Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 984 of 1013.
- CVE-2026-102761 Memory corruption in NetX Duo
- CVE-2026-102760 Use after free in NetX Duo
- CVE-2026-10276 hekmon8 Jenkins-server-mcp get_build_status/get_build_log/trigger_build index.ts jobPath server-side request forgery
- CVE-2026-102759 Security feature bypass in NetX Duo
- CVE-2026-102758 Memory corruption in NetX Duo
- CVE-2026-102757 Memory corruption in ThreadX
- CVE-2026-102756 DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting
- CVE-2026-102755 DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting
- CVE-2026-10275 OpenSC pkcs11-tool Key Generation pkcs11-tool.c test_kpgen_certwrite buffer overflow
- CVE-2026-102748 Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
- CVE-2026-102740 AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink
- CVE-2026-10274 indrasishbanerjee aem-mcp-server Axios Request Flow mcp-server.ts getAssetMetadata server-side request forgery
- CVE-2026-102734 asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
- CVE-2026-102731 Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode
- CVE-2026-102730 Memory corruption in eclipse-threadx/levelx(NAND driver)
- CVE-2026-10273 php-censor Webhook Endpoint GitBuild.php os command injection
- CVE-2026-102729 Memory corruption in GUIX
- CVE-2026-102728 Memory corruption in NetX Duo
- CVE-2026-102727 Other in NetX Duo
- CVE-2026-102726 Denial of service in NetX Duo
- CVE-2026-102725 Memory corruption in NetX Duo
- CVE-2026-102724 Null dereference in NetX Duo
- CVE-2026-102723 Null dereference in NetX Duo
- CVE-2026-102722 Server-side request forgery in NetX Duo
- CVE-2026-102721 Memory corruption in NetX Duo
- CVE-2026-102720 Memory corruption in eclipse-threadx/netxduo
- CVE-2026-10272 a4m4 Student-Management-System deleteform.php improper authorization
- CVE-2026-102719 Weak cryptography in netxduo
- CVE-2026-102718 Memory corruption in NetX Duo
- CVE-2026-102717 MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
- CVE-2026-102716 Denial of service in eclipse-threadx/netxduo
- CVE-2026-102715 Memory corruption in eclipse-threadx/netxduo
- CVE-2026-102714 Integer overflow in NetX Duo
- CVE-2026-102713 Memory corruption in NetX Duo
- CVE-2026-102712 Memory corruption in NetX Duo
- CVE-2026-102711 Memory corruption in `eclipse-threadx/threadx` (module manager / loadable-module loader)
- CVE-2026-102710 Privilege escalation in eclipse-threadx/threadx
- CVE-2026-10271 a4m4 Student-Management-System Admin Endpoint admin redirect
- CVE-2026-102709 Information disclosure in ThreadX
- CVE-2026-102702 Arm: multiple issues with GNTTABOP_cache_flush
- CVE-2026-102700 gnttab: cache-flush handling may cause page reference leak
- CVE-2026-10270 D-Link DI-7001 MINI API httpd_debug.asp sprintf stack-based overflow
- CVE-2026-102699 Arm: multiple issues with GNTTABOP_cache_flush
- CVE-2026-102697 Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization
- CVE-2026-102695 OmniFaces: Forged combined-resource IDs and related output/push boundaries
- CVE-2026-102693 RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID
- CVE-2026-102692 RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access
- CVE-2026-10269 decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization
- CVE-2026-102682 Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation
- CVE-2026-10268 janet-lang janet marsh.c unmarshal_one_fiber integer overflow
- CVE-2026-102677 Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
- CVE-2026-102676 Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
- CVE-2026-102675 Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
- CVE-2026-102674 Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
- CVE-2026-102673 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
- CVE-2026-102672 Electron: Local race condition in Squirrel.Mac update installation on macOS
- CVE-2026-102671 Joyland AI WebView accepts invalid SSL certificates
- CVE-2026-102670 Joyland AI enables HTTP
- CVE-2026-10267 janet-lang janet debug.c doframe out-of-bounds
- CVE-2026-102669 Joyland AI hostname checking disabled
- CVE-2026-102668 Joyland AI accepts TLS certificates without validation
- CVE-2026-102667 Joyland AI WebView command injection
- CVE-2026-102666 Joyland AI hard-coded credentials for push notifications
- CVE-2026-102663 OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search
- CVE-2026-10265 itsourcecode Content Management System edit_topic.php sql injection
- CVE-2026-102649 Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset
- CVE-2026-10264 lharries whatsapp-mcp Send API Endpoint main.go SendMessageRequest path traversal
- CVE-2026-102639 MobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB Deserialization
- CVE-2026-102638 Electronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
- CVE-2026-102637 Fusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
- CVE-2026-102636 Design Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
- CVE-2026-102635 ImageMagick before 7.1.2-32 and 6.9.13-57 Uninitialized Heap Memory Disclosure in GIF Decoder
- CVE-2026-102634 SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room
- CVE-2026-102633 libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc
- CVE-2026-102631 authd: Account takeover via username fallback in identity matching after IdP email reassignment
- CVE-2026-102630 UnoPim 2.0.0 before 2.0.1 and 2.1.0 before 2.1.1 Cache Poisoning via X-Forwarded-Host
- CVE-2026-10263 SourceCodester Computer Repair Shop Management System manage_product.php sql injection
- CVE-2026-102628 Cadmos LTI exposure of sensitive information via debug mode
- CVE-2026-102627 Security Vulnerability identified in IBM TRIRIGA - Zip Slip
- CVE-2026-102626 LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute
- CVE-2026-102623 Kubevirt: kubevirt: virt-controller nil-pointer dereference via malformed ephemeral volume
- CVE-2026-102621 Freedesktop Poppler SplashClip.cc clipToPath integer overflow
- CVE-2026-102620 Freedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflow
- CVE-2026-10262 code-projects Real State Services Login loginuser.php sql injection
- CVE-2026-102616 risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection
- CVE-2026-10261 CodeAstro Online Job Portal application_status.php sql injection
- CVE-2026-102608 ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)
- CVE-2026-102607 ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
- CVE-2026-102603 Gotify: Insufficiently Protected Password Change endpoint
- CVE-2026-102601 Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
- CVE-2026-102600 Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
- CVE-2026-10260 CodeAstro Online Job Portal delete-jobs.php sql injection
- CVE-2026-102599 Socket.IO: Engine.IO Protocol Revision Mismatch DoS
- CVE-2026-102598 Werkzeug safe_join() allows Windows special device names
- CVE-2026-102596 Nango: Production flow RBAC bypass on private flow-read routes
- CVE-2026-102590 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-10259 H3C Magic B0 aspForm SetMobileAPInfoById stack-based overflow
- CVE-2026-102588 Moodle: csrf in xml grade import
- CVE-2026-102587 Moodle: user list filters bypass profile field visibility
- CVE-2026-102586 Moodle: xss via password reset link due to insufficient username escaping