Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 866 of 1013.
- CVE-2026-14620 webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
- CVE-2026-1462 Safe Mode Bypass in keras-team/keras
- CVE-2026-14619 itsourcecode Hospital Management System medicine.php sql injection
- CVE-2026-14618 Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service
- CVE-2026-14617 Security feature bypass in hermes-agent
- CVE-2026-14615 Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter
- CVE-2026-14614 Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource
- CVE-2026-14613 Missing authorization in Red Hat Build of Keycloak
- CVE-2026-14612 Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorization
- CVE-2026-14611 DeepMyst Mysti Per-Project Auto-Memory MemoryManager.ts initProjectMemory exposure of resource
- CVE-2026-14610 Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile heap-based overflow
- CVE-2026-1461 Simple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Values
- CVE-2026-14609 SourceCodester CET Automated Grading System with AI Predictive Analytics session fixiation
- CVE-2026-14608 SourceCodester CET Automated Grading System with AI Predictive Analytics POST index.php view_student authorization
- CVE-2026-14607 RT-Thread lwp_syscall.c sys_getaddrinfo memory corruption
- CVE-2026-14606 RT-Thread SWM341 CAN SWM341.h CAN_Receive stack-based overflow
- CVE-2026-14605 RT-Thread ls1c CAN ls1c_can.h recvmsg stack-based overflow
- CVE-2026-14604 Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free
- CVE-2026-14603 WowOptin < 1.4.38 - Unauthenticated Opt-in Deactivation and Template Row Injection
- CVE-2026-14602 Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter
- CVE-2026-14601 Link Whisper < 0.9.7 - Editor+ SQL Injection via domain Parameter
- CVE-2026-1460 Command injection in DX3301-T0 firmware
- CVE-2026-14596 DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Link Host Injection
- CVE-2026-14592 WP Real IP-based Access Control <= 1.3.1 - Unauthenticated Stored XSS via acl_ctrl_addr
- CVE-2026-1459 Command injection in VMG3625-T50B firmware
- CVE-2026-14587 Unathenticated connection can hold Bolt channel open
- CVE-2026-14586 Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments
- CVE-2026-1458 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-14574 Code injection in Eclipse Theia
- CVE-2026-14572 Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
- CVE-2026-14571 SQL injection (SQLi) in the user authentication module of Futurum Software
- CVE-2026-14570 Weak cryptography in Crypt::DSA
- CVE-2026-1457 Authenticated RCE Vulnerability Due to Buffer Overflow on TP-Link VIGI C385
- CVE-2026-14568 WP User Frontend < 4.3.8 - Unauthenticated Author-less Attachment Deletion
- CVE-2026-14567 WP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User Directory
- CVE-2026-14566 Advanced Customized Prompts <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tampering
- CVE-2026-14565 Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration
- CVE-2026-14564 Sensitive Data Exposure in Innotim Software's Logsign SIEM
- CVE-2026-14563 Advanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover
- CVE-2026-14562 Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure
- CVE-2026-14561 Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure
- CVE-2026-14560 Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload
- CVE-2026-1456 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-14559 Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover
- CVE-2026-14558 WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder
- CVE-2026-14557 SoftMarket <= 1.0.0 - Unauthenticated Account Takeover via Email Verification Bypass
- CVE-2026-14556 HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer
- CVE-2026-14554 Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters
- CVE-2026-14553 Zportals < 6.3.4 - Subscriber+ Arbitrary File Upload
- CVE-2026-14552 Incorrect Authorization in GitLab
- CVE-2026-14551 Local Privilege Escalation in servereye client (sensorhub)
- CVE-2026-14550 WPCafe < 3.0.18 - Unauthenticated Reservation Approval Bypass via Missing Authorization
- CVE-2026-1455 Cross-site request forgery in Whatsiplus Scheduled Notification for Woocommerce
- CVE-2026-14549 Ray Enterprise Translation <= 1.7.3 - Subscriber+ Language Addition and Deletion
- CVE-2026-14548 Ray Enterprise Translation <= 1.7.3 - Subscriber+ Arbitrary API Token Update
- CVE-2026-14547 Estatik Real Estate Plugin < 4.3.3 - Unauthenticated Arbitrary-Recipient Mail Relay via Request Form
- CVE-2026-14545 TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset
- CVE-2026-14544 Hplip: incomplete fix for cve-2026-8631
- CVE-2026-14541 Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider
- CVE-2026-14540 Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox
- CVE-2026-1454 Responsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting
- CVE-2026-14539 Denial of Service via Unrestricted Payload Buffering in MCP Toolbox
- CVE-2026-14538 BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox
- CVE-2026-14537 Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints
- CVE-2026-14536 Auth bypass in Server
- CVE-2026-14535 Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code()
- CVE-2026-14534 Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit)
- CVE-2026-14532 IBM WebSphere Application Server Liberty Integer Overflow
- CVE-2026-1453 Missing Authentication for Critical Function in KiloView Encoder Series
- CVE-2026-14529 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery
- CVE-2026-14528 IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information
- CVE-2026-14526 AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Route
- CVE-2026-14525 IBM WebSphere Application Server Liberty is affected by an authenication bypass
- CVE-2026-14524 ProSolution WP Client <= 2.0.8 - Unauthenticated Arbitrary File Deletion via 'newfilename' and 'filename' Parameters
- CVE-2026-14522 IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings
- CVE-2026-14521 IBM DataPower Gateway affected by server-side request forgery
- CVE-2026-14519 IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings
- CVE-2026-14516 Online Scheduling and Appointment Booking System <= 27.5 - Unauthenticated SQL Injection
- CVE-2026-14515 IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities
- CVE-2026-14514 Reliable Scalable Cluster Technology Denial-of-Service
- CVE-2026-14512 IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information
- CVE-2026-14511 IBM MQ Denial of Service
- CVE-2026-1451 rognone <= 0.6.2 - Reflected Cross-Site Scripting via 'a' Parameter
- CVE-2026-14509 IBM DataPower Gateway Denial of Service
- CVE-2026-14508 IBM DataPower Gateway Use After Free
- CVE-2026-14507 IBM DataPower Gateway Out-of-bounds Write
- CVE-2026-14505 Tanium addressed a path traversal vulnerability in Tanium Data Service.
- CVE-2026-14504 Nexus Repository 3 - Authorization Bypass in Component Upload API
- CVE-2026-14503 Missing authorization in pCloud WP Backup
- CVE-2026-14502 IBM DataPower Gateway Improper Authentication
- CVE-2026-14501 Use of Potentially Dangerous Functionthat in IBM Db2 Genius Hub
- CVE-2026-14500 Bulk Order Update for WooCommerce <= 1.6 - Unauthenticated Arbitrary File Read via 'csv_url' Parameter
- CVE-2026-1450 rognone <= 0.6.2 - Reflected Cross-Site Scripting via 'mode' Parameter
- CVE-2026-14499 Command injection in Langflow OSS
- CVE-2026-14498 Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter
- CVE-2026-14497 IBM DataPower Gateway Improper Verification of Cryptographic Signature
- CVE-2026-14496 IBM DataPower Gateway Out-of-bounds Read
- CVE-2026-14495 Weak cryptography in DoLogin Security
- CVE-2026-14494 File upload in SigmaForms Pro – AI Generated Forms
- CVE-2026-14490 Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action