Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 878 of 1013.
- CVE-2026-13283 Use after free in Chrome
- CVE-2026-13282 Use after free in Chrome
- CVE-2026-13281 Integer overflow in Chrome
- CVE-2026-1328 Totolink NR1800X POST Request cstecgi.cgi setWizardCfg buffer overflow
- CVE-2026-13277 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-13276 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-13275 IBM MQ Managed File Transfer is vulnerable to XML external entity injection
- CVE-2026-13272 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-1327 Totolink NR1800X POST Request cstecgi.cgi setTracerouteCfg command injection
- CVE-2026-13268 G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability
- CVE-2026-13267 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-13265 IBM MQ Managed File Transfer REST API is vulnerable to XML external entity injection
- CVE-2026-13262 Majestic Support <= 1.1.9 - Authenticated (Subscriber+) SQL Injection via 'val' Parameter
- CVE-2026-13260 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-1326 Totolink NR1800X POST Request cstecgi.cgi setWanCfg command injection
- CVE-2026-13258 IBM DataPower Gateway Cross-Site Scripting
- CVE-2026-13257 IBM DataPower Gateway Insufficient Verification of Data Authenticity
- CVE-2026-13253 Cross-site scripting in Post Grid Gutenberg Blocks – PostX
- CVE-2026-13252 Cross-site scripting in RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
- CVE-2026-13251 Perfmatters <= 2.6.4 - Unauthenticated Arbitrary File Read via 's' Parameter
- CVE-2026-13250 Missing authorization in Solace Extra
- CVE-2026-1325 Sangfor Operation and Maintenance Security Management System edit_pwd_mall password recovery
- CVE-2026-13249 Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040
- CVE-2026-13248 Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface
- CVE-2026-13247 Logo Slider <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lgx_tooltip_position' Parameter
- CVE-2026-13246 GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute
- CVE-2026-13245 MaxButtons <= 9.8.5 - Reflected Cross-Site Scripting via 'view' Parameter
- CVE-2026-13244 Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064
- CVE-2026-13243 Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063
- CVE-2026-13242 Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062
- CVE-2026-13241 Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061
- CVE-2026-13240 Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060
- CVE-2026-1324 Sangfor Operation and Maintenance Management System SSH Protocol session SessionController os command injection
- CVE-2026-13239 WissKI - Critical - Access bypass - SA-CONTRIB-2026-059
- CVE-2026-13238 Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058
- CVE-2026-13237 AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057
- CVE-2026-13236 AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056
- CVE-2026-13235 AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055
- CVE-2026-13234 Cross-site scripting in AI (Artificial Intelligence)
- CVE-2026-13233 OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053
- CVE-2026-13232 Missing authorization in Advanced Content Feedback (aka admin feedback)
- CVE-2026-13231 Advanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051
- CVE-2026-13230 Information Disclosure Vulnerability in Local Discovery Response in TP-Link Kasa EC70 and EC71
- CVE-2026-1323 Insecure Deserialization in extension "Mailqueue" (mailqueue)
- CVE-2026-13229 Zammad 7.0.1 - Improper authorization in ticket article attachment cloning
- CVE-2026-13228 LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter
- CVE-2026-13227 ERPNext v16.25.0 - Improper authorization in Prospect opportunities API
- CVE-2026-13226 Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter
- CVE-2026-13225 Stored XSS in ticket confirmation page
- CVE-2026-13224 Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read
- CVE-2026-13223 Insufficient validation of payment status in pretix-computop
- CVE-2026-13222 Insufficient validation of payment status in pretix-oppwa
- CVE-2026-13221 Integer overflow in perl:perl
- CVE-2026-1322 Business Logic Errors in GitLab
- CVE-2026-13218 Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher
- CVE-2026-13217 NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi
- CVE-2026-13216 Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability length
- CVE-2026-13215 Zephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a crafted filesystem image
- CVE-2026-13214 Stack buffer overflow in OCPP GetConfiguration key parsing
- CVE-2026-13213 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register
- CVE-2026-13212 Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id
- CVE-2026-13211 Genucenter Disclosure of SNMP Credentials
- CVE-2026-13210 Incorrect Authorization in GitLab
- CVE-2026-1321 Membership Plugin – Restrict Content <= 3.2.20 - Unauthenticated Privilege Escalation via 'rcp_level'
- CVE-2026-13208 Auth bypass in Red Hat OpenShift Virtualization 4
- CVE-2026-13207 Frangoteam FUXA SCADA/HMI Authentication Bypass by Spoofing
- CVE-2026-13206 Multiple Vulnerabilities in Zyxel's WAH7601 - OS Command Injection
- CVE-2026-13204 Unexpected exit in certain situations with NSEC and NSEC3 both present
- CVE-2026-13203 Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute
- CVE-2026-13202 HTML Injection in OTDS Swagger UI
- CVE-2026-13201 Path traversal in Red Hat Container Native Virtualization 4.12
- CVE-2026-13200 Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter
- CVE-2026-1320 Cross-site scripting in Secure Copy Content Protection and Content Locking
- CVE-2026-13199 Insufficient Entropy in Raspberry Pi 5 and Compute Module 5
- CVE-2026-13198 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControl
- CVE-2026-13197 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControl
- CVE-2026-13196 Out-of-bounds Write in KUNBUS piControl
- CVE-2026-13192 RadEditor PDF Export SSRF Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13191 Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order_by' Parameter
- CVE-2026-13190 PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-1319 Robin Image Optimizer <= 2.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Alternative Text Field
- CVE-2026-13189 SpellChecker DictionaryLanguage Path Traversal Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13188 DialogHandler Parameters Tampering Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13187 DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13186 AppDataStorageProvider Path Traversal Deserialization Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13185 PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13184 RadAsyncUpload Default HMAC Key Fallback Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13183 RadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13182 RadAsyncUpload Client-State Decrypt-vs-Parse Oracle Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13181 RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13179 WP Maps <= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter
- CVE-2026-13178 Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation
- CVE-2026-13177 Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR
- CVE-2026-13176 Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery
- CVE-2026-13175 Eventin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR
- CVE-2026-13174 Eventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR
- CVE-2026-13173 Eventin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker Creation
- CVE-2026-13172 Eventin < 4.1.22 - Unauthenticated Unpublished Content Disclosure
- CVE-2026-13171 Eventin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint
- CVE-2026-13170 Eventin < 4.1.20 - Editor+ Local File Inclusion via speaker_template Setting