Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 952 of 1013.
- CVE-2026-108381 dataclasses-avroschema pydantic-class metadata allows code injection in generated annotations
- CVE-2026-108380 dataclasses-avroschema field documentation allows code injection in generated Pydantic descriptions
- CVE-2026-108379 dataclasses-avroschema fixed namespaces allow code injection in generated annotations
- CVE-2026-108378 dataclasses-avroschema record documentation can terminate generated class docstrings
- CVE-2026-108377 dataclasses-avroschema allows code injection through generated Meta.schema_name
- CVE-2026-108376 dataclasses-avroschema allows code injection through record names in generated default factories
- CVE-2026-108375 dataclasses-avroschema allows code injection through generated field-default literals
- CVE-2026-108374 ERPNext: Unauthorised status modification due to missing validation
- CVE-2026-108373 ERPNext: Unauthorised access to financial data due to missing validation
- CVE-2026-108372 LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
- CVE-2026-10837 Open redirection vulnerability in Password Manager
- CVE-2026-108366 easy.jobs <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute
- CVE-2026-108362 Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)
- CVE-2026-108361 Privasys Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks
- CVE-2026-108360 PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
- CVE-2026-10836 Improper neutralization of HTTP headers in Password Manager
- CVE-2026-108359 PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
- CVE-2026-108358 PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
- CVE-2026-108357 PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
- CVE-2026-10835 SALESmanago & Leadoo < 3.11.3 - Subscriber+ SQL Injection
- CVE-2026-10834 WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image
- CVE-2026-108337 Password Reset Code Accessible in User Listing API
- CVE-2026-108336 Token Signing Key Allows Unauthenticated Administrative Access
- CVE-2026-108335 Password Reset Functionality Missing Brute-Force Protection
- CVE-2026-108334 Security feature bypass in Red Hat Connectivity Link 1
- CVE-2026-108333 Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.
- CVE-2026-108332 Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.
- CVE-2026-108331 Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.
- CVE-2026-108330 Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.
- CVE-2026-10833 Cross-site scripting in Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
- CVE-2026-108329 Tanium addressed an unauthorized code execution vulnerability in Threat Response.
- CVE-2026-108328 Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response.
- CVE-2026-108326 Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.
- CVE-2026-108325 Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation.
- CVE-2026-10832 Denial of service in Cryostat 4
- CVE-2026-108316 Tanium addressed an information disclosure vulnerability in Tanium Server.
- CVE-2026-108313 Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server.
- CVE-2026-108311 Tanium addressed an insufficient logging vulnerability in Tanium Server.
- CVE-2026-108310 Tanium addressed a denial of service vulnerability in Tanium Server.
- CVE-2026-10831 Improper Authorization of Break Signal Commands in Devices
- CVE-2026-108309 Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension.
- CVE-2026-108308 Tanium addressed a SQL injection vulnerability in Patch.
- CVE-2026-108307 Tanium addressed a heap-based buffer overflow vulnerability in Index.
- CVE-2026-108306 Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
- CVE-2026-108305 Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
- CVE-2026-108304 Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
- CVE-2026-108303 Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.
- CVE-2026-108302 Tanium addressed an improper access controls vulnerability in Comply.
- CVE-2026-108301 Tanium addressed an improper access controls vulnerability in Comply.
- CVE-2026-10830 AllCoach < 1.0.2 - Unauthenticated Account Takeover
- CVE-2026-1083 Cross-site scripting in Appointment Hour Booking – Booking Calendar
- CVE-2026-108291 WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability
- CVE-2026-10829 Memory corruption in NPort W2150A-W4/W2250A-W4 Series
- CVE-2026-10828 Memory corruption in NPort W2150A-W4/W2250A-W4 Series
- CVE-2026-10827 Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes
- CVE-2026-108269 ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session
- CVE-2026-108268 enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session
- CVE-2026-108267 Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session
- CVE-2026-108266 Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session
- CVE-2026-108265 enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session
- CVE-2026-108264 Code injection in wizarr
- CVE-2026-108263 Astron Agent: Unsandboxed code-node leads to cross-tenant RCE
- CVE-2026-108261 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
- CVE-2026-108260 @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
- CVE-2026-108259 Tina: Code injection via unescaped Git branch name in generated client source
- CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore
- CVE-2026-10825 Improper JSON Input Validation in WebSocket API Leads to Denial of Service
- CVE-2026-10824 Masteriyo LMS < 2.2.1 - Unauthenticated Course Progress Disclosure and Deletion
- CVE-2026-10823 YMC Smart Filter < 3.11.3 - Unauthenticated Private/Draft Post Disclosure
- CVE-2026-10822 Key Record using PRIVATEDNS algorithm may lead to unexpected exit
- CVE-2026-10821 Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE
- CVE-2026-10820 ProfilePress < 4.16.17 - Subscriber+ Subscription Cancellation via IDOR
- CVE-2026-1082 TITLE ANIMATOR <= 1.0 - Cross-Site Request Forgery to Settings Update
- CVE-2026-10819 Mattermost Server Denial of Service via Animated GIF Emoji Upload
- CVE-2026-108185 Security feature bypass in Zoom Clients
- CVE-2026-108184 Security feature bypass in Zoom Clients
- CVE-2026-10818 WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
- CVE-2026-108179 WordPress WOLF plugin <= 1.1.1 - SQL Injection vulnerability
- CVE-2026-108175 WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-108174 WordPress FOX plugin <= 1.5.4 - Broken Access Control vulnerability
- CVE-2026-10817 Insufficient input validation leading to memory overread
- CVE-2026-108168 WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-108165 Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata
- CVE-2026-108164 Open Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Route
- CVE-2026-108163 Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTL
- CVE-2026-108162 Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For
- CVE-2026-108161 FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download
- CVE-2026-108160 AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed
- CVE-2026-10816 Arbitrary File Read (Unauthenticated)
- CVE-2026-108159 AstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and IPC Bridge
- CVE-2026-108158 plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert
- CVE-2026-108157 Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking
- CVE-2026-108156 LobsterAI 2026.5.27 through 2026.9.23 Arbitrary Directory Deletion via Skill _meta.json
- CVE-2026-108151 WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vulnerability
- CVE-2026-10815 LakshayD02 Hostel-Management-System-PHP Admin Dashboard index.php authorization
- CVE-2026-108142 Auth bypass in Backup and Replication
- CVE-2026-108141 Path traversal in Backup and Replication
- CVE-2026-108140 Path traversal in Backup and Replication
- CVE-2026-10814 milvus-io milvus Grantee ID Hash kv_catalog.go weak hash
- CVE-2026-108136 Microsoft Windows Search Component Elevation of Privilege Vulnerability