Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 886 of 1013.
- CVE-2026-12308 Memory safety bug fixed in Thunderbird 152
- CVE-2026-12307 Memory safety bug fixed in Thunderbird 152
- CVE-2026-12306 Memory safety bug fixed in Thunderbird 152
- CVE-2026-12305 Memory safety bug fixed in Thunderbird 152
- CVE-2026-12304 Same-origin policy bypass in the Networking: Cookies component
- CVE-2026-12303 Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component
- CVE-2026-12302 Mitigation bypass in the DOM: Security component
- CVE-2026-12301 Memory safety bug fixed in Thunderbird 152
- CVE-2026-12300 Memory safety bug fixed in Thunderbird 152
- CVE-2026-1230 Use of Incorrectly-Resolved Name or Reference in GitLab
- CVE-2026-12299 JIT miscompilation in the DOM: Core & HTML component
- CVE-2026-12298 Memory safety bug fixed in Thunderbird 152
- CVE-2026-12297 Sandbox escape due to incorrect boundary conditions in the Networking component
- CVE-2026-12296 Sandbox escape in the Security: Process Sandboxing component
- CVE-2026-12295 Sandbox escape in the DOM: Navigation component
- CVE-2026-12294 Sandbox escape in the DOM: Workers component
- CVE-2026-12293 Use-after-free in the Graphics: WebGPU component
- CVE-2026-12292 Incorrect boundary conditions in the Web Audio component
- CVE-2026-12291 Use-after-free in the Networking: HTTP component
- CVE-2026-12290 Memory safety bug fixed in Thunderbird 152
- CVE-2026-1229 Incorrect calculation in CIRCL secp384r1 CombinedMult
- CVE-2026-12289 Privilege escalation in the Graphics: WebRender component
- CVE-2026-12285 Mali GPU Kernel Driver allows access to already freed memory
- CVE-2026-12284 Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler
- CVE-2026-12283 SQL injection in Amazon Athena Synapse connector
- CVE-2026-12281 Shibboleth < 2.5.4 - Unauthenticated Administrator Account Creation via Identity Header Spoofing
- CVE-2026-1228 Missing authorization in Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines)
- CVE-2026-12277 Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal
- CVE-2026-12276 LA-Studio Element Kit for Elementor < 1.6.1 - Unauthenticated Open Registration
- CVE-2026-12275 Missing authorization in Tutor LMS
- CVE-2026-12274 Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR
- CVE-2026-12273 Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Auto-Approved Comment Creation
- CVE-2026-12272 Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant
- CVE-2026-12271 Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDOR
- CVE-2026-12270 Everest Forms < 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST Endpoints
- CVE-2026-1227 XML external entity in EcoStruxure Building Operation Webstation
- CVE-2026-12269 Authenticated File Write to RCE via keepalived in DDI Central
- CVE-2026-12268 Authenticated PowerShell Injection leads to RCE
- CVE-2026-12267 Authenticated PowerShell Injection in DNS Query Resolution Policy leads to RCE
- CVE-2026-12265 Missing Authorization on HA Failover Config allows Complete Data Destruction
- CVE-2026-12264 Authenticated File Write via HA Failover Config Upload leads to RCE
- CVE-2026-12263 Authentication Bypass
- CVE-2026-12261 Improper Access Control in nltk/nltk
- CVE-2026-12260 SQL injection in the NetBoard CRM demo platform
- CVE-2026-1226 Code injection in EcoStruxure Building Operation Webstation
- CVE-2026-12259 Improper Input Validation in nltk/nltk
- CVE-2026-12258 Inadequate access control in the Hiperdino REST API
- CVE-2026-12257 Remote code execution in Mura Software’s CMS
- CVE-2026-12256 WordPress Fusion Builder plugin <= 3.15.3 - PHP Object Injection vulnerability
- CVE-2026-12255 MainWP Child < 6.1.2 - Unauthenticated Administrator Authentication Bypass via Passwordless Site Registration
- CVE-2026-12254 Netskope Client Captive Portal WebView Persistence allowing SWG bypass issue
- CVE-2026-12252 Untrusted JAR Code Execution in Multiple Stanford Interface Classes in nltk/nltk
- CVE-2026-12251 Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field
- CVE-2026-12250 Sensitive Data Exposure in TUBITAK BILGEM's Pardus Domain Joiner
- CVE-2026-1225 Malicious logback.xml configuration file allows instantiation of arbitrary classes
- CVE-2026-12249 Canonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-Enrollment
- CVE-2026-12248 WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter
- CVE-2026-12246 Out of bounds stack write with crafted APL RR
- CVE-2026-12245 Denial of DNS over TLS service by any DoT client
- CVE-2026-12244 Heap overflow and crash with crafted SVCB RR
- CVE-2026-12242 AdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute
- CVE-2026-12241 Cross-site scripting in Advanced Woo Labels – Product Labels & Badges for WooCommerce
- CVE-2026-12240 Deserialization in Export User Data
- CVE-2026-1224 Tanium addressed an uncontrolled resource consumption vulnerability in Discover.
