Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 949 of 1013.
- CVE-2026-108728 Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook
- CVE-2026-108727 EdgeEver through 1.108.0 Missing Authorization via Memo-Template API Routes
- CVE-2026-108726 GLPI through 12.0.0 Missing Authorization via ajax/map.php
- CVE-2026-108725 Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin
- CVE-2026-108724 Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint
- CVE-2026-108723 answer-me-with-html through 0.5.0 Symlink Following in Code Block src Embedding
- CVE-2026-108722 open-computer-use through commit 610bac8 Stored XSS via log.html Session Log
- CVE-2026-108721 Open Computer Use through 1.0.0 Denylist Bypass via Case-Variant Bundle ID
- CVE-2026-108720 phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages
- CVE-2026-10872 Shibby Tomato Web UI rc start_vpnserver os command injection
- CVE-2026-108719 LLMGateway through 1.20.0 Blind SSRF via Video-Generation callback_url
- CVE-2026-108718 Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration
- CVE-2026-108717 Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController
- CVE-2026-108716 mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant
- CVE-2026-108715 LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php
- CVE-2026-108714 MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket
- CVE-2026-108713 SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplate
- CVE-2026-108712 SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point
- CVE-2026-108711 Plastic Labs Honcho through 3.3.0 Incorrect Authorization via POST /v3/workspaces
- CVE-2026-108710 NornicDB through 1.4.1 Missing Authorization via Vector Search Endpoints
- CVE-2026-10871 Shibby Tomato Web UI rc start_6rd_tunnel os command injection
- CVE-2026-108709 Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)
- CVE-2026-108708 Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil
- CVE-2026-108707 Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect
- CVE-2026-108706 eladmin through commit 55fbf70 Missing Authorization via S3 Storage Download Endpoint
- CVE-2026-108705 CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import
- CVE-2026-108704 CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints
- CVE-2026-108703 CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push
- CVE-2026-108702 CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test
- CVE-2026-108701 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort
- CVE-2026-108700 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title
- CVE-2026-10870 Shibby Tomato Web UI rc start_dhcpc os command injection
- CVE-2026-1087 The Guardian News Feed <= 1.2 - Cross-Site Request Forgery to Settings Update
- CVE-2026-108699 hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins
- CVE-2026-108698 hyper-mcp through 0.8.3 OCI Plugin Signature Verification TOCTOU Race Condition
- CVE-2026-108697 CoreShop through 2026.2.2 Missing Authorization via ResourceController listAction
- CVE-2026-108696 CoreShop through 1.5.5 Authorization Bypass via OrderController OrderConfirm and SendReship
- CVE-2026-108695 MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint
- CVE-2026-108694 ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter
- CVE-2026-108693 ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate
- CVE-2026-108692 1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints
- CVE-2026-108691 mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList
- CVE-2026-108690 mall4j through 4.0 Operator Precedence Error Exposes Other Users' Cart Items via /p/shopCart/expiryProdList
- CVE-2026-108689 Wukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST /chat/send
- CVE-2026-108688 Eladmin through 2.7 Missing Authorization via /api/localStorage/pictures Upload
- CVE-2026-108686 WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure
- CVE-2026-108685 WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields
- CVE-2026-108684 erzhongxmu Jeewms Autocomplete Data JeecgFormDemoController.java getTreeData sql injection
- CVE-2026-108683 zhayujie CowAgent Media Download memory allocation
- CVE-2026-108682 zhayujie CowAgent Web Console upload read denial of service
- CVE-2026-108681 zhayujie CowAgent Web Console web_channel.py denial of service
- CVE-2026-108680 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement
- CVE-2026-10868 MISP user edit endpoint mass assignment vulnerability allows unauthorized user account modification
- CVE-2026-108679 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncement
- CVE-2026-108678 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles
- CVE-2026-108677 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName
- CVE-2026-108676 JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles
- CVE-2026-108675 JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTop
- CVE-2026-108674 JeecgBoot through 3.9.5 Missing Authorization via /openapi/queryById
- CVE-2026-108673 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXls
- CVE-2026-108672 JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser
- CVE-2026-108671 JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryById
- CVE-2026-108670 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experiment
- CVE-2026-108669 JeecgBoot through 3.9.5 Missing Authorization via /airag/knowledge/embedding/search
- CVE-2026-108668 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin
- CVE-2026-108667 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/revertRecycleBin
- CVE-2026-108666 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatch
- CVE-2026-108665 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/edit
- CVE-2026-108664 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById
- CVE-2026-108663 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApply
- CVE-2026-108662 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteTenantPackUser
- CVE-2026-108661 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenant
- CVE-2026-108660 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/updateApplyStatus
- CVE-2026-108659 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserId
- CVE-2026-108658 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/queryTenantAuthInfo
- CVE-2026-108657 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/passApply
- CVE-2026-108656 JeecgBoot through 3.9.5 Missing Authorization via getTenantPackApplyUsers Endpoint
- CVE-2026-108655 JeecgBoot through 3.9.5 Missing Authorization via /sys/quartzJob/queryById
- CVE-2026-108654 JeecgBoot through 3.9.5 Missing Authorization via /sys/oss/file/queryById
- CVE-2026-108653 JeecgBoot through 3.9.5 Missing Authorization via GET /openapi/list
- CVE-2026-108652 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/updateAvatar
- CVE-2026-108651 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getRolesByUserId
- CVE-2026-108650 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSet
- CVE-2026-10865 Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys
- CVE-2026-108649 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesById
- CVE-2026-108648 JeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode Endpoint
- CVE-2026-108647 JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel
- CVE-2026-108646 JeecgBoot through 3.9.5 Missing Authorization via /sys/category/importExcel
- CVE-2026-108645 JeecgBoot through 3.9.5 Missing Authorization via /sys/category/edit
- CVE-2026-108644 JeecgBoot through 3.9.5 Missing Authorization via /sys/category/delete
- CVE-2026-108643 JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteBatch
- CVE-2026-108642 JeecgBoot through 3.9.5 IDOR via PUT /sys/sysAnnouncementSend/edit
- CVE-2026-108641 JeecgBoot through 3.9.5 IDOR via /sys/sysAnnouncementSend/getOne
- CVE-2026-108640 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/queryById
- CVE-2026-10864 MISP Dashboard widget field selection may expose restricted user and organisation data
- CVE-2026-108639 JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/deletePhysic/{id}
- CVE-2026-108638 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser
- CVE-2026-108637 JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint
- CVE-2026-108636 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepart/appImportExcel
- CVE-2026-108635 JeecgBoot through 3.9.5 Missing Authorization via getDepartmentHead Endpoint