Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 950 of 1013.
- CVE-2026-108634 JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission deleteBatch Endpoint
- CVE-2026-108633 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/add
- CVE-2026-108632 JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission queryById Endpoint
- CVE-2026-108631 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/delete
- CVE-2026-108630 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/edit
- CVE-2026-10863 MISP User-controlled order parameter in correlations over-correlation endpoint
- CVE-2026-108629 JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission datarule Endpoint
- CVE-2026-108628 JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint
- CVE-2026-108627 JeecgBoot through 3.9.5 Missing Authorization via /sys/role/datarule Endpoint
- CVE-2026-108626 JeecgBoot through 3.9.5 Missing Authorization via sysMessage queryById Endpoint
- CVE-2026-108625 JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint
- CVE-2026-108624 JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint
- CVE-2026-108623 JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch
- CVE-2026-108622 JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete Endpoint
- CVE-2026-108621 JeecgBoot through 3.9.5 Missing Authorization via /sys/position/edit
- CVE-2026-108620 JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatch
- CVE-2026-10862 Accordions <= 2.3.23 - Authenticated (Custom+) Stored Cross-Site Scripting via Accordion Body Field
- CVE-2026-108619 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate deleteBatch Endpoint
- CVE-2026-108618 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit Endpoint
- CVE-2026-108617 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate/add Endpoint
- CVE-2026-108616 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/deleteBatch
- CVE-2026-108615 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/delete
- CVE-2026-108614 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/exportXls
- CVE-2026-108613 JeecgBoot through 3.9.5 Missing Authorization via /airag/app/release Endpoint
- CVE-2026-108612 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/deleteBatch
- CVE-2026-108611 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete Endpoint
- CVE-2026-108610 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/edit Endpoint
- CVE-2026-10861 MISP post-login open redirect via pre_login_requested_url
- CVE-2026-108609 JeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId Parameter
- CVE-2026-108608 JeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId Parameter
- CVE-2026-108607 JeecgBoot through 3.9.5 IDOR via deleteVideoRecord userId Parameter
- CVE-2026-108606 JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/deleteById
- CVE-2026-108605 JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/edit Endpoint
- CVE-2026-108604 Tabularis through 0.27.0 Read-Only Bypass via MCP run_query SELECT Classification
- CVE-2026-108603 slide-maker through 5.8.0 Path Traversal via generate_images_openai.py
- CVE-2026-108602 Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution
- CVE-2026-108600 open-multi-agent 1.5.0 through 1.21.2 Sandbox Escape via file_write Dangling Symlink
- CVE-2026-10860 MISP CRUDComponent delete validation bypass via operator precedence error
- CVE-2026-1086 Font Pairing Preview For Landing Pages <= 1.3 - Cross-Site Request Forgery to Settings Update
- CVE-2026-108599 Phi 0.1.1 through 0.28.4 Symlink Workspace Write Restriction Bypass
- CVE-2026-108598 Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates
- CVE-2026-108597 Cohere Python SDK 5.11.0 through 7.2.0 Path Traversal via SageMaker Tar Extraction
- CVE-2026-108596 OpenLIT 2.1.0 Authorization Bypass via x-openlit-project-id Header
- CVE-2026-108595 Phi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn Workdir
- CVE-2026-108594 Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch
- CVE-2026-108593 9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint
- CVE-2026-108592 mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment
- CVE-2026-108591 InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool
- CVE-2026-108587 10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter
- CVE-2026-108586 1MCP Agent 0.20.0 through 0.39.0 OAuth Tag-Scope Bypass via Negated Tag Filter
- CVE-2026-108585 argocd-mcp through 0.9.0 Path Traversal via delete_application Tool
- CVE-2026-108584 FunnyWolf Viper config hard-coded credentials
- CVE-2026-108583 zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool
- CVE-2026-108582 GenOffice through 0.11.505 Insecure Permissions in HTTP MCP Server File Store
- CVE-2026-108581 Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers
- CVE-2026-108580 AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login
- CVE-2026-10858 IBM MQ for HPE NonStop is vulnerable to a denial of service attack
- CVE-2026-108579 OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export
- CVE-2026-108578 Neterbit NW-431F Embedded Web Server sms.json information disclosure
- CVE-2026-108577 Konstanty Bialkowski libmodplug ABC Music Format load_abc.cpp abc_add_gchord resource consumption
- CVE-2026-108576 TOZED X300 IPPingDiagnostics process_ping os command injection
- CVE-2026-108575 BerriAI LiteLLM Secret Resolution main.py get_secret improper authorization
- CVE-2026-108574 BerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs authorization
- CVE-2026-108573 Open Asset Import Library Assimp PLY File getNextBlock out-of-bounds
- CVE-2026-108572 Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery
- CVE-2026-108571 Xinhu Rainrock RockOA Openkqj Action openkqjAction.php returnchuli sql injection
- CVE-2026-108570 Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine
- CVE-2026-10857 Reflected XSS in Akinsoft's e-Commerce
- CVE-2026-108569 Furion .NET Framework StringRenderExtensions.cs String.Replace sql injection
- CVE-2026-108568 InstantSoft icms2 Billing paypal.php validatePaypalOrder data authenticity
- CVE-2026-108567 InstantSoft icms2 Image image.php files_delete_file path traversal
- CVE-2026-108566 InstantSoft icms2 Private Message index.tpl.php index cross site scripting
- CVE-2026-10856 Open redirect in MISP dashboard button widget URL handling
- CVE-2026-108555 PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header
- CVE-2026-108554 PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input
- CVE-2026-108553 OpenRefine through 3.10.1 CSRF to RCE via get-rows Command
- CVE-2026-108551 openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates
- CVE-2026-108550 SkillHub before 0.2.22 Account Takeover via Account Merge Flow
- CVE-2026-10855 MISP Event template importer authorization bypass
- CVE-2026-108549 cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing
- CVE-2026-108548 AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token
- CVE-2026-108547 AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var
- CVE-2026-108546 Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration
- CVE-2026-108545 SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing
- CVE-2026-108544 Lippu Docx Reader Office Viewer App path traversal
- CVE-2026-108543 ag2ai ag2 UserProxyAgent os.path.join path traversal
- CVE-2026-108542 021is elvix-sdk MCP Request index.ts server-side request forgery
- CVE-2026-108541 highwarden Super Store Finder index.php sql injection
- CVE-2026-108540 OpenSpug File Transfer transfer os command injection
- CVE-2026-10854 Unauthorized exposure of private galaxies in MISP event template creation
- CVE-2026-108539 GPAC MP4Box filter_queue.c gf_fq_pop use after free
- CVE-2026-108538 GPAC MP4Box os_thread.c gf_mx_v use after free
- CVE-2026-10853 IBM MQ queue manager is vulnerable to remote code execution
- CVE-2026-108529 SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit
- CVE-2026-108525 HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit
- CVE-2026-108523 Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery
- CVE-2026-108522 Studio-Saelix Sencho Login Endpoint login improper authentication
- CVE-2026-108521 Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery
- CVE-2026-10852 Websphere Application Server is Affected By a Denial of Service
- CVE-2026-108518 DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.