- CVE-2026-12238 WP Go Maps <= 10.1.01 - Unauthenticated Arbitrary Record Creation
- CVE-2026-12236 Infinite loop (DoS) in Bluetooth GATT client parsing of Read-By-Type responses with zero data length
- CVE-2026-12235 Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787)
- CVE-2026-12234 TOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write
- CVE-2026-12233 Uninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contention
- CVE-2026-12232 Out-of-bounds read via unvalidated stream_id in Intel ALH DAI get_properties
- CVE-2026-12231 Cross-site scripting in Exclusive Addons for Elementor
- CVE-2026-12230 LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'
- CVE-2026-1223 BROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Insufficiently Protected Credentials
- CVE-2026-12228 Stored XSS in Direct Messages via Prompt Sharing in parisneo/lollms
- CVE-2026-12227 Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
- CVE-2026-12225 syracom Secure Login (2FA) for Confluence allows 2FA bypass via spoofed User-Agent
- CVE-2026-12224 Dokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint
- CVE-2026-12223 Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection
- CVE-2026-12222 Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow
- CVE-2026-12221 Yealink SIP-T46U Firmware Chunk Upload upgrade sprintf stack-based overflow
- CVE-2026-12220 Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflow
- CVE-2026-1222 BROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Arbitrary File Upload
- CVE-2026-12219 Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection
- CVE-2026-12218 Yealink SIP-T46U Web FastCGI Service beforewifitest StartReportInformation stack-based overflow
- CVE-2026-12217 DVDFab Virtual Drive Signed Kernel Driver dvdfabio.sys privileges management
- CVE-2026-12216 svaarala duktape duk_api_bytecode.c memory corruption
- CVE-2026-12215 OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force
- CVE-2026-12214 Qihoo 360 Total Security Nucleus Engine Monitoring Logic RpcStringBindingComposeW protection mechanism
- CVE-2026-12213 hcengineering Huly Platform User Information operations.ts getAccountInfo improper authorization
- CVE-2026-12212 hcengineering Huly Platform RPC operations.ts getMailboxSecret access control
- CVE-2026-12211 Intelbras iNVU 7016 FT Web syslog path traversal
- CVE-2026-12210 universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery
- CVE-2026-1221 BROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Use of Hard-coded Credentials
- CVE-2026-12209 RubyLouvre avalon Template Filter index.js prototype pollution
- CVE-2026-12208 jsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollution
- CVE-2026-12207 medkey-org medkey HTTP REST API PatientController.php actionGetPatientById resource injection
- CVE-2026-12206 Grit42 Grit data_table_entity.rb DataTableEntity sql injection
- CVE-2026-12205 Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery
- CVE-2026-12204 ShopXO Scheduled Task Endpoint Crontab.php GoodsGiveIntegral authorization
- CVE-2026-12203 HKUDS AI-Trader Research Export agents.csv information disclosure