Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 865 of 1013.
- CVE-2026-14725 SourceCodester Online Boat Reservation System session expiration
- CVE-2026-14723 AD-Security AD_Miner Cache analyse_cache.py request_a deserialization
- CVE-2026-14722 tiddly-gittly TidGi-Desktop Git Repository Import loadWikiTiddlersWithSubWikis.ts code injection
- CVE-2026-14721 UTT HiPER 1250GW Web Endpoint ConfigWirelessBase_5g stack-based overflow
- CVE-2026-1472 Out-of-band SQL injection in Quatuor Performance Evaluation
- CVE-2026-14719 SourceCodester Onlne Examination & Learning Management System Registration Endpoint register.php privileges management
- CVE-2026-14717 itsourcecode Hospital Management System patientlogin.php sql injection
- CVE-2026-14716 nextlevelbuilder GoClaw WebSocket RPC router.go MethodRouter.Handle authorization
- CVE-2026-14714 zhayujie chatgpt-on-wechat CowAgent wx Endpoint common.py verify_server missing authentication
- CVE-2026-14713 SourceCodester Pizzafy E-Commerce System ajax.php confirm_order sql injection
- CVE-2026-1471 Caching of authentication context
- CVE-2026-14706 code-projects Online Examination Quiz Creation Feature update.php sql injection
- CVE-2026-14705 code-projects Online Examination head.php sql injection
- CVE-2026-14704 stephen-kruger bluebox cross site scripting
- CVE-2026-14703 itsourcecode Hospital Management System patientorder.php sql injection
- CVE-2026-14702 zcaceres markdownify-mcp webpage-to-markdown Markdownify.ts saveToTempFile random values
- CVE-2026-14701 code-projects Internship Management System Password Change Endpoint change_password.php sql injection
- CVE-2026-14700 code-projects Internship Management System Employer Login Endpoint login.php sql injection
- CVE-2026-1470 n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution
- CVE-2026-14699 zcaceres markdownify-mcp Markdownify.ts assertPathAllowed symlink
- CVE-2026-14698 SourceCodester Syllabus-Aligned Learning Management and Examination System upload_files.php unrestricted upload
- CVE-2026-14697 IPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of service
- CVE-2026-14696 Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion
- CVE-2026-14695 SourceCodester Multi-Vendor Online Grocery Management System Registration Users.php save_client sql injection
- CVE-2026-14694 SourceCodester Multi-Vendor Online Grocery Management System POST Parameter Master.php cancel_order sql injection
- CVE-2026-14693 SourceCodester Multi-Vendor Online Grocery Management System Master.php cancel_order improper authorization
- CVE-2026-14692 SourceCodester Multi-Vendor Online Grocery Management System POST Parameter Master.php save_shop_type sql injection
- CVE-2026-14691 Code injection in Multi-Vendor Online Grocery Management System
- CVE-2026-14690 SourceCodester Multi-Vendor Online Grocery Management System Users.php save_users improper authorization
- CVE-2026-1469 Stored Cross-Site Scripting (XSS) in RLE NOVA's PlanManager
- CVE-2026-14689 CodeAstro Apartment Visitor Management System add-apartment.php sql injection
- CVE-2026-14688 itsourcecode Online Hotel Management System login.php sql injection
- CVE-2026-14687 666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison
- CVE-2026-14686 HdrHistogram Range Check DoubleHistogram.java org.HdrHistogram.DoubleHistogram.recordValue comparison
- CVE-2026-14685 HdrHistogram AbstractHistogram AbstractHistogram.java recordValueWithCount state issue
- CVE-2026-14684 HdrHistogram AbstractHistogram.java memory allocation
- CVE-2026-14683 HdrHistogram AbstractHistogram.java memory allocation
- CVE-2026-14682 Possible OOM from unbounded up-front allocation on a definite-length read
- CVE-2026-14681 PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL
- CVE-2026-14680 PostgreSQL type confusion via "internal" arguments
- CVE-2026-1468 Cross-Site Request Forgery in QuickCMS
- CVE-2026-14679 PostgreSQL stack buffer overflow in argument match writes 0x0 and 0x1 to server memory
- CVE-2026-14678 PostgreSQL pg_trgm picksplit reads past end of buffer
- CVE-2026-14677 PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound
- CVE-2026-14676 PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code
- CVE-2026-14673 PostgreSQL amcheck does not clear untrusted search path
- CVE-2026-14672 PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle
- CVE-2026-14671 PostgreSQL refint plan cache type confusion executes arbitrary code
