Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 970 of 1013.
- CVE-2026-10533 Denial of service in Red Hat OpenShift Container Platform 4
- CVE-2026-105329 TallCMS PluginManager ThemeManager.php code injection
- CVE-2026-105326 Cups: cups: argument injection in mailto notifier via notify-recipient-uri
- CVE-2026-105324 An HTTP header injection vulnerability was found in the ADM
- CVE-2026-105323 Reflected XSS in Kulga Software's Kulga News Software
- CVE-2026-105322 Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact Form
- CVE-2026-10532 Logback deserialization whitelist bypass for Proxy objects
- CVE-2026-105318 WordPress AcyMailing SMTP Newsletter plugin <= 11.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105317 WordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerability
- CVE-2026-105316 Magee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode Actions
- CVE-2026-105315 django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection
- CVE-2026-105314 Path traversal in Papermerge
- CVE-2026-105312 Privilege escalation in StreamsHub Console for Apache Kafka®
- CVE-2026-105311 Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy
- CVE-2026-10531 AI Share & Summarize < 2.0.4 - Contributor+ Stored XSS via title_style Shortcode Attribute
- CVE-2026-105307 Casdoor API Endpoint authz_filter.go ApiFilter missing authentication
- CVE-2026-105306 Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration
- CVE-2026-105305 Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement
- CVE-2026-105302 Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens
- CVE-2026-10530 Pie Register < 3.8.4.10 - Unauthenticated Email Verification Bypass via Predictable Token
- CVE-2026-1053 Cross-site scripting in Ivory Search – WordPress Search Plugin
- CVE-2026-105299 Security feature bypass in https://github.com/cloudflare/pingora
- CVE-2026-105298 Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass
- CVE-2026-105297 Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits
- CVE-2026-105295 GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass
- CVE-2026-105294 Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig
- CVE-2026-105293 Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers
- CVE-2026-105292 Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback
- CVE-2026-105291 feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting
- CVE-2026-105290 feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery
- CVE-2026-10529 westboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting
- CVE-2026-105289 Cross-site scripting in feelcrm-os
- CVE-2026-105288 feelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting
- CVE-2026-105287 feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection
- CVE-2026-105286 Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal
- CVE-2026-105285 Totolink A3002MU QoS Rule formIpQoS stack-based overflow
- CVE-2026-105284 Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization
- CVE-2026-105283 Internal error terms inspected into AshTypescript RPC error responses
- CVE-2026-105281 Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function
- CVE-2026-105280 Hex writes unverified package tarballs to standard output in mix hex.package fetch
- CVE-2026-10528 Orthanc DICOM Server DCMTK FromDcmtkBridge.cpp read stack-based overflow
- CVE-2026-105279 J4Care dcm4che Missing Authentication for Critical Function
- CVE-2026-105278 Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials
- CVE-2026-105275 Satel Netco Design Relative Path Traversal
- CVE-2026-105274 hex_core decompresses registry and Erlang term API responses without size limits
- CVE-2026-105273 J4Care dcm4che Loop with Unreachable Exit Condition
- CVE-2026-105272 Missing authorization in GROWI
- CVE-2026-105271 Information disclosure in "ゲオアプリ" for Android
- CVE-2026-105270 Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion
- CVE-2026-10527 Boards plugin retains Board Admin rights for users demoted to System Guest
- CVE-2026-105269 Satel Netco Design Cross-site Scripting
- CVE-2026-105268 Gitea issue attachment API allows changing comment attachments
- CVE-2026-105267 Gitea tag delete route deletes releases without release permission
- CVE-2026-105265 Kiloview E3 NDI Encoder Path Traversal
- CVE-2026-105263 Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery
- CVE-2026-105262 Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation
- CVE-2026-105261 PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes
- CVE-2026-105260 Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF
- CVE-2026-10526 EmbedPress < 4.6.1 - Unauthenticated Blind SSRF
- CVE-2026-105258 LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings
- CVE-2026-105257 LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR
- CVE-2026-105256 LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter
- CVE-2026-105254 itsourcecode Online Admission System schoolyear.php sql injection
- CVE-2026-105253 itsourcecode Online Admission System Project login1.php sql injection
- CVE-2026-105251 vgmstream VAG File psx_decoder.c ps_find_padding out-of-bounds
- CVE-2026-105250 vgmstream Microsoft IMA Decoder ima_decoder.c decode_ms_ima divide by zero
- CVE-2026-10525 NEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form Submission
- CVE-2026-105249 vgmstream TXTP File txtp_process.c make_group_random use after free
- CVE-2026-105248 vgmstream TXTP File txtp_parser.c txtp_parse out-of-bounds write
- CVE-2026-105247 SourceCodester Online Reviewer Management System btn_functions.php course sql injection
- CVE-2026-105246 SourceCodester Online Reviewer Management System btn_functions.php update sql injection
- CVE-2026-105245 sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission
- CVE-2026-105244 Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content
- CVE-2026-105243 Apache log4net: Oversize EventLogAppender record silently discarded
- CVE-2026-105242 Apache log4net: Request validation failure drops the event in the aspnet-request converter
- CVE-2026-105241 Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch
- CVE-2026-105240 Apache log4net: NUL character truncates OutputDebugStringAppender records
- CVE-2026-10524 CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation
- CVE-2026-105239 Apache log4net: NUL character truncates EventLogAppender records
- CVE-2026-105238 ChatGPTNextWeb NextChat Proxy Fallback proxy.ts proxyHandler server-side request forgery
- CVE-2026-105237 linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication
- CVE-2026-105236 TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries
- CVE-2026-105233 kishor-23 food-waste-management-system Login Flow login.php session fixiation
- CVE-2026-105232 kishor-23 food-waste-management-system Registration deliverysignup.php sql injection
- CVE-2026-105231 kishor-23 food-waste-management-system Admin Registration signup.php sql injection
- CVE-2026-105230 kishor-23 food-waste-management-system deliverymyord.php sql injection
- CVE-2026-10523 Auth bypass in Sentry
- CVE-2026-105229 kishor-23 food-waste-management-system User Registration Endpoint signup.php sql injection
- CVE-2026-105228 ISPSoft Out-of-Bounds Read Vulnerability
- CVE-2026-105227 ISPSoft Out-of-Bounds Read Vulnerability
- CVE-2026-105226 osCommerce osCommerce2 Newsletter Management newsletters.php include code injection
- CVE-2026-105225 osCommerce osCommerce2 Payment payment.php include code injection
- CVE-2026-105224 YesWiki before 4.6.7 Stored XSS via Bazar valeur Action
- CVE-2026-105223 maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification
- CVE-2026-105222 alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer
- CVE-2026-105221 Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification
- CVE-2026-105220 Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files
- CVE-2026-10522 Simple User Registration <= 6.9 - Unauthenticated Privilege Escalation to Administrator
- CVE-2026-105219 Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser
- CVE-2026-105218 gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client