Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 869 of 1013.
- CVE-2026-14259 Board archive import bypasses team board creation permissions
- CVE-2026-14258 Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in router advertisement handling
- CVE-2026-14257 brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash
- CVE-2026-14256 Memory corruption in 100w Gen 4 Laptop (Lenovo) ELAN TrackPoint Driver for Windows 11 (Version 22H2 or later) - Lenovo 100w Gen 4, 300w Yoga Gen 4, 500w Yoga Gen 4
- CVE-2026-14255 IFC File Parsing Uncontrolled Recursion in Certain Autodesk Products
- CVE-2026-14254 Improper Restriction of Excessive Authentication Attempts in Delphix Continuous Data
- CVE-2026-14251 Missing authorization in Red Hat OpenShift GitOps
- CVE-2026-14250 Themehunk Login Registration <= 1.0.2 - Unauthenticated Privilege Escalation via 'role' Parameter
- CVE-2026-1425 pymumu SmartDNS SVBC Record dns.c _dns_decode_SVCB_HTTPS stack-based overflow
- CVE-2026-14249 Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter
- CVE-2026-14245 Auth bypass in miniOrange OTP Login, Verification and SMS Notifications
- CVE-2026-14244 Jssor Slider by jssor.com <= 3.1.24 - Unauthenticated Arbitrary File Read via 'url' Parameter
- CVE-2026-14241 Memory safety bugs fixed in Firefox 152.0.4
- CVE-2026-14240 Tourmaster < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export
- CVE-2026-1424 PHPGurukul News Portal Profile Pic unrestricted upload
- CVE-2026-14239 Tourmaster < 5.4.8 - Stored XSS via CSRF
- CVE-2026-14238 Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report
- CVE-2026-14237 Vitepos < 3.6.0 - Outlet Manager+ Privilege Escalation
- CVE-2026-14236 Contact Form 7 – PayPal & Stripe Add-on < 2.5 - Open Redirect
- CVE-2026-14235 WordPress Download Manager < 3.3.62 - Unauthorized Protected File Download via Reusable Download Key
- CVE-2026-14234 WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF
- CVE-2026-14231 LifterLMS < 10.0.10 - Subscriber+ Sensitive Information Disclosure via select2_query_posts
- CVE-2026-14230 ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings
- CVE-2026-1423 code-projects Online Examination System admin_pic.php unrestricted upload
- CVE-2026-14229 ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload
- CVE-2026-14227 Insufficient session expiration in MikroTik RouterOS
- CVE-2026-14226 Easy Appointments < 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing
- CVE-2026-14225 Easy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist Bypass
- CVE-2026-14224 Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR
- CVE-2026-14223 Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR
- CVE-2026-14222 Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization
- CVE-2026-14221 Easy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization
- CVE-2026-1422 code-projects Online Examination System Login Page index.php sql injection
- CVE-2026-14219 URL Redirection in Bilin Software's HUMANIST Digital Human Resources
- CVE-2026-14216 Amelia < 2.4.7 - Unauthenticated Notification Queue Dispatch
- CVE-2026-14215 Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger
- CVE-2026-14214 Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment
- CVE-2026-14213 Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR
- CVE-2026-14212 Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR
- CVE-2026-14211 Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR
- CVE-2026-14210 Insufficient Granularity of Access Control in GitLab
- CVE-2026-1421 code-projects Online Examination System Add Pages cross site scripting
- CVE-2026-14209 Missing authorization in Red Hat JBoss Enterprise Application Platform Expansion Pack
- CVE-2026-14208 Local Privilege Escalation via Insecure DLL Permissions in Remote Utilities Host <=7.7.3.0
- CVE-2026-14207 LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information
- CVE-2026-14206 HT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure
- CVE-2026-14205 WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter
- CVE-2026-14204 Google Authenticator < 0.56 - 2FA Secret Overwrite via CSRF
- CVE-2026-14203 Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title
- CVE-2026-14202 Username Enumeration via Differential Login Responses in Bilin Software's HUMANIST Digital Human Resources
- CVE-2026-1420 Tenda AC23 WifiExtraSet buffer overflow
- CVE-2026-14199 Session takeover via Auth Proxy cache key collision
- CVE-2026-14198 @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values
- CVE-2026-14197 Fluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR
- CVE-2026-14196 WCFM Marketplace < 3.8.1 - Store Vendor+ Cross-Vendor Review Deletion and Status Update via IDOR
- CVE-2026-14195 Brizy – Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_info
- CVE-2026-14194 Path Traversal Allows Arbitrary File Download in Bilin Software's HUMANIST Digital Human Resources
- CVE-2026-14193 DVP80ES300T - Improper Validation of Array Index Vulnerability
- CVE-2026-14192 Stored XSS in Bilin Software's HUMANIST Digital Human Resources
- CVE-2026-14191 WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader
- CVE-2026-14190 Sina Extension for Elementor < 3.10.2 - Reflected XSS
- CVE-2026-1419 D-Link DCS700l Web Form setDayNightMode command injection
- CVE-2026-14189 WPBot AI ChatBot < 8.5.2 - Admin+ Second-Order SQL Injection via qc_bot_str_fields
- CVE-2026-14188 Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure
- CVE-2026-14187 Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR
- CVE-2026-14185 WPBot AI ChatBot < 8.2.0 - Subscriber+ RAG Settings Update
- CVE-2026-14184 Academy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR
- CVE-2026-14183 Classified Listing < 5.3.9 - Subscriber+ Payment Receipt Disclosure via IDOR
- CVE-2026-14182 Auth bypass in Customer Email Verification for WooCommerce
- CVE-2026-14181 @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths
- CVE-2026-14180 Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap
- CVE-2026-1418 GPAC SRT Subtitle Import text_to_bifs.c gf_text_import_srt_bifs out-of-bounds write
- CVE-2026-14178 openGauss存在非法内存访问导致DoS漏洞
- CVE-2026-14177 User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure
- CVE-2026-14175 Unrestricted File Upload in Bilin Software's HUMANIST Digital Human Resources
- CVE-2026-14172 Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation
- CVE-2026-14171 ads-tec Industrial IT: Post-login open redirect in the web interface
- CVE-2026-1417 GPAC filedump.c dump_isom_rtp null pointer dereference
- CVE-2026-14169 ads-tec Industrial IT: Account lockout via non-atomic user creation
- CVE-2026-14168 ads-tec Industrial IT: Vertical privilege escalation via configuration table write
- CVE-2026-14167 ads-tec Industrial IT: Privilege escalation during configuration import
- CVE-2026-14165 Missing authorization in Tuleap Enterprise Edition
- CVE-2026-14164 Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()
- CVE-2026-14163 Information disclosure in Octopus Server
- CVE-2026-14162 Advantech｜Hospital Quering Management - Missing Authentication
- CVE-2026-14161 Advantech｜Hospital Queuing Management - Sensitive Data Exposure
- CVE-2026-14160 Race condition in Escargot
- CVE-2026-1416 GPAC filedump.c DumpMovieInfo null pointer dereference
- CVE-2026-14158 Widget Logic Visual <= 1.52 - Authenticated (Subscriber+) Remote Code Execution via 'nwlv[cod-tag]' Parameter
- CVE-2026-14157 Memory corruption in Router
- CVE-2026-14156 Security feature bypass in Chrome
- CVE-2026-14155 Security feature bypass in Chrome
- CVE-2026-14154 Other in Chrome
- CVE-2026-14153 Other in Chrome
- CVE-2026-14152 Memory corruption in Chrome
- CVE-2026-14151 Security feature bypass in Chrome
- CVE-2026-14150 Other in Chrome
- CVE-2026-1415 GPAC media_export.c gf_media_export_webvtt_metadata null pointer dereference
- CVE-2026-14149 Use after free in Chrome
- CVE-2026-14148 Memory corruption in Chrome