Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 1001 of 1013.
- CVE-2026-100710 Froxlor before 2.3.12 DKIM Private Key Disclosure via API
- CVE-2026-10071 Interinfo｜DreamMaker - Arbitrary File Upload
- CVE-2026-100709 Froxlor before 2.3.11 2FA Bypass via Namespace Confusion
- CVE-2026-100708 Froxlor before 2.3.13 Private Key Disclosure via Certificates API
- CVE-2026-100707 Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path
- CVE-2026-100706 kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath
- CVE-2026-100705 Kyverno before 1.19.1 SSRF via legacy apiCall service executor
- CVE-2026-100704 Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass
- CVE-2026-100703 Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib
- CVE-2026-100702 Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays
- CVE-2026-100701 Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion
- CVE-2026-100700 nodemailer before 10.0.6 Denial of Service via addressparser
- CVE-2026-10070 macrozheng mall Super Admin Password update improper authorization
- CVE-2026-1007 Security feature bypass in Server
- CVE-2026-100699 Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment
- CVE-2026-100698 Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex
- CVE-2026-100697 Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver
- CVE-2026-100696 Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver
- CVE-2026-100695 Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE
- CVE-2026-100694 Hugo before 0.166.0 Cross-Site Scripting via text/org
- CVE-2026-100693 Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
- CVE-2026-100692 Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots
- CVE-2026-100691 Hugo before 0.166.0 Stored XSS via lineAnchors code block option
- CVE-2026-100690 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks
- CVE-2026-10069 Shibby Tomato miniupnpd resource consumption
- CVE-2026-100689 GitPython before 3.1.62 Path Traversal via gitmodules path
- CVE-2026-100688 Budibase server before 3.45.0 Cross-Tenant Information Disclosure
- CVE-2026-100687 Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast
- CVE-2026-100686 Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps
- CVE-2026-100685 Budibase before 3.45.0 Information Disclosure via Chat Links
- CVE-2026-100684 Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC
- CVE-2026-100683 Budibase before 3.45.0 SQL Injection via column-rename DDL
- CVE-2026-100682 Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink
- CVE-2026-100681 Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook
- CVE-2026-100680 Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import
- CVE-2026-10068 Shibby Tomato SUBSCRIBE Call miniupnpd send server-side request forgery
- CVE-2026-100679 stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket
- CVE-2026-100678 stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting
- CVE-2026-100677 stoatchat before 0.15.5 Account Enumeration via Error Location
- CVE-2026-100676 stoatchat before 0.15.5 Local Filesystem Read via SVG
- CVE-2026-100675 stoatchat before 0.15.5 Denial of Service via mass mentions
- CVE-2026-100674 stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization
- CVE-2026-100673 Grav Data Manager before 1.4.5 Stored XSS via item-detail view
- CVE-2026-100672 grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure
- CVE-2026-100671 Grav before 2.0.25 Session Cookie Theft via Twig Sandbox
- CVE-2026-100670 Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass
- CVE-2026-10067 Shibby Tomato multimon.cgi sub_90F0 stack-based overflow
- CVE-2026-100669 Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass
- CVE-2026-100668 Grav before 2.0.25 Sandbox Escape via array Filter
- CVE-2026-100667 grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass
- CVE-2026-100666 Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec
- CVE-2026-100665 Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass
- CVE-2026-100664 Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion
- CVE-2026-100663 Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3
- CVE-2026-100662 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS
- CVE-2026-100661 Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation
- CVE-2026-100660 Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention
- CVE-2026-10066 Shibby Tomato UPS Service tomatoups.cgi sub_9068 stack-based overflow
- CVE-2026-100659 Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass
- CVE-2026-100654 vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids
- CVE-2026-100653 vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation
- CVE-2026-100652 vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids
- CVE-2026-100651 vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass
- CVE-2026-100650 vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization
- CVE-2026-10065 Shibby Tomato tomatodata.cgi get_ups_field stack-based overflow
- CVE-2026-100649 vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass
- CVE-2026-100648 vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding
- CVE-2026-100647 vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt
- CVE-2026-100646 SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header
- CVE-2026-100645 SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban
- CVE-2026-100644 SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath
- CVE-2026-100643 SiYuan before v3.8.4 Stored XSS via Attribute View textarea
- CVE-2026-100642 SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth
- CVE-2026-100641 SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content
- CVE-2026-100640 SiYuan before v3.8.4 Clipboard Data Disclosure via IPC
- CVE-2026-10064 TRENDnet TEW-432BRP formSetPortTr stack-based overflow
- CVE-2026-100639 SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL
- CVE-2026-100638 SiYuan before v3.8.4 Path Traversal via setNotebookIcon
- CVE-2026-100637 SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID
- CVE-2026-100636 SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder
- CVE-2026-100635 SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie
- CVE-2026-100634 SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows
- CVE-2026-100633 SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations
- CVE-2026-100632 Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery
- CVE-2026-100631 Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection
- CVE-2026-100630 AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field
- CVE-2026-10063 TRENDnet TEW-432BRP formWPS stack-based overflow
- CVE-2026-100629 Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH
- CVE-2026-100628 capgo.app before 12.128.12 Authentication Bypass via apikey
- CVE-2026-100627 Capgo bundle promotion API channel RBAC deny override bypass
- CVE-2026-100626 capgo through 12.128.2 IDOR via PUT /app icon endpoint
- CVE-2026-100625 Capgo Build Upload Proxy Authorization Bypass via TUS Resource
- CVE-2026-100624 Capgo.app before 12.264.5 Upload Expiry Bypass via build upload
- CVE-2026-100623 Capgo Authentication Bypass via Direct PostgREST org_users Table Write
- CVE-2026-100622 capgo.app through 12.129.0 Cache Restoration of Deleted Bundles
- CVE-2026-100621 capgo.app Content-Lock Bypass via r2-direct Bundle Mutation
- CVE-2026-100620 Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account
- CVE-2026-10062 TRENDnet TEW-432BRP formSetRoute stack-based overflow
- CVE-2026-100619 Capgo OTA Manifest Poisoning via app_versions.manifest Bypass
- CVE-2026-100618 Capgo App Icon Update Privilege Escalation via Service-Role Worker