Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 955 of 1013.
- CVE-2026-107756 Cross-site scripting in Meow Lightbox
- CVE-2026-107755 Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs
- CVE-2026-107754 GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title
- CVE-2026-107752 Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie
- CVE-2026-107751 Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter
- CVE-2026-10775 sgl-project SGLang Cache data_hash denial of service
- CVE-2026-107748 User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
- CVE-2026-107746 Missing authorization in FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
- CVE-2026-107745 AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter
- CVE-2026-107744 Missing authorization in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- CVE-2026-107743 Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter
- CVE-2026-107742 10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
- CVE-2026-10774 PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoS
- CVE-2026-107738 SumatraPDF: Untrusted binary record offset used without lower-bound validation
- CVE-2026-107737 SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup
- CVE-2026-107736 SumatraPDF: stack buffer overflow while processing EXIF Orientation metadata
- CVE-2026-107735 SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open policy initialization)
- CVE-2026-107734 SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors
- CVE-2026-107733 SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open
- CVE-2026-107732 SumatraPDF: Markup/command-link injection into UI notification text
- CVE-2026-107731 SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of service
- CVE-2026-107730 SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-pointer read
- CVE-2026-10773 Out-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name)
- CVE-2026-107729 SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read
- CVE-2026-107728 Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
- CVE-2026-107727 Strawberry legacy graphql-ws retains naturally completed subscription slots
- CVE-2026-107726 Hazelcast: Arbitrary member memory access by low-privileged client
- CVE-2026-107725 Hazelcast: Authorization bypass in IMap Predicates API
- CVE-2026-107724 fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
- CVE-2026-107723 fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
- CVE-2026-107722 fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
- CVE-2026-107721 fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)
- CVE-2026-107720 fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
- CVE-2026-107719 fast-jwt: Verifier cache accepts expired JWTs without iat.
- CVE-2026-107718 AdonisJS: Unencoded route parameters can produce open redirects
- CVE-2026-107717 Banks: User-controlled prompt input can be parsed as privileged chat messages
- CVE-2026-107716 Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry
- CVE-2026-107715 Mechanize sends credential headers to another host after an HTTP redirect
- CVE-2026-107714 Mechanize sends credential headers to a different scheme or port after a redirect
- CVE-2026-107712 WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter
- CVE-2026-107710 Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title
- CVE-2026-10771 crmeb crmeb_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgery
- CVE-2026-107709 Bower decompress-zip has a path traversal vulnerability
- CVE-2026-107708 MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC
- CVE-2026-107707 Intego Antivirus through 3.0.0.1 Local Privilege Escalation via Optimization Module Junction
- CVE-2026-107706 Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php
- CVE-2026-107705 Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash()
- CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format
- CVE-2026-107703 @enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo
- CVE-2026-107702 QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking
- CVE-2026-107701 dot-access through 1.0.0 Prototype Pollution via set() path argument
- CVE-2026-107700 dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument
- CVE-2026-10770 Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042
- CVE-2026-107699 ppt2png through 0.0.6 OS Command Injection via input and output paths
- CVE-2026-107698 FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling
- CVE-2026-107697 FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist()
- CVE-2026-107696 FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c
- CVE-2026-107695 FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist
- CVE-2026-107694 Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint
- CVE-2026-107692 War Thunder Account Impersonation
- CVE-2026-10769 Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041
- CVE-2026-107686 Gitea reactions accepted on locked issues and comments
- CVE-2026-107685 WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers
- CVE-2026-107682 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-10768 LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039
- CVE-2026-107678 FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes
- CVE-2026-107677 FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media
- CVE-2026-107676 FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer
- CVE-2026-107675 FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol
- CVE-2026-107674 IBM i is Affected by a Denial of Service in Digital Certificate Manager
- CVE-2026-107672 Stack File Trusted Markdown Injection in Autodesk Fusion Post Processor Utility
- CVE-2026-107671 Auth bypass in ONE
- CVE-2026-107660 FFmpeg before 8.1.3 and 9.x before 9.0.2 mbedTLS Hostname Verification Bypass for IP Hosts
- CVE-2026-10766 mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hash
- CVE-2026-107659 Missing authorization in Modula Image Gallery – Photo Grid & Video Gallery
- CVE-2026-107657 HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
- CVE-2026-107656 Auth bypass in FortiSandbox
- CVE-2026-107655 Cups: null pointer dereference via embedded job ticket comments allows remote denial of service
- CVE-2026-107652 Path traversal in Database Addon for Contact Form 7 – CFDB7
- CVE-2026-107651 Eog: eog: arbitrary code execution via heap buffer overflow in png metadata reader
- CVE-2026-107650 Cross-site scripting in GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- CVE-2026-107649 Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter
- CVE-2026-107648 Cross-site scripting in WP Sessions Time Monitoring Full Automatic
- CVE-2026-107646 HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script
- CVE-2026-107645 Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter
- CVE-2026-107640 Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API
- CVE-2026-10764 Information disclosure in BVMS 4.5 up to 12.3
- CVE-2026-107639 ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filename
- CVE-2026-107638 pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php
- CVE-2026-107637 pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action
- CVE-2026-107636 pH7Builder before 18.5.1 Payment Bypass via Payment Module MainController
- CVE-2026-107635 Dislocker through 0.7.3 Out-of-Bounds Heap Read via VMK/FVEK Datum Size Underflow
- CVE-2026-107634 Dislocker through 0.7.3 Heap Out-of-Bounds Read via BitLocker Metadata Dataset Size
- CVE-2026-107631 Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter
- CVE-2026-10763 Weak cryptography in PROMOD V
- CVE-2026-107629 Cross-site scripting in Greenshift – animation and page builder blocks
- CVE-2026-107627 Cross-site scripting in Greenshift – animation and page builder blocks
- CVE-2026-107625 Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field
- CVE-2026-107623 Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation
- CVE-2026-107621 J4Care dcm4che Loop with Unreachable Exit Condition