE-2026-1480 Out-of-band SQL injection in Quatuor Performance Evaluation
- CVE-2026-14799 CodeAstro Ecommerce Website my_account.php sql injection
- CVE-2026-14798 CodeAstro Apartment Visitor Management System visitor-entry.php sql injection
- CVE-2026-14797 CodeAstro Apartment Visitor Management System edit-apartment.php sql injection
- CVE-2026-14796 CodeAstro Apartment Visitor Management System report.php sql injection
- CVE-2026-14795 CodeAstro Apartment Visitor Management System action-visitor.php sql injection
- CVE-2026-14794 Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization
- CVE-2026-14793 Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization
- CVE-2026-14792 Formbricks Survey actions.ts access control
- CVE-2026-14791 crater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross site scripting
- CVE-2026-14790 GPAC Media File write_nhml.c nhmldump_send_frame null pointer dereference
- CVE-2026-1479 Out-of-band SQL injection in Quatuor Performance Evaluation
- CVE-2026-14789 radareorg radare2 Memory64ListStream mdmp.c stack-based overflow
- CVE-2026-14788 radareorg radare2 cfile.c r_core_bin_load use after free
- CVE-2026-14787 radareorg radare2 pb Print cmd_print.inc cmd_print integer overflow
- CVE-2026-14786 radareorg radare2 str.c r_str_word_get0set integer overflow
- CVE-2026-14785 Web Directory Free <= 1.7.13 - Unauthenticated SQL Injection
- CVE-2026-14784 vxcontrol PentAGI Docker API client.go sandbox
- CVE-2026-14783 NousResearch hermes-agent skills_tool.py skill_view path traversal
- CVE-2026-14782 SQL injection in Booking for Appointments and Events Calendar – Amelia
- CVE-2026-14781 Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email
- CVE-2026-14780 PaperCut NG/MF: Remote Code Execution via Scripting Subsystem
- CVE-2026-1478 Out-of-band SQL injection in Quatuor Performance Evaluation
- CVE-2026-14778 Missing authorization in Onlne Examination & Learning Management System
- CVE-2026-14777 SourceCodester Onlne Examination & Learning Management System announcements.php unrestricted upload
- CVE-2026-14776 File upload in Onlne Examination & Learning Management System
- CVE-2026-14775 SourceCodester Onlne Examination & Learning Management System process_lesson.php unrestricted upload
- CVE-2026-14774 itsourcecode Hospital Management System paymentdischarge.php sql injection
- CVE-2026-14773 itsourcecode Hospital Management System payment.php sql injection
- CVE-2026-14772 SourceCodester Class and Exam Timetabling System edit_course1.php sql injection
- CVE-2026-14771 SourceCodester Class and Exam Timetabling System edit_exam1.php sql injection
- CVE-2026-14770 SourceCodester Class and Exam Timetabling System edit_room.php sql injection
- CVE-2026-1477 Out-of-band SQL injection in Quatuor Performance Evaluation
- CVE-2026-14769 code-projects Real State Services pay.php sql injection
- CVE-2026-14768 code-projects Real State Services builderHome.php sql injection
- CVE-2026-14767 CodeAstro Ecommerce Website POST Parameter confirm.php sql injection
- CVE-2026-14766 CodeAstro Apartment Visitor Management System POST Parameter search-result.php sql injection
- CVE-2026-14765 Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURL
- CVE-2026-14764 code-projects Hotel and Tourism Reservation Event Management add_event.php sql injection
- CVE-2026-14763 code-projects Hotel and Tourism Reservation Tour Reservations tour_reserves.php sql injection
- CVE-2026-14762 code-projects Hotel and Tourism Reservation Room Management rooms.php sql injection
- CVE-2026-14761 radareorg radare2 str.c r_str_append integer overflow
- CVE-2026-14760 radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free
- CVE-2026-1476 Out-of-band SQL injection in Quatuor Performance Evaluation
- CVE-2026-14759 radareorg radare2 RBinJava Line Number Table class.c r_bin_java_inner_classes_attr_calc_size heap-based overflow
- CVE-2026-14758 radareorg radare2 hexpairs cmd_anal.inc.c cmd_anal_opcode integer overflow
- CVE-2026-14757 radareorg radare2 cmd_anal.inc core_anal_bytes integer overflow
- CVE-2026-14756 code-projects Hotel and Tourism Reservation Tour Management add_tour.php sql injection
- CVE-2026-14755 code-projects Hotel and Tourism Reservation Reservations Management reservations.php sql injection
- CVE-2026-14754 code-projects Hotel and Tourism Reservation add_room.php sql injection
- CVE-2026-14753 mjperpinosa stumasy Note Handler/Assignment notes authorization
- CVE-2026-14752 mjperpinosa stumasy add_into_dictionary.php add_definition cross site scripting
- CVE-2026-14751 mjperpinosa stumasy search_scratch_data.php search_scratch_data sql injection
- CVE-2026-14750 mjperpinosa stumasy accessing_dictionary_authorization.php accessing_dictionary_authorization sql injection
- CVE-2026-1475 Out-of-band SQL injection in Quatuor Performance Evaluation
- CVE-2026-14749 mjperpinosa stumasy calculate.php eval code injection
- CVE-2026-14748 AIAnytime Awesome-MCP-Server mcp-wiki/wiki-summary server.py server-side request forgery
- CVE-2026-14747 code-projects Real State Services addprojectsale.php sql injection
- CVE-2026-14746 code-projects Real State Services addprojectrent.php sql injection
- CVE-2026-14745 code-projects Real State Services single-list_rent.php sql injection
- CVE-2026-14744 code-projects Real State Services normalHomeRent.php sql injection
- CVE-2026-14743 code-projects Real State Services normalHomeSale.php sql injection
- CVE-2026-14742 langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash
- CVE-2026-14741 HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date
- CVE-2026-14740 DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment
- CVE-2026-1474 Out-of-band SQL injection in Quatuor Performance Evaluation
- CVE-2026-14739 Memory corruption in DBI
- CVE-2026-14738 exo-explore exo Vision Feature Cache vision.py _image_cache_key weak hash
- CVE-2026-14737 Hanwang e-Face General Management Platform querySysAuthStr.do sql injection
- CVE-2026-14736 Ruijie RG-UAC user_auth_commit.php unrestricted upload
- CVE-2026-14735 code-projects Smart Parking System parkings.php sql injection
- CVE-2026-14734 SourceCodester Class and Exam Timetabling System edit_product.php sql injection
- CVE-2026-14733 SourceCodester Class and Exam Timetabling System edit_coursea.php sql injection
- CVE-2026-14732 SourceCodester Class and Exam Timetabling System edit_exam.php sql injection
- CVE-2026-14731 itsourcecode Hospital Management System patientreport.php sql injection
- CVE-2026-14730 itsourcecode Hospital Management System patientprofile.php sql injection
- CVE-2026-1473 Out-of-band SQL injection in Quatuor Performance Evaluation