Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 971 of 1013.
- CVE-2026-105217 Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php
- CVE-2026-105216 go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper
- CVE-2026-105215 ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback
- CVE-2026-105214 Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification
- CVE-2026-105213 ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations
- CVE-2026-105212 ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment
- CVE-2026-105211 ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode
- CVE-2026-105210 ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers
- CVE-2026-10521 Authenticated unintended access to critical program parameters
- CVE-2026-105209 ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment
- CVE-2026-105208 ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens
- CVE-2026-105207 ZITADEL before 4.17.3 Account Takeover via External IdP Linking
- CVE-2026-105206 ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service
- CVE-2026-105205 SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo
- CVE-2026-10520 Ivanti Sentry OS Command Injection
- CVE-2026-105199 Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID
- CVE-2026-105198 LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR
- CVE-2026-105197 LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR
- CVE-2026-105196 LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API
- CVE-2026-105195 Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure
- CVE-2026-105194 Easy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Downloads Block
- CVE-2026-105193 Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking Hash
- CVE-2026-105192 LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization
- CVE-2026-105190 Easy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Registration Disabled
- CVE-2026-105188 code-projects Human Resource Management System Live Event History liveEventHistory.php cross site scripting
- CVE-2026-105187 itsourcecode Online Admission System key.php sql injection
- CVE-2026-105186 itsourcecode Online Admission System new.php sql injection
- CVE-2026-105185 itsourcecode Online Admission System examinee.php sql injection
- CVE-2026-105184 itsourcecode Online Admission System creteria.php sql injection
- CVE-2026-105183 itsourcecode Online Admission System confirm.php sql injection
- CVE-2026-105182 SourceCodester Online Reviewer Management System btn_functions.php update sql injection
- CVE-2026-105181 itsourcecode Online Admission System register1.php sql injection
- CVE-2026-105180 Jeebase UserService info updateUser dynamically-determined object attributes
- CVE-2026-10518 Incorrect Authorization in GitLab
- CVE-2026-105179 SourceCodester Drug Recommendation System Password add_user.php missing encryption
- CVE-2026-105178 SourceCodester Drug Recommendation System Symptom Creation add_symptom.php mysqli_real_escape_string sql injection
- CVE-2026-105177 SourceCodester Drug Recommendation System Drug Creation add_drug.php sql injection
- CVE-2026-105176 SourceCodester Drug Recommendation System edit_class.php sql injection
- CVE-2026-105175 SourceCodester Drug Recommendation System Student Registration add_student.php sql injection
- CVE-2026-105174 Gerapy Project Management views.py project_create path traversal
- CVE-2026-105173 code-projects Human Resource Management Event Creation EventStore.php cross site scripting
- CVE-2026-105172 itsourcecode Online Admission System login1.php sql injection
- CVE-2026-105171 kishor-23 food-waste-management-system Role Attribute admin.php authorization
- CVE-2026-105170 kishor-23 food-waste-management-system Admin Signup signup.php missing authentication
- CVE-2026-105169 kishor-23 food-waste-management-system Take Order delivery.php sql injection
- CVE-2026-105168 kishor-23 food-waste-management-system Order Assignment Block admin.php sql injection
- CVE-2026-105167 kishor-23 food-waste-management-system donate.php sql injection
- CVE-2026-105166 kishor-23 food-waste-management-system Food Donation Form fooddonateform.php insert sql injection
- CVE-2026-105165 devopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignment
- CVE-2026-105164 NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bounds
- CVE-2026-105163 crossplane crossplane-runtime ImageConfig client.go Get toctou
- CVE-2026-105161 invariant-systems-ai aiir Policy Gate signature verification
- CVE-2026-105158 RainyGao DocSys Database Management BaseController.java BaseController.createDBForMysql sql injection
- CVE-2026-105157 RainyGao DocSys Document Controller doGetTmpFile.do DocController.doGetTmp path traversal
- CVE-2026-105156 YzmCMS MD5 system.func.php password weak password hash
- CVE-2026-105149 mooSocial all-products sql injection
- CVE-2026-105148 SciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request forgery
- CVE-2026-105147 SciPhi-AI R2R JWT Secret hard-coded credentials
- CVE-2026-105146 Comsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injection
- CVE-2026-105145 Weaviate Verba generate_stream Endpoint util.py get_environment information disclosure
- CVE-2026-105144 Drogon Static File Router StaticFileRouter.cc route path traversal
- CVE-2026-105141 topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials
- CVE-2026-105140 Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership
- CVE-2026-10514 1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting
- CVE-2026-105139 Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resources
- CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API
- CVE-2026-105137 Laradock Build Process Dockerfile code download
- CVE-2026-105135 InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection
- CVE-2026-105134 Ahsay AhsayCBS Command Injection
- CVE-2026-105133 Ahsay AhsayCBS Improper Authentication
- CVE-2026-105131 mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint
- CVE-2026-105130 LaraDashboard 1.4.0 before 1.4.8 Race Condition Bypasses Per-IP Registration Limit
- CVE-2026-10513 Webmention <= 5.8.0 - Unauthenticated Stored Cross-Site Scripting via MF2 'photo'/'url' Author Properties
- CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API
- CVE-2026-105128 LaraDashboard before 1.4.8 Open Redirect via Email Template Builder redirect_url
- CVE-2026-105127 LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints
- CVE-2026-105126 LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering
- CVE-2026-105125 LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint
- CVE-2026-105124 W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments
- CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API
- CVE-2026-105122 OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri
- CVE-2026-105121 OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping
- CVE-2026-105120 OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint
- CVE-2026-10512 X25519 x86_64 assembly final reduction leaves non-canonical field element
- CVE-2026-105119 OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows
- CVE-2026-105118 OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession
- CVE-2026-105117 OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions
- CVE-2026-105116 OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page
- CVE-2026-105115 OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface
- CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page
- CVE-2026-105113 Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock
- CVE-2026-105112 Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints
- CVE-2026-105111 Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS
- CVE-2026-105110 Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter
- CVE-2026-10511 Cross-site scripting in Jupiter X Core
- CVE-2026-105107 Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters
- CVE-2026-105106 Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task
- CVE-2026-105105 Missing authorization in AIT-Core
- CVE-2026-10510 GeniexWebView XSS in com.transsion.aiassistantlifestyle
- CVE-2026-1051 Newsletter – Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription