Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 876 of 1013.
- CVE-2026-13521 SourceCodester Class and Exam Timetabling System preview5.php sql injection
- CVE-2026-13520 itsourcecode Hospital Management System Appointment appointmentapproval.php sql injection
- CVE-2026-1352 IBM® Db2® is vulnerable to a trap or return SQLCODE -901 when compiling a specially crafted query with a defined index
- CVE-2026-13519 Tenda JD12L NatStaticSetting fromNatStaticSetting stack-based overflow
- CVE-2026-13518 Tenda JD12L addressNat fromAddressNat stack-based overflow
- CVE-2026-13517 Tenda JD12L WifiBasicSet formWifiBasicSet stack-based overflow
- CVE-2026-13516 Tenda JD12L WifiGuestSet fromSetWifiGusetBasic stack-based overflow
- CVE-2026-13515 Tenda JD12L SetPptpServerCfg formSetPPTPServer stack-based overflow
- CVE-2026-13514 Chess Play and Learn App com.chess AndroidManifest.xml backup
- CVE-2026-13513 MyScale MyScaleDB SegmentId.h getCacheKey data authenticity
- CVE-2026-13512 Databend Tenant client_session_manager.rs state_key authorization
- CVE-2026-13511 VoltAgent Memory REST API memory.handlers.ts handleGetMemoryConversation improper authorization
- CVE-2026-13510 SimStudioAI sim Password Protection deployment.ts weak hash
- CVE-2026-13509 RAGapp Knowledge File files.py FileHandler.remove_file path traversal
- CVE-2026-13508 khoj-ai khoj Conversation Sharing api_chat.py authorization
- CVE-2026-13507 volcengine OpenViking Local VectorDB Primary-key Label str_to_uint64.py str_to_uint64 data authenticity
- CVE-2026-13506 Lazy ASN.1 sequence forcing resets nesting-depth guard
- CVE-2026-13505 Zeroisation of sensitive key material on garbage collection relies on finalization
- CVE-2026-13504 code-projects Project Management System Mail Compose mail.php cross site scripting
- CVE-2026-13503 antlr ANTLR4 tokenVocab Grammar Option TokenVocabParser.java getImportedVocabFile path traversal
- CVE-2026-13502 antlr ANTLR4 Maven Plugin GrammarDependencies.java ObjectInputStream.readObject toctou
- CVE-2026-13501 antlr ANTLR4 gofmt GoTarget.java GoTarget command injection
- CVE-2026-13500 antlr ANTLR4 Grammar Action Block OutputFile.java code injection
- CVE-2026-13499 yashpokharna2555 restaurent-management-system Registration login_register.php cross site scripting
- CVE-2026-13498 yashpokharna2555 restaurent-management-system POST Parameter forgotpassword.php sql injection
- CVE-2026-13497 itsourcecode Hospital Management System appointment.php sql injection
- CVE-2026-13496 itsourcecode Hospital Management System ajaxmedicine.php sql injection
- CVE-2026-13495 itsourcecode Hospital Management System adminprofile.php sql injection
- CVE-2026-13493 AIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation_api.py resource injection
- CVE-2026-13492 UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field
- CVE-2026-13491 78 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service
- CVE-2026-13490 glpi-project glpi Document document.send.php canViewFile authorization
- CVE-2026-13489 78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization
- CVE-2026-13488 SourceCodester Class and Exam Timetabling System preview7.php sql injection
- CVE-2026-13487 SourceCodester Class and Exam Timetabling System archive.php sql injection
- CVE-2026-13486 SourceCodester Class and Exam Timetabling System preview6.php sql injection
- CVE-2026-13485 SourceCodester Class and Exam Timetabling System preview.php sql injection
- CVE-2026-13484 MLflow Experiment-scoped Label Schema CRUD API authorization
- CVE-2026-13483 arc53 DocsGPT Credential Storage encryption.py encrypt_credentials data authenticity
- CVE-2026-13482 skypilot-org skypilot User ID server.py username.encode weak hash
- CVE-2026-13481 Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP
- CVE-2026-13480 Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler
- CVE-2026-13479 Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler
- CVE-2026-13478 Out-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_count
- CVE-2026-13477 IBM QRadar SIEM is vulnerable to remote code execution by privileged users
- CVE-2026-13476 IBM Informix Wire Listener Vulnerable to Unauthenticated Remote Code Execution
