Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 334 of 1013.
- CVE-2026-82397 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
- CVE-2026-82396 Sulu: Stored XSS via media download inline-disposition override
- CVE-2026-82395 Sulu: Media move/update authorization bypass (IDOR)
- CVE-2026-82394 Sulu: Fix authorization bypass when creating preview links
- CVE-2026-82393 pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
- CVE-2026-82392 pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
- CVE-2026-82390 Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver
- CVE-2026-8239 Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/get_rating'
- CVE-2026-82389 Null dereference in zephyr
- CVE-2026-82388 Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host
- CVE-2026-82387 Apache Roller: Stored cross-site scripting via uploaded media content type
- CVE-2026-82386 Apache Roller: XML external entity processing in OPML bookmark import
- CVE-2026-82385 Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files
- CVE-2026-82384 Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint
- CVE-2026-82383 Apache Roller: Anonymous setup action allows frontpage configuration tampering
- CVE-2026-82382 Apache Roller: Reflected cross-site scripting in the frontpage directory parameter
- CVE-2026-82381 Apache Roller: Stored cross-site scripting in the authoring UI
- CVE-2026-82380 Apache Roller: CSRF protection bypass via self-generated salt validation
- CVE-2026-8238 Concrete CMS is vulnerable to IDOR
- CVE-2026-82379 Apache Roller: WSSE digest authentication headers can be replayed
- CVE-2026-82378 Apache Roller: OAuth authorization endpoint trusts request-supplied identity
- CVE-2026-82377 Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers
- CVE-2026-82376 Apache Roller: XML external entity processing in trackback response parser
- CVE-2026-82375 Apache Roller: Server-side request forgery via entry trackback and enclosure URLs
- CVE-2026-82372 Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav before 3.0.1.a
- CVE-2026-82371 Plaintext exposure of sensitive authentication data in SANnav discovery service log files
- CVE-2026-82370 Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service
- CVE-2026-8237 Concrete CMS 9.5.0 and below is vulnerable to IDOR in the`/ccm/frontend/conversations/message_detail` endpoint
- CVE-2026-82369 Insufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a
- CVE-2026-82368 Missing authorization in SANnav
- CVE-2026-82367 Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic
- CVE-2026-82364 macrozheng mall Order Submission submit race condition
- CVE-2026-8236 Concrete CMS is vulnerable to IDOR combined with a missing authentication gate
- CVE-2026-82358 RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass
- CVE-2026-82357 RT-Labs AB C-Open CANopen NULL pointer dereference
- CVE-2026-82356 Imprivata EAM: Unrotatable X.509 RSA Key Pair in Production
- CVE-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation
- CVE-2026-8235 8421bit MiniClaw System kernel.ts resolveSkillScriptPath os command injection
- CVE-2026-82348 Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups
- CVE-2026-82346 HP ImageDiags - Potential Escalation of Privilege
- CVE-2026-82344 IBM Guardium Data Protection Buffer Overflow
- CVE-2026-82343 Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling
- CVE-2026-82340 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-8234 EFM ipTIME A8004T WifiBasicSet formWifiBasicSet stack-based overflow
- CVE-2026-82335 IBM Guardium Data Protection Buffer Overflow
- CVE-2026-82334 IBM Guardium Data Protection Out-of-bounds Read
- CVE-2026-82333 multer vulnerable to Denial of Service via oversized array index in field names
- CVE-2026-82332 Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking
- CVE-2026-82331 Apache BuildStream: tar source extraction escape
- CVE-2026-82330 Gimp: heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds check
- CVE-2026-8233 Dotouch XproUPF access control
- CVE-2026-82329 JFrog Artifactory Improper Authentication
- CVE-2026-82328 Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count
- CVE-2026-82327 Memory corruption in Red Hat Enterprise Linux 10
- CVE-2026-82326 HTML Injection in Enocta Educational's Enocta Platform
- CVE-2026-82325 Use after free in ovpn-dco-win
- CVE-2026-82324 Gimp: heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=0
- CVE-2026-82323 Improper Authorization in Enocta Educational's Enocta Platform
- CVE-2026-8232 Dotouch XproUPF UPF Process libvlib.so vlib_worker_loop denial of service
- CVE-2026-82312 Misconfiguration in OpenVPN
- CVE-2026-82311 Auth bypass in Apache Airflow FAB provider
- CVE-2026-82310 Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access
- CVE-2026-8231 CodeAstro Online Catering Ordering System deleteorder.php sql injection
- CVE-2026-82309 Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation l
- CVE-2026-82307 Multiple Vulnerabilities in Dolusoft Software's SOPLOG
- CVE-2026-82306 StarRocks Query Detail Endpoint Returns Every User's Query History
- CVE-2026-82305 YITH WooCommerce Wishlist < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change_wishlist_title
- CVE-2026-82304 Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler
- CVE-2026-82302 Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification
- CVE-2026-82300 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
- CVE-2026-8230 Wavlink NU516U1 login.cgi sys_login1 os command injection
- CVE-2026-82299 Incorrect Authorization in Kibana Leading to Information Disclosure
- CVE-2026-82298 Incorrect Authorization in Kibana Leading to Denial of Service
- CVE-2026-82294 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
- CVE-2026-82293 Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption
- CVE-2026-82291 HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials
- CVE-2026-82290 Chainlit Feedback Endpoints Missing Ownership Validation
- CVE-2026-8229 Wavlink NU516U1 wireless.cgi WifiBasic os command injection
- CVE-2026-82289 Gitingest Prefix-Based Git Host Check Enables Request Forgery and Token Disclosure
- CVE-2026-82288 Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags
- CVE-2026-82287 Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials
- CVE-2026-82286 gpt-crawler Arbitrary File Write via outputFileName Parameter
- CVE-2026-82285 BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback
- CVE-2026-82284 Quivr Chat Endpoints Missing Ownership Validation
- CVE-2026-82283 VoltAgent Memory API Handlers Missing Ownership Checks
- CVE-2026-82282 Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers
- CVE-2026-82281 Kotaemon Missing Ownership Check in Conversation Functions
- CVE-2026-82280 Quivr Prompt Endpoints Missing Ownership Validation
- CVE-2026-8228 Wavlink NU516U1 wireless.cgi advance os command injection
- CVE-2026-82279 HyperDX Team Management Operations Missing Role-Based Access Control
- CVE-2026-82278 BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once
- CVE-2026-82277 Argo Rollouts Dashboard Unauthenticated Mutating Operations
- CVE-2026-82276 StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate
- CVE-2026-82275 Qwen-Agent Arbitrary File Read via Caller-Supplied Document Path
- CVE-2026-82274 Twenty Open Redirect via OAuth Propagator Callback
- CVE-2026-82273 Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset
- CVE-2026-82272 Immich Locked Assets Remain Readable Through Albums and Shared Links
- CVE-2026-82271 R2R Missing Ownership Check Allows Modifying Other Users' Conversations
- CVE-2026-82270 Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/*
- CVE-2026-8227 Wavlink NU516U1 adm.cgi wzdapMesh os command injection