Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 439 of 1013.
- CVE-2026-69228 missing authentication vulnerability in Esri Portal for ArcGIS
- CVE-2026-69227 BUG-000187331 Portal for ArcGIS has a security vulnerability
- CVE-2026-69226 Portal for ArcGIS has a security vulnerability
- CVE-2026-69225 information disclosure vulnerability in Esri Portal for ArcGIS
- CVE-2026-69224 information disclosure vulnerability in Esri Portal for ArcGIS
- CVE-2026-69223 Apache Allura: Server-side request forgery
- CVE-2026-69222 LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process
- CVE-2026-69220 RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
- CVE-2026-6922 Missing authorization in WP Table Builder – Drag & Drop Table Builder
- CVE-2026-69219 RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
- CVE-2026-69218 Http4s Ember HTTP/2: unbounded continuation frame accumulation
- CVE-2026-69217 Http4s: Ember Server accepts duplicate Content-Length headers
- CVE-2026-69216 Http4s: Ember chunk parser lenience (TE.TE request smuggling)
- CVE-2026-69215 Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin
- CVE-2026-69214 Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain
- CVE-2026-69213 Http4s Ember HTTP/2: unbounded outbound frame queue
- CVE-2026-69212 Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect
- CVE-2026-69211 Http4s: Set-Cookie rendering does not escape attribute delimiters
- CVE-2026-69210 Http4s: WebSocket decoder accepts negative length, causing infinite decode loop
- CVE-2026-6921 Race condition in Chrome
- CVE-2026-69209 Http4s: WebSocket decoder accepts unbounded message sizes
- CVE-2026-69208 Http4s: DigestAuth nonce map grows unbounded
- CVE-2026-69207 Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
- CVE-2026-69206 Http4s: DigestAuth allows replay of captured requests
- CVE-2026-69205 Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)
- CVE-2026-69204 Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)
- CVE-2026-69203 Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS
- CVE-2026-69202 Http4s Ember HTTP/2: unbounded inbound body buffering
- CVE-2026-69201 Http4s: ResourceService and Webjar Service path escape via percent-encoded separators
- CVE-2026-69200 node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)
- CVE-2026-6920 Memory corruption in Chrome
- CVE-2026-69198 ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
- CVE-2026-69197 Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion
- CVE-2026-69194 FileRise: Unsanitized footerHtml in Public Site Config
- CVE-2026-69193 FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying
- CVE-2026-69192 ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
- CVE-2026-69191 FileRise: Login Method Restriction Bypass via Direct API Access
- CVE-2026-69190 Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
- CVE-2026-6919 Use after free in Chrome
- CVE-2026-69189 Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers
- CVE-2026-69186 c-ares: Memory-amplification denial of service via unvalidated DNS header record counts
- CVE-2026-69185 Socket.IO: Zero-attachment Memory Exhaustion
- CVE-2026-69184 c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains
- CVE-2026-69183 Security feature bypass in monkeytype
- CVE-2026-6918 Denial of service in Eclipse OpenJ9
- CVE-2026-69160 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API
- CVE-2026-6916 Cross-site scripting in Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
- CVE-2026-69153 PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
- CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
- CVE-2026-69151 Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
- CVE-2026-69150 KeePassXC: Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map
- CVE-2026-6915 Flaw in the updateUser Command May Allow Unauthorized Configuration Change
- CVE-2026-69149 Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
- CVE-2026-69148 MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id
- CVE-2026-69147 vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation
- CVE-2026-69146 MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth
- CVE-2026-6914 MD5 checksum creation may cause availability loss
- CVE-2026-6913 Shortcodely <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_area' Shortcode Attribute
- CVE-2026-69129 KubePi: Insufficient per-cluster authorization checks in cluster management APIs
- CVE-2026-69127 Kirby: System path exposure from error messages in the REST API
- CVE-2026-6912 Privilege Escalation via Self-Writable Cognito Custom Attribute in AWS Ops Wheel
- CVE-2026-69119 Taubyte Tau v1.1.10 Missing Authorization via GET and DELETE /projects/{id}
- CVE-2026-69118 Cachet 2.4.1 Authenticated Server-Side Template Injection RCE
- CVE-2026-69117 NetBox 4.5.8 ORM Injection via WritableNestedSerializer
- CVE-2026-69116 FlyEnv < 4.18.0 Cross-Site Scripting via v-html
- CVE-2026-69115 OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints
- CVE-2026-69114 Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass
- CVE-2026-69113 Cap v0.3.1 Broken Access Control via video comment endpoint
- CVE-2026-69112 Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map
- CVE-2026-69111 Milvus 2.6.22, 3.0.0 Unauthenticated Denial of Service via /management/stop
- CVE-2026-69110 OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music
- CVE-2026-6911 Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel
- CVE-2026-69109 Path traversal in Siemens License Server (SLS)
- CVE-2026-69108 Privilege escalation in Siemens License Server (SLS)
- CVE-2026-69107 Potential unauthorized artifact access in JFrog Artifactory
- CVE-2026-69106 Potential cache poisoning in JFrog Artifactory
- CVE-2026-69105 Potential package cache integrity issue in JFrog Artifactory
- CVE-2026-69104 Potential unauthorized repository migration in JFrog Artifactory
- CVE-2026-69102 MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust
- CVE-2026-69101 Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint
- CVE-2026-69100 LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution
- CVE-2026-6910 Bookero.pl <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-69098 kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization
- CVE-2026-69097 GitPython before 3.1.53 Config Injection via Submodule Names
- CVE-2026-69096 OpenWrt luci-app-dockerman Read ACL Remote Code Execution
- CVE-2026-69095 OpenWrt luci-app-bmx7 Path Traversal via bmx7-info
- CVE-2026-69094 Admidio before 5.0.11 IDOR via save_temporary mylist_function.php
- CVE-2026-69093 Admidio before 5.0.11 CSRF via category-report preferences
- CVE-2026-69092 Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint
- CVE-2026-69091 Admidio before 5.0.11 Authentication Bypass via forum.php
- CVE-2026-69090 Admidio before 5.0.11 Cross-Organization Role Modification
- CVE-2026-6909 Reflected XSS in ATutor
- CVE-2026-69089 Grav CMS before 2.0.11 Path Traversal via watermark
- CVE-2026-69088 Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint
- CVE-2026-69087 Grav Form Plugin before 9.1.13 Open Redirect via form.value() Twig
- CVE-2026-69086 SiYuan before v3.7.3 Path Traversal via unvalidated avID
- CVE-2026-69085 SiYuan before v3.7.3 SQL Injection via searchDocs
- CVE-2026-69084 SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
- CVE-2026-69083 SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
- CVE-2026-69082 Cross-Site Request Forgery in the Administrative User Deletion Endpoint