- CVE-2026-14670 PostgreSQL plperl tied object heap buffer overflow executes arbitrary code
- CVE-2026-1467 Libsoup: libsoup: http header injection via specially crafted urls when an http proxy is configured
- CVE-2026-14669 PostgreSQL to_char heap buffer overflow executes arbitrary code
- CVE-2026-14668 PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read
- CVE-2026-14666 PostgreSQL row security caching disregards role modifications
- CVE-2026-14664 PostgreSQL regexp heap buffer overflow executes arbitrary code
- CVE-2026-14663 PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext
- CVE-2026-14662 PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound
- CVE-2026-14660 code-projects Online Job Portal login.php sql injection
- CVE-2026-1466 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jirafeau
- CVE-2026-14659 itsourcecode Hospital Management System patientappointment.php sql injection
- CVE-2026-14658 code-projects Assessment Management marking-scheme.php sql injection
- CVE-2026-14657 code-projects Assessment Management Database Query marking-scheme.php sql injection
- CVE-2026-14656 code-projects Assessment Management remove-user.php cross site scripting
- CVE-2026-14655 code-projects Assessment Management view-users.php cross site scripting
- CVE-2026-14654 SourceCodester Simple and Nice Shopping Cart Script girlsproductdeletequery.php sql injection
- CVE-2026-14653 SourceCodester Simple and Nice Shopping Cart Script mensproductdeletequery.php sql injection
- CVE-2026-14652 SourceCodester Simple and Nice Shopping Cart Script Admin Login login.php sql injection
- CVE-2026-14651 connorskees grass visitor denial of service
- CVE-2026-14650 connorskees grass UTF-8 Character raw_to_parse_error denial of service
- CVE-2026-1465 A heap-based buffer over-read or buffer overflow in tildearrow/furnace
- CVE-2026-14649 code-projects Online Voting System saveVote.php test_input sql injection
- CVE-2026-14648 code-projects Online Voting System Login authentication.php test_input sql injection
- CVE-2026-14647 onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds
- CVE-2026-14646 Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect
- CVE-2026-14645 Nexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global Capability
- CVE-2026-14644 Nexus Repository 3 - Privilege Escalation
- CVE-2026-14643 undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
- CVE-2026-14642 SourceCodester Class and Exam Timetabling System edit_class2.php sql injection
- CVE-2026-14641 SourceCodester Class and Exam Timetabling System edit_course.php sql injection
- CVE-2026-14640 CodeAstro Apartment Visitor Management System Login index.php sql injection
- CVE-2026-1464 A possible integer overflow vulnerability in RawTherapee/RawTherapee
- CVE-2026-14639 CodeAstro Ecommerce Website my_account.php sql injection
- CVE-2026-14638 itsourcecode Hospital Management System patient.php sql injection
- CVE-2026-14637 kirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserialization
- CVE-2026-14636 kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Image Manager AddProduct.php do_upload_others_images path traversal
- CVE-2026-14635 kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Multi-Image Endpoint AddProduct.php path traversal
- CVE-2026-14634 Cross-site scripting in Ecommerce-CodeIgniter-Bootstrap
- CVE-2026-14633 kirilkirkov Ecommerce-CodeIgniter-Bootstrap Hidden REST API Endpoint set cross site scripting
- CVE-2026-14632 kirilkirkov Ecommerce-CodeIgniter-Bootstrap Trusted Backend MY_Controller.php setReferrer redirect
- CVE-2026-14631 webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
- CVE-2026-14630 ForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hash
- CVE-2026-1463 Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion
- CVE-2026-14629 RT-Thread Parameter lwp_syscall.c sys_ioctl divide by zero
- CVE-2026-14628 NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal
- CVE-2026-14627 Auth bypass in hermes-agent
- CVE-2026-14626 NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service
- CVE-2026-14625 NousResearch hermes-agent server.py shell.exec protection mechanism
- CVE-2026-14624 omec-project amf NGSetupRequest handler.go denial of service
- CVE-2026-14623 omec-project amf NGAP Message RRCInactiveTransitionReport denial of service
- CVE-2026-14622 jairiidriss restaurant-website-php-mysql AJAX Endpoint ajax_files missing authentication
- CVE-2026-14621 FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session