Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 316 of 1013.
- CVE-2026-84380 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
- CVE-2026-8438 All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path
- CVE-2026-84379 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
- CVE-2026-84378 HTTPX2: Quadratic SSE line buffering can cause CPU denial of service
- CVE-2026-84377 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
- CVE-2026-84376 Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
- CVE-2026-84375 js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
- CVE-2026-84374 Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path
- CVE-2026-84373 Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
- CVE-2026-84372 Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
- CVE-2026-84371 ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
- CVE-2026-84370 SVGO: removeScripts allows executable links through namespace and control-character bypasses
- CVE-2026-84369 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
- CVE-2026-84368 joi: Prototype pollution via a `__proto__` language key in custom messages
- CVE-2026-84367 joi: object().rename() with a template target can set the validated object's prototype
- CVE-2026-84366 Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default
- CVE-2026-84365 Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory
- CVE-2026-84364 Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
- CVE-2026-84363 Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
- CVE-2026-84361 Composer: Perforce source URL permits P4PORT `rsh:` command execution
- CVE-2026-84360 Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
- CVE-2026-84359 Information disclosure in Chrome
- CVE-2026-84358 Privilege escalation in Chrome
- CVE-2026-84357 Security feature bypass in Chrome
- CVE-2026-84356 Other in Chrome
- CVE-2026-84355 Security feature bypass in Chrome
- CVE-2026-84354 Missing authorization in Chrome
- CVE-2026-84353 Use after free in Chrome
- CVE-2026-84352 Use after free in Chrome
- CVE-2026-84351 Memory corruption in Chrome
- CVE-2026-84350 Use after free in Chrome
- CVE-2026-8435 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion()
- CVE-2026-84349 Use after free in Chrome
- CVE-2026-84348 Information disclosure in Chrome
- CVE-2026-84347 Use after free in Chrome
- CVE-2026-8434 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple()
- CVE-2026-84335 Missing authorization in Chrome
- CVE-2026-84334 Missing authorization in Chrome
- CVE-2026-84333 Use after free in Chrome
- CVE-2026-84332 Security feature bypass in Chrome
- CVE-2026-84331 Security feature bypass in Chrome
- CVE-2026-84330 Other in Chrome
- CVE-2026-8433 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan()
- CVE-2026-84329 Information disclosure in Chrome
- CVE-2026-84328 Missing authorization in Chrome
- CVE-2026-84327 Missing authorization in Chrome
- CVE-2026-84326 Memory corruption in Chrome
- CVE-2026-84325 Security feature bypass in Chrome
- CVE-2026-84324 Use after free in Chrome
- CVE-2026-84323 Missing authorization in Chrome
- CVE-2026-84321 Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
- CVE-2026-84320 Nginx UI: Auto backup name allows path traversal outside validated storage path
- CVE-2026-8432 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star()
- CVE-2026-84319 Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
- CVE-2026-84318 Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
- CVE-2026-84317 Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
- CVE-2026-84316 Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
- CVE-2026-84315 Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
- CVE-2026-84314 Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint
- CVE-2026-84313 Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
- CVE-2026-84312 Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
- CVE-2026-84311 pypdf: Possible long runtimes/large memory usage when extracting XForm objects
- CVE-2026-84310 pypdf: Possible long runtimes/large memory usage when retrieving outlines
- CVE-2026-8431 Ops Manager RCE via webhook body
- CVE-2026-84309 pypdf: Possible infinite loop for TreeObject.insert_child
- CVE-2026-84308 phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery
- CVE-2026-84307 Filament: Password validity disclosure for accounts denied panel access on login page
- CVE-2026-84306 Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used
- CVE-2026-84305 sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
- CVE-2026-84304 gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
- CVE-2026-84303 gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
- CVE-2026-84302 Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables
- CVE-2026-84301 FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests
- CVE-2026-8430 SPIP < 4.4.14 Remote Code Execution via nginx
- CVE-2026-84298 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher
- CVE-2026-84296 SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server
- CVE-2026-84295 Improper Authentication in Progress WS_FTP Server
- CVE-2026-84294 Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server
- CVE-2026-84293 Cross-site scripting in Repeater Fields for Gravity Forms
- CVE-2026-84292 fast-uri vulnerable to authority injection via an unvalidated port in serialize
- CVE-2026-84290 Security vulnerability affects the Windows S-TAP component as part of IBM Guardium Data Protection
- CVE-2026-8429 SPIP < 4.4.14 Remote Code Execution via Private Space
- CVE-2026-84289 NousResearch hermes-agent MCP Tool mcp_tool.py list_tools memory allocation
- CVE-2026-84288 NousResearch hermes-agent ACP Prompt Workflow session.py HermesACPAgent.prompt denial of service
- CVE-2026-84287 NousResearch hermes-agent Session Chat api_server.py denial of service
- CVE-2026-84286 OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table
- CVE-2026-84285 OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5
- CVE-2026-84284 Incorrect Authorization in GitLab
- CVE-2026-84283 FluteCode Secure Folder 1.2 -Plaintext vault files in shared storage bypass the PIN gate
- CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)
- CVE-2026-84281 Cross-site scripting in Fancy Product Designer
- CVE-2026-84280 Cross-site scripting in Fancy Product Designer
- CVE-2026-8428 CSRF token is not validated in the core CMS update controller for Concrete CMS 9.5.0 and below
- CVE-2026-84279 Cross-site scripting in Fancy Product Designer
- CVE-2026-84278 IBM Guardium Data Protection Command Injection
- CVE-2026-84276 IBM Guardium Data Protection Denial of Service
- CVE-2026-84275 IBM Guardium Data Protection Path Traversal
- CVE-2026-84274 IBM Guardium Data Protection Information Disclosure
- CVE-2026-84272 IBM Guardium Data Protection Missing Authentication
- CVE-2026-84271 IBM Guardium Data Protection Signature Verification Bypass