Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 953 of 1013.
- CVE-2026-108135 Windows Backup Engine Elevation of Privilege Vulnerability
- CVE-2026-108134 Windows Autopilot Elevation of Privilege Vulnerability
- CVE-2026-108133 Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability
- CVE-2026-108132 Windows Kerberos Elevation of Privilege Vulnerability
- CVE-2026-108131 Active Directory Federation Services (AD FS) Spoofing Vulnerability
- CVE-2026-108130 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
- CVE-2026-10813 LMCache KV Cache utils.py hex_hash_to_int16 weak hash
- CVE-2026-108129 Role: DNS Server Information Disclosure Vulnerability
- CVE-2026-108128 Role: DNS Server Information Disclosure Vulnerability
- CVE-2026-108127 Role: DNS Server Information Disclosure Vulnerability
- CVE-2026-108126 temporal-proxy payload decryption is not bound to the request namespace
- CVE-2026-108125 WordPress Post Author Authenticated SQLi
- CVE-2026-108124 WordPress Post Author Authenticated SQLi
- CVE-2026-108123 Missing authorization in WP Booking System – Booking Calendar
- CVE-2026-108121 Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service
- CVE-2026-108120 path traversal inKoozali - SME Server
- CVE-2026-10812 zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hash
- CVE-2026-108119 Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix
- CVE-2026-108116 MDX and SOAP Injection in Kendo UI for jQuery
- CVE-2026-108115 Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses
- CVE-2026-108114 Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions
- CVE-2026-108113 ILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI Import
- CVE-2026-108112 ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint
- CVE-2026-108111 ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search
- CVE-2026-108110 MOVO through 0.2.3 Authorization Bypass via Document Endpoints
- CVE-2026-10811 itsourcecode Fees Management System receipt.php sql injection
- CVE-2026-108109 PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code
- CVE-2026-108108 PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()
- CVE-2026-108107 PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php
- CVE-2026-108106 Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service
- CVE-2026-108105 Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request
- CVE-2026-108104 Xerial snappy-java 1.1.7.4 before 1.1.10.10 Double Release of Pooled Buffers in SnappyFramedInputStream
- CVE-2026-108103 Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropped DL Traffic Threshold IE
- CVE-2026-108102 Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Volume Measurement IE
- CVE-2026-108101 HortusFox through 6.3 Unrestricted File Upload via Plant Attachments
- CVE-2026-108100 HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter
- CVE-2026-10810 itsourcecode Fees Management System navbar.php cross site scripting
- CVE-2026-1081 Set Bulk Post Categories <= 1.1 - Cross-Site Request Forgery to Bulk Post Category Update
- CVE-2026-108096 Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category
- CVE-2026-108094 Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path
- CVE-2026-108093 Gimp: gimp: denial of service via null pointer dereference in xcf simulation parasite loading
- CVE-2026-108092 Missing authorization in Blog2Social: Social Media Auto Post & Scheduler
- CVE-2026-10809 itsourcecode Fees Management System manage_user.php sql injection
- CVE-2026-108089 Apache Cocoon: Unauthenticated access to diagnostic interfaces
- CVE-2026-108088 Apache Cocoon: Cross-user cache poisoning
- CVE-2026-108087 Apache Cocoon: SQL Injection
- CVE-2026-108086 Apache Cocoon: XEE could lead to SSRF and information disclosure
- CVE-2026-108082 Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
- CVE-2026-10808 itsourcecode Fees Management System manage_student.php sql injection
- CVE-2026-108073 SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter
- CVE-2026-108072 Insecure Permissions on Shared Startup Scripts Allow Cross-User Code Execution and Potential Privilege Escalation
- CVE-2026-108071 Improper Multi-Factor Authentication Validation Allows Authentication Bypass
- CVE-2026-108070 Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access
- CVE-2026-10807 mjperpinosa stumasy change_profile_image.php unrestricted upload
- CVE-2026-108069 Sunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_comment()
- CVE-2026-108066 WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR
- CVE-2026-108065 Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce
- CVE-2026-108064 WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler
- CVE-2026-108063 Libhangul: null pointer dereference in hanja_new() when looking up a malformed hanja dictionary entry
- CVE-2026-108062 Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop
- CVE-2026-10806 mjperpinosa stumasy add_post.php unrestricted upload
- CVE-2026-10805 Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend
- CVE-2026-10804 Streamlit Palette hashing.py weak hash
- CVE-2026-108039 Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits
- CVE-2026-10803 MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hash
- CVE-2026-10802 keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption
- CVE-2026-108015 eMudhra Compromised Certificate vulnerability impacts HCL Notes Client
- CVE-2026-108014 eMudhra Compromised Certificate vulnerability impacts HCL Domino Server
- CVE-2026-108013 HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)
- CVE-2026-10801 modelscope ms-swift PIL Image Cache Key base.py Template._save_pil_image weak hash
- CVE-2026-10800 PaddlePaddle FastDeploy MultimodalHasher hasher.py hash_features weak hash
- CVE-2026-1080 Authorization Bypass Through User-Controlled Key in GitLab
- CVE-2026-10796 nvm executes commands from a malicious Node.js mirror's version strings
- CVE-2026-10795 UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc
- CVE-2026-107938 Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.
- CVE-2026-107937 Denial of service in Apache CXF
- CVE-2026-107935 Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose
- CVE-2026-107929 local interface connection reuse mixup
- CVE-2026-107928 info leak uploading over WebSockets with GnuTLS
- CVE-2026-107918 Insufficient input validation vulnerability in NETGEAR R7300
- CVE-2026-107917 Insufficient input validation vulnerability in NETGEAR R7300 router
- CVE-2026-107914 Information disclosure in Backdrop
- CVE-2026-107911 Type confusion in FalkorDB GRAPH.QUERY via the --bolt argument
- CVE-2026-107910 Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling
- CVE-2026-107909 Pre-authentication heap out-of-bounds write in FalkorDB Bolt WebSocket frame handling via unbounded payload length
- CVE-2026-107908 Pre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET message
- CVE-2026-107907 MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist
- CVE-2026-107900 Memory corruption in V-SFT
- CVE-2026-1079 Other in Pega Browser Extension (PBE)
- CVE-2026-107899 Memory corruption in V-SFT
- CVE-2026-107898 Memory corruption in V-SFT
- CVE-2026-107897 Memory corruption in V-SFT
- CVE-2026-107896 Memory corruption in V-SFT
- CVE-2026-107895 Memory corruption in V-SFT
- CVE-2026-107894 Memory corruption in V-SFT
- CVE-2026-107890 Null dereference in CUPS
- CVE-2026-10789 MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop
- CVE-2026-107889 Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass
- CVE-2026-107888 Null dereference in CUPS
- CVE-2026-107887 Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme