Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 998 of 1013.
- CVE-2026-101082 PMWeb downloader.aspx path traversal
- CVE-2026-101081 D-Link DI-8400 Web Administration Service menu_nat_more.asp menu_nat_more_asp stack-based overflow
- CVE-2026-101080 Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal
- CVE-2026-10108 xiaomusic 0.5.7 Path Traversal via GET /music endpoint
- CVE-2026-101079 agentverus agentverus-scanner context.js isSecurityDefenseSkill reliance on untrusted inputs in a security decision
- CVE-2026-101078 deepseek-ai deepseek-harness Landlock Backend profiles.ts isolation
- CVE-2026-101077 Netcore NR289-GE boa_temp process_request missing authentication
- CVE-2026-101076 Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection
- CVE-2026-101075 Netcore NR289-GE Location Time location_time.cgi system os command injection
- CVE-2026-101074 Netcore NR289-GE Authentication boa password-check stack-based overflow
- CVE-2026-101073 Netcore NR289-GE CGI Dispatcher boa improper authentication
- CVE-2026-101072 Netcore NR289-GE CGI ap_ip.cgi system os command injection
- CVE-2026-101071 Acrel Electric Unet Web Service Upload Endpoint upload unrestricted upload
- CVE-2026-101070 dbgate Files Endpoint runners.js files path traversal
- CVE-2026-10107 MoviePilot v2 SSRF via /api/v1/system/img/{proxy} Endpoint
- CVE-2026-101069 dbgate Export databaseConnections.js exportModelSql path traversal
- CVE-2026-101068 dbgate Create Connection Endpoint zipJsonLinesData.js zipJsonLinesData path traversal
- CVE-2026-101067 dbgate save-uploaded-file Endpoint files.js saveUploadedFile path traversal
- CVE-2026-101066 dbgate Archive Link Creation archive.js createLink path traversal
- CVE-2026-101065 Obot Quickstart Docker Deployment Unauthenticated Admin Access
- CVE-2026-101064 Obot before v0.23.0 Server-Side Request Forgery via MCP
- CVE-2026-101063 Obot before v0.23.0 Authentication Bypass via Registry API
- CVE-2026-101062 Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration
- CVE-2026-101061 utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass
- CVE-2026-101060 python-utcp before 1.1.4 SSRF via unvalidated HTTP redirects
- CVE-2026-10106 Missing authorization in Mattermost
- CVE-2026-101059 utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass
- CVE-2026-101058 python-utcp before 1.1.12 SSRF via Remote HTTP Manual
- CVE-2026-101057 utcp-mcp before 1.1.3 SSRF via unvalidated MCP server URL
- CVE-2026-101056 Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint
- CVE-2026-101055 Thinkware U3000 TCP Service GET_STATUS information disclosure
- CVE-2026-101054 Thinkware U3000 TCP Service wpa_supplicant.conf get_file access control
- CVE-2026-101053 Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control
- CVE-2026-101052 refly-ai refly JWT Token app.config.ts hard-coded credentials
- CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download
- CVE-2026-101050 Heym before 0.0.53 Authentication Bypass via Telegram Webhook
- CVE-2026-10105 agno 2.6.5 SQL Injection via ClickHouse delete_by_metadata()
- CVE-2026-101049 Heym before 0.0.53 Slack Webhook Signature Verification Bypass
- CVE-2026-101048 Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope
- CVE-2026-101047 Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs
- CVE-2026-101046 Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints
- CVE-2026-101045 Fleet Homebrew Cask OS Command Injection via Metadata
- CVE-2026-101044 pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias
- CVE-2026-101043 pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings
- CVE-2026-101042 Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity
- CVE-2026-101041 Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover
- CVE-2026-101040 Ricoh SP 330DN/SP 221/SP C252SF/Aficio SP 3500SF HTTP Multipart Form-Data denial of service
- CVE-2026-10104 Cross-site scripting in Product Video Gallery for Woocommerce
- CVE-2026-101039 FAST FAC1900R devdiscover Service copy_msg_element stack-based overflow
- CVE-2026-101038 FAST FAC1200R MmtAtePrase stack-based overflow
- CVE-2026-101037 FAST FAC1200R devdiscover Service parse_advertisement_frame stack-based overflow
- CVE-2026-101036 FLB-Music FLB-Music-Player createParsedTrack.ts path.join path traversal
- CVE-2026-101035 aligungr UERANSIM nr-gnb encode.cpp DecodePlainMmMessage uncaught exception
- CVE-2026-101034 Security Advisory for offline recovery of Symantec GSS 3.3 RU11 stored domain credentials
- CVE-2026-101033 KitchenOwl through 0.7.10 IDOR via unchecked category ID
- CVE-2026-101032 navi through 2.24.0 OS Command Injection via Cheatsheet Variables
- CVE-2026-10103 Missing authorization in Mattermost
- CVE-2026-101029 Gitea migration and pull mirror SSRF through multi-answer DNS
- CVE-2026-101028 Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts
- CVE-2026-101027 Gitea migration SSRF through ALLOWED_DOMAINS address check bypass
- CVE-2026-101025 NGINX ngx_http_js_module vulnerability
- CVE-2026-101024 Satel Netco Design Relative path traversal
- CVE-2026-101023 Gitea OAuth2 refresh token grant accepts access tokens
- CVE-2026-101022 Grid Protection Alliance openPDC and openHistorian Server-Side Request Forgery (SSRF)
- CVE-2026-101021 J4Care dcm4che Inefficient Algorithmic Complexity
- CVE-2026-101020 Privilege escalation in AssetView
- CVE-2026-101019 NGINX ngx_http_js_module vulnerability
- CVE-2026-101018 dayrui XunruiCMS Group Editing Home.php group_all_edit sql injection
- CVE-2026-101017 Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition
- CVE-2026-101016 Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional condition
- CVE-2026-101015 Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input
- CVE-2026-101014 Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one
- CVE-2026-101013 mathurvishal CloudClassroom-PHP-Project updateresultdetails.php sql injection
- CVE-2026-101012 mathurvishal CloudClassroom-PHP-Project makeresult.php sql injection
- CVE-2026-101011 aaPanel BaoTa Domain domainMod.py get_domain_status sql injection
- CVE-2026-101010 aaPanel BaoTa data.py getData sql injection
- CVE-2026-10101 Assisted-service: assisted-service: infraenv status leaks referenced pull-secret contents to namespace view users
- CVE-2026-101009 aaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injection
- CVE-2026-101008 aaPanel BaoTa File Merge files.py merge_split_file command injection
- CVE-2026-101007 aaPanel BaoTa Database Backup database.py InputSql os command injection
- CVE-2026-101006 Frappe HR Permission Validation __init__.py get_attendance_requests authorization
- CVE-2026-101005 October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery
- CVE-2026-101004 notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication
- CVE-2026-101003 Cesanta Mongoose MQTT Broker main.c fn stack-based overflow
- CVE-2026-101002 Netcore NBR200V2 Tools Ping network_tools system os command injection
- CVE-2026-101001 Netcore NBR200V2 Web Management network_tools eval os command injection
- CVE-2026-101000 Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization
- CVE-2026-10100 Simple Custom Login Page <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting
- CVE-2026-1010 Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalation
- CVE-2026-10099 XX-Net V5.16.6 WebSocket Frame Parsing Data Corruption via simple_http_server.py
- CVE-2026-10098 OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status
- CVE-2026-10097 ML-KEM-1024 x64 AVX2 incomplete cipher text comparison enables IND-CCA2 break and static private-key recovery
- CVE-2026-10096 Missing authorization in Qi Blocks
- CVE-2026-10095 Cross-site scripting in WP Photo Album Plus
- CVE-2026-10094 Path traversal in SOLIDWORKS Visualize
- CVE-2026-10093 Cross-site scripting in Secure Client Portal and Private File Sharing Plugin – User Private Files
- CVE-2026-10092 Cross-site scripting in Cincopa video and media plug-in
- CVE-2026-10091 Email JavaScript Cloak <= 1.03 - Unauthenticated Stored Cross-Site Scripting
- CVE-2026-100909 OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery
- CVE-2026-100908 Eyeplus p2pcam HTTP stack-based overflow