Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 968 of 1013.
- CVE-2026-10573 1734 POINT I/OTM - Denial of Service via Malformed Inputs on CIP Object
- CVE-2026-105729 SysInternals Elevation of Privilege Vulnerability
- CVE-2026-105728 Dynamics Business Central Information Disclosure Vulnerability
- CVE-2026-105727 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
- CVE-2026-105726 Microsoft Defender Information Disclosure Vulnerability
- CVE-2026-105725 Windows Security App Elevation of Privilege Vulnerability
- CVE-2026-105723 Windows Distributed File System (DFS) Elevation of Privilege Vulnerability
- CVE-2026-105722 Windows Broadcast DVR User Service Elevation of Privilege Vulnerability
- CVE-2026-105720 Microsoft Office SharePoint Elevation of Privilege Vulnerability
- CVE-2026-10572 IBM MQ Buffer Overflow
- CVE-2026-105719 Microsoft SharePoint Server Information Disclosure Vulnerability
- CVE-2026-105718 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-105717 Microsoft Office Access Remote Code Execution Vulnerability
- CVE-2026-105716 Microsoft Office Access Remote Code Execution Vulnerability
- CVE-2026-105715 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-105714 Microsoft Office Access Remote Code Execution Vulnerability
- CVE-2026-105713 Microsoft Office SharePoint Spoofing Vulnerability
- CVE-2026-105712 Path traversal in GnuPG
- CVE-2026-105711 Use of Cache Containing Sensitive Information in GitLab
- CVE-2026-10571 IBM WebSphere Application Server Liberty is affected by a denial of service
- CVE-2026-105708 imgproxy SVG svg.go sanitizeElement cross site scripting
- CVE-2026-105707 uptrace user_handler.go Login information exposure
- CVE-2026-105706 SourceCodester Drug Recommendation System cross-site request forgery
- CVE-2026-105705 SourceCodester Drug Recommendation System add_drug.php cross site scripting
- CVE-2026-105704 SourceCodester Drug Recommendation System Auth Guard improper authentication
- CVE-2026-105703 PHPGurukul User Registration & Login and User Management System Change Password change-password.php authorization
- CVE-2026-105701 ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template
- CVE-2026-10570 Cross-site scripting in Sympl Repeater for ACF and Elementor
- CVE-2026-105699 Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
- CVE-2026-105698 Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
- CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
- CVE-2026-105696 Missing authorization in penpot
- CVE-2026-105695 Missing authorization in penpot
- CVE-2026-105694 Penpot: Stored XSS via Unsanitised SVG Uploads
- CVE-2026-105693 Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle
- CVE-2026-105692 Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create
- CVE-2026-105691 Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color
- CVE-2026-105690 Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile access
- CVE-2026-10569 IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Exposure of Sensitive Information Vulnerability
- CVE-2026-105689 Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download
- CVE-2026-105688 Penpot: Team admin can escalate to owner via team invitation (missing owner-role guard on the invitation path)
- CVE-2026-105687 Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection
- CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification
- CVE-2026-105684 Missing authorization in penpot
- CVE-2026-105683 Ghost: Path Traversal Vulnerability in Ghost ImageSize Service
- CVE-2026-105682 Ghost: Server-Side Request Forgery in Webhook Trigger
- CVE-2026-105681 Ghost: Authorization Bypass in Comments Feature
- CVE-2026-105680 Ghost: Authorization Issue Allowed Author Role to Delete any Post
- CVE-2026-10568 itsourcecode Fees Management System manage_payment.php sql injection
- CVE-2026-105679 Ghost: Stored XSS via File Uploads on Local Storage
- CVE-2026-105678 Ghost: Editors Could Promote Staff Users to Their Own Role
- CVE-2026-105677 Ghost: Remote Code Execution via Theme Translation Files
- CVE-2026-105676 Ghost: Path Traversal via Locale Setting
- CVE-2026-105675 Ghost: Invite Token Disclosure in Ghost Admin API
- CVE-2026-105674 Predictable Media Stream Pre-Shared Key Vulnerability in TP-Link Tapo C325WB
- CVE-2026-105673 Unauthenticated RTSP Tunnel Denial-of-Service Vulnerability in TP-Link Tapo C325WB
- CVE-2026-105672 Unauthenticated JSON API Authorization Bypass Vulnerability in TP-Link Tapo C325WB
- CVE-2026-10567 1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting
- CVE-2026-105668 Hex release-age cooldown is lifted package-wide when the locked release is retired
- CVE-2026-105667 J4Care dcm4che Missing Authentication for Critical Function
- CVE-2026-105664 Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy
- CVE-2026-105661 Gitea panic on the repositories route of individual users
- CVE-2026-105660 Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit
- CVE-2026-10566 FoundationAgents MetaGPT schema.py Message.check_instruct_content deserialization
- CVE-2026-105659 Denial of service in bandit
- CVE-2026-105652 Ghost: Password Hash Ordering Disclosure in Ghost Admin API
- CVE-2026-105651 Ghost: Stored XSS via Bookmark Card Images
- CVE-2026-105650 Ghost: Stored XSS via oEmbed Photo Responses
- CVE-2026-10565 Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition
- CVE-2026-105649 Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
- CVE-2026-105648 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
- CVE-2026-105647 Ghost: Server-Side Request Forgery in Bookmark Fetching
- CVE-2026-105646 Ghost: Regular Expression Denial of Service in Content Import
- CVE-2026-105645 Ghost: Regular Expression Denial of Service in External Media Inliner
- CVE-2026-105644 Ghost: Stored XSS via SVG Files in Content Imports
- CVE-2026-105643 Ghost: Stored XSS via Embed Card Previews
- CVE-2026-105642 Ghost: Remote Code Execution via Bookmark Card Images
- CVE-2026-105641 Hardcoded credentials in plane
- CVE-2026-105640 Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
- CVE-2026-10564 SSRF Vulnerability in Langflow OSS Legacy Components Bypasses Protection
- CVE-2026-105639 Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane
- CVE-2026-105638 Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force
- CVE-2026-105637 Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)
- CVE-2026-105636 Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
- CVE-2026-105635 Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token
- CVE-2026-105634 Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles
- CVE-2026-105633 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope
- CVE-2026-105632 Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects
- CVE-2026-105631 Missing authorization in plane
- CVE-2026-105630 Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)
- CVE-2026-105629 Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup
- CVE-2026-105628 Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint
- CVE-2026-105626 Consul vulnerable to a denial of service in HTTP APIs
- CVE-2026-105621 jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization
- CVE-2026-105620 PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query
- CVE-2026-10562 Unauthenticated Open Redirect Vulnerability on TP-Link Archer AX20 Web Interface
- CVE-2026-105619 PostgreSQL Anonymizer: Masking rules of the tables are not applied through security_invoker views
- CVE-2026-105618 PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent
- CVE-2026-105617 PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule
- CVE-2026-105616 PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting