Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 488 of 1013.
- CVE-2026-62362 PeerBanHelper: SQL injection via ${field} interpolation in MyBatis mapper for analysis endpoint
- CVE-2026-62361 SQL injection in listmonk
- CVE-2026-6236 Posts map <= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute
- CVE-2026-62357 DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds write
- CVE-2026-62355 TDengine: Standard User permission unexpect
- CVE-2026-62354 Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests
- CVE-2026-62353 TDengine: Authenticated Out-of-Bounds Read in SQL Lexer tGetToken
- CVE-2026-62351 TDengine: Unauthenticated Remote Denial of Service via Out-of-Bounds Read in transDecompressMsg
- CVE-2026-62350 TDengine: UDF lead to RCE
- CVE-2026-6235 Sendmachine for WordPress <= 1.0.20 - Unauthenticated SMTP Hijack to Privilege Escalation via manage_admin_requests
- CVE-2026-62349 TDengine: Off-by-One Buffer Overflow
- CVE-2026-62348 TDengine: KILL SSMIGRATE missing authorization lets low-privilege users interrupt shared-storage migrations
- CVE-2026-62343 ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided
- CVE-2026-62328 9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints
- CVE-2026-62327 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats
- CVE-2026-62326 Weblate Has Uncontrolled Resource Consumption via
- CVE-2026-62325 goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)
- CVE-2026-62324 Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
- CVE-2026-62323 Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored
- CVE-2026-62322 Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)
- CVE-2026-6232 Out-of-bounds write in LR11xx Transceiver
- CVE-2026-62317 Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)
- CVE-2026-62316 Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution
- CVE-2026-62315 Frappe: Mass assignment via set_value
- CVE-2026-62314 Anubis: Policy bypass via client controlled X-Original-URI header
- CVE-2026-62313 Incus: Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`
- CVE-2026-62312 9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments
- CVE-2026-6231 bson_validate may skip validation when processing certain inputs
- CVE-2026-62309 CoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoS
- CVE-2026-62308 Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint
- CVE-2026-6230 Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter
- CVE-2026-62299 Null dereference in coredns
- CVE-2026-62296 HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service
- CVE-2026-62295 HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service
- CVE-2026-62294 Flameshot: OCTOU symlink attack via predictable /tmp path in Flameshot "Open With"
- CVE-2026-62293 HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles
- CVE-2026-62292 libheif: Out-of-bounds read in uncompressed unci tile range slicing
- CVE-2026-62291 Memory corruption in libheif
- CVE-2026-62290 cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials
- CVE-2026-6229 Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter
- CVE-2026-62289 libheif: Integer underflow in Fraction constructor via double clap transform application
- CVE-2026-62286 Dozzle label filters do not restrict container event and statistics streams
- CVE-2026-62283 Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check
- CVE-2026-62282 OpenCVE: Server-Side Request Forgery (SSRF) in notifications
- CVE-2026-62280 OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
- CVE-2026-6228 Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form
- CVE-2026-62279 Missing authorization in lubelog
- CVE-2026-62278 Path traversal in lubelog
- CVE-2026-6227 BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter
- CVE-2026-62263 OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
- CVE-2026-62262 Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`
- CVE-2026-6226 Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injection
- CVE-2026-62253 Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)
- CVE-2026-62252 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
- CVE-2026-62251 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
- CVE-2026-6225 SQL injection in Taskbuilder – Project Management & Task Management Tool With Kanban Board
- CVE-2026-62249 Missing authorization in weblate
- CVE-2026-62247 Supabase Realtime: Incorrect Authorization
- CVE-2026-62246 Business logic in kamaji
- CVE-2026-62243 Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass
- CVE-2026-62242 Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration
- CVE-2026-62241 clawvet < 0.7.5 Hard-coded JWT Secret Session Forgery
- CVE-2026-62240 CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools
- CVE-2026-6224 nocobase plugin-workflow-javascript Vm.js createSafeConsole sandbox
- CVE-2026-62239 FlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py
- CVE-2026-62238 OpenRemote < 1.26.0 SQL Injection via Crosstab Export
- CVE-2026-62237 Grav < 2.0.4 ReDoS via regex_replace in Sandbox
- CVE-2026-62236 grav-plugin-login < 3.8.11 CSRF via regenerate2FASecret
- CVE-2026-62235 Grav Flex-Objects < 1.4.3 Authorization Bypass via API
- CVE-2026-62234 Grav < 2.0.4 SSRF via Unrestricted cURL Protocols
- CVE-2026-62233 grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey
- CVE-2026-62232 Grav < 2.0.4 2FA Bypass via Secret Regeneration
- CVE-2026-62231 Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator
- CVE-2026-62230 Grav < 2.0.4 File Access Bypass via Case Variation
- CVE-2026-6223 OTP Bypass in Bahçelievler Muncipality's BiHayat App
- CVE-2026-62229 OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching
- CVE-2026-62228 OpenClaw < 2026.6.5 Authorization Bypass via Node Exec Approvals
- CVE-2026-62227 OpenClaw 2026.4.14 < 2026.5.26 SSRF via Browser Snapshot
- CVE-2026-62226 OpenClaw 2026.3.28 < 2026.5.19 Authorization Bypass via Browser Act Route
- CVE-2026-62225 OpenClaw < 2026.5.18 Authorization Bypass via Skill Command Dispatch
- CVE-2026-62224 OpenClaw MS Teams < 2026.5.12 Authorization Bypass
- CVE-2026-62223 OpenClaw < 2026.5.18 Authorization Bypass via Device-pair
- CVE-2026-62222 OpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-mode
- CVE-2026-62221 OpenClaw 2026.5.12 < 2026.5.26 Authorization Bypass via allowFrom
- CVE-2026-62220 OpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass
- CVE-2026-6222 Missing authorization in Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- CVE-2026-62219 OpenClaw 2026.2.12 < 2026.5.26 Authorization Bypass via Blank Agent IDs
- CVE-2026-62218 OpenClaw 2026.1.20 < 2026.5.27 Authorization Bypass via device.pair.approve
- CVE-2026-62217 OpenClaw 2026.5.14-beta.1 < 2026.5.27 Authentication Bypass via exec approvals
- CVE-2026-62216 OpenClaw 2026.4.20 < 2026.5.28 Policy Bypass via Media Upload
- CVE-2026-62215 OpenClaw < 2026.6.5 Authentication Bypass via HTTP Canvas
- CVE-2026-62214 OpenClaw < 2026.5.28 Bot Framework SSRF via serviceUrl Parameter Validation
- CVE-2026-62213 OpenClaw < 2026.5.27 Token Leakage via MS Teams Outbound Requests
- CVE-2026-62212 OpenClaw < 2026.5.28 Authentication Bypass via safeFetch
- CVE-2026-62211 OpenClaw < 2026.6.1 Credential Redaction Bypass via Trajectory Export
- CVE-2026-62210 OpenClaw < 2026.6.1 Denial of Service via Remote Media URLs
- CVE-2026-62209 OpenClaw 2026.5.10-beta.1 < 2026.6.5 Authorization Bypass via agent-mode dispatch
- CVE-2026-62208 OpenClaw < 2026.6.5 Authorization Header Forwarding via SSE
- CVE-2026-62207 OpenClaw < 2026.6.5 Authentication Bypass via Admin Tools
- CVE-2026-62206 OpenClaw < 2026.6.9 Authentication Bypass via Moderation Actions