Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 999 of 1013.
- CVE-2026-100907 Eyeplus p2pcam Service snapshot information disclosure
- CVE-2026-100906 Eyeplus ONVIF Device GetUsers information disclosure
- CVE-2026-100904 amirsanni mini-inventory-and-sales-management-system Items Management Items.php cross site scripting
- CVE-2026-100903 ООО НПО Ритм GEOritm REST API obj-groups missing authentication
- CVE-2026-100902 Barco ClickShare CX-20 Gen2 Wallpaper Upload wallpaper improper validation of syntactic correctness of input
- CVE-2026-100901 athlon1600 youtube-downloader stream.php stream server-side request forgery
- CVE-2026-100900 DevaslanPHP project-management Jira Import jira-import updateJiraProjects server-side request forgery
- CVE-2026-10090 Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2.11
- CVE-2026-1009 Stored Cross-Site Scripting in Altium Live Forum Leading to Cross-Customer Data Exposure
- CVE-2026-100899 DevaslanPHP project-management Timesheet Dashboard MonthlyReport.php whereRaw sql injection
- CVE-2026-100898 DevaslanPHP project-management Timesheet Dashboard ActivitiesReport.php whereRaw sql injection
- CVE-2026-100897 fuzui StudentInfo Password Change Endpoint moditypasswordstu authorization
- CVE-2026-100896 TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection
- CVE-2026-100895 Trusted Domain Project OpenARC libopenarc arc-canon.c arc_parse_canon_t null pointer dereference
- CVE-2026-100894 mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection
- CVE-2026-100893 Privoce VoceChat Server open_graphic_parse Endpoint resource.rs fetch server-side request forgery
- CVE-2026-100892 aligungr UERANSIM nr-gnb handler.cpp ULInformationTransfer memory corruption
- CVE-2026-100891 Security feature bypass in OpenDMARC
- CVE-2026-100890 Trusted Domain Project OpenDMARC SPF Parser opendmarc_spf.c opendmarc_spf_ipv6_explode null pointer dereference
- CVE-2026-10089 Insert Pages <= 3.11.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Keys (Meta Key Names)
- CVE-2026-100889 Trusted Domain Project OpenDKIM Decoder util.c dkim_qp_decode off-by-one
- CVE-2026-100888 Trusted Domain Project OpenDKIM DKIM Signature Header Selection dkim-canon.c dkim_canon_selecthdrs out-of-bounds write
- CVE-2026-100887 amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_builder.php order_by sql injection
- CVE-2026-100886 Seetong T8108/T8108P/T8116/T8232 Debug Service improper authentication
- CVE-2026-100885 Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization
- CVE-2026-100884 Krayin laravel-crm attachment-download Endpoint acl.php resource injection
- CVE-2026-100883 Krayin laravel-crm acl.php access control
- CVE-2026-100882 Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting
- CVE-2026-100881 zhistaredu StarTraining application.yml cross site scripting
- CVE-2026-100880 zhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scripting
- CVE-2026-100879 zhistaredu StarTraining dataScope Endpoint SysRoleServiceImpl.java checkRoleAllowed authorization
- CVE-2026-100878 zhistaredu StarTraining authRole Endpoint SysUser.java SysUser.isAdmin authorization
- CVE-2026-100877 mathurvishal CloudClassroom-PHP-Project registrationform.php cross site scripting
- CVE-2026-100876 mathurvishal CloudClassroom-PHP-Project loginlinkstudent.php missing authentication
- CVE-2026-100875 mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php sql injection
- CVE-2026-100874 mathurvishal CloudClassroom-PHP-Project addnewstudent.php sql injection
- CVE-2026-100873 mathurvishal CloudClassroom-PHP-Project cross-site request forgery
- CVE-2026-100872 Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
- CVE-2026-100871 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
- CVE-2026-100870 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header
- CVE-2026-10087 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-100869 Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API
- CVE-2026-100868 Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge
- CVE-2026-100867 spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection
- CVE-2026-100866 onefetch through 2.28.1 Terminal Escape Sequence Injection
- CVE-2026-100865 Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape
- CVE-2026-100864 heym before 0.0.91 Remote Code Execution via Expression Engine
- CVE-2026-100863 Heym before 0.0.91 SSRF via image fetching and IPv6 validation
- CVE-2026-100862 heym before 0.0.91 Multiple Secrets Plaintext Storage
- CVE-2026-100861 heym before 0.0.105 SSRF via credential-controlled base URLs
- CVE-2026-100860 heym before 0.0.105 Authentication Bypass via Redis Node
- CVE-2026-10086 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-100859 Heym before 0.0.106 Credential Exfiltration via URL Override
- CVE-2026-100858 heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes
- CVE-2026-100857 AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation
- CVE-2026-100856 AzuraCast before 0.23.6 Code Injection via Remote Relay Password
- CVE-2026-100855 AzuraCast before 0.23.6 Missing Permission Check via /play
- CVE-2026-100854 AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API
- CVE-2026-100853 AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass
- CVE-2026-100852 AzuraCast before 0.23.8 Command Injection via Streamer Username
- CVE-2026-100851 AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile
- CVE-2026-100850 AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist
- CVE-2026-10085 Ordinary group/direct message member can enable group_constrained and remove all channel participants
- CVE-2026-100849 AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs
- CVE-2026-100848 AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL
- CVE-2026-100847 AzuraCast before 0.23.8 DQL Injection via sortOrder
- CVE-2026-100846 MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization
- CVE-2026-100845 MONAI before 1.6.0 Remote Code Execution via NumpyReader
- CVE-2026-100844 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id
- CVE-2026-100843 MONAI before 1.6.0 Remote Code Execution via algo_from_pickle
- CVE-2026-100842 MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains
- CVE-2026-100841 MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache
- CVE-2026-100840 MONAI through 1.6.0 Remote Code Execution via bundle configuration
- CVE-2026-100839 Contrast before 1.18.0 AML Injection Remote Code Execution
- CVE-2026-100838 Contrast before 1.19.1 CopyFile Policy Symlink Subversion
- CVE-2026-100837 Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching
- CVE-2026-100836 Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer
- CVE-2026-100835 Contrast before 1.16.0 Remote Attestation Relay Attack
- CVE-2026-100834 http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass
- CVE-2026-100833 Contrast before 1.23.1 Image Substitution via Policy Generation
- CVE-2026-100832 Use-after-free in the Graphics: Canvas2D component
- CVE-2026-100831 Use-after-free in the DOM: UI Events & Focus Handling component
- CVE-2026-100830 Mitigation bypass in the DOM: Navigation component
- CVE-2026-10083 APCu Manager < 4.5.0 - Unauthenticated Stored XSS via Cache Key Pollution
- CVE-2026-100829 Mitigation bypass in the DOM: Security component
- CVE-2026-100828 Mitigation bypass in the Bookmarks & History component
- CVE-2026-100826 Denial-of-service in the Storage: StorageManager component
- CVE-2026-100825 Use-after-free in the JavaScript Engine: JIT component
- CVE-2026-100824 Privilege escalation in the Places component
- CVE-2026-100823 Spoofing issue in the Downloads component in Firefox for Android
- CVE-2026-100822 Spoofing issue in the Networking: HTTP component
- CVE-2026-100821 Site isolation issue in the Panning and Zooming component
- CVE-2026-100820 Privilege escalation in the Address Bar component
- CVE-2026-10082 Advanced Ads – Ad Manager & AdSense < 2.0.23 - Contributor+ Stored XSS via the_ad Shortcode 'ad_args' Parameter
- CVE-2026-100819 Sandbox escape due to incorrect boundary conditions in the XPCOM component
- CVE-2026-100818 Sandbox escape due to use-after-free in the Widget: Gtk component
- CVE-2026-100817 Other issue in the JavaScript: WebAssembly component
- CVE-2026-100816 Site isolation issue in the DOM: Networking component
- CVE-2026-100815 Use-after-free in the CSS Parsing and Computation component
- CVE-2026-100814 Incorrect boundary conditions in the JavaScript Engine: JIT component