Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 958 of 1013.
- CVE-2026-107275 @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed
- CVE-2026-107273 Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site
- CVE-2026-107272 Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages
- CVE-2026-107271 Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing
- CVE-2026-107270 Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints
- CVE-2026-10727 Command injection in Endpoint Manager Mobile
- CVE-2026-107269 Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy
- CVE-2026-10726 Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation
- CVE-2026-10725 Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb
- CVE-2026-107248 CVE-2026-107248
- CVE-2026-10724 Reviews Feed < 2.6.5 - Unauthenticated Stored Arbitrary Shortcode Execution via Google Reviews
- CVE-2026-107239 Code injection in Management Pack for Microsoft System Center
- CVE-2026-107238 Deserialization in Management Pack for Microsoft System Center
- CVE-2026-107237 Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live
- CVE-2026-107232 AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT
- CVE-2026-107231 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
- CVE-2026-107230 AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins
- CVE-2026-10723 Incorrect acceptance of NSEC3 records
- CVE-2026-107229 Security feature bypass in async-http-client
- CVE-2026-107228 AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)
- CVE-2026-107227 AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled
- CVE-2026-107226 AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
- CVE-2026-107225 Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml
- CVE-2026-107224 Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader
- CVE-2026-107223 Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process
- CVE-2026-107222 Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check
- CVE-2026-107221 Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API
- CVE-2026-107220 Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref
- CVE-2026-10722 cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflow
- CVE-2026-107219 Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile
- CVE-2026-107218 Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics
- CVE-2026-107217 Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows
- CVE-2026-107216 Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow
- CVE-2026-107215 Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS
- CVE-2026-107214 Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks
- CVE-2026-107213 Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element
- CVE-2026-107212 Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days
- CVE-2026-107211 Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic
- CVE-2026-107210 ImageMagick: Policy Bypass in MAT decoder when reading highly compressed data
- CVE-2026-10721 Concrete CMS: PHP Object Injection via unserialize() calls
- CVE-2026-107209 ImageMagick: Use-After-Free in RSVG decoder that is build without cairo support
- CVE-2026-107208 ImageMagick: Denial of service with crafted XMP profile
- CVE-2026-107207 LMCache through 0.5.5 Missing Authentication in Frontend Node Catalog Allows SSRF Allowlist Bypass
- CVE-2026-107206 LMCache through 0.5.5 Missing Authentication in MP HTTP Server Management API
- CVE-2026-107205 LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API
- CVE-2026-107204 LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint
- CVE-2026-107203 Foreman: domain and subnet interface api skips host search filters
- CVE-2026-107202 CVE-2026-107202
- CVE-2026-10720 MicroCeph path traversal issue in the remote-import API
- CVE-2026-1072 Keybase.io Verification <= 1.4.5 - Cross-Site Request Forgery to Settings Update
- CVE-2026-107194 Auth bypass in iSolarCloud
- CVE-2026-107193 Foreman: api filter lookup ignores a search-limited filter permission
- CVE-2026-10719 Open Seachest/Seachest NVMe show Format Descriptors Vulnerability
- CVE-2026-107188 Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
- CVE-2026-107187 Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables
- CVE-2026-107186 Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse
- CVE-2026-107183 llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser
- CVE-2026-107181 Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
- CVE-2026-107180 MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances
- CVE-2026-10718 Open Seachest/Seachest NVMe Trim (Deallocate) Vulnerability
- CVE-2026-107178 Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter
- CVE-2026-107177 Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens
- CVE-2026-107176 Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret
- CVE-2026-107175 MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes
- CVE-2026-107174 Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction
- CVE-2026-107171 Hardcoded credentials in Trellix Agent
- CVE-2026-107170 M17n-lib: null dereference in minput_open_im() after failed m17n_init()
- CVE-2026-10717 Open-Seachest/Seachest show SCSI Defect List Vulnerability
- CVE-2026-107169 M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8
- CVE-2026-107168 M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars()
- CVE-2026-107167 M17n-lib: heap use-after-free write in re_init_ic()
- CVE-2026-107166 Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources
- CVE-2026-107162 Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass
- CVE-2026-107161 Memory corruption in Red Hat Enterprise Linux 10
- CVE-2026-107160 LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error Message
- CVE-2026-10716 Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation
- CVE-2026-107159 MiniUPnPd through 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header
- CVE-2026-107158 Missing authorization in LTL Freight Quotes
- CVE-2026-107157 Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework
- CVE-2026-107153 Hardcoded credentials in Rakuten BIGs
- CVE-2026-107151 Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests
- CVE-2026-10715 Camaleon CMS 2.9.2 - Improper authorization in draft autosave endpoint
- CVE-2026-107147 Authentication bypass by spoofing in twofactor_gauthenticator
- CVE-2026-107146 Insufficient session expiration in twofactor_gauthenticator
- CVE-2026-107145 Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator
- CVE-2026-10714 Rockwell Automation FactoryTalk® Services Platform FTSP - Weak Authentication via JWT Validation Bypass
- CVE-2026-107128 Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization
- CVE-2026-107127 Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF
- CVE-2026-107126 WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header
- CVE-2026-107125 XnView Classic FLI File heap-based overflow
- CVE-2026-107121 Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade
- CVE-2026-107120 Contest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN
- CVE-2026-10712 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-10711 RCE in Akınsoft's CafePlus
- CVE-2026-107104 Unsafe Deserialization Vulnerability in Manacle Technologies ERP System
- CVE-2026-107103 SQL Injection Vulnerability in Manacle Technologies ERP System
- CVE-2026-107102 Account Takeover Vulnerability in Manacle Technologies ERP System
- CVE-2026-107100 Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content
- CVE-2026-10710 FBX ExtractDrive Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK
- CVE-2026-1071 Carta Online <= 2.13.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings