Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 875 of 1013.
- CVE-2026-13635 Information disclosure in DiskStation Manager (DSM)
- CVE-2026-1363 JNC｜IAQS and I6 - Client-Side Enforcement of Server-Side Security
- CVE-2026-13623 Cross-site scripting in DiskStation Manager (DSM)
- CVE-2026-13622 Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host
- CVE-2026-13613 KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint
- CVE-2026-13612 KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR
- CVE-2026-13611 KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure
- CVE-2026-13610 KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration
- CVE-2026-1361 ASDA-Soft Stack-based Buffer Overflow Vulnerability
- CVE-2026-13609 Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Form Field
- CVE-2026-13608 OpenLDAP SASL authentication bypass
- CVE-2026-13607 File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access
- CVE-2026-13605 Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute
- CVE-2026-13604 Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX
- CVE-2026-13603 SSRF with API key leak in pretix-oppwa
- CVE-2026-13602 Session takeover vulnerability
- CVE-2026-13601 Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications
- CVE-2026-13600 AutoNetTV Relay < 3.0.14 - Unauthenticated Privilege Escalation via Scheduled Sync Cron
- CVE-2026-1360 BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data
- CVE-2026-13599 ABB Ability Edgenius | Missing Authentication in Edgenius AuthDB
- CVE-2026-13598 RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to Administrator
- CVE-2026-13597 QRcode Login for WeChat <= 1.3 - Unauthenticated Account Takeover
- CVE-2026-13596 Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search
- CVE-2026-13595 Util-linux: util-linux: heap use-after-free in libblkid nested partition probing
- CVE-2026-13593 CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away
- CVE-2026-13592 liftoff-sr CIPster EtherNet IP Message append out-of-bounds write
- CVE-2026-13591 DeepMyst Mysti Contact Tracking ChannelBridge.ts _isTrackedConversation improper authorization
- CVE-2026-13590 seladb PcapPlusPlus Modbus Protocol ModbusLayer.h getLength heap-based overflow
- CVE-2026-1359 Missing authorization in Genolve – Genolve AI Business Graphics, AI Images
- CVE-2026-13589 seladb PcapPlusPlus Telnet Subnegotiation Packet TelnetLayer.cpp getSubCommand heap-based overflow
- CVE-2026-13588 seladb PcapPlusPlus TLS Hello SSLHandshake.cpp getHandshakeVersion heap-based overflow
- CVE-2026-13587 seladb PcapPlusPlus LightPcapNg light_pcapng.c parse_by_block_type heap-based overflow
- CVE-2026-13586 PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)
- CVE-2026-13585 Information disclosure in Business Manager
- CVE-2026-13584 Information tampering and Denial-of-service (DoS) vulnerability in CC-Link IE TSN communication protocol
- CVE-2026-13583 Edimax EW-7478APC POST Request formUSBFolder buffer overflow
- CVE-2026-13582 Edimax EW-7478APC POST Request formUSBAccount buffer overflow
- CVE-2026-13581 Edimax EW-7478APC POST Request formStaDrvSetup os command injection
- CVE-2026-13580 Edimax EW-7478APC POST Request formQoS buffer overflow
- CVE-2026-1358 Airleader Master Unrestricted Upload of File with Dangerous Type
- CVE-2026-13579 itsourcecode Hospital Management System patientchangepassword.php sql injection
- CVE-2026-13578 itsourcecode Hospital Management System patientdetail.php sql injection
- CVE-2026-13577 Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable
- CVE-2026-13574 llvm llvm-project Bitcode File IntrinsicInst.cpp getBasePtr heap-based overflow
- CVE-2026-13573 llvm llvm-project ValueSymbolTable ValueSymbolTable.cpp insert stack-based overflow
- CVE-2026-13572 itsourcecode Hospital Management System insertbillingrecord.php sql injection
- CVE-2026-13571 SourceCodester Simple Food Ordering System cart.php logic error
- CVE-2026-13570 SourceCodester Inventory Management System User Registration Endpoint users_handler.php cross site scripting
- CVE-2026-1357 Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
- CVE-2026-13569 weng-xianhu EyouCMS API index.php sql injection
- CVE-2026-13568 SourceCodester Inventory Management System User Registration Endpoint users_handler.php access control
- CVE-2026-13567 code-projects Online Music Site POST Request Feedback.php cross site scripting
- CVE-2026-13566 SourceCodester Class and Exam Timetabling System preview3.php sql injection
- CVE-2026-13565 SourceCodester Class and Exam Timetabling System edit_class1.php sql injection
- CVE-2026-13564 Edimax EW-7478APC POST Request formPPPoESetup stack-based overflow
- CVE-2026-13563 Edimax EW-7478APC POST Request formL2TPSetup stack-based overflow
- CVE-2026-13562 Edimax EW-7478APC POST Request formiNICSiteSurvey buffer overflow
- CVE-2026-13561 Edimax EW-7478APC POST Request formiNICbasic os command injection
- CVE-2026-13560 Edimax EW-7478APC POST Request formAccept os command injection
- CVE-2026-1356 Server-side request forgery in Converter for Media – Optimize images | Convert WebP & AVIF
- CVE-2026-13559 code-projects Real State Services single-list_sale.php add sql injection
- CVE-2026-13558 CodeAstro Complaint Management System Report addreport cross site scripting
- CVE-2026-13557 itsourcecode Online Hotel Management System POST Request controller.php add cross site scripting
- CVE-2026-13556 itsourcecode Online Hotel Management System POST Request controller.php edit cross site scripting
- CVE-2026-13555 itsourcecode Online Hotel Management System controller.php add sql injection
- CVE-2026-13554 itsourcecode Online Hotel Management System POST Request controller.php add cross site scripting
- CVE-2026-13553 itsourcecode Online Hotel Management System controller.php add unrestricted upload
- CVE-2026-13552 itsourcecode Online Hotel Management System controller.php edit sql injection
- CVE-2026-13551 itsourcecode Baptism Information Management System editBaptism.php sql injection
- CVE-2026-13550 itsourcecode Baptism Information Management System delbaptism.php sql injection
- CVE-2026-1355 Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports
- CVE-2026-13549 CodeAstro Complaint Management System Report Endpoint Report.php deletereport authorization
- CVE-2026-13548 itsourcecode Hospital Management System doctortimings.php sql injection
- CVE-2026-13547 Hanwang e-Face General Management Platform upload.do unrestricted upload
- CVE-2026-13546 Feehi CMS REST API Endpoint articles missing authentication
- CVE-2026-13545 D-Link DCS-935L POST Parameter setconf.cgi sub_400E40 os command injection
- CVE-2026-13544 Feehi CMS API users access control
- CVE-2026-13543 Documenso Google OAuth Login handle-oauth-callback-url.ts improper authentication
- CVE-2026-13542 itsourcecode Hospital Management System doctorprofile.php sql injection
- CVE-2026-13541 itsourcecode Hospital Management System doctorchangepassword.php sql injection
- CVE-2026-13540 GitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgery
- CVE-2026-1354 Zero Motorcycles Firmware Key Exchange without Entity Authentication
- CVE-2026-13539 Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_407504 stack-based overflow
- CVE-2026-13538 Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_401D68 command injection
- CVE-2026-13537 CodeAstro Human Resource Management System cross-site request forgery
- CVE-2026-13536 GotoHTTP reg.12x cross site scripting
- CVE-2026-13535 CodeAstro Human Resource Management System View Endpoint Employee_model.php GetFileInfo sql injection
- CVE-2026-13534 CherryHQ cherry-studio CherryIN Preload API MemoryService.ts sha256 authorization
- CVE-2026-13533 agentejo Cockpit CMS htaccess config.yaml YAMLLoad file access
- CVE-2026-13532 itsourcecode Hospital Management System departmentDoctor.php sql injection
- CVE-2026-13531 itsourcecode Hospital Management System department.php sql injection
- CVE-2026-13530 itsourcecode Hospital Management System Appointment appointmentdetail.php sql injection
- CVE-2026-13529 YzmCMS index.php sql injection
- CVE-2026-13528 Path traversal in ruoyi-vue-pro
- CVE-2026-13527 SourceCodester Class and Exam Timetabling System preview4.php sql injection
- CVE-2026-13526 SourceCodester Class and Exam Timetabling System edit_class.php sql injection
- CVE-2026-13525 CodeAstro Human Resource Management System Update_Earn_Leave Endpoint Employee_model.php emselectByCode sql injection
- CVE-2026-13524 CherryHQ cherry-studio MCP OAuth Local Callback Server callback.ts improper authorization
- CVE-2026-13523 GPAC ISOBMFF base_encoding.c data amplification
- CVE-2026-13522 Investintech SlimPDFReader PDF File SlimPDFReader.exe TeighaDo+0x25cde0 out-of-bounds