Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 889 of 1013.
- CVE-2026-11973 WP-Lister Lite for eBay <= 3.8.8 - Authenticated (Shop Manager+) SQL Injection via 'orderby' Parameter
- CVE-2026-11972 tarfile opened in streaming mode mishandles EOF
- CVE-2026-11970 Security feature bypass in F1E mac
- CVE-2026-1197 MineAdmin downloadById information disclosure
- CVE-2026-11969 WP TripAdvisor Review Slider <= 14.3 - Authenticated (Administrator+) SQL Injection
- CVE-2026-11968 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in TortoiseGit
- CVE-2026-11967 Arbitrary code execution in MobaXterm Personal Edition (Portable)
- CVE-2026-11966 User Registration & Membership < 5.2.3 - Unauthenticated Limited User Deletion via Stripe Subscription Handler
- CVE-2026-11965 User Registration & Membership < 5.2.0 - Unauthenticated Paid Membership Bypass
- CVE-2026-11964 Auth bypass in User Registration & Membership
- CVE-2026-11963 User Registration & Membership < 5.2.2 - Subscriber+ Cross-User Role and Membership Tier Modification via IDOR
- CVE-2026-11962 FileOrganizer < 1.2.0 - Authenticated Arbitrary File Upload via elFinder File Operations
- CVE-2026-11961 User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID
- CVE-2026-11960 Multiple vulnerabilities in FacturaScripts
- CVE-2026-1196 MineAdmin getFileInfoById information disclosure
- CVE-2026-11959 Multiple vulnerabilities in FacturaScripts
- CVE-2026-11958 Local privilege escalation in ANSSI’s DFIR-ORC
- CVE-2026-11956 TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute
- CVE-2026-1195 MineAdmin JWT Token refresh data authenticity
- CVE-2026-11946 GetEndpoints Memory Exhaustion in open62541
- CVE-2026-11945 PostgreSQL Anonymizer: SQL injection in the rules import functions
- CVE-2026-11944 openSIS Classic 9.3 - Authenticated path traversal in SentMail attachment download
- CVE-2026-11943 Akaunting 3.1.21 - Authenticated stored XSS in document timeline
- CVE-2026-11942 Akaunting 3.1.21 - Stored XSS in delete confirmation modal
- CVE-2026-11941 Use-after-free in connection ID iterator and FFI functions
- CVE-2026-11940 tarfile extraction filter bypass allows escaping the destination directory
- CVE-2026-1194 MineAdmin Swagger information disclosure
- CVE-2026-11939 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-11937 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-11936 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-11934 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-11933 Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion
- CVE-2026-119325 Bricks Theme Broken Access Control via load_popup_content
- CVE-2026-11932 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-119317 Incorrect Authorization
- CVE-2026-11931 Insecure Permissions on Authentication Token Cache File in Kiro IDE
- CVE-2026-11930 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-1193 MineAdmin View view improper authorization
- CVE-2026-11929 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-119286 GraphQL-core: Denial of service via memory leak in aborted validations
- CVE-2026-119285 Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads
- CVE-2026-119284 joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection
- CVE-2026-119283 Denial of service in joserfc
- CVE-2026-119282 Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle
- CVE-2026-119281 MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing
- CVE-2026-119280 MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths
- CVE-2026-11928 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-119279 MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths
- CVE-2026-119278 MariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authentication
- CVE-2026-119277 MariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengths
- CVE-2026-119276 MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets
- CVE-2026-11927 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-11926 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-119251 Privilege escalation in WiFiman Desktop for macOS
- CVE-2026-119250 Command injection in WiFiman Desktop for macOS
- CVE-2026-11925 Tanium addressed a User Interface (UI) Misrepresentation of Critical Information vulnerability in Tanium Server.
- CVE-2026-119249 Misconfiguration in WiFiman Desktop for macOS
- CVE-2026-11923 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-11922 Rate-limit Bypass in zenml-io/zenml
- CVE-2026-119210 Path traversal in mariadb-connector-j
- CVE-2026-11921 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-119209 pypdf: Possible large memory usage when parsing cross-reference streams
- CVE-2026-119208 pypdf: Possible long runtimes/large memory usage for encrypted PDF files
- CVE-2026-119207 pypdf: Possible large memory usage for exceptions in strict mode
- CVE-2026-119206 pypdf: Possible long runtimes when retrieving page labels
- CVE-2026-119205 pypdf: Possible infinite loop when cloning dictionaries
- CVE-2026-119204 pypdf: Possible large memory usage when parsing page tree
- CVE-2026-119203 pypdf: Possible infinite loop when hitting EOF in standard xref table during trailer search
- CVE-2026-119202 @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service
- CVE-2026-119201 Nuxt dev server exposes generated appSecret through Vite file serving
- CVE-2026-119200 Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes
- CVE-2026-11920 JoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter
- CVE-2026-1192 Tosei Online Store Management System ネット店舗管理システム imode_alldata.php command injection
- CVE-2026-119199 Nuxt dev server exposes private runtime config through the Nitro dev bundle
- CVE-2026-119198 Nuxt dev server arbitrary file read through client error reports
- CVE-2026-119197 pyasn1: Quadratic-complexity denial of service in binary REAL decoding
- CVE-2026-119196 pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding
- CVE-2026-119195 pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding
- CVE-2026-119194 pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding
- CVE-2026-119193 PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling
- CVE-2026-119191 Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
- CVE-2026-119190 Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
- CVE-2026-119189 Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage
- CVE-2026-119188 Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
- CVE-2026-119187 Forge: Denial of service in TLS record processing via call stack exhaustion
- CVE-2026-119186 Forge: AES-GCM authentication bypass via unvalidated tagLength option
- CVE-2026-11918 IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures
- CVE-2026-11917 ThinManager® - Path Traversal via API
- CVE-2026-119168 Nomad allocation data migration may allow host directory permission modification via symlink following
- CVE-2026-11915 Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047
- CVE-2026-119145 Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload
- CVE-2026-119144 Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields
- CVE-2026-119143 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes
- CVE-2026-119142 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop
- CVE-2026-119141 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc
- CVE-2026-119140 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield
- CVE-2026-11914 Composer - Critical - Unsupported - SA-CONTRIB-2026-046
- CVE-2026-119139 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call
- CVE-2026-119138 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap
- CVE-2026-119137 Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry