Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 987 of 1013.
- CVE-2026-10230 Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_animations heap-based overflow
- CVE-2026-1023 Gotac｜Statistics Database System - Missing Authentication
- CVE-2026-102299 Memory corruption in Chrome
- CVE-2026-102298 Insufficient Authorization and User Boundary Validation in Omada Controller MSP
- CVE-2026-102297 ZoneMinder before 1.38.4 Incorrect Authorization in frames API index
- CVE-2026-102296 ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response
- CVE-2026-102295 Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter
- CVE-2026-102294 Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration
- CVE-2026-102293 realjerrytang tacomall api-admin Backend ApiMaApplication.java OrgStaffServiceImpl.add improper authorization
- CVE-2026-102292 coolbeans1212 MateisHomePage-Website users.php cross site scripting
- CVE-2026-102291 Code injection in Kirki – Freeform Page Builder, Website Builder & Customizer
- CVE-2026-102290 CodeCanyon Rocket LMS Student Profile Image Upload cross site scripting
- CVE-2026-10229 Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_meshes heap-based overflow
- CVE-2026-102282 adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
- CVE-2026-102281 Nest: Remote process termination via a deeply nested microservice message pattern
- CVE-2026-10228 raisulislamg4 student_management_system_by_php admission_form_check.php cross site scripting
- CVE-2026-102279 Laravel: XSS in Debug Page Information
- CVE-2026-102278 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
- CVE-2026-102277 brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
- CVE-2026-102276 brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
- CVE-2026-102275 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
- CVE-2026-102274 PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
- CVE-2026-102273 PyJWT accepts public JWK containers as HMAC secrets
- CVE-2026-102272 PyJWT BOM Bypass
- CVE-2026-102271 PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
- CVE-2026-102270 PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.
- CVE-2026-10227 raisulislamg4 student_management_system_by_php User Creation add_user_check.php sql injection
- CVE-2026-102269 PyJWT: Non-canonical signature segments enable raw-token revocation bypass
- CVE-2026-102268 PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
- CVE-2026-102267 PyJWT: PyJWKClient follows redirects when fetching JWKS
- CVE-2026-102266 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
- CVE-2026-102265 PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
- CVE-2026-102264 mwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scripting
- CVE-2026-102263 mwasikz robo-cafe-rms manage-food.php unrestricted upload
- CVE-2026-102262 Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control
- CVE-2026-102261 owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization
- CVE-2026-102260 Nomad vulnerable to cross-namespace information disclosure in multiple endpoints
- CVE-2026-10226 raisulislamg4 student_management_system_by_php delete.php sql injection
- CVE-2026-102258 Cross-site scripting in SMA1000
- CVE-2026-102257 Path traversal in SMA1000
- CVE-2026-102256 Command injection in SMA1000
- CVE-2026-102255 Server-side request forgery in SMA1000
- CVE-2026-102253 iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS
- CVE-2026-102252 Path Traversal in VMDK Extractor in OSV-SCALIBR
- CVE-2026-102251 SQL injection in Abandoned Cart Pro for WooCommerce
- CVE-2026-102250 Security feature bypass in Sage RTU 1410
- CVE-2026-10225 raisulislamg4 student_management_system_by_php Login login_check.php sql injection
- CVE-2026-102249 REBUILD file-editor-save authorization
- CVE-2026-102248 Rebuild Login Endpoint login improper authentication
- CVE-2026-102247 FastAdmin Database Management database.php unnecessary privileges
- CVE-2026-102245 MODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication
- CVE-2026-102244 MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery
- CVE-2026-102243 MODSetter SurfSense MCP Connector Integration test command injection
- CVE-2026-102242 Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases
- CVE-2026-102241 Netcore NAP930 Backup/Restore backup_common.sh hard-coded key
- CVE-2026-102240 Netcore NAP930 Network Tools CGI network_tools eval os command injection
- CVE-2026-10224 NousResearch hermes-agent Webhook Endpoint feishu.py _handle_webhook_request resource consumption
- CVE-2026-102238 Visual Studio Code Remote Code Execution Vulnerability
- CVE-2026-102235 Visual Studio Code Remote Code Execution Vulnerability
- CVE-2026-102234 Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-102233 Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-102232 Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-102231 Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-10223 NousResearch hermes-agent memory_tool.py _scan_memory_content injection
- CVE-2026-102229 Visual Studio Code Information Disclosure Vulnerability
- CVE-2026-102227 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
- CVE-2026-102226 Dynamics Business Central Elevation of Privilege Vulnerability
- CVE-2026-102225 Windows Text Shaping Remote Code Execution Vulnerability
- CVE-2026-102221 Secure Boot Security Feature Bypass Vulnerability
- CVE-2026-102220 Windows VHD miniport driver Elevation of Privilege Vulnerability
- CVE-2026-10222 NousResearch hermes-agent config.py _sanitize_env_lines injection
- CVE-2026-102218 Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
- CVE-2026-102217 WebDAV Elevation of Privilege Vulnerability
- CVE-2026-102216 Windows StateRepository API Elevation of Privilege Vulnerability
- CVE-2026-102215 Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
- CVE-2026-102214 Windows Hyper-V Remote Code Execution Vulnerability
- CVE-2026-102211 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
- CVE-2026-102210 Windows Text Shaping Remote Code Execution Vulnerability
- CVE-2026-10221 NousResearch hermes-agent run_agent.py _compress_context injection
- CVE-2026-102209 Microsoft Graphics Component Elevation of Privilege Vulnerability
- CVE-2026-102208 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
- CVE-2026-102207 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-102206 Windows Portable Device MTP Driver Elevation of Privilege Vulnerability
- CVE-2026-102205 Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
- CVE-2026-102204 Windows Subsystem for Linux Elevation of Privilege Vulnerability
- CVE-2026-102203 RPC Runtime Remote Code Execution Vulnerability
- CVE-2026-102202 Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability
- CVE-2026-102201 Microsoft Windows Media Foundation Elevation of Privilege Vulnerability
- CVE-2026-10220 NousResearch hermes-agent skills_tool.py skill_view injection
- CVE-2026-1022 Gotac｜Statistics Database System - Arbitrary File Read
- CVE-2026-102199 Microsoft Windows Codecs Library Denial of Service Vulnerability
- CVE-2026-102198 Windows Remote Desktop Protocol Information Disclosure Vulnerability
- CVE-2026-102197 Windows Broadcast DVR User Service Elevation of Privilege Vulnerability
- CVE-2026-102196 Windows Broadcast DVR User Service Elevation of Privilege Vulnerability
- CVE-2026-102195 Windows Broadcast DVR User Service Elevation of Privilege Vulnerability
- CVE-2026-102194 Windows Graphics Kernel Elevation of Privilege Vulnerability
- CVE-2026-102193 Windows Broadcast DVR User Service Elevation of Privilege Vulnerability
- CVE-2026-102192 Windows Failover Cluster Denial of Service Vulnerability
- CVE-2026-102191 Windows Storage Elevation of Privilege Vulnerability
- CVE-2026-10219 nextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injection