Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 997 of 1013.
- CVE-2026-101270 HTML injection
- CVE-2026-10127 Edimax BR-6478AC POST Request formStaDrvSetup command injection
- CVE-2026-101269 Incorrect session validation for API-uploaded files
- CVE-2026-101268 Customer session fixation
- CVE-2026-101267 Revenue information leak
- CVE-2026-101266 Checkout validation bypass
- CVE-2026-101265 Intelbras TIP 125i Básico sensitive information in source
- CVE-2026-101264 Ziroom ZHOME A0101 set_passwd command injection
- CVE-2026-101263 Ziroom ZHOME A0101 set_online_client command injection
- CVE-2026-101262 Ziroom ZHOME A0101 set_online_client command injection
- CVE-2026-101261 Ziroom ZHOME A0101 firstSetup_wifi command injection
- CVE-2026-101260 Ziroom ZHOME A0101 firstLogin command injection
- CVE-2026-10126 Edimax BR-6478AC POST Request formQoS buffer overflow
- CVE-2026-101259 Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions
- CVE-2026-101258 Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free
- CVE-2026-10125 Edimax BR-6478AC POST Request formPPPoESetup stack-based overflow
- CVE-2026-10124 Shibby Tomato Zserv ripd rip_zebra_read_ipv4 stack-based overflow
- CVE-2026-10123 TRENDnet TEW-432BRP formSetDomainFilter stack-based overflow
- CVE-2026-10122 TRENDnet TEW-432BRP formSetProtocolFilter stack-based overflow
- CVE-2026-101217 Path traversal in Unisphere for PowerMax vApp
- CVE-2026-101216 Command injection in Unisphere for PowerMax vApp
- CVE-2026-101215 Command injection in Unisphere for PowerMax vApp
- CVE-2026-10121 TRENDnet TEW-432BRP formSetUrlFilter stack-based overflow
- CVE-2026-101207 Command injection in OpenManage Integration
- CVE-2026-101205 FastStone Image Viewer PCX Decoder out-of-bounds
- CVE-2026-101204 FastStone Image Viewer TGA Image FSViewer.exe out-of-bounds
- CVE-2026-101203 FastStone Image Viewer 1bpp RLE Decoder out-of-bounds write
- CVE-2026-101202 FastStone Image Viewer TGA Image out-of-bounds write
- CVE-2026-101201 QBinaryJson::fromBinaryData() integer overflow leading to OOB read
- CVE-2026-10120 TRENDnet TEW-432BRP formSetFirewallRule stack-based overflow
- CVE-2026-10119 TRENDnet TEW-432BRP formSetMACFilter stack-based overflow
- CVE-2026-101188 Netcore POWER13 ubus routerd.passwd_set password recovery
- CVE-2026-101187 Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop_usb_device command injection
- CVE-2026-10118 Integer overflow in Red Hat AI Inference Server 3.3
- CVE-2026-10117 Open5GS nghttp2-server.c ogs_pool_id_calloc denial of service
- CVE-2026-101169 Deserialization in Octopus Server
- CVE-2026-101168 Insertion of Sensitive Information into Log File in GitLab
- CVE-2026-101162 WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings
- CVE-2026-101161 WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode
- CVE-2026-101160 WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating
- CVE-2026-10116 Open5GS ue-authentications Endpoint ogs-timer.c ogs_sbi_xact_add denial of service
- CVE-2026-101159 WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission
- CVE-2026-101158 Security Advisory 0185
- CVE-2026-101157 Security Advisory 0192
- CVE-2026-101156 Security Advisory 0192
- CVE-2026-101155 Security Advisory 0189
- CVE-2026-101154 Security Advisory 0189
- CVE-2026-101153 Security Advisory 0188
- CVE-2026-101152 Security Advisory 0187
- CVE-2026-101151 Security Advisory 0187
- CVE-2026-101150 Security Advisory 0186
- CVE-2026-10115 Open5GS Shared NF-profile nnrf-handler.c denial of service
- CVE-2026-101149 Security Advisory 0186
- CVE-2026-101148 BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key
- CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF
- CVE-2026-101146 Eleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAudit information disclosure
- CVE-2026-101145 Eleveo Call Recording Software User Management userAddAction.do ldap injection
- CVE-2026-101144 Eleveo Call Recording Software Query Builder searchAction.do access control
- CVE-2026-101143 Eleveo Quality Management QMBODownload information disclosure
- CVE-2026-101142 Eleveo Quality Management Questionnaire Audio Upload Scorecard.jsp path traversal
- CVE-2026-101141 Eleveo Call Recording Software Play Audio audio.jsp cross site scripting
- CVE-2026-10114 Open5GS Shared NF-profile nnrf-handler.c handle_scp_info out-of-bounds write
- CVE-2026-101139 Webkul Bagisto Invoice Mass Status Update state authorization
- CVE-2026-101138 CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist
- CVE-2026-101132 DeepSeek deepseek-harness Bundle Patch profile.ts loadProfile path traversal
- CVE-2026-101131 deepseek-ai deepseek-harness dsh index.ts reliance on untrusted inputs in a security decision
- CVE-2026-101130 Memory corruption in affinity
- CVE-2026-10113 Open5GS Shared NF-profile nnrf-handler.c denial of service
- CVE-2026-101127 Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4
- CVE-2026-101126 Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4
- CVE-2026-10112 sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scripting
- CVE-2026-101112 Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4
- CVE-2026-101111 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6
- CVE-2026-101110 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6
- CVE-2026-10111 sambitraj STUDENT-MANAGEMENT-SYSTEM Login Page sql injection
- CVE-2026-101109 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8
- CVE-2026-101108 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8
- CVE-2026-101105 code-projects Matrimonial System Profile Creation Endpoint create_profile processprofile_form sql injection
- CVE-2026-101104 Missing Authorization in Meari IoT Cloud Platform OpenAPI Service
- CVE-2026-101103 HMS Networks PEAK-System PCAN Windows drivers Classic Buffer Overflow
- CVE-2026-101102 deepseek-ai deepseek-harness Code Mode Sandbox run_code sandbox
- CVE-2026-101101 ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception
- CVE-2026-101100 ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup
- CVE-2026-10110 code-projects Student Details Management System index.php sql injection
- CVE-2026-1011 Stored Cross-Site Scripting in Altium Live Support Center Comment Endpoint
- CVE-2026-101099 ag-ui-protocol ag-ui Kotlin Community SDK SseParser.kt exceptional condition
- CVE-2026-101098 ag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumption
- CVE-2026-101094 Memory corruption in affinity
- CVE-2026-101093 Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion
- CVE-2026-101092 SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages
- CVE-2026-101091 SiYuan before v3.8.4 SQL Injection via Block Query Embed
- CVE-2026-101090 Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri
- CVE-2026-10109 IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling
- CVE-2026-101089 Nezha before 2.2.7 Information Disclosure via /api/v1/profile
- CVE-2026-101088 Nezha before 2.3.1 Denial of Service via Concurrent Server Delete
- CVE-2026-101087 Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6
- CVE-2026-101086 Nezha Dashboard before 2.3.5 Task Type Validation Bypass
- CVE-2026-101085 Nezha before 2.3.8 Denial of Service via Alert Rule
- CVE-2026-101084 obot before v0.21.1 Authorization Bypass via /mcp-connect
- CVE-2026-101083 PMWeb encryptionhelper.dll information disclosure