Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 468 of 1013.
- CVE-2026-64685 ImageMagick: Heap Buffer Over-Read in BGR decoder due to mising end-of-file check
- CVE-2026-64684 RMCP: Custom HTTP headers leak to cross-origin redirect targets
- CVE-2026-64679 Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation
- CVE-2026-64677 Anki's local HTTP server is vulnerable to directory traversal attacks
- CVE-2026-64676 Kata Containers: Unauthorized mem-agent ttRPC methods let an untrusted host tamper with confidential-guest memory
- CVE-2026-64665 Statamic: Account takeover via OAuth email matching without email-verification check
- CVE-2026-64664 Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence
- CVE-2026-64663 Statamic: Unsafe method invocation via Antlers template resolution allows data destruction
- CVE-2026-64662 Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries
- CVE-2026-64657 Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL
- CVE-2026-64655 GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching
- CVE-2026-64654 GitHub CLI: Terminal escape sequence injection in multiple `gh` commands
- CVE-2026-64653 GitHub CLI: Unescaped variable components in request URLs could allow path traversal
- CVE-2026-64652 GitHub CLI: Partial token disclosure in `gh auth status` output
- CVE-2026-64651 AI SDK OpenCode Harness Tool Relay Authorization Bypass
- CVE-2026-64650 AI SDK Codex Harness Tool Relay Authorization Bypass
- CVE-2026-64649 Next.js: Server-Side Request Forgery in Server Actions on Custom Servers
- CVE-2026-64648 Next.js: Response Body Cache Confusion for Requests Containing Bodies
- CVE-2026-64647 Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies
- CVE-2026-64646 Next.js: Unbounded Server Action payload in Edge runtime
- CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
- CVE-2026-64644 Next.js: Denial of Service in the Image Optimization API using SVGs
- CVE-2026-64643 Next.js: Unauthenticated Disclosure of Internal Server Function endpoints
- CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- CVE-2026-64641 Next.js: Denial of Service in App Router using Server Actions
- CVE-2026-64640 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation
- CVE-2026-6464 PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands
- CVE-2026-64639 Privilege escalation in Plesk
- CVE-2026-64638 Cross-site scripting in WordPress
- CVE-2026-64637 Privilege escalation in Plesk
- CVE-2026-64636 SQL injection in Plesk
- CVE-2026-64635 Business logic in Service Provider Console
- CVE-2026-64634 Privilege escalation in ONE
- CVE-2026-64633 Code injection in ONE
- CVE-2026-64632 Information disclosure in ONE
- CVE-2026-64631 SQL injection in ONE
- CVE-2026-64630 Missing authorization in ONE
- CVE-2026-64629 Memory corruption in Parasolid V38.0
- CVE-2026-64628 Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers
- CVE-2026-64627 Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion
- CVE-2026-64626 AVideo Encoder downloadURL SSRF via unpinned retry fallback
- CVE-2026-64625 AVideo before 29.0 OS Command Injection via execAsync
- CVE-2026-64624 FreeRDP RDP File Parser Remote Code Execution via CLI Options
- CVE-2026-64623 Network-AI before 5.13.4 Cryptographic Signature Verification Bypass
- CVE-2026-64622 Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox
- CVE-2026-64621 FreeRDP before 3.28.0 Double-Free via selectedmonitors
- CVE-2026-64620 FreeRDP before 3.28.0 Heap Buffer Overflow via crypto_rsa_common
- CVE-2026-64619 FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers
- CVE-2026-64617 Misconfiguration in Data::PubSub::Shared
- CVE-2026-64616 Misconfiguration in Data::NDArray::Shared
- CVE-2026-64615 Misconfiguration in Data::Graph::Shared
- CVE-2026-64614 Misconfiguration in Data::Deque::Shared
- CVE-2026-64613 Misconfiguration in Data::Buffer::Shared
- CVE-2026-64612 Libcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malformed png
- CVE-2026-64611 Libcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loop in cfieee1284normalizemakemodel()
- CVE-2026-64610 Apache Kylin: Redis unsafe Java deserialization
- CVE-2026-64609 Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization
- CVE-2026-64608 Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths
- CVE-2026-64607 Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
- CVE-2026-64606 Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface
- CVE-2026-64604 KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
- CVE-2026-64603 platform/x86: intel-hid: Protect ACPI notify handler against recursion
- CVE-2026-64602 iio: adc: spear: Initialize completion before requesting IRQ
- CVE-2026-64601 ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
- CVE-2026-64600 xfs: resample the data fork mapping after cycling ILOCK
- CVE-2026-64599 crypto: amlogic - avoid double cleanup in meson_crypto_probe()
- CVE-2026-64598 smb/client: Fix error code in smb2_aead_req_alloc()
- CVE-2026-64597 smb: client: fix double-free in SMB2_close() replay
- CVE-2026-64596 libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
- CVE-2026-64595 HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()
- CVE-2026-64594 usb: gadget: f_fs: initialize reset_work at allocation time
- CVE-2026-64593 btrfs: do not trim a device which is not writeable
- CVE-2026-64592 riscv: mm: Unconditionally sfence.vma for spurious fault
- CVE-2026-64591 iommu/vt-d: Avoid WARNING in sva unbind path
- CVE-2026-64590 dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
- CVE-2026-6459 Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CVE-2026-64589 i2c: core: fix NULL-deref on adapter registration failure
- CVE-2026-64588 fuse-uring: fix data races on ring->ready
- CVE-2026-64587 net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
- CVE-2026-64586 wifi: brcmfmac: drain bus_reset work on device removal
- CVE-2026-64585 can: esd_usb: kill anchored URBs before freeing netdevs
- CVE-2026-64584 usb: gadget: f_midi: cancel pending IN work before freeing the midi object
- CVE-2026-64583 usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
- CVE-2026-64582 RDMA/rxe: Fix a use-after-free problem in rxe_mmap
- CVE-2026-64581 xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
- CVE-2026-64580 xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
- CVE-2026-6458 AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is Empty
- CVE-2026-64579 xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
- CVE-2026-64578 ksmbd: validate compound request size before reading StructureSize2
- CVE-2026-64577 gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
- CVE-2026-64576 nexthop: initialize extack in nh_res_bucket_migrate()
- CVE-2026-64575 bpf: tcp: fix double sock release on batch realloc
- CVE-2026-64574 wifi: mac80211: tear down new links on vif update error path
- CVE-2026-64573 Bluetooth: qca: fix NVM tag length underflow in TLV parser
- CVE-2026-64572 ipv4: fib: free fib_alias with kfree_rcu() on insert error path
- CVE-2026-64571 wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
- CVE-2026-64570 wifi: mac80211: fix fils_discovery double free on alloc failure
- CVE-2026-6457 Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection via 'geo_mashup_null_fields' Parameter
- CVE-2026-64569 mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
- CVE-2026-64568 wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure