Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 479 of 1013.
- CVE-2026-63517 Microsoft Office Graphics Component Information Disclosure Vulnerability
- CVE-2026-63516 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-63515 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-63514 Microsoft SharePoint Server Remote Code Execution Vulnerability
- CVE-2026-63513 Microsoft Office Graphics Component Remote Code Execution Vulnerability
- CVE-2026-63512 Microsoft SharePoint Server Tampering Vulnerability
- CVE-2026-6351 Openfind｜MailGates/MailAudit - CRLF Injection
- CVE-2026-63509 Microsoft Fabric Elevation of Privilege Vulnerability
- CVE-2026-63508 Microsoft Planetary Computer Pro Elevation of Privilege Vulnerability
- CVE-2026-63506 Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
- CVE-2026-6350 Openfind｜MailGates/MailAudit - Stack-based Buffer Overflow
- CVE-2026-63498 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
- CVE-2026-63495 Libevent: Unbounded memory accumulation in WebSocket server via fragmented frames
- CVE-2026-63493 Snipe-IT: 2FA bypass via the API token flow
- CVE-2026-63490 Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass
- CVE-2026-6349 HGiga｜iSherlock - OS Command Injection
- CVE-2026-63481 Hurl: Cookies in Cookies section leak when redirecting to a different host
- CVE-2026-6348 Simopro Technology｜WinMatrix - Missing Authentication
- CVE-2026-63472 Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification
- CVE-2026-6347 Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets
- CVE-2026-63466 Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username
- CVE-2026-63464 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`
- CVE-2026-63462 Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter
- CVE-2026-63461 Vendure: Shop API list queries can return non-public entities when filterOperator is OR
- CVE-2026-63460 Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends
- CVE-2026-6346 Sensitive credentials exposed in plaintext in Mattermost support packets
- CVE-2026-63459 Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
- CVE-2026-63458 Perses project query parameter authorization bypass exposes cross-project resources
- CVE-2026-63457 Denial of service in HPE Integrated Lights-Out 6 (iLO 6)
- CVE-2026-63456 Authentication bypass via spoofed HTTP headers Orchestrator REST API
- CVE-2026-63455 Authentication bypass via spoofed HTTP headers Orchestrator REST API
- CVE-2026-63454 Authenticated Path Traversal Vulnerability Leads to Remote Code Execution in AOS-CX
- CVE-2026-63453 Authenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX
- CVE-2026-63452 Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption
- CVE-2026-63451 Suricata detect: frame rules without content and with transform can cause heap buffer overflow during rule load
- CVE-2026-63450 Suricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detection
- CVE-2026-6345 Prevent password disclosure and force reset during Slack import
- CVE-2026-63449 Suricata sip: large SIP message bodies can evade detection with frame keyword
- CVE-2026-63448 Suricata smb: some SMB flows can cause resource exhaustion
- CVE-2026-63447 Suricata ftp: crafted FTP traffic can cause quadratic CPU consumption
- CVE-2026-63446 Suricata app-layer: passed flows can retain transactions, causing resource exhaustion
- CVE-2026-63445 Perses: Unvalidated project parameter enables filesystem path traversal
- CVE-2026-63443 Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write
- CVE-2026-63442 OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking
- CVE-2026-6344 Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment
- CVE-2026-63435 Mail: Email address spoofing via malformed RFC 2047 encoded-words
- CVE-2026-63432 Code injection in horilla-hr
- CVE-2026-63431 Missing authorization in horilla-hr
- CVE-2026-63430 ammonia: mXSS in ammonia via MathML `annotation-xml` encoding strip
- CVE-2026-6343 Mattermost doesn't check public/private permissions
- CVE-2026-63429 HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context
- CVE-2026-63428 Business logic in heyform
- CVE-2026-63427 Auth bypass in Software Fix
- CVE-2026-63426 Privilege escalation in Dock Manager
- CVE-2026-63425 Privilege escalation in Dock Manager
- CVE-2026-63424 Privilege escalation in Dock Manager
- CVE-2026-63423 Hardcoded credentials in Accessories and Display Manager
- CVE-2026-63422 OpenImageIO OpenEXR plugin partial edge tile heap out-of-bounds write
- CVE-2026-63421 Keystone: `graphql.maxTake` bypass with negative `take`
- CVE-2026-63420 OpenImageIO: PSD RawColor indexed image out-of-bounds read in `interleave_row`
- CVE-2026-6342 Group prefix matching bypass for subscriptions
- CVE-2026-63419 OpenImageIO: IFF ZBUFFER tile read writes past caller tile buffer
- CVE-2026-63416 draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints
- CVE-2026-6341 Incomplete group locking implementation
- CVE-2026-63409 Deskflow: Odd-length DSOP options vector causes out-of-bounds read in Deskflow client
- CVE-2026-63408 Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter
- CVE-2026-63407 Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses
- CVE-2026-63406 AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets
- CVE-2026-63405 AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body
- CVE-2026-63404 Faktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive)
- CVE-2026-63403 Faktory: Unrecovered panic in command handlers allows full-server denial of service
- CVE-2026-6340 Memory Exhaustion via Malicious 7zip File Upload
- CVE-2026-63397 remorses/genql code injection
- CVE-2026-6339 Missing request origin validation on burn-on-read reveal endpoint
- CVE-2026-63388 Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept
- CVE-2026-63387 Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response
- CVE-2026-63386 js-toml: Uncontrolled recursion in `load()` causes `RangeError` (stack exhaustion) on deeply nested input
- CVE-2026-63385 Libevent: HTTP header handling bugs create risk of access control bypass.
- CVE-2026-63384 Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.
- CVE-2026-63383 Libevent: decode_tag_internal() can lead to out-of-bounds read
- CVE-2026-63382 libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling
- CVE-2026-63381 Libevent: Dangling Pointer in `evbuffer_add_buffer_reference`
- CVE-2026-63380 Libevent: Null Pointer Dereference in `evws_new_session`
- CVE-2026-6338 HTTP request smuggling in Kong Enteprise Gateway
- CVE-2026-63379 Libevent: HTTP Header smuggling
- CVE-2026-63376 toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization
- CVE-2026-63374 AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing
- CVE-2026-63373 draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection
- CVE-2026-63362 o6 Automation open62541 Integer Underflow
- CVE-2026-63361 LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup
- CVE-2026-63360 LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint
- CVE-2026-6336 Incorrect Authorization in GitLab
- CVE-2026-63359 Appriss Insights VINE SQLI
- CVE-2026-63358 FileGator privilege escalation
- CVE-2026-63357 Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF
- CVE-2026-63356 Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF
- CVE-2026-63355 Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF
- CVE-2026-63354 Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF
- CVE-2026-63353 Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF
- CVE-2026-63352 Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF