Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 991 of 1013.
- CVE-2026-101894 @xhmikosr/decompress: Path traversal via symlink chain
- CVE-2026-101893 Newell Brands DYMO ID document parsing failing file type extension authentication check
- CVE-2026-101891 WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access
- CVE-2026-101890 Prime Mover < 2.2.1 Stored XSS via Package Metadata
- CVE-2026-10189 Tenda W12 httpd cgiSysTimeInfoSet stack-based overflow
- CVE-2026-101889 Prime Mover < 2.2.1 Path Traversal via wprime-config.json
- CVE-2026-101888 Prime Mover < 2.2.1 Zip Slip Path Traversal File Write
- CVE-2026-101887 BlueALSA bluealsad LC3plus Decoder Division-by-Zero DoS
- CVE-2026-101886 Cisco Jabber for Android Path Traversal via Shared Content URI
- CVE-2026-101885 ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path
- CVE-2026-101884 OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override
- CVE-2026-101883 OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present
- CVE-2026-101882 OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set
- CVE-2026-101881 OpenClaw Windows Node before 2026.7.1 Denial of Service
- CVE-2026-101880 OpenClaw Windows Node before 2026.7.1 Authorization Bypass
- CVE-2026-10188 Tenda W12 httpd cgistaKickOff stack-based overflow
- CVE-2026-101879 OpenClaw Windows Node before 2026.7.1-3 Missing Authorization
- CVE-2026-101878 Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation
- CVE-2026-10187 Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow
- CVE-2026-101861 Langflow Code Execution via eval() in Component Input Schema
- CVE-2026-101860 RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management
- CVE-2026-10186 code-projects Online Hospital Management System patient.php sql injection
- CVE-2026-101859 RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection
- CVE-2026-101858 RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection
- CVE-2026-101857 Information disclosure in Oracle Order Management
- CVE-2026-101856 Information disclosure in Oracle Order Management
- CVE-2026-101855 Information disclosure in Oracle Product Hub
- CVE-2026-101854 Missing authorization in Oracle Product Hub
- CVE-2026-101853 Missing authorization in Oracle Product Hub
- CVE-2026-101852 Missing authorization in Oracle Product Hub
- CVE-2026-101851 Information disclosure in Installed Base
- CVE-2026-101850 Information disclosure in Installed Base
- CVE-2026-10185 SourceCodester Hospitals Patient Records Management System Users.php save sql injection
- CVE-2026-101849 Information disclosure in Installed Base
- CVE-2026-101847 Information disclosure in Oracle Bills of Material
- CVE-2026-101846 Information disclosure in Oracle Purchasing
- CVE-2026-101845 Information disclosure in Oracle Purchasing
- CVE-2026-101844 Information disclosure in Oracle Concurrent Processing
- CVE-2026-101843 Information disclosure in Production Scheduling
- CVE-2026-101842 Missing authorization in Strategic Network Optimization
- CVE-2026-101841 Missing authorization in Global Order Promising
- CVE-2026-101840 Missing authorization in Oracle Contract Lifecycle Management for Public Sector
- CVE-2026-10184 SourceCodester Hospitals Patient Records Management System Users.php delete sql injection
- CVE-2026-101837 Missing authorization in Oracle Shipping Execution
- CVE-2026-101836 Missing authorization in iSupplier Portal
- CVE-2026-101835 Missing authorization in Oracle Shipping Execution
- CVE-2026-101834 Missing authorization in Oracle Shipping Execution
- CVE-2026-101833 Missing authorization in Oracle Shipping Execution
- CVE-2026-101832 Missing authorization in Oracle Order Management
- CVE-2026-101831 Missing authorization in Oracle Quality
- CVE-2026-101830 Missing authorization in Oracle Project Contracts
- CVE-2026-10183 TRENDnet TEW-432BRP formWlanSetup stack-based overflow
- CVE-2026-101829 Missing authorization in Oracle Mobile Application Server
- CVE-2026-101828 Missing authorization in Oracle Mobile Application Server
- CVE-2026-101827 Missing authorization in Oracle HCM Common Architecture
- CVE-2026-101826 Missing authorization in Oracle HCM Common Architecture
- CVE-2026-101825 Missing authorization in Oracle HCM Common Architecture
- CVE-2026-101824 Missing authorization in Document Management and Collaboration
- CVE-2026-101823 Missing authorization in Oracle Bills of Material
- CVE-2026-101822 Missing authorization in Oracle Bills of Material
- CVE-2026-101821 Missing authorization in Oracle Compensation Workbench
- CVE-2026-101820 Missing authorization in Oracle General Ledger
- CVE-2026-10182 TRENDnet TEW-432BRP formWlanSetup command injection
- CVE-2026-101819 Missing authorization in Oracle General Ledger
- CVE-2026-101818 Missing authorization in Oracle Product Hub
- CVE-2026-101816 Missing authorization in Oracle Product Hub
- CVE-2026-101815 Missing authorization in Assets
- CVE-2026-101814 Missing authorization in Oracle Engineering
- CVE-2026-101813 Missing authorization in Oracle Engineering
- CVE-2026-101812 Missing authorization in Oracle Complex Maintenance, Repair and Overhaul
- CVE-2026-101810 Denial of service in MySQL Router
- CVE-2026-10181 TRENDnet TEW-432BRP formSysCmd stack-based overflow
- CVE-2026-101809 Missing authorization in Workflow
- CVE-2026-101808 Auth bypass in Oracle Product Workbench
- CVE-2026-101807 Missing authorization in Oracle Communications Billing and Revenue Management
- CVE-2026-101806 Missing authorization in MySQL Connectors
- CVE-2026-101805 Missing authorization in Oracle Applications Manager
- CVE-2026-101804 Denial of service in MySQL Connectors
- CVE-2026-101803 Other in MySQL Cluster
- CVE-2026-101802 Denial of service in MySQL Cluster
- CVE-2026-101801 Denial of service in MySQL Cluster
- CVE-2026-101800 Missing authorization in MySQL Cluster
- CVE-2026-10180 TRENDnet TEW-432BRP formSysCmd command injection
- CVE-2026-101799 Denial of service in MySQL Cluster
- CVE-2026-101798 Denial of service in MySQL Cluster
- CVE-2026-101797 Other in MySQL Cluster
- CVE-2026-101796 Other in MySQL Cluster
- CVE-2026-101795 Other in MySQL Cluster
- CVE-2026-101794 Denial of service in MySQL Cluster
- CVE-2026-101793 Missing authorization in Oracle Communications BRM - Elastic Charging Engine
- CVE-2026-101792 Missing authorization in Oracle Communications BRM - Elastic Charging Engine
- CVE-2026-101791 Missing authorization in Oracle Communications BRM - Elastic Charging Engine
- CVE-2026-101790 Missing authorization in Oracle Communications BRM - Elastic Charging Engine
- CVE-2026-10179 TRENDnet TEW-432BRP formSetWlanEncrypt stack-based overflow
- CVE-2026-101789 Denial of service in MySQL Cluster
- CVE-2026-101788 Denial of service in MySQL Cluster
- CVE-2026-101787 Denial of service in MySQL Cluster
- CVE-2026-101786 Other in MySQL Cluster
- CVE-2026-101785 Missing authorization in MySQL Cluster
- CVE-2026-101784 Denial of service in MySQL Cluster