Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 996 of 1013.
- CVE-2026-101401 Denial of service in Siebel Apps - Marketing
- CVE-2026-101400 Denial of service in Siebel Apps - Marketing
- CVE-2026-10140 Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem
- CVE-2026-1014 IBM InfoSphere Information Server is vulnerable due to disclosure of sensitive information
- CVE-2026-101399 Denial of service in Siebel Apps - Marketing
- CVE-2026-101398 Missing authorization in Oracle Capacity
- CVE-2026-101397 Information disclosure in Siebel Apps - Marketing
- CVE-2026-101396 Missing authorization in Siebel Apps - Marketing
- CVE-2026-101395 Missing authorization in Siebel Apps - Marketing
- CVE-2026-101394 Missing authorization in Siebel Apps - Marketing
- CVE-2026-101393 Cross-site request forgery in Siebel Apps - Marketing
- CVE-2026-101392 Information disclosure in Siebel Apps - Marketing
- CVE-2026-101391 Missing authorization in Siebel Apps - Marketing
- CVE-2026-101390 Auth bypass in PeopleSoft Enterprise PeopleTools
- CVE-2026-10139 Memory corruption in Totolink
- CVE-2026-101389 Denial of service in PeopleSoft Enterprise PeopleTools
- CVE-2026-101388 Missing authorization in PeopleSoft Enterprise PeopleTools
- CVE-2026-101387 Missing authorization in Oracle Capacity
- CVE-2026-101386 Missing authorization in Oracle REST Data Services
- CVE-2026-101385 Missing authorization in Oracle REST Data Services
- CVE-2026-101384 Information disclosure in Oracle REST Data Services
- CVE-2026-101383 Missing authorization in Oracle REST Data Services
- CVE-2026-101382 Missing authorization in Oracle REST Data Services
- CVE-2026-101381 Missing authorization in Oracle REST Data Services
- CVE-2026-101380 Missing authorization in Oracle REST Data Services
- CVE-2026-10138 Command injection in Totolink
- CVE-2026-101379 Missing authorization in Oracle REST Data Services
- CVE-2026-101378 Missing authorization in Oracle REST Data Services
- CVE-2026-101377 Denial of service in Oracle REST Data Services
- CVE-2026-101376 Missing authorization in Oracle REST Data Services
- CVE-2026-101375 Missing authorization in Oracle REST Data Services
- CVE-2026-101374 Missing authorization in Oracle REST Data Services
- CVE-2026-101373 Missing authorization in Oracle REST Data Services
- CVE-2026-101372 Information disclosure in Oracle REST Data Services
- CVE-2026-101371 Other in Oracle REST Data Services
- CVE-2026-101370 Other in Oracle REST Data Services
- CVE-2026-10137 Memory corruption in Totolink
- CVE-2026-101369 Other in Oracle REST Data Services
- CVE-2026-101368 Other in Oracle REST Data Services
- CVE-2026-101367 Other in Oracle REST Data Services
- CVE-2026-101366 Information disclosure in Oracle REST Data Services
- CVE-2026-101365 Denial of service in Oracle REST Data Services
- CVE-2026-101364 Other in Oracle REST Data Services
- CVE-2026-101363 Information disclosure in Oracle REST Data Services
- CVE-2026-101362 Other in Oracle REST Data Services
- CVE-2026-101361 Other in Oracle REST Data Services
- CVE-2026-101360 Other in Oracle REST Data Services
- CVE-2026-10136 Memory corruption in Totolink
- CVE-2026-101359 Missing authorization in Oracle REST Data Services
- CVE-2026-101357 Cross-site scripting in SEOPress – AI SEO Plugin & On-site SEO
- CVE-2026-101356 Apache Tomcat: HTTP/2 request/response mix-up after error during async processing
- CVE-2026-101354 FAST FAC1203R MmtAtePrase _tWlanTask stack-based overflow
- CVE-2026-10135 Command injection in Totolink
- CVE-2026-101341 Stack overwrite from specially formatted TXT-DATA RDATA field
- CVE-2026-10134 Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows
- CVE-2026-101339 Stack overwrite from a specially crafted and formatted HIP RR
- CVE-2026-101338 Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR
- CVE-2026-101337 Stack overwrite from specially formatted base64 RDATA field
- CVE-2026-101335 Code injection in Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- CVE-2026-101333 Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint
- CVE-2026-101331 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-10133 Memory corruption in Totolink
- CVE-2026-101329 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-101324 Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter
- CVE-2026-101322 Information disclosure in Eclipse BaSyx AAS Web UI
- CVE-2026-10132 Memory corruption in Totolink
- CVE-2026-101311 Multiple vulnerabilities in bhyve device models
- CVE-2026-101310 Multiple vulnerabilities in bhyve device models
- CVE-2026-10131 Command injection in Totolink
- CVE-2026-101309 Multiple vulnerabilities in bhyve device models
- CVE-2026-101308 TOCTOU race between sound(4) buffer resizing and mmap
- CVE-2026-101307 Remotely triggerable buffer overflow in tcp_rack
- CVE-2026-101306 Multiple jail filesystem root escapes
- CVE-2026-101305 Multiple jail filesystem root escapes
- CVE-2026-101304 Multiple jail filesystem root escapes
- CVE-2026-101303 IPv6 UDP sendto(2) bypasses jail loopback restriction
- CVE-2026-101302 Remote DoS via receive-side kernel TLS
- CVE-2026-101301 WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass
- CVE-2026-101300 Server-Side Request Forgery in Wegow PDF export
- CVE-2026-10130 QueryWeaver Authentication Bypass via Email Signup Token Issuance for Existing Accounts
- CVE-2026-101296 Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
- CVE-2026-101295 Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction
- CVE-2026-101294 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step
- CVE-2026-101292 Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization
- CVE-2026-101290 CVE-2026-101290
- CVE-2026-10129 SSRF via HTTP Redirect Following in Langflow API Request Component
- CVE-2026-101288 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-101287 Authentication bypass in Stela by Diaple Networking
- CVE-2026-101283 Memory corruption in iperf3
- CVE-2026-101281 Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication
- CVE-2026-101280 Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing
- CVE-2026-10128 Langflow is affected by weaknesses in secret handling and sensitive configuration access
- CVE-2026-101279 Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow
- CVE-2026-101278 Trusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation
- CVE-2026-101277 Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source
- CVE-2026-101276 Use after free in iperf3
- CVE-2026-101274 When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the
- CVE-2026-101273 Giftcard enumeration
- CVE-2026-101272 Incorrect session validation for API-created shredder exports
- CVE-2026-101271 OAuth credentials not disabled when application is disabled