Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 890 of 1013.
- CVE-2026-119136 Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass
- CVE-2026-119135 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch
- CVE-2026-119134 Denial of service in wasmtime
- CVE-2026-119133 Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tags
- CVE-2026-119132 Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter
- CVE-2026-119131 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http
- CVE-2026-119130 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling
- CVE-2026-11913 Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045
- CVE-2026-119129 ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval
- CVE-2026-119128 ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie
- CVE-2026-119127 ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection
- CVE-2026-119126 Security feature bypass in parse-server
- CVE-2026-119125 Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields
- CVE-2026-119124 ImageMagick before 7.1.2-34 Heap Buffer Overflow via -morph Option
- CVE-2026-119123 ImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder
- CVE-2026-119122 Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check
- CVE-2026-119121 Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for
- CVE-2026-119120 Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name
- CVE-2026-11912 Missing authorization in Simple File List
- CVE-2026-119119 Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields
- CVE-2026-119118 Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags
- CVE-2026-119115 Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes
- CVE-2026-11911 Simple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter
- CVE-2026-1191 JavaScript Notifier <= 1.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
- CVE-2026-11909 Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044
- CVE-2026-11908 Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043
- CVE-2026-11907 Missing authorization in Stream – Activity Log & Audit Trail
- CVE-2026-11906 Denial of service in Db2
- CVE-2026-119054 Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url
- CVE-2026-119053 lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto()
- CVE-2026-119052 llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length
- CVE-2026-119051 flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys
- CVE-2026-119050 Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection
- CVE-2026-11905 Missing authorization in Elementor Website Builder – more than just a page builder
- CVE-2026-119049 FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming
- CVE-2026-119048 JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module
- CVE-2026-11904 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-11903 Stored XSS in MOVEit Transfer Ad Hoc module
- CVE-2026-119028 oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values
- CVE-2026-119027 oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension
- CVE-2026-119025 open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows
- CVE-2026-11901 Business logic in WP Hotel Booking
- CVE-2026-11900 Missing authorization in Ad Inserter – Ad Manager & AdSense Ads
- CVE-2026-1190 Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods
- CVE-2026-11899 Missing authorization in PDF Builder for WooCommerce. Create invoices,packing slips and more
- CVE-2026-118989 WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects
- CVE-2026-118984 OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login
- CVE-2026-11898 White Label CMS <= 2.7.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import Settings
- CVE-2026-11897 IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2
- CVE-2026-11896 Missing authorization in My Calendar – Accessible Event Manager
- CVE-2026-11895 Cross-site scripting in HT Mega Addons for Elementor – Elementor Widgets & Template Builder
- CVE-2026-11894 Double-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error paths
- CVE-2026-11893 Double free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci_bflb)
- CVE-2026-11891 Mali GPU Userspace Driver allows access to already freed memory
- CVE-2026-118905 nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed
- CVE-2026-11890 Missing authorization in Devolutions Server
- CVE-2026-1189 Cross-site scripting in LeadBI Plugin for WordPress
- CVE-2026-11889 SALTO ProAccess Space Authorization Bypass Through User-Controlled Key
- CVE-2026-11888 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-11887 Salon Booking System < 10.30.20 - Subscriber+ Booking Approval Bypass
- CVE-2026-11885 Power System update in Buffer Copy
- CVE-2026-11884 Memory corruption in Red Hat Directory Server 11
- CVE-2026-11883 WebAuthn Provider for Two Factor < 2.5.6 - 2FA Bypass
- CVE-2026-11882 Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes
- CVE-2026-11881 Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field
- CVE-2026-118804 Bricks Broken Access Control via query_result Endpoint
- CVE-2026-118803 Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result
- CVE-2026-11880 Fluent Forms < 6.2.1 - Subscriber+ Subscription Cancellation via IDOR
- CVE-2026-1188 Memory corruption in Eclipse OMR
- CVE-2026-11879 Arbitrary code execution in MobaXterm Personal Edition (Portable)
- CVE-2026-118782 Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count
- CVE-2026-118781 Denial of service in forge
- CVE-2026-118780 Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store
- CVE-2026-11878 Reflected Cross-Site Scripting vulnerability in OpenText Access Manager
- CVE-2026-118779 Forge: Regular expression denial of service in PEM decoding (pem.decode)
- CVE-2026-118778 Forge: TLS client crash when the server sends no certificate
- CVE-2026-118777 Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie
- CVE-2026-118776 Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption
- CVE-2026-118775 Forge: ASN.1 OID first arc truncation in asn1.oidToDer
- CVE-2026-118774 Forge: Certificate signature verified with the issuer's RSA signature scheme
- CVE-2026-118773 Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal
- CVE-2026-118772 joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service
- CVE-2026-11877 Missing Authorization Vulnerability in OpenText Access Manager
- CVE-2026-118769 Botan: Integer overflow when reporting block size in FFI can cause memory corruption
- CVE-2026-118768 Botan: CLI utility `ocsp_check` accepts unauthenticated responses
- CVE-2026-118767 Botan: Python binding bcrypt APIs truncate passwords containing embedded NULs
- CVE-2026-118766 Botan: Online OCSP redirects enable blind requests to internal HTTP services
- CVE-2026-118765 Botan: AutoSeeded_RNG can become reinitialized from predictable data after clearing state
- CVE-2026-118764 minimatch: potential denial of service via globparts amplification
- CVE-2026-118763 @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
- CVE-2026-118762 Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN
- CVE-2026-118761 Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory
- CVE-2026-118760 Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads
- CVE-2026-11876 Missing Authorization in get_deployed_stack Endpoint in zenml-io/zenml
- CVE-2026-118759 Missing authorization in pipelines
- CVE-2026-118758 Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source
- CVE-2026-118757 PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees
- CVE-2026-118756 gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir
- CVE-2026-118755 Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path
- CVE-2026-118754 Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php