Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 909 of 1013.
- CVE-2026-11451 GL.iNet GL-MT3000 FTP Protocol glc snprintf command injection
- CVE-2026-114509 Laravel TokenGuard authentication bypass through non-string API credentials
- CVE-2026-114508 Laravel relationship inclusion can trigger unauthorized data destruction
- CVE-2026-114501 Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
- CVE-2026-11450 GL.iNet GL-MT3000 Path Normalization dlopen command injection
- CVE-2026-1145 quickjs-ng quickjs quickjs.c js_typed_array_constructor_ta heap-based overflow
- CVE-2026-114493 LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects
- CVE-2026-114492 gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint
- CVE-2026-114491 pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images
- CVE-2026-114490 Incorrect Authorization in hMailServer
- CVE-2026-11449 GL.iNet GL-MT3000 LuCI JSON-RPC rpc rpc_sys command injection
- CVE-2026-114489 Missing Authorization in hMailServer
- CVE-2026-114488 Auth bypass in Red Hat Fuse 7
- CVE-2026-114487 Missing authorization in Server
- CVE-2026-114486 Security feature bypass in Server
- CVE-2026-114485 Information disclosure in Server
- CVE-2026-11448 GL.iNet GL-MT3000 Minidlna Service rpc realpath command injection
- CVE-2026-114479 Not Failing Securely ('Failing Open') in hMailServer
- CVE-2026-114478 Unintended Proxy or Intermediary ('Confused Deputy') in hMailServer
- CVE-2026-114477 Missing Authorization in hMailServer
- CVE-2026-114476 Incorrect Authorization in hMailServer
- CVE-2026-114475 Missing Authorization in hMailServer
- CVE-2026-114474 Use of Less Trusted Source in hMailServer
- CVE-2026-114473 Incorrect Authorization in hMailServer
- CVE-2026-114472 Insufficient Resource Pool in hMailServer
- CVE-2026-114471 Insertion of Sensitive Information into Log File in hMailServer
- CVE-2026-114470 Cross-Site Request Forgery (CSRF) in hMailServer
- CVE-2026-11447 GL.iNet GL-MT3000 MTK Backend iwinfo.so iwinfo_backend command injection
- CVE-2026-114463 CVE-2026-114463
- CVE-2026-114462 Arbitrary File Read via Symlink in Velneo vServer HTTP Server
- CVE-2026-114460 Mod_qos: query truncation during json body merging permits security-rule bypass
- CVE-2026-11446 Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization
- CVE-2026-114459 Mod_qos: out-of-bounds reads in response-body substring matching
- CVE-2026-114458 Mod_qos: undersized connection-monitor scratch array permits heap buffer overflow
- CVE-2026-114457 Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads
- CVE-2026-114441 oretnom23 php-travel-agency-system update.php sql injection
- CVE-2026-114440 oretnom23 php-travel-agency-system delete.php sql injection
- CVE-2026-114439 oretnom23 php-travel-agency-system Session session.php missing authentication
- CVE-2026-114438 Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering
- CVE-2026-114437 Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For
- CVE-2026-11443 Allegra downloadAttachment Cross-Site Scripting Authentication Bypass Vulnerability
- CVE-2026-114429 WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content
- CVE-2026-11442 Allegra exportReport Directory Traversal Information Disclosure Vulnerability
- CVE-2026-11441 theonedev Pull Request issues canAccessIssue improper authorization
- CVE-2026-114409 Docker Desktop logs can expose stored third-party credentials
- CVE-2026-114407 e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter
- CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
- CVE-2026-114405 Denial of Service via Malformed VATP Packet in Velneo vServer
- CVE-2026-114404 PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions
- CVE-2026-114403 PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load
- CVE-2026-114402 Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload
- CVE-2026-114401 Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login
- CVE-2026-114400 Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
- CVE-2026-11440 theonedev REST API default-branch improper authorization
- CVE-2026-1144 quickjs-ng quickjs Atomics Ops quickjs.c use after free
- CVE-2026-114399 Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API
- CVE-2026-114398 Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo
- CVE-2026-114397 Trudesk through 1.2.11 Missing Authentication on Debug Routes
- CVE-2026-114396 Trudesk through 1.2.11 MongoDB $where Injection via tickets search API
- CVE-2026-114395 Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send
- CVE-2026-114394 Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs
- CVE-2026-114393 Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints
- CVE-2026-114392 Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid
- CVE-2026-114391 ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods
- CVE-2026-114390 Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers
- CVE-2026-11439 theonedev Parent Project projects improper authorization
- CVE-2026-114389 Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade
- CVE-2026-114388 Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController
- CVE-2026-114387 Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components
- CVE-2026-114386 Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code
- CVE-2026-114384 itsourcecode Online Cake Ordering System transactionsave.php sql injection
- CVE-2026-114383 TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow
- CVE-2026-114382 TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow
- CVE-2026-114381 itsourcecode Online Cake Ordering System orderdetail.php sql injection
- CVE-2026-114380 itsourcecode Online Cake Ordering System inserttrans.php sql injection
- CVE-2026-11438 theonedev projects improper authorization
- CVE-2026-114379 EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion
- CVE-2026-114378 itsourcecode Online Cake Ordering System deleteproduct.php sql injection
- CVE-2026-114377 leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal
- CVE-2026-114376 leomoon-studios wiki-go API editor.go SourceHandler path traversal
- CVE-2026-114375 leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal
- CVE-2026-114374 leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery
- CVE-2026-114370 Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal
- CVE-2026-11437 perfree go-fastdfs-web Installation Endpoint checkServer server-side request forgery
- CVE-2026-114362 HarnessRouter Targets Test Endpoint app.py server-side request forgery
- CVE-2026-114361 HarnessRouter Identity Mode app.py improper authorization
- CVE-2026-11436 Mage AI Sign-in Flow index.tsx useMutation cross site scripting
- CVE-2026-114358 SQL Injection Vulnerability in Radius Xenia M2M Platform
- CVE-2026-114357 DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)
- CVE-2026-114356 DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization
- CVE-2026-114355 DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root
- CVE-2026-114354 DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root
- CVE-2026-114353 DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution
- CVE-2026-11435 Jinher OA nextselectplan.aspx sql injection
- CVE-2026-114349 Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches
- CVE-2026-114348 webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint
- CVE-2026-11434 FluentCMS Blocks Plugin blocks cross site scripting
- CVE-2026-11431 Path Traversal in Altium Projects Service Allows Arbitrary File Read
- CVE-2026-11430 Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit
- CVE-2026-1143 TOTOLINK A3700R cstecgi.cgi setWiFiEasyGuestCfg buffer overflow