Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 883 of 1013.
- CVE-2026-12663 ControlFLASH ® – Improper Access Control
- CVE-2026-12661 FactoryTalk® Historian Machine Edition - Out-of-Bounds Write Vulnerability
- CVE-2026-12660 IBM MQ Path Traversal
- CVE-2026-1266 Postalicious <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
- CVE-2026-12659 Rockwell Automation Flex 5000® Adapter - Denial of Service
- CVE-2026-12657 LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter
- CVE-2026-12656 1732E ArmorBlock® - Multiple Vulnerabilities
- CVE-2026-12655 1732E ArmorBlock® - Multiple Vulnerabilities
- CVE-2026-12654 Missing authorization in Payment Plugins for Stripe WooCommerce
- CVE-2026-12651 Deserialization in Neurons for ITSM
- CVE-2026-12650 Deserialization in Neurons for ITSM
- CVE-2026-1265 IBM InfoSphere Information Server is vulnerable due to sensitive information written to a log file
- CVE-2026-12648 Deserialization in Neurons for ITSM
- CVE-2026-12647 Missing authorization in Ivanti Neurons for ITSM
- CVE-2026-12646 Missing authorization in Ivanti Neurons for ITSM
- CVE-2026-12645 Missing authorization in Ivanti Neurons for ITSM
- CVE-2026-12644 ts-deepmerge: Prototype Method Override leads to DoS
- CVE-2026-1264 IBM Sterling B2B Integrator and IBM Sterling File Gateway Improper Access Controls
- CVE-2026-12635 Reliance on Reverse DNS Resolution for a Security-Critical Action in GitLab
- CVE-2026-12634 Out-of-bounds stack write in the settings NVS backend from over-reported nvs_read length
- CVE-2026-12633 Out-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router Advertisement
- CVE-2026-12632 Out-of-bounds read in Zephyr PTP message parsing from unvalidated message type
- CVE-2026-12631 Broken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernel
- CVE-2026-12630 6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing mode
- CVE-2026-1263 Webling <= 3.9.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'title' Parameter
- CVE-2026-12629 PL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denial of service
- CVE-2026-12628 Hardcoded credential in the IBM Storage Protect Snapshot For Windows leads to unauthorized access to system
- CVE-2026-12627 Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability
- CVE-2026-12626 Deserialization in Online Scheduling and Appointment Booking System – Bookly
- CVE-2026-12624 Vault vulnerable to LIST authorization bypass via trailing-slash strip
- CVE-2026-12622 Open Redirect Vulnerability in Password Reset Submission in GridTime™ 3000 GNSS Time Server
- CVE-2026-12621 Cross-Site Scripting (XSS) Vulnerability in Password Reset Redirect in GridTime™ 3000 GNSS Time Server
- CVE-2026-12620 Access Token Exposure in URL Parameters in GridTime™ 3000 GNSS Time Server
- CVE-2026-1262 IBM InfoSphere Information Server Information Disclosure
- CVE-2026-12619 GridTime™ 3000 GNSS Time Server CSRF to XSS
- CVE-2026-12618 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-12617 Record ordering based unexpected exit with CNAME or DNAME
- CVE-2026-12616 Other in Eclipse CSI - PIA
- CVE-2026-12613 Insecure Deserialization Leading to Remote Code Execution in Ministry of Justice's UYAP Document Editor
- CVE-2026-12611 Race condition in Eclipse Jetty
- CVE-2026-12610 Sssd: use-after-free crash in sssd' 'sssd_pam' process
- CVE-2026-1261 MetForm Pro <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting
- CVE-2026-12609 Path traversal in Eclipse Theia
- CVE-2026-12606 Other in Eclipse GlassFish
- CVE-2026-12605 Server-side request forgery in Eclipse GlassFish
- CVE-2026-12602 Incorrect permissions in ArubaSign by Aruba
- CVE-2026-12600 Uncontrolled memory usage in Innodata Labs’ Poppler JPX decoder
- CVE-2026-1260 Invalid Memory Access in Sentencepiece,
- CVE-2026-12598 LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth Callback
- CVE-2026-12597 LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via GitHub OAuth Callback
- CVE-2026-12595 LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth Callback
- CVE-2026-12593 Privilege escalation via forged API token creation in Axivion Dashboard OIDC/OAuth2/SSO subsystem
- CVE-2026-12592 SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header
- CVE-2026-12590 body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement
- CVE-2026-12588 Denial of service in Trellix HX Console
- CVE-2026-12587 Embedded credentials in Virtuagym
- CVE-2026-12586 Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset
- CVE-2026-12585 Abandoned Cart Lite for WooCommerce < 6.8.2 - Unauthenticated Account Takeover via Malleable Recovery-Link Token
- CVE-2026-12584 Business logic in Payment Gateway for Redsys & WooCommerce Lite
- CVE-2026-12583 Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field
- CVE-2026-12582 Library Management System < 3.5.8 - Unauthenticated SQL Injection via book_id
- CVE-2026-12581 Digiwin｜EasyFlow .NET - Session Fixation
- CVE-2026-12580 Digiwin｜EasyFlow .NET - Stored Cross-Site Scripting
- CVE-2026-1258 Mail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints
- CVE-2026-12579 AS228T - Authentication Bypass Vulnerability
- CVE-2026-12578 DTMSoft - Deserialization of Untrusted Data Vulnerability
- CVE-2026-12577 DVP80ES3 Improperly Implemented Security Check for Standard vulnerability
- CVE-2026-12576 DVP80ES3 Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability
- CVE-2026-12575 DVP80ES3 Improper Resource Shutdown or Release Vulnerability
- CVE-2026-12571 Authentication Bypass Leading to Account Takeover
- CVE-2026-12570 Denial of Service via HDF5 Shape Bomb in keras.models.load_model() in keras-team/keras
- CVE-2026-1257 Administrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Local File Inclusion via 'slug' Shortcode Attribute
- CVE-2026-12569 PTC Windchill and FlexPLM Improper Input Validation
- CVE-2026-12568 Arbitrary File Write in postman_download module
- CVE-2026-12567 Symlink-following arbitrary write via github_workflows module
- CVE-2026-12566 SSRF via unvalidated WWW-Authenticate realm in docker_pull module
- CVE-2026-12565 Path Traversal (Zip-Slip) in unarchive module
- CVE-2026-12564 Server-side request forgery in Red Hat Ansible Automation Platform 2.4 for RHEL 8
- CVE-2026-12562 Toptech Systems RCU II+ and Multiload II+ Missing Authentication for Critical Function
- CVE-2026-12561 tagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2026-12560 Editorial Rating <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Link URL' Field
- CVE-2026-1256 Missing authorization in YS LeadGen – Popup Builder, Popup Maker & Form Builder for WordPress | Lead Generation, Email Marketing, Sales, Conversions, Opt-Ins & Subscribers
- CVE-2026-12559 Cross-site scripting in Vendor Invoice Management for SAP Solutions
- CVE-2026-12557 Missing authorization in Ninja Forms - File Uploads
- CVE-2026-12556 HP Easy Start for macOS - Security Update
- CVE-2026-12555 HP Easy Start for macOS - Security Update
- CVE-2026-12554 HP Easy Start for macOS - Security Update
- CVE-2026-12553 HP Web Jetadmin (WJA) - Potential Arbitrary File Read/Write
- CVE-2026-1255 Missing authorization in YS LeadGen – Popup Builder, Popup Maker & Form Builder for WordPress | Lead Generation, Email Marketing, Sales, Conversions, Opt-Ins & Subscribers
- CVE-2026-12549 Libsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserver
- CVE-2026-12548 Libsoup: heap out-of-bounds read in libsoup due to integer truncation
- CVE-2026-12547 Libsoup: information disclosure in libsoup via soupauthmanager proxy credential leak on proxy switch
- CVE-2026-12545 Rubygem-hammer_cli: command injection via insecure editor invocation
- CVE-2026-12544 Foreman: ssti and insecure deserialization in foreman-rake configuration
- CVE-2026-12542 Foreman: command injection in foreman-tail
- CVE-2026-12541 Foreman: command injection in foreman-rake database tasks
- CVE-2026-12540 Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
- CVE-2026-1254 Missing authorization in Modula Image Gallery – Photo Grid & Video Gallery
- CVE-2026-12539 Docker Sandboxes ICMP egress restriction bypass after daemon restart
- CVE-2026-12537 Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows