Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 407 of 1013.
- CVE-2026-72816 go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware
- CVE-2026-72815 go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header
- CVE-2026-72814 actix-files before 0.6.10 Information Disclosure via Files
- CVE-2026-72813 actix-files before 0.6.10 Denial of Service via empty Range header
- CVE-2026-72812 SiYuan before v3.7.4 Missing Authorization via refreshBacklink
- CVE-2026-72811 SiYuan before v3.7.4 SQL Injection via backlink search
- CVE-2026-72810 SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket
- CVE-2026-7281 SourceCodester Pharmacy Sales and Inventory System index.php supplier cross site scripting
- CVE-2026-72809 SiYuan before v3.7.4 Authentication Bypass via Localhost Trust
- CVE-2026-72808 SiYuan before v3.7.4 Information Disclosure via getFileAnnotation
- CVE-2026-72807 SiYuan before v3.7.4 SQL Injection via queryBlocks template
- CVE-2026-72806 SiYuan before v3.7.4 Authentication Bypass via Attribute View
- CVE-2026-72805 SiYuan before v3.7.4 Information Disclosure via Block Endpoints
- CVE-2026-72804 SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints
- CVE-2026-72803 SiYuan before v3.7.4 Information Disclosure via getBlockAttrs
- CVE-2026-72802 SiYuan before v3.7.4 Information Disclosure via resolveAssetPath
- CVE-2026-72801 SiYuan before v3.7.4 Information Disclosure via Encryption Key Material
- CVE-2026-72800 SiYuan before v3.7.4 Information Disclosure via Unfiltered API
- CVE-2026-7280 eMPIA Technology｜AVACAST - Unquoted Service Path
- CVE-2026-72799 SiYuan before v3.7.4 Information Disclosure via Path Resolution
- CVE-2026-72798 SiYuan before v3.7.4 Information Disclosure via renderAttributeView
- CVE-2026-72797 SiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatus
- CVE-2026-72796 SiYuan before v3.7.4 Access Control Bypass via Static Routes
- CVE-2026-72795 SiYuan before v3.7.4 Information Disclosure via Embed Block
- CVE-2026-72794 siyuan before v3.7.4 Session Cookie Key Disclosure via getConf
- CVE-2026-72793 SiYuan before v3.7.4 Information Disclosure via /api/system/getConf
- CVE-2026-72792 SiYuan before v3.7.4 Information Disclosure via Tag API
- CVE-2026-72791 SiYuan v3.7.4-alpha.1 Information Disclosure via getAttributeViewFieldViews
- CVE-2026-72790 SiYuan before v3.7.4 Information Disclosure via getNotebookInfo
- CVE-2026-7279 eMPIA Technology｜AVACAST - DLL Hijacking
- CVE-2026-72789 SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks
- CVE-2026-72788 SiYuan before v3.7.4 Information Disclosure via UILayout Filter
- CVE-2026-72787 Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name
- CVE-2026-72786 Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset
- CVE-2026-72785 Craft CMS before 5.10.6 Authorization Bypass via structures/move-element
- CVE-2026-72784 Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation
- CVE-2026-72783 Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained
- CVE-2026-72782 Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak
- CVE-2026-72781 Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape
- CVE-2026-72780 Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey
- CVE-2026-72779 Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject
- CVE-2026-72778 Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config
- CVE-2026-72777 Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url
- CVE-2026-72776 AgenticSeek Unauthenticated RCE via /query API Endpoint
- CVE-2026-72775 n8n before 1.123.67 SQL Injection via PostgresTrigger Node
- CVE-2026-72774 n8n before 1.123.67 Authentication Bypass via HTTP Request Node
- CVE-2026-72773 n8n before 2.32.1 Path Traversal via computer-use search_files
- CVE-2026-72772 n8n before 2.32.1 Authentication Bypass via Token Exchange
- CVE-2026-72771 n8n before 2.32.1 Credential Restriction Bypass via AI/LLM Nodes
- CVE-2026-72770 n8n before 1.123.67 Path Traversal via Git Node Operations
- CVE-2026-72769 n8n before 1.123.67 Prototype Pollution via VM Expression Engine
- CVE-2026-72768 n8n before 2.32.1 SSRF Protection Bypass via MCP Client
- CVE-2026-72767 n8n before 1.123.67 Remote Code Execution via Git node
- CVE-2026-72766 n8n before 1.123.67 Arbitrary File Read via Send Email Node
- CVE-2026-72765 n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escape
- CVE-2026-72764 n8n before 1.123.67 Module Cache Poisoning via Code Node
- CVE-2026-72763 n8n before 1.123.67 Credential Exfiltration via Sub-Workflow
- CVE-2026-72762 n8n before 1.123.67 Arbitrary File Write via Edit Image Node
- CVE-2026-72761 Server-side request forgery in vulnerability-lookup
- CVE-2026-72760 cti-transmute Following List Exposes User Email Addresses to Authenticated Users
- CVE-2026-72759 cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletion
- CVE-2026-72758 Routinator may exit on malformed ranges
- CVE-2026-72757 Routinator HTTP server becomes unavailable with many unclosed connections
- CVE-2026-72756 Routinator exits on malformed rsync URIs
- CVE-2026-72755 Routinator stores TA certificate in cache without validation
- CVE-2026-72754 Routinator exits when parsing an incorrect or very large CRL file
- CVE-2026-72753 Routinator incorrectly handles delta updates
- CVE-2026-72752 Routinator exits when requesting the output repeatedly
- CVE-2026-72751 Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Content
- CVE-2026-72750 n8n before 1.123.67 SQL Injection via executeQuery Operation
- CVE-2026-72749 n8n before 1.123.67 Prototype Pollution via Edit Fields
- CVE-2026-72748 AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php
- CVE-2026-72747 AVideo Stored Cross-Site Scripting via Unauthenticated Registration
- CVE-2026-72744 Nuxt before 4.5.1 Information Disclosure via Chrome DevTools
- CVE-2026-72743 SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html
- CVE-2026-72742 DSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing
- CVE-2026-72741 Rainbond 6.9.7 Region API Cross-Enterprise IDOR via Tenant Access
- CVE-2026-72740 Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan`
- CVE-2026-72739 Dokploy: Command Injection via Compose Shell Execution
- CVE-2026-72738 Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameter
- CVE-2026-72737 Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backups
- CVE-2026-72736 Dokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCE
- CVE-2026-72735 Command injection in dokploy
- CVE-2026-72734 Missing authorization in dokploy
- CVE-2026-72733 Dokploy: OS Command Injection via `databaseName` / `backupFile` in database restore
- CVE-2026-72732 Discourse: Templates endpoint exposes hidden tag names
- CVE-2026-72731 Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer
- CVE-2026-72730 Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor
- CVE-2026-7273 Zyxel GS1900 Series Switches Stack-Based Buffer Overflow
- CVE-2026-72729 Discourse: Stored XSS in discourse-local-dates plugin
- CVE-2026-72728 Discourse: Onebox iframe origin allowlist enforces URL authority boundary
- CVE-2026-72727 Discourse: Stored XSS in the moderation review queue
- CVE-2026-72726 Discourse: Unauthorized eavesdropping on private AI bot conversations.
- CVE-2026-72725 Discourse: Stored XSS in staff action logs injects staff UI
- CVE-2026-72724 Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch
- CVE-2026-72723 Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags
- CVE-2026-72722 Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs
- CVE-2026-72721 Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison
- CVE-2026-72720 Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing
- CVE-2026-7272 WilliamCloudQi matlab-mcp-server MCP index.ts execute_matlab_code path traversal