Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 902 of 1013.
- CVE-2026-116157 ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading
- CVE-2026-116156 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile Option
- CVE-2026-116155 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile
- CVE-2026-116154 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML Parsing Depth Limit
- CVE-2026-116153 ImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bit
- CVE-2026-116152 ImageMagick before 7.1.2-33 Memory Leak in MAT Decoder Error Path
- CVE-2026-116151 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG Encoder
- CVE-2026-116150 ImageMagick before 7.1.2-33 Memory Leak in FPX Encoder
- CVE-2026-116149 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images
- CVE-2026-116148 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options
- CVE-2026-116147 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Null Pointer Dereference in DJVU Decoder
- CVE-2026-116146 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder
- CVE-2026-116145 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete Fix
- CVE-2026-116144 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder
- CVE-2026-116143 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Decoders
- CVE-2026-116142 ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box
- CVE-2026-116141 ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder
- CVE-2026-116140 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation Parsing
- CVE-2026-11614 Cross-site scripting in Xpro Addons — 140+ Widgets for Elementor
- CVE-2026-116139 WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering
- CVE-2026-116137 adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names
- CVE-2026-116136 ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking
- CVE-2026-116135 HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them.
- CVE-2026-116134 HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block
- CVE-2026-116133 HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary.
- CVE-2026-116132 HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk
- CVE-2026-116131 HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts.
- CVE-2026-11613 Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter
- CVE-2026-116124 GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow
- CVE-2026-116123 NocoDB signup validatePassword excessive authentication
- CVE-2026-116122 NocoDB Sign-in Endpoint AuthService.validateUser information disclosure
- CVE-2026-116121 NocoDB Registration users.service.ts race condition
- CVE-2026-116120 NocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of resources
- CVE-2026-116119 NocoDB Password-Reset Flow users.service.ts race condition
- CVE-2026-116118 Z.ai Zcode Sed Command Filter os command injection
- CVE-2026-116117 halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal
- CVE-2026-116116 Yoosee GM8135S Camera Secure Boot signature verification
- CVE-2026-116115 Yoosee GM8135S Camera WiFi Configuration wpa_supplicantX.conf initialization
- CVE-2026-116114 Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission
- CVE-2026-116113 GouGuOA Api.php chunkUpload unrestricted upload
- CVE-2026-116112 HashenUdara edoc-doctor-appointment-system add-new.php sql injection
- CVE-2026-116111 2K Games Civilization V Lua Sandbox loadstring type confusion
- CVE-2026-116110 GiantappMan LiveWallPaper SignalR Hub UploadFile missing authentication
- CVE-2026-11611 389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions
- CVE-2026-116109 continuedev Continue MCP Server Transport ConfigHandler.ts MCPManagerSingleton.setConnections os command injection
- CVE-2026-116108 openbq-org OpenBB Local API Server api_settings.py access control
- CVE-2026-116107 Datafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization
- CVE-2026-116106 HeyCyan App FileProvider access control
- CVE-2026-116105 HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission
- CVE-2026-116104 Sony Neural Network Libraries NNP Converter utils.py func_set_nnabla_version_decorate code injection
- CVE-2026-116103 Sony Neural Network Libraries Encode Param encode_decode_param.py load_param_in_txt code injection
- CVE-2026-116102 QuantGeekDev docker-mcp docker_executor.py _build_windows_command os command injection
- CVE-2026-116101 itsourcecode Online Cake Ordering System deletetransac.php sql injection
- CVE-2026-116100 gougucms User Level Level.php add cross site scripting
- CVE-2026-11610 389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind
- CVE-2026-1161 pbrong hrms recruitment.go UpdateRecruitmentById cross site scripting
- CVE-2026-116099 Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds write
- CVE-2026-116098 SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization
- CVE-2026-116097 CloudClassroom-PHP-Project addnewstudent.php cross site scripting
- CVE-2026-116096 ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write
- CVE-2026-116095 smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation
- CVE-2026-116094 EyouCMS function.php remote_file_to_local server-side request forgery
- CVE-2026-11608 WP Customer Reviews <= 3.7.8 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter
- CVE-2026-116078 HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit
- CVE-2026-116073 Leon before commit 50df142 Path Traversal via /download model Command
- CVE-2026-116072 Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity
- CVE-2026-116071 rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption
- CVE-2026-116070 Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config
- CVE-2026-11607 TYPO3 CMS - Broken Access Control in Form Framework
- CVE-2026-116069 NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field
- CVE-2026-116068 Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router
- CVE-2026-116067 Paisa before 0.7.8 Path Traversal via Editor and Sheet API
- CVE-2026-116066 Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service
- CVE-2026-116063 DedeCMS update_guide.php require_once code injection
- CVE-2026-116062 SourceCodester Performance Indicator System save_profile.php sql injection
- CVE-2026-116061 SourceCodester Performance Indicator System edit_dealer.php sql injection
- CVE-2026-116060 SourceCodester Performance Indicator System adddealer.php sql injection
- CVE-2026-116058 Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injection
- CVE-2026-116057 KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload
- CVE-2026-116056 KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery
- CVE-2026-116055 SourceCodester Performance Indicator System deleteproduct.php sql injection
- CVE-2026-116054 SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash
- CVE-2026-116053 dbcli mycli Whitelist source.py source_special_command_is_safe os command injection
- CVE-2026-116052 LinkStackOrg LinkStack cross-site request forgery
- CVE-2026-116050 krupalshah Employee Recruitment System Registration registerform3.php sql injection
- CVE-2026-11605 Unnecessary validation of DNSSEC signed records
- CVE-2026-116049 krupalshah EmployeeRecruitmentSystem Registration Wizard registerform2.php mysql_query sql injection
- CVE-2026-116048 krupalshah EmployeeRecruitmentSystem Registration registerform1.php mysql_query sql injection
- CVE-2026-116047 Privoce Vocechat Query Parameter widget.html cross site scripting
- CVE-2026-116046 eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal
- CVE-2026-116045 1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal
- CVE-2026-116044 prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload
- CVE-2026-11604 Memory corruption in ovpn-dco-win
- CVE-2026-11603 Product Filter Widget for Elementor <= 1.0.6 - Reflected Cross-Site Scripting via 'args[filterFormArray]' Parameter
- CVE-2026-116020 BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages
- CVE-2026-116019 Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives
- CVE-2026-116018 ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint
- CVE-2026-116017 Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint
- CVE-2026-116016 yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header
- CVE-2026-116015 yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint