Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 978 of 1013.
- CVE-2026-103778 Hardcoded credentials in Command | Configure (DCC)
- CVE-2026-103768 File upload in ELEX WordPress HelpDesk & Customer Ticketing System
- CVE-2026-103766 ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter
- CVE-2026-103765 Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server
- CVE-2026-103764 Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport
- CVE-2026-103763 SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo
- CVE-2026-103762 SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints
- CVE-2026-103761 Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue
- CVE-2026-103760 Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write
- CVE-2026-103758 Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route
- CVE-2026-103757 Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation
- CVE-2026-103754 Path traversal in Red Hat Ansible Automation Platform 2
- CVE-2026-103752 WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability
- CVE-2026-1037 Cross-site scripting in Common Licensing
- CVE-2026-103696 Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter
- CVE-2026-103695 Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameter
- CVE-2026-103694 Mobile builder <= 1.4.2 - Subscriber+ Privilege Escalation to Admin
- CVE-2026-103693 Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection
- CVE-2026-103692 Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function Call
- CVE-2026-103690 itsourcecode Leave Management System controller.php sql injection
- CVE-2026-103688 Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
- CVE-2026-103687 rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist
- CVE-2026-103686 rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting
- CVE-2026-103685 Missing authorization in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce
- CVE-2026-103684 WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability
- CVE-2026-103681 Frontend Dashboard < 3.0.0 - Subscriber+ Profile and Post Field Deletion via fed_user_profile_delete
- CVE-2026-103680 Tnef: heap buffer overflow in find_free_number() via numbered-backup suffix generation
- CVE-2026-103679 Tnef: use-after-free and double-free in get_body_files() via multi-value body extraction
- CVE-2026-103678 Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi value
- CVE-2026-103672 HMS Networks PEAK-System PCAN Windows drivers Improper Validation of Array Index
- CVE-2026-103671 Open redirect in AmazonPay Plugin (4.0 series)
- CVE-2026-103670 Gitea trusted workflow cancellation by unapproved fork runs
- CVE-2026-103668 SQL injection in Movable Type
- CVE-2026-103667 Gitea container registry stored XSS through blob media type
- CVE-2026-103665 Other in Yamaha LAN Monitor for Windows
- CVE-2026-103664 MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter
- CVE-2026-103663 Path Traversal leading to Remote Code Execution in Ollama
- CVE-2026-103662 MISP Reflected XSS in Taxonomy Tag Confirmation Forms
- CVE-2026-103659 MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes
- CVE-2026-103658 Memory corruption in Aspell
- CVE-2026-103655 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period
- CVE-2026-103651 MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass
- CVE-2026-103649 Synchronous Access of Remote Resource without Timeout in hMailServer
- CVE-2026-103648 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader
- CVE-2026-103647 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hMailServer
- CVE-2026-103646 Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter
- CVE-2026-103641 Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder
- CVE-2026-103636 Memory corruption in Apache DataSketches
- CVE-2026-103635 Memory corruption in Apache DataSketches
- CVE-2026-103634 Memory corruption in Apache DataSketches
- CVE-2026-103631 Memory corruption in Chrome
- CVE-2026-103630 Use after free in Chrome
- CVE-2026-103629 Integer overflow in Chrome
- CVE-2026-103628 Memory corruption in Chrome
- CVE-2026-103627 Information disclosure in Chrome
- CVE-2026-103626 Missing authorization in Chrome
- CVE-2026-103625 Memory corruption in Chrome
- CVE-2026-103624 Use after free in Chrome
- CVE-2026-103623 Use after free in Chrome
- CVE-2026-103622 Use after free in Chrome
- CVE-2026-103621 Integer overflow in Chrome
- CVE-2026-103620 Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL
- CVE-2026-103604 Quadratic-time escaping when converting X.509 distinguished names to strings
- CVE-2026-103603 Unbounded HSS public key level count allows huge array allocation during signature verification
- CVE-2026-103602 Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts
- CVE-2026-103601 CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check
- CVE-2026-103600 Unbounded ASN.1 nesting depth causes process-terminating stack overflow
- CVE-2026-1036 Missing authorization in Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2026-103594 Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution
- CVE-2026-103593 Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution
- CVE-2026-103592 simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers
- CVE-2026-103591 DeepWiki-Open through commit d92819a Unauthenticated Arbitrary File Read via /codemap/file
- CVE-2026-103590 QloApps through 1.7.0 Reflected XSS via Length of Stay Fields
- CVE-2026-103589 QloApps through 1.7.0 Reflected XSS via Room Type Editor
- CVE-2026-103588 QloApps through 1.7.0 Reflected XSS via exceptions field
- CVE-2026-103587 QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters
- CVE-2026-103585 attacker-controlled javascript license URL via XSS
- CVE-2026-103584 attacker-controlled javascript license URL via XSS
- CVE-2026-103578 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-103577 Microsoft QUIC Security Feature Bypass Vulnerability
- CVE-2026-103576 Active Directory Federation Services (AD FS) Spoofing Vulnerability
- CVE-2026-103575 Remote Desktop Client Remote Code Execution Vulnerability
- CVE-2026-103572 Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability
- CVE-2026-103569 Windows IKE Extension Information Disclosure Vulnerability
- CVE-2026-103568 Windows Credential Providers Elevation of Privilege Vulnerability
- CVE-2026-103567 Windows Broadcast DVR User Service Information Disclosure Vulnerability
- CVE-2026-103565 Windows Broadcast DVR User Service Elevation of Privilege Vulnerability
- CVE-2026-103560 Role: DNS Server Tampering Vulnerability
- CVE-2026-103558 Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability
- CVE-2026-103555 Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulnerability
- CVE-2026-103554 Windows Broadcast DVR User Service Elevation of Privilege Vulnerability
- CVE-2026-103553 Windows Partition Management Driver Elevation of Privilege Vulnerability
- CVE-2026-103552 Denial of service in Apache Directory LDAP API
- CVE-2026-103549 Incorrect Authorization in GitLab
- CVE-2026-103548 Improperly Stored Credentials
- CVE-2026-103547 Auth bypass in OpenBSD
- CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator
- CVE-2026-103544 datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong session
- CVE-2026-103543 itsourcecode Leave Management System controller.php sql injection
- CVE-2026-103542 formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery