Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 983 of 1013.
- CVE-2026-10289 code-projects Hotel and Tourism Reservation System tour.php cross site scripting
- CVE-2026-10288 code-projects Hotel and Tourism Reservation System Admin Login login.php password_verify improper authentication
- CVE-2026-102879 ClaraVerse through 0.3.1 SSRF Protection Bypass
- CVE-2026-102878 mcp-chrome-bridge through 1.0.31 CORS Origin Bypass
- CVE-2026-102877 Fider before 0.38.0 SSRF via DNS rebinding in webhook validation
- CVE-2026-102876 SurrealDB before 3.3.0 Cross-Tenant Access via Headers
- CVE-2026-102875 VLC media player before 3.0.24 Path Traversal via skins2
- CVE-2026-102874 HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection
- CVE-2026-102870 ASP.NET Core Remote Code Execution Vulnerability
- CVE-2026-10287 SourceCodester SEO Meta Tag Extractor index.php get_headers server-side request forgery
- CVE-2026-102869 .NET and Visual Studio Elevation of Privilege Vulnerability
- CVE-2026-102867 Microsoft Office Word Information Disclosure Vulnerability
- CVE-2026-102866 Microsoft Office SharePoint Elevation of Privilege Vulnerability
- CVE-2026-102865 Microsoft Office SharePoint Information Disclosure Vulnerability
- CVE-2026-102864 Microsoft Office SharePoint Spoofing Vulnerability
- CVE-2026-102863 Microsoft Office SharePoint Elevation of Privilege Vulnerability
- CVE-2026-102862 Microsoft Office SharePoint Elevation of Privilege Vulnerability
- CVE-2026-102861 Microsoft Office SharePoint Elevation of Privilege Vulnerability
- CVE-2026-102860 Microsoft Office SharePoint Elevation of Privilege Vulnerability
- CVE-2026-10286 CodeAstro Payroll System home_employee.php sql injection
- CVE-2026-102859 Microsoft Office SharePoint Spoofing Vulnerability
- CVE-2026-102858 Microsoft Office OneNote Remote Code Execution Vulnerability
- CVE-2026-102857 Microsoft Office Visio Remote Code Execution Vulnerability
- CVE-2026-102856 Microsoft Office Visio Remote Code Execution Vulnerability
- CVE-2026-102855 Microsoft Office Visio Remote Code Execution Vulnerability
- CVE-2026-102851 Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-102850 Microsoft Office Access Remote Code Execution Vulnerability
- CVE-2026-10285 DevaslanPHP project-management Ticket KanbanScrumHelper.php recordUpdated improper authorization
- CVE-2026-102849 Microsoft Office Access Remote Code Execution Vulnerability
- CVE-2026-102847 gedelumbung HospitalManagement Guest Book buku_tamu.php kirim cross site scripting
- CVE-2026-102846 gedelumbung HospitalManagement Configuration sistem.php simpan improper authorization
- CVE-2026-102845 gedelumbung HospitalManagement HTTP Response index.php error_reporting information disclosure
- CVE-2026-102844 gedelumbung HospitalManagement laporan_data_pasien.php detail authorization
- CVE-2026-102843 gedelumbung HospitalManagement Endpoint data_galeri.php hapus path traversal
- CVE-2026-102842 gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload
- CVE-2026-10284 DevaslanPHP project-management Livewire ViewTicket.php doDeleteComment improper authorization
- CVE-2026-102834 JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS
- CVE-2026-102832 JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
- CVE-2026-102831 JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
- CVE-2026-102830 JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
- CVE-2026-10283 Bottelet DaybydayCRM Setting missing authentication
- CVE-2026-102829 simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
- CVE-2026-102828 simple-git unsafe-operation guard does not block trailer command configuration
- CVE-2026-102827 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
- CVE-2026-102826 simple-git allows command execution through unblocked Git configuration includes
- CVE-2026-102825 Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path
- CVE-2026-102824 Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
- CVE-2026-102823 russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened
- CVE-2026-102822 russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic
- CVE-2026-102821 Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey
- CVE-2026-102820 pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)
- CVE-2026-10282 Bottelet DaybydayCRM DocumentsController.php view improper authorization
- CVE-2026-102816 Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305
- CVE-2026-102815 Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305
- CVE-2026-102814 Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305
- CVE-2026-102813 Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305
- CVE-2026-102812 Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7
- CVE-2026-102811 Marmite through 0.4.2 Unauthenticated API Access via Development Server
- CVE-2026-102810 Marmite through 0.4.2 Path Traversal via Development Server
- CVE-2026-10281 Enderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authentication
- CVE-2026-102809 PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command
- CVE-2026-102808 PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress
- CVE-2026-102807 OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket
- CVE-2026-102806 OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines
- CVE-2026-102805 Nothings stb Image Encoding stb_image_write.h stbi_write_tga_core integer overflow
- CVE-2026-102804 Nothings stb stb_hexwave.h hexwave_init integer overflow
- CVE-2026-102800 Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0
- CVE-2026-10280 horizon921 mcpilot MCP API Call Endpoint route.ts server-side request forgery
- CVE-2026-102799 Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16
- CVE-2026-102798 WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-102797 WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-102796 Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters
- CVE-2026-102795 Apache Traffic Server: SNI to Host header matching policy is not properly enforced
- CVE-2026-102794 Ziroom ZHOME A0101 ping command injection
- CVE-2026-102793 Ziroom ZHOME A0101 set_time_zone command injection
- CVE-2026-102792 Ziroom ZHOME A0101 set_syslog command injection
- CVE-2026-102790 Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12
- CVE-2026-10279 hiraishikentaro wezterm-mcp switch_pane/write_to_specific_pane wezterm_executor.ts os command injection
- CVE-2026-102789 Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2
- CVE-2026-102788 Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2
- CVE-2026-102787 Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5
- CVE-2026-102786 Cross-site scripting in Phoca Gallery extension for Joomla
- CVE-2026-102785 Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52
- CVE-2026-102784 Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0
- CVE-2026-102783 Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0
- CVE-2026-102782 Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0
- CVE-2026-102781 Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6
- CVE-2026-102780 Missing authorization in TF Content for Joomla
- CVE-2026-10278 ishayoyo excel-mcp read_file/write_file index.ts path traversal
- CVE-2026-102779 Missing authorization in TF Content for Joomla
- CVE-2026-102778 Cross-site scripting in Event Gallery for Joomla
- CVE-2026-102777 Server-side request forgery in Event Gallery for Joomla
- CVE-2026-102776 Cross-site request forgery in Event Gallery for Joomla
- CVE-2026-102775 Missing authorization in Phoca Cart extension for Joomla
- CVE-2026-102774 Cross-site scripting in SureDash – Community, Courses & Member Dashboard
- CVE-2026-102772 CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field
- CVE-2026-102771 Naichen ThinkCMF Email Template MailController.php templatePut special elements in template engine
- CVE-2026-10277 j3k0 mcp-google-workspace MCP Gmail Tool gmail.ts saveToDisk access control
- CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing
- CVE-2026-102762 Denial of service in NetX Duo