Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 948 of 1013.
- CVE-2026-108823 Apache Kylin: Potential unauthenticated job metadata replacement
- CVE-2026-108822 Kamailio sipt ss7_parser.c isup_get_calling_party buffer overflow
- CVE-2026-108821 Tencent WeKnora SQL Validator inject.go validateSubquery sql injection
- CVE-2026-108820 agno-agi agno Delegation Feature _default_tools.py member_agent.run unnecessary privileges
- CVE-2026-10882 Use after free in Chrome
- CVE-2026-108819 agno-agi agno Agent Orchestration Layer exec dynamically-managed code resources
- CVE-2026-108818 agno-agi agno auth.py get_authentication_dependency missing authentication
- CVE-2026-108817 agno-agi agno CodingTools coding.py agno.CodingTools.run_shell os command injection
- CVE-2026-108816 agno-agi agno PythonTools python.py run_python_code code injection
- CVE-2026-108815 idcCMS member_deal.php cross site scripting
- CVE-2026-108814 SEMCMS SEMCMS_Banner.php sql injection
- CVE-2026-108813 SEMCMS SEMCMS_Download.php sql injection
- CVE-2026-108812 SEMCMS SEMCMS_User.php user improper authorization
- CVE-2026-108811 WMCMS index.php information disclosure
- CVE-2026-108810 tsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure
- CVE-2026-10881 Memory corruption in Chrome
- CVE-2026-108809 Eleveo Call Recording Software logout session expiration
- CVE-2026-108808 Eleveo Call Recording Software JWT Token logout get request method with sensitive query strings
- CVE-2026-108807 krupalshah EmployeeRecruitmentSystem Registration adminregister.php mysql_query sql injection
- CVE-2026-108806 krupalshah EmployeeRecruitmentSystem Forgot Password authprocessing.php mysql_query sql injection
- CVE-2026-108805 krupalshah EmployeeRecruitmentSystem Login loginprocessing.php mysql_query sql injection
- CVE-2026-108804 TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection
- CVE-2026-108803 y_project RuoYi Disable API add changeStatus session expiration
- CVE-2026-108802 y_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting
- CVE-2026-108801 prasathmani TinyFileManager tinyfilemanager.php move_uploaded_file unrestricted upload
- CVE-2026-108800 yangzongzhuan RuoYi cross-site request forgery
- CVE-2026-10880 Unauthenticated SQL Injection in Osnexus Quantastor
- CVE-2026-1088 Login Page Editor <= 1.2 - Cross-Site Request Forgery to Settings Update
- CVE-2026-108799 jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection
- CVE-2026-108798 ZKTeco BioTime hard-coded key
- CVE-2026-108797 ZKTeco BioTime Employee REST API employees authorization
- CVE-2026-108796 ZKTeco BioTime Biometric Data Endpoint finger_data authorization
- CVE-2026-108795 ZKTeco BioTime System Settings API systemSettings access control
- CVE-2026-108794 ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection
- CVE-2026-108791 westboy CicadasCMS Template Management input TemplateController.input path traversal
- CVE-2026-108790 westboy CicadasCMS Backend Template Editor save TemplateController.save path traversal
- CVE-2026-10879 DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders
- CVE-2026-108789 deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow
- CVE-2026-108788 deepseek-ai deepseek-harness Sandbox spawn sandbox
- CVE-2026-108787 houtini-ai voice-analyser-mcp collect_corpus crawler.ts fetch server-side request forgery
- CVE-2026-108786 houtini-ai seo-crawler-mcp Crawler CrawlOrchestrator.ts run_seo_audit server-side request forgery
- CVE-2026-108785 macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration
- CVE-2026-108784 macrozheng mall Payment Endpoint AlipayServiceImpl.java AlipayServiceImpl.pay logic error
- CVE-2026-108783 PRVTPRO Amnezia-Web-Panel Backup Download app.py default credentials
- CVE-2026-108782 erzhongxmu JEEWMS Autocomplete CommonServiceImpl.java CommonServiceImpl.getAutoList sql injection
- CVE-2026-108781 erzhongxmu JEEWMS PDA WmToMoveGoodsController.java WmToMoveGoodsController.list sql injection
- CVE-2026-108780 Apache Kylin: Potential JDBC source configuration validation issue
- CVE-2026-10878 D-Link DWR-M920 formSmsManage sub_41C8E8 command injection
- CVE-2026-108779 erzhongxmu JEEWMS WmSttInGoodsController.java WmSttInGoodsController.list sql injection
