Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 284 of 1013.
- CVE-2026-88046 rclone: source object names can escape the configured root on upload
- CVE-2026-88045 rclone: S3 multipart declared-length memory exhaustion
- CVE-2026-88044 rclone: RC per-server auth-proxy bypass
- CVE-2026-88043 Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter
- CVE-2026-88041 Apache Tomcat: HTTP/2 trailer header cross-contamination
- CVE-2026-8804 Cleartext Storage of Sensitive Information for Puppet Resource API
- CVE-2026-88038 cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options
- CVE-2026-88037 Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title
- CVE-2026-88036 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver
- CVE-2026-88035 Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver
- CVE-2026-88034 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver
- CVE-2026-88033 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver
- CVE-2026-88032 Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver
- CVE-2026-88031 GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver
- CVE-2026-88030 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver
- CVE-2026-8803 opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash
- CVE-2026-88029 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver
- CVE-2026-88028 SQL injection in Laravel MongoDB (PHP)
- CVE-2026-88027 SQL injection in Laravel MongoDB (PHP)
- CVE-2026-88026 Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver
- CVE-2026-88025 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver
- CVE-2026-88024 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver
- CVE-2026-88023 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library
- CVE-2026-88022 SQL injection in Laravel MongoDB (PHP)
- CVE-2026-88021 Consul vulnerable to an authorization bypass in the Connect service mesh
- CVE-2026-88020 Improper Neutralization of Input During Web Page Generation in OpenPLC Runtime v3
- CVE-2026-8802 opensourcepos Open Source Point of Sale Items.php getPicThumb path traversal
- CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
- CVE-2026-88017 rclone: FTP cross-session auth-proxy backend confusion
- CVE-2026-88016 rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
- CVE-2026-88015 rclone local: crafted Range request against a translated symlink panics (DoS)
- CVE-2026-88014 rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace
- CVE-2026-88013 rclone: http backend forwards custom/auth headers to a different host on redirect
- CVE-2026-88012 Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
- CVE-2026-88011 Traefik: ForwardAuth identity spoofing via dot-form header alias
- CVE-2026-88010 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
- CVE-2026-8801 File Extension Restriction Bypass in MOVEit Transfer
- CVE-2026-88009 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
- CVE-2026-88008 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
- CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse
- CVE-2026-88006 Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
- CVE-2026-88005 Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange
- CVE-2026-88004 Traefik entrypoint header-name sanitization bypassed via request trailers
- CVE-2026-88003 InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade
- CVE-2026-88002 Open WebUI: Any authenticated user can hang the server via a cyclic chat message history
- CVE-2026-88001 Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets
- CVE-2026-88000 Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree
- CVE-2026-8800 Cross-Org External Token Metadata accessible to AuditUser role
- CVE-2026-87999 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
- CVE-2026-87998 Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
- CVE-2026-87997 Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions
- CVE-2026-87996 Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
- CVE-2026-87995 Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
- CVE-2026-87994 Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
- CVE-2026-87993 Consul-template vulnerable to an information disclosure issue in error handling
- CVE-2026-87988 Path traversal in mistral-vibe
- CVE-2026-87987 Code injection in mistral-vibe
- CVE-2026-87986 Security feature bypass in mistral-vibe
- CVE-2026-87985 Security feature bypass in mistral-vibe
- CVE-2026-87984 Path traversal in mistral-vibe
- CVE-2026-87983 Path traversal in mistral-vibe
- CVE-2026-87981 Missing authorization in Paymob for WooCommerce
- CVE-2026-87980 Security vulnerability affects the UNIX S-TAP component as part of IBM Guardium Data Protection
- CVE-2026-8798 Native entropy source retries the CPU entropy instructions without limit
- CVE-2026-87979 Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via Webhook
- CVE-2026-87978 Paymob for WooCommerce < 4.1.14 - Unauthenticated Payment Bypass via Unverified Subscription Transaction Callback
- CVE-2026-87976 Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles
- CVE-2026-87975 Privilege abuse in model formsets with editable primary keys
- CVE-2026-87974 Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook
- CVE-2026-87973 If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name
- CVE-2026-87971 If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter
- CVE-2026-87970 If-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes
- CVE-2026-8797 Privilege escalation in ExpressUpdate Agent for Windows
- CVE-2026-87969 WatchGuard AP Authenticated Command Injection in Diagnostic CLI
- CVE-2026-87968 Product Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store Registration
- CVE-2026-87966 Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR
- CVE-2026-87965 Easy Appointments < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token
- CVE-2026-87963 Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter
- CVE-2026-87962 t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes
- CVE-2026-87961 ESP32-audioI2S 3.4.4 through 4.0.0 Heap-based Out-of-Bounds Read via Shadowed Length Parameter in read_ID3_Header
- CVE-2026-8796 Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input
- CVE-2026-87959 WPBot 8.7.2 - 8.7.5 - Subscriber+ Claude AI Settings Update
- CVE-2026-87958 Privilege escalation in Db2
- CVE-2026-87955 Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153
- CVE-2026-87954 Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152
- CVE-2026-87953 SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151
- CVE-2026-87952 SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150
- CVE-2026-87951 SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149
- CVE-2026-87950 SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148
- CVE-2026-8795 Code injection in Velociraptor
- CVE-2026-87949 SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147
- CVE-2026-87948 SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146
- CVE-2026-87947 SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145
- CVE-2026-87946 SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144
- CVE-2026-87945 SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143
- CVE-2026-87944 SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142
- CVE-2026-87943 SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141
- CVE-2026-87942 SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140
- CVE-2026-87941 Patreon - Critical - Unsupported - SA-CONTRIB-2026-139
- CVE-2026-87940 Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138