Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 370 of 1013.
- CVE-2026-7741 CodeAstro Online Classroom studentlogin sql injection
- CVE-2026-77409 RabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel Blocking
- CVE-2026-77408 RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow
- CVE-2026-77407 RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields
- CVE-2026-77406 RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration
- CVE-2026-77405 RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser
- CVE-2026-77404 RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection
- CVE-2026-77403 RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation
- CVE-2026-77401 Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions
- CVE-2026-7740 justdan96 tsMuxer vvc.cpp setFPS denial of service
- CVE-2026-77399 icalendar: Denial of service via unbounded VALARM REPEAT expansion
- CVE-2026-77396 PJSIP: Heap buffer overflow in the AVI parser
- CVE-2026-77394 OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
- CVE-2026-77393 Inductive Automation Ignition Incorrect Default Permissions
- CVE-2026-77392 SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injection
- CVE-2026-77391 SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP cross-site request forgery
- CVE-2026-7739 justdan96 tsMuxer hevc.cpp setFPS denial of service
- CVE-2026-77387 geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point
- CVE-2026-77386 Kyoo: OIDC login token can be redirected to an attacker-controlled URL
- CVE-2026-77385 Kyoo: Transcoder serves uncataloged files from the media directory
- CVE-2026-77384 libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion
- CVE-2026-7738 puchunjie doc-tools-mcp MCP mcp-server.ts open_document path traversal
- CVE-2026-77375 SFTPGo: Denial of service via malformed SSH channel request
- CVE-2026-77371 Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access
- CVE-2026-7737 osrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-bounds
- CVE-2026-77368 SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths
- CVE-2026-77366 obsidian-tc tokens can access arbitrary configured vaults
- CVE-2026-77365 Optimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter
- CVE-2026-77364 obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets
- CVE-2026-77363 obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access
- CVE-2026-77362 obsidian-tc bridge tools expose data outside the read ACL
- CVE-2026-77361 obsidian-tc symlink path mismatch bypasses read ACL restrictions
- CVE-2026-77360 oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass
- CVE-2026-7736 osrg GoBGP mrt.go parseRibEntry integer underflow
- CVE-2026-77358 cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close()
- CVE-2026-77357 Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server
- CVE-2026-77354 kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding
- CVE-2026-77353 Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export
- CVE-2026-77352 Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)
- CVE-2026-77351 Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings
- CVE-2026-7735 osrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflow
- CVE-2026-77348 Server-side request forgery in Wallos
- CVE-2026-77341 cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing
- CVE-2026-7734 osrg GoBGP SRv6 L3 Service prefix_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of service
- CVE-2026-77339 Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools
- CVE-2026-77337 CakePHP: Potential Authentication bypass with CookieAuthenticator
- CVE-2026-7733 funadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted upload
- CVE-2026-77322 SIPGO: DoS via unvalidated WebSocket frame length
- CVE-2026-77321 TREK MCP trip summary bypasses delegated OAuth read scopes
- CVE-2026-77320 Missing authorization in TREK
- CVE-2026-7732 code-projects BloodBank Managing System request_blood.php unrestricted upload
- CVE-2026-77317 SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite
- CVE-2026-77310 jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization
- CVE-2026-7731 code-projects BloodBank Managing System get_state.php sql injection
- CVE-2026-77301 adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
- CVE-2026-7730 privsim mcp-test-runner MCP index.ts child_process.spawn os command injection
- CVE-2026-77298 SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy
- CVE-2026-77294 TREK: Server-Side Request Forgery via User-Configurable LLM Base URL
- CVE-2026-77293 TREK: Cross-user note-file deletion (IDOR / Broken Access Control)
- CVE-2026-7729 pixelsock directus-mcp MCP index.ts validateUrl server-side request forgery
- CVE-2026-77285 OpenBao Agent Writes Secrets to Stdout
- CVE-2026-77281 Caddy: rewrite placeholder re-expansion
- CVE-2026-7728 ryanjoachim mcp-rtfm MCP update_doc path traversal
- CVE-2026-77274 MCP Atlassian: SSRF Protection Bypass
- CVE-2026-77272 MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler
- CVE-2026-77271 MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)
- CVE-2026-77270 MCP Atlassian: Arbitrary File Read via Upload Attachment Tools
- CVE-2026-7727 Shandong Hoteam Software PDM Product Data Management System DataService GetQueryMachineGridOnePageData sql injection
- CVE-2026-77269 MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)
- CVE-2026-77268 MCP Atlassian: Insecure File Permissions on OAuth Token Storage
- CVE-2026-77267 mcp-atlassian has an incomplete SSRF remediation
- CVE-2026-77266 MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call
- CVE-2026-77265 MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow
- CVE-2026-77264 Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure
- CVE-2026-77263 Cross-site scripting in iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more
- CVE-2026-77262 MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)
- CVE-2026-77261 MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches
- CVE-2026-77260 MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)
- CVE-2026-7726 Missing authorization in Layouts for WPBakery
- CVE-2026-77259 MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials
- CVE-2026-77258 MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()
- CVE-2026-77257 MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths
- CVE-2026-77256 MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask
- CVE-2026-77255 MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue
- CVE-2026-77254 MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials
- CVE-2026-77253 MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files
- CVE-2026-77252 MCP Atlassian: JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER can be bypassed in search tools
- CVE-2026-77251 MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)
- CVE-2026-77250 MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions
- CVE-2026-7725 PrefectHQ prefect GitRepository Pull storage.py argument injection
- CVE-2026-77249 MCP Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookup
- CVE-2026-77248 MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport
- CVE-2026-77247 MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters
- CVE-2026-77246 MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path
- CVE-2026-77244 [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token
- CVE-2026-77243 MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass
- CVE-2026-77242 MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned)
- CVE-2026-77240 WACRM: Database-layer authorization bypasses
- CVE-2026-7724 PrefectHQ prefect Webhook/Notification validate_restricted_url toctou
- CVE-2026-77239 WACRM: Service-role routes missing a role check