- CVE-2026-108778 erzhongxmu JEEWMS Inbound Quality Check Pda WmInQmIController.java WmInQmIController.list sql injection
- CVE-2026-108777 erzhongxmu JEEWMS WvGiController.java WvGiController.list sql injection
- CVE-2026-108776 Apache Kylin: tables/names SparkSQL injection
- CVE-2026-108775 erzhongxmu JEEWMS Search Endpoint WvNoticeController.java WvNoticeController.list sql injection
- CVE-2026-108774 erzhongxmu JEEWMS MdBinController.java getbinallagv sql injection
- CVE-2026-108773 erzhongxmu JEEWMS WmOmNoticeHController.java docheck sql injection
- CVE-2026-108772 bleenco abstruse Cache Endpoint download_cache.go filepath.Join path traversal
- CVE-2026-108771 Apache Kylin: unauthenticated broadcast API and polymorphic deserialization
- CVE-2026-108770 Appwrite Browser Screenshot Service Get.php PublicHostname server-side request forgery
- CVE-2026-10877 SourceCodester Ship Ferry Ticket Reservation System Admin Login login.php sql injection
- CVE-2026-108769 zhayujie CowAgent Markdown Rendering Markdown.tsx denial of service
- CVE-2026-108768 zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources
- CVE-2026-108766 Apache Kylin: missing JDBC-config authorization
- CVE-2026-108764 Apache Kylin: job-driver UI proxy SSRF
- CVE-2026-108763 Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR
- CVE-2026-108762 Apache Kylin: delete metadata backup path-confinement bypass
- CVE-2026-108760 LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces
- CVE-2026-10876 SourceCodester Ship Ferry Ticket Reservation System admin improper authorization
- CVE-2026-108759 mistral.rs 0.9.0 through 0.9.4 Sandbox Escape via Symlink Following in mistralrs-code-exec
- CVE-2026-108758 Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint
- CVE-2026-108757 Nexting pinclaw through 0.3.0 Missing Authentication via POST /pinclaw/send
- CVE-2026-108756 Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes
- CVE-2026-108755 Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint
- CVE-2026-108754 GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger
- CVE-2026-108753 Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose
- CVE-2026-108752 JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen
- CVE-2026-108751 MoAI-ADK through 3.1.2 Symlink Following via moai init Template Deployer
- CVE-2026-108750 OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction
- CVE-2026-10875 projectworlds Online Art Gallery Shop Project adminHome.ph sql injection
- CVE-2026-108748 Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket
- CVE-2026-108747 Lightdash through 2.556.0 Authorization Bypass via Personal Access Token Deletion
- CVE-2026-108746 Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources
- CVE-2026-108745 CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet
- CVE-2026-108744 pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync
- CVE-2026-108743 Apache Kylin: spark job OS command injection
- CVE-2026-108742 CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation
- CVE-2026-108741 Shepherd through 0.3.1 SSRF via DNS Rebinding in Citation Checker
- CVE-2026-108740 GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment
- CVE-2026-10874 projectworlds Online Art Gallery Shop Project adminHome.php sql injection
- CVE-2026-108739 OpenAgents Workspace through launcher-v1.0.17 Unauthenticated Credential Exposure via /v1/workspaces
- CVE-2026-108738 Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback
- CVE-2026-108737 Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion
- CVE-2026-108736 Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing
- CVE-2026-108735 Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL
- CVE-2026-108734 Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_document
- CVE-2026-108733 Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation
- CVE-2026-108732 Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount
- CVE-2026-108731 Raven 2.0.0 through 3.0.0 Missing Authorization via join_workspace Invite-Only Bypass
- CVE-2026-108730 Raven 2.0.0 through 3.0.0 Missing Authorization via Legacy Message and File APIs
- CVE-2026-10873 Shibby Tomato Web UI rstats rstats_path os command injection
- CVE-2026-108729 Corteza through 2024.9.10 Unauthenticated Attachment Access via Compose Attachment Endpoints