Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 906 of 1013.
- CVE-2026-115392 Security feature bypass in wasmtime
- CVE-2026-115391 Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams
- CVE-2026-115390 Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS
- CVE-2026-11539 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- CVE-2026-115389 Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API
- CVE-2026-115388 Denial of service in wasmtime
- CVE-2026-115387 Integer overflow in wasmtime
- CVE-2026-115386 Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir
- CVE-2026-115385 Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps
- CVE-2026-115384 Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow
- CVE-2026-115383 Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports
- CVE-2026-115382 Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS
- CVE-2026-115381 Denial of service in wasmtime
- CVE-2026-115380 Denial of service in wasmtime
- CVE-2026-11538 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- CVE-2026-115379 Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call
- CVE-2026-115378 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull
- CVE-2026-115377 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream
- CVE-2026-115376 Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy
- CVE-2026-115375 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes
- CVE-2026-115374 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs
- CVE-2026-115373 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}
- CVE-2026-115372 Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options
- CVE-2026-115371 Missing authorization in incus
- CVE-2026-115370 Security feature bypass in incus
- CVE-2026-11537 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- CVE-2026-115369 OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs
- CVE-2026-115366 OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs
- CVE-2026-115365 OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal
- CVE-2026-115364 OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints
- CVE-2026-115363 OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration
- CVE-2026-115362 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass
- CVE-2026-115361 OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial
- CVE-2026-115360 OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI
- CVE-2026-11536 IBM WebSphere Application Server is affected by a remote code execution vulnerability
- CVE-2026-115359 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing
- CVE-2026-115358 OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters
- CVE-2026-115357 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses
- CVE-2026-115356 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation
- CVE-2026-115355 Mistune before 3.3.0 Path Traversal and XSS via Include Directive
- CVE-2026-115354 Mistune before 3.3.0 Arbitrary Local File Read via Include Directive
- CVE-2026-115353 Mistune before 3.3.0 Path Traversal via include Directive
- CVE-2026-115352 Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser
- CVE-2026-115351 Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option
- CVE-2026-115350 Mistune before 3.3.0 Stored XSS via Include Directive HTML Files
- CVE-2026-11535 Auth bypass in PcSuite
- CVE-2026-115349 Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing
- CVE-2026-115348 Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text
- CVE-2026-115347 Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text
- CVE-2026-11534 imvks786 student_management_system add.php cross site scripting
- CVE-2026-115334 Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint
- CVE-2026-115333 Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix
- CVE-2026-115332 Lotus through 0.10.2 SQL Injection via Subscription Filter Keys
- CVE-2026-115331 Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters
- CVE-2026-115330 Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics
- CVE-2026-11533 imvks786 student_management_system Student Deletion Endpoint see.php improper authorization
- CVE-2026-115329 Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet
- CVE-2026-115328 JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API
- CVE-2026-115327 libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser
- CVE-2026-115326 QloApps through 1.7.0 IDOR via OrderDetailController Refund Request
- CVE-2026-115325 Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup
- CVE-2026-115324 mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store
- CVE-2026-115323 EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API
- CVE-2026-115322 Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers
- CVE-2026-115321 Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment
- CVE-2026-11532 imvks786 student_management_system Student Record add.php access control
- CVE-2026-115319 fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents
- CVE-2026-11531 imvks786 student_management_system Administrator Login Endpoint admin_login.php sql injection
- CVE-2026-115303 Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping
- CVE-2026-115302 Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion
- CVE-2026-115301 Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block
- CVE-2026-115300 Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF
- CVE-2026-11530 imvks786 student_management_system Login index.ph sql injection
- CVE-2026-1153 technical-laohu mpay cross-site request forgery
- CVE-2026-115299 Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF
- CVE-2026-11529 designcomputer mysql-mcp-server mysql URI server.py read_resource sql injection
- CVE-2026-115282 Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure
- CVE-2026-115281 Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute
- CVE-2026-11528 Tenda AC18 Web Management getRebootStatus sub_45304 stack-based overflow
- CVE-2026-11527 Command injection in Config::IniFiles
- CVE-2026-115269 HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
- CVE-2026-11526 Command injection in GD
- CVE-2026-115259 Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR
- CVE-2026-115255 WP Roster < 2.35 - Unauthenticated Roster Member Deletion
- CVE-2026-115253 WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering
- CVE-2026-115251 Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade
- CVE-2026-11525 undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
- CVE-2026-115249 subhajitkhan online-clinic-management-system Appointment Booking patappointtime.php input validation
- CVE-2026-115248 subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow
- CVE-2026-115247 subhajitkhan online-clinic-management-system patientregistration.php missing encryption
- CVE-2026-115246 subhajitkhan online-clinic-management-system patdocmsg.php cross site scripting
- CVE-2026-115245 Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload
- CVE-2026-11524 Tenda W20E Web Management modifyWifiFilterRules stack-based overflow
- CVE-2026-11523 Tenda W20E Web Management PortalAuth formPortalAuth stack-based overflow
- CVE-2026-115225 Smart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup
- CVE-2026-115224 Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding
- CVE-2026-115223 Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block
- CVE-2026-115221 Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership
- CVE-2026-11522 Tenda W20E setPortMirror formSetPortMirror stack-based overflow
- CVE-2026-115216 Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials