Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 400 of 1013.
- CVE-2026-73563 @backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass
- CVE-2026-73562 Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
- CVE-2026-73561 Hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
- CVE-2026-73560 vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections
- CVE-2026-7356 Use after free in Chrome
- CVE-2026-73559 vLLM: Completion prompt lists fan out into unbounded engine requests
- CVE-2026-73558 vLLM: Cross-User Data Leak Vulnerability
- CVE-2026-73557 vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
- CVE-2026-73556 vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m
- CVE-2026-73555 vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
- CVE-2026-73553 Envoy: RBAC Authorization Bypass via Path Parameters
- CVE-2026-73552 Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values
- CVE-2026-73551 Envoy: Path normalization does not handle dot and dotdot segments with parameters
- CVE-2026-73550 Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
- CVE-2026-7355 Use after free in Chrome
- CVE-2026-73549 Denial of service in envoy
- CVE-2026-73548 Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool
- CVE-2026-73547 Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check
- CVE-2026-73546 Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)
- CVE-2026-73542 Weak cryptography in Multiple SEIKO EPSON printers and scanners
- CVE-2026-73541 Denial of service in mpp
- CVE-2026-7354 Memory corruption in Chrome
- CVE-2026-73539 Gitea external renderer argument injection and code execution
- CVE-2026-73537 Cross-site scripting in Miraikan Assist App Android version
- CVE-2026-73535 Gitea second-factor bypass through OpenID identity linking
- CVE-2026-73533 Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build
- CVE-2026-73532 Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build
- CVE-2026-73531 django-helpdesk < 2.3.3 Stored XSS via HTML Attachments
- CVE-2026-73530 Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip()
- CVE-2026-7353 Memory corruption in Chrome
- CVE-2026-73529 Plainpad Missing Rate Limiting via POST /v1/sessions
- CVE-2026-73524 Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module
- CVE-2026-73523 COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation
- CVE-2026-73522 COVESA Open1722 0.9.2 Stack Buffer Overflow via avtp_to_can() in acf-can-listener
- CVE-2026-7352 Use after free in Chrome
- CVE-2026-73519 WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret
- CVE-2026-73515 PostGIS < 3.7.0beta2 Out-of-Bounds Read via FlatGeobuf Buffer
- CVE-2026-73514 PostGIS address_standardizer Out-of-Bounds Write via standardize_address()
- CVE-2026-73513 Envoy: oghttp2 upstream trailers incorrect handling
- CVE-2026-73512 Envoy: use-after-free in QUIC on internal redirects
- CVE-2026-73511 Auth bypass in envoy
- CVE-2026-7351 Race condition in Chrome
- CVE-2026-73509 OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal
- CVE-2026-73508 Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names
- CVE-2026-73507 Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion
- CVE-2026-73506 Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data
- CVE-2026-73505 Oh My Posh: Arbitrary command execution via template injection in the path segment
- CVE-2026-73502 kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema
- CVE-2026-73501 kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default
- CVE-2026-73500 etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
- CVE-2026-7350 Use after free in Chrome
- CVE-2026-73499 etcd: Watch API authorization bypass via open-ended range requests
- CVE-2026-73498 mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment
- CVE-2026-73497 MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)
- CVE-2026-73496 MCP Atlassian: Arbitrary server-side file read via attachment upload
- CVE-2026-73495 blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)
- CVE-2026-73494 blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
- CVE-2026-73493 http4s-blaze-server: Unbounded WebSocket message aggregation
- CVE-2026-73492 Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons
- CVE-2026-73491 Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references
- CVE-2026-73490 Loofah: SVG `href` attribute bypasses local-reference restriction
- CVE-2026-7349 Use after free in Chrome
- CVE-2026-73489 Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records
- CVE-2026-73488 Flowise before 3.1.3 IDOR via customer-default-source endpoint
- CVE-2026-73487 Flowise before 3.1.3 Prompt Injection RCE via CSV Agent
- CVE-2026-73486 Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV
- CVE-2026-73485 Flowise before 3.1.3 Remote Code Execution via Airtable Agent
- CVE-2026-73484 Flowise before 3.1.3 Sandbox Escape via Pandas Methods
- CVE-2026-73483 Flowise before 3.1.3 Sandbox Escape via Puppeteer
- CVE-2026-73482 phpList < 3.7.0-RC5 Cross-Site Request Forgery via admins.php
- CVE-2026-73481 phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules
- CVE-2026-73480 gdu Terminal Injection via Unstripped Escape Sequences
- CVE-2026-7348 Use after free in Chrome
- CVE-2026-73479 dua-cli Terminal Escape Sequence Injection via Marked Paths
- CVE-2026-73478 Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096
- CVE-2026-73477 Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099
- CVE-2026-73476 External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
- CVE-2026-73475 Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095
- CVE-2026-73474 Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097
- CVE-2026-73470 Apache Syncope: Delegating users can grant unowned Roles
- CVE-2026-7347 Use after free in Chrome
- CVE-2026-73469 Security Advisory 0176
- CVE-2026-73468 Security Advisory 0175
- CVE-2026-73467 Information disclosure in EOS
- CVE-2026-73466 On affected platforms running Arista EOS, under certain circumstances plaintext user passwords
- CVE-2026-73465 On affected platforms running Arista EOS, under certain circumstances plaintext private keys
- CVE-2026-73464 Security Advisory 0166
- CVE-2026-73463 Security Advisory 0169
- CVE-2026-73462 Denial of service in EOS
- CVE-2026-73461 Security Advisory 0163
- CVE-2026-73460 Security Advisory 0160
- CVE-2026-7346 Memory corruption in Chrome
- CVE-2026-73459 Security Advisory 0160
- CVE-2026-73458 Denial of service in EOS
- CVE-2026-73457 Information disclosure in EOS
- CVE-2026-73456 Code injection in EOS
- CVE-2026-73455 Security Advisory 0173
- CVE-2026-73454 Security Advisory 0165
- CVE-2026-73453 Security Advisory 0174
- CVE-2026-73451 Security feature bypass in EOS