Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 403 of 1013.
- CVE-2026-73253 Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching
- CVE-2026-73252 Memory corruption in mongoose
- CVE-2026-73251 Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification
- CVE-2026-73250 Notepad++: Install-time PowerShell command injection through installation path
- CVE-2026-7325 Server-side request forgery in Server
- CVE-2026-73249 Missing authorization in calibre
- CVE-2026-73248 calibre: Bypass of Python template restrictions via nested `template()` leading to RCE
- CVE-2026-73247 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
- CVE-2026-73246 Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials
- CVE-2026-73245 Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth
- CVE-2026-73244 kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing
- CVE-2026-73243 kkFileView: Unauthenticated SSRF via /addTask with fullfilename type-confusion bypass
- CVE-2026-73242 FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`
- CVE-2026-73241 Auth bypass in FreeRDP
- CVE-2026-73240 Apache Allura: Git command injection
- CVE-2026-7324 Memory safety bugs fixed in Thunderbird 150.0.1
- CVE-2026-73239 Apache Allura: Missing permission checks IDOR
- CVE-2026-73238 Apache Allura: XSS in code display
- CVE-2026-73237 Apache Allura: XSS in markdown pipeline
- CVE-2026-73236 Apache Syncope: Cross-Realm authorization bypass in delegated administration
- CVE-2026-73235 FreeCAD: XXE file read and SSRF via external entity injection in Document.xml SAX parser
- CVE-2026-73234 Path traversal in FreeCAD
- CVE-2026-73233 FreeCAD: FEM formula incomplete escape
- CVE-2026-73232 ffuf denial of service (OOM) via HTTP response decompression bomb
- CVE-2026-73231 Faker: helpers.fake exploitable into arbritary code execution
- CVE-2026-73230 Ente: 2of3 cards v1 contain a checksum that enables offline guessing of low-entropy secrets
- CVE-2026-7323 Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1
- CVE-2026-73229 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests
- CVE-2026-73228 Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`
- CVE-2026-73227 electerm's RDP clipboard file download may parse unsafe file name
- CVE-2026-73226 Code injection in electerm
- CVE-2026-73225 electerm: Path traversal in FTP/SFTP recursive folder download via unsanitized server filename
- CVE-2026-73224 Electerm check folder size function may get attacked by unsafe folder name
- CVE-2026-73223 electerm: Path traversal in editWithSystemEditor temp file path via unsanitized SFTP filename
- CVE-2026-73222 Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)
- CVE-2026-73221 CVAT: Flawed authorization logic in endpoints related to lambda requests
- CVE-2026-73220 CVAT: Stored XSS via annotation guides in audio tasks
- CVE-2026-7322 Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1
- CVE-2026-73219 CVAT: Denial of service with regards to automatic annotation
- CVE-2026-73218 Cursor: Sandbox escape via launching privileged containers
- CVE-2026-73217 Cursor: Sandbox escape via tampered Python virtual environments
- CVE-2026-73216 coturn: mobility disconnects bypass allocation quotas and exhaust relay capacity
- CVE-2026-73215 The coturn server can end in a state where it does not accept more requests with "even-port" enabled.
- CVE-2026-73214 Denial of service in coturn
- CVE-2026-73213 Server-side request forgery in coturn
- CVE-2026-73212 Server-side request forgery in coturn
- CVE-2026-73211 PeerTube: Unauthenticated remote SQL injection in ActorFollowModel.updateScore()
- CVE-2026-73210 Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture
- CVE-2026-7321 Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component
- CVE-2026-73209 Denial of service in OX Dovecot CE
- CVE-2026-73208 Auth bypass in OX Dovecot CE
- CVE-2026-7320 Information disclosure due to incorrect boundary conditions in the Audio/Video component
- CVE-2026-73199 Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value
- CVE-2026-73198 Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read
- CVE-2026-73197 Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read
- CVE-2026-73196 Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding
- CVE-2026-73195 Apache Syncope: CSV export spreadsheet formula injection
- CVE-2026-73194 DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse.
- CVE-2026-73193 DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse.
- CVE-2026-73192 Apache Sling XSS: XSS possible through XSSAPI.getValidHref()
- CVE-2026-73191 Apache Syncope: CAS service URL injection via Forwarded HTTP headers
- CVE-2026-73190 WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-7319 elinsky execution-system-mcp add_action Tool server.py _get_context_file_path path traversal
- CVE-2026-73187 WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability
- CVE-2026-73185 WordPress NGG Smart Image Search plugin < 4.0.0 - SQL Injection vulnerability
- CVE-2026-73184 WordPress Global Gallery plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-73183 WordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerability
- CVE-2026-73182 WordPress BBQ Pro plugin <= 3.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-73181 WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability
- CVE-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session
- CVE-2026-7318 elie mcp-project research_server.py search_papers path traversal
- CVE-2026-73179 Apache CXF: JPA authorization-code consume is non-atomic
- CVE-2026-73178 Apache Syncope: JWT Access Token takeover
- CVE-2026-73177 Security feature bypass in EKI-1242EIMS
- CVE-2026-73176 Command injection in EKI-1242EIMS
- CVE-2026-73175 Denial of service in EKI-1242EIMS
- CVE-2026-73174 Information disclosure in EKI-1242EIMS
- CVE-2026-73173 Missing authorization in EKI-1242EIMS
- CVE-2026-73172 Command injection in EKI-1242EIMS
- CVE-2026-73171 Path traversal in EKI-1242EIMS
- CVE-2026-73170 Code injection in EKI-1242EIMS
- CVE-2026-7317 Grav CMS Cache Value FileCache.php doGet deserialization
- CVE-2026-73169 Cross-site scripting in EKI-1242EIMS
- CVE-2026-73167 Command injection in EKI-1242EIMS
- CVE-2026-73166 Code injection in EKI-1242EIMS
- CVE-2026-73165 Command injection in EKI-1242EIMS
- CVE-2026-73164 Command injection in EKI-1242EIMS
- CVE-2026-73163 Command injection in EKI-1242EIMS
- CVE-2026-73162 cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes
- CVE-2026-73161 cti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search Highlighting
- CVE-2026-73160 cti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP Addresses
- CVE-2026-7316 eiliyaabedini aider-mcp code_with_ai aider_mcp.py command injection
- CVE-2026-73159 cti-transmute Stored XSS via Crafted Tag Icon on Admin Triage Interface
- CVE-2026-73158 cti-transmute Saved Graph Configuration Allows Stored Cross-Site Scripting via svgIcon
- CVE-2026-73157 cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata
- CVE-2026-73156 cti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion Data
- CVE-2026-73155 cti-transmute Missing Authorization Allows Reactions to Private Comments
- CVE-2026-7315 eiceblue spire-pdf-mcp-server PDF File server.py get_pdf_path path traversal
- CVE-2026-73140 cti-transmute Evaluation Report Exports Expose Private Comments and Author Information
- CVE-2026-7314 eiceblue spire-doc-mcp-server base.py get_doc_path path traversal