- CVE-2026-13474 Denial of service via malformed HTTP/2 requests
- CVE-2026-13473 IBM Storage Protect Client is vulnerable to Heap-Based Buffer Overflow
- CVE-2026-13471 Missing authorization in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
- CVE-2026-13468 Missing authorization in Visualizer – Tables & Charts Manager with Built-in AI Generator
- CVE-2026-13467 Systemic Missing Address Validation in SiP SMC Handlers
- CVE-2026-13466 Unit Confusion in VAB Authentication
- CVE-2026-13465 EL3 Stack Buffer Overflow in FCS HKDF Request
- CVE-2026-13464 Missing authorization in Kirki – Freeform Page Builder, Website Builder & Customizer
- CVE-2026-13463 Due to use of IBM Storage Protect, IBM Cloud Pak System is affected by vulnerability []
- CVE-2026-13462 PayRange for Android, version 7.0.7, contains an SSL bypass vulnerability
- CVE-2026-13461 PayRange version 7.0.7 contains a JavaScript injection vulnerability
- CVE-2026-13460 Hardcoded credentials in Storage Scale
- CVE-2026-1346 Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-13459 Missing authorization in JetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-13458 Cross-site scripting in GenerateBlocks
- CVE-2026-13457 InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure
- CVE-2026-13456 WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter
- CVE-2026-13455 PostgreSQL Anonymizer: Unrestricted function can leak the secret salt
- CVE-2026-13454 MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter
- CVE-2026-13451 Kserve: kserve: server-side request forgery via malicious storageuri
- CVE-2026-13450 Missing authorization in GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress
- CVE-2026-1345 Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-13449 XXE attack in IBM Business Automation Manager Open Editions
- CVE-2026-13448 Code injection in Langflow OSS
- CVE-2026-13447 MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery
- CVE-2026-13446 Hardcoded credentials in Langflow OSS
- CVE-2026-13445 Missing authorization in Langflow OSS
- CVE-2026-13444 Missing authorization in Langflow OSS
- CVE-2026-13443 Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title
- CVE-2026-13442 Missing authorization in Langflow OSS
- CVE-2026-13441 EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter
- CVE-2026-13440 Cross-site scripting in StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce
- CVE-2026-1344 Insecure file permissions in Enforce Recovery Key Portal
- CVE-2026-13439 Privilege escalation in Easy Form Builder by WhiteStudio – Drag & Drop Form Builder
- CVE-2026-13437 Information disclosure in PowerShell Universal
- CVE-2026-13435 Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure
- CVE-2026-13434 Security feature bypass in Red Hat OpenShift Virtualization 4
- CVE-2026-13433 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities
- CVE-2026-13432 ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation
- CVE-2026-13430 File upload in Post Export Import with Media
- CVE-2026-1343 Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-13426 Client4 fails to validate path parameters
- CVE-2026-13425 Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values
- CVE-2026-13424 Cross-site scripting in Online Scheduling and Appointment Booking System – Bookly
- CVE-2026-13423 Streamit <= 4.5.0 - Unauthenticated Remote Code Execution via Arbitrary Function Call
- CVE-2026-13422 HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers
- CVE-2026-1342 Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-13417 Boards plugin denial of service via unvalidated block fields.properties
- CVE-2026-13416 CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmedia
- CVE-2026-13415 CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings
- CVE-2026-13414 CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax
- CVE-2026-13413 CMP - Coming Soon & Maintenance < 4.1.20 - Unauthenticated Maintenance Mode Bypass via Login URL Match
- CVE-2026-13411 Null condition in Playbooks import crashes the plugin
- CVE-2026-13410 Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled