Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 979 of 1013.
- CVE-2026-103541 formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload
- CVE-2026-103540 formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine
- CVE-2026-103539 ZongXR SuperMarket Instant Buy InstantBuyController.java startBuy missing authentication
- CVE-2026-103538 ZongXR SuperMarket Order Deletion Endpoint OrderController.java OrderController.deleteOrder missing authentication
- CVE-2026-103537 CVE-2026-103537
- CVE-2026-103536 ZongXR Supermarket save Endpoint OrderController.java OrderController.addOrder missing authentication
- CVE-2026-103535 CVE-2026-103535
- CVE-2026-103534 David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control
- CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal
- CVE-2026-103532 immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization
- CVE-2026-103531 OpenSC card-setcos.c setcos_construct_fci_44 stack-based overflow
- CVE-2026-103530 decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery
- CVE-2026-103529 CVE-2026-103529
- CVE-2026-103528 CVE-2026-103528
- CVE-2026-103527 CVE-2026-103527
- CVE-2026-103526 CVE-2026-103526
- CVE-2026-103525 Missing authorization in FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler
- CVE-2026-103524 CVE-2026-103524
- CVE-2026-103523 CVE-2026-103523
- CVE-2026-103522 CVE-2026-103522
- CVE-2026-103521 CVE-2026-103521
- CVE-2026-103520 Cross-site scripting in HivePress – Business Directory, Listings & Classified Ads Plugin
- CVE-2026-103519 Code injection in WP Ultimate Review
- CVE-2026-103518 SQL injection in FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler
- CVE-2026-103517 Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged Webhook
- CVE-2026-103515 Incorrect Authorization in GitLab
- CVE-2026-103514 WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay
- CVE-2026-103513 Memory corruption in Apache DataSketches
- CVE-2026-103512 Ticket host-binding bypass via spoofed client IP in P4Search
- CVE-2026-103511 Arbitrary file-write via extension installation in P4Search
- CVE-2026-103510 Authentication bypass via blank auth token in P4Search
- CVE-2026-103509 Credential Disclosure in P4 Search Configuration API
- CVE-2026-103508 Path traversal via logging configuration in P4Search
- CVE-2026-103507 Arbitrary file-write via log configuration path in P4Search
- CVE-2026-103506 SSO settings authorization bypass
- CVE-2026-103505 AWS EFS CSI Driver Mount Option Injection via mounttargetipmap
- CVE-2026-103504 Gitea API team demotion not applied to unit permissions
- CVE-2026-103503 Hex trusts its bundled CA certificates when cacerts_path is set
- CVE-2026-103502 hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
- CVE-2026-103501 Memory corruption in Apache DataSketches
- CVE-2026-103500 Heap buffer overflow opening large email
- CVE-2026-1035 Org.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race condition
- CVE-2026-103499 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service
- CVE-2026-103497 Server-side request forgery in YouTrack
- CVE-2026-103496 Missing authorization in YouTrack
- CVE-2026-103495 Missing authorization in YouTrack
- CVE-2026-103494 Privilege escalation in YouTrack
- CVE-2026-103493 Cross-site scripting in YouTrack
- CVE-2026-103492 Denial of service in YouTrack
- CVE-2026-103491 Missing authorization in YouTrack
- CVE-2026-103490 Privilege escalation in YouTrack
- CVE-2026-103489 Cross-site scripting in YouTrack
- CVE-2026-103488 Missing authorization in YouTrack
- CVE-2026-103485 Extensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property
- CVE-2026-103484 pgvector buffer overflow in IVFFlat index build
- CVE-2026-103482 Cross-site scripting in Noptin – Newsletter, New Post Notifications & Email Automation
- CVE-2026-103481 Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter
- CVE-2026-103480 Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
- CVE-2026-103478 Cross-site scripting in Premium Packages – Sell Digital Products Securely
- CVE-2026-103476 yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download
- CVE-2026-103475 yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure
- CVE-2026-103474 yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE
- CVE-2026-103473 Deno 2.7.0 through 2.9.7 Command Injection via node:child_process
- CVE-2026-103472 restbed through 5.0.0 WebSocket Memory Exhaustion via Unbounded Frame Buffering
- CVE-2026-103471 restbed through 5.0.0 Denial of Service via Unbounded Header Buffering
- CVE-2026-103470 Privilege escalation in Grouper
- CVE-2026-103446 WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments
- CVE-2026-103445 Stored XSS through PageForms #autoedit redirect links
- CVE-2026-103444 Stored XSS through system messages in WikiForum
- CVE-2026-103443 API permits session-seeded javascript URL XSS
- CVE-2026-103442 MergeAccount PHP object injection via session-key substitution
- CVE-2026-103441 Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing
- CVE-2026-103440 pagetriagelist discloses suppressed reviewer usernames
- CVE-2026-103439 Various rawParams() and escaped() updates to prevent XSS in Wikibase extension
- CVE-2026-103438 Various rawParams() and escaped() updates to prevent XSS in Wikistories extension
- CVE-2026-103437 ReadingLists imported metadata permits JavaScript URL XSS
- CVE-2026-103436 Information disclosure in apcupsd
- CVE-2026-103435 Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code
- CVE-2026-103433 Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions
- CVE-2026-103432 Memory corruption in apcupsd
- CVE-2026-103431 colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances be
- CVE-2026-103427 Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field
- CVE-2026-103426 Relevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' Parameter
- CVE-2026-103425 Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
- CVE-2026-103424 Cross-site scripting in Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA
- CVE-2026-103423 Missing authorization in Booking Package
- CVE-2026-103422 AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
- CVE-2026-103421 WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment
- CVE-2026-103418 Universal XSS via the HTML language attribute in Translation Services
- CVE-2026-103417 Saved credentials can be autofilled after cross-origin navigation
- CVE-2026-103416 Memory corruption in Eclipse ThreadX - NetX Duo
- CVE-2026-103415 Memory corruption in NetX Duo
- CVE-2026-103414 Memory corruption in GUIX
- CVE-2026-103413 Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml
- CVE-2026-103412 Apache Camel Karavan: project file name path traversal when committing a project to Git
- CVE-2026-103411 Integer overflow in Session Smart Router
- CVE-2026-103410 Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection
- CVE-2026-103409 Auth bypass in Session Smart Router
- CVE-2026-103408 Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options
- CVE-2026-103407 Path traversal in Session Smart Conductor