Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 985 of 1013.
- CVE-2026-102585 Moodle: group validation missing when enrolling user to course
- CVE-2026-102584 Moodle: missing capability check allows unauthorised grade penalty recalculation
- CVE-2026-102583 Moodle: incorrect capability check in ai generate image web service
- CVE-2026-102582 Moodle: manual enrolment page accessible when plugin disabled
- CVE-2026-102581 Moodle: xss in forum post templates due to insufficient escaping
- CVE-2026-102580 Moodle: arbitrary class instantiation via report builder audience classname
- CVE-2026-10258 itsourcecode Content Management System add_sub_topic.php sql injection
- CVE-2026-102579 Moodle: user profile information disclosure via grade web service
- CVE-2026-102578 Moodle: sql injection in question bank web service
- CVE-2026-102577 Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass
- CVE-2026-102576 Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page
- CVE-2026-102570 ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter
- CVE-2026-10257 itsourcecode Content Management System update_ss_img.php sql injection
- CVE-2026-102569 ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter
- CVE-2026-102568 Pardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py
- CVE-2026-102567 CTranslate2 before 4.8.1 Out-of-Bounds Read via Model Deserialization
- CVE-2026-102566 CTranslate2 before 4.8.1 Heap Buffer Overflow via model.bin
- CVE-2026-102565 BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameter
- CVE-2026-102562 AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter
- CVE-2026-102560 Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth
- CVE-2026-10256 itsourcecode Content Management System save_comment.php sql injection
- CVE-2026-102559 Libsoup: libsoup: heap buffer overflow during websocket client-frame masking
- CVE-2026-102558 Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth
- CVE-2026-102557 Libsoup: libsoup: heap buffer overflow during websocket message reassembly
- CVE-2026-102556 Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion
- CVE-2026-102555 Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding
- CVE-2026-102554 Denial of Service via Eager Array Allocation During Deserialization in Guava
- CVE-2026-102552 Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver
- CVE-2026-102551 Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling
- CVE-2026-10255 SourceCodester Pharmacy Sales and Inventory System ShowForm.php sell_statement access control
- CVE-2026-10254 SourceCodester Pet Grooming Management Software admin file information disclosure
- CVE-2026-102539 Super Productivity: SuperSync E2EE setup uploads and stores all user operations in plaintext before password is set
- CVE-2026-10253 itsourcecode Online House Rental System manage_payment.php sql injection
- CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
- CVE-2026-102521 lib0 `readFromDataView` out-of-bounds read
- CVE-2026-10252 itsourcecode Online House Rental System manage_tenant.php sql injection
- CVE-2026-102514 Out-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archive
- CVE-2026-102511 Other in Apache PLC4X
- CVE-2026-102510 Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengths
- CVE-2026-10251 itsourcecode Online House Rental System ajax.php login sql injection
- CVE-2026-102509 Apache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser
- CVE-2026-102508 Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade
- CVE-2026-102507 Sliver 1.7.7 Denial of Service via PE Parser Slice Bounds in Operator RPC
- CVE-2026-102505 Memory corruption in tonycoz:imager
- CVE-2026-102504 Denial of service in tonycoz:imager
- CVE-2026-102503 Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)
- CVE-2026-102502 CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)
- CVE-2026-102501 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-10250 itsourcecode Online Blood Bank Management System campsdetails.php sql injection
- CVE-2026-1025 Cross-site scripting in Common Licensing
- CVE-2026-102499 Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action
- CVE-2026-102497 Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker
- CVE-2026-102496 Apache XMLSchema: Denial of service through deeply nested schema structures
- CVE-2026-102495 Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes
- CVE-2026-102491 mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection
- CVE-2026-102490 Zammad GmbH Zammad Improper Privilege Management
- CVE-2026-10249 itsourcecode Online Blood Bank Management System viewrequest.php sql injection
- CVE-2026-102489 Zammad GmbH Zammad Session Fixation
- CVE-2026-102488 Privilege escalation in Octopus Server
- CVE-2026-102486 Out-of-bounds Read in ntpsec
- CVE-2026-102485 Out-of-bounds Read in ntpsec
- CVE-2026-102484 Heap-based Buffer Overflow in ntpsec
- CVE-2026-102483 Reachable Assertion in ntpsec
- CVE-2026-10248 SourceCodester Pharmacy Sales and Inventory System Supplier Creation export create_supplier csv injection
- CVE-2026-102479 Other in Eclipse Vert.x
- CVE-2026-102478 Privilege escalation in Octopus Server
- CVE-2026-102477 Denial of service in Eclipse Vert.x
- CVE-2026-102476 Security feature bypass in Eclipse Vert.x
- CVE-2026-102475 Denial of service in Eclipse Vert.x
- CVE-2026-102474 Dash: dash: heap out-of-bounds write in conv_escape via undersized unicode escape reservation
- CVE-2026-102473 Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled
- CVE-2026-102471 CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages
- CVE-2026-10247 SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting
- CVE-2026-102469 Deserialization in Eclipse Vert.x
- CVE-2026-102467 Denial of service in Eclipse Vert.x
- CVE-2026-102466 Denial of service in Eclipse Vert.x
- CVE-2026-102465 Denial of service in Eclipse Vert.x
- CVE-2026-102464 Denial of service in Eclipse Vert.x
- CVE-2026-102463 Denial of service in Eclipse Vert.x
- CVE-2026-102462 Denial of service in Eclipse Vert.x
- CVE-2026-102461 Denial of service in Eclipse Vert.x
- CVE-2026-102460 Auth bypass in Eclipse Vert.x
- CVE-2026-10246 SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting
- CVE-2026-102459 DigiWin｜EasyFlow .NET - Reflected Cross-site Scripting
- CVE-2026-102458 DigiWin｜EasyFlow .NET - Missing Authentication
- CVE-2026-102457 DigiWin｜EasyFlow .NET - Arbitrary File Read
- CVE-2026-102456 DigiWin｜EasyFlow .NET - SQL Injection
- CVE-2026-102455 DigiWin｜EasyFlow .NET - Insecure Deserialization
- CVE-2026-102454 DigiWin｜EasyFlow .NET - Arbitrary File Upload
- CVE-2026-10245 SourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scripting
- CVE-2026-10244 SourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scripting
- CVE-2026-102438 Privilege escalation in Armoury Crate
- CVE-2026-102437 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix
- CVE-2026-10243 code-projects Smart Parking System Admin Endpoint missing authentication
- CVE-2026-102428 Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16
- CVE-2026-102427 Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16
- CVE-2026-102426 Cross-site scripting in SP Page Builder (Pro) extension for Joomla
- CVE-2026-102425 Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4
- CVE-2026-102424 Path traversal in Balbooa Forms extension for Joomla
- CVE-2026-102422 shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token