Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 492 of 1013.
- CVE-2026-61859 ImageMagick before 7.1.2-26 Policy Bypass via script operation
- CVE-2026-61858 ImageMagick before 7.1.2-26 Policy Bypass via APNG encoder
- CVE-2026-61857 ImageMagick before 7.1.2-26 Heap Use-After-Free via XMP
- CVE-2026-61855 Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail
- CVE-2026-61852 Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool
- CVE-2026-61851 Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool
- CVE-2026-61844 FileRise: Folder Metadata Filename Collisions Bypass "read_own" Isolation
- CVE-2026-61843 FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares
- CVE-2026-61842 Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
- CVE-2026-6184 code-projects Simple Content Management System welcome.php cross site scripting
- CVE-2026-61838 Lychee: Album password bypass in ZIP downloads
- CVE-2026-61837 Missing authorization in rabbitmq-server
- CVE-2026-61836 Directus: Authorization-dependent response served from unsegmented cache key
- CVE-2026-61835 Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
- CVE-2026-61834 scim-patch: Mutation of Inherited Built-in Method Objects
- CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
- CVE-2026-6183 code-projects Simple Content Management System index.php sql injection
- CVE-2026-61828 Misconfiguration in nixpkgs
- CVE-2026-61825 code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
- CVE-2026-61824 Defuddle: XSS via unescaped attribute interpolation in site extractors
- CVE-2026-61823 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute
- CVE-2026-61822 pg_partman disable maintenance for all partition sets
- CVE-2026-61821 pg_partman authorization bypass to move child tables between schemas during retention
- CVE-2026-61820 pg_partman privilege escalation via SQL injection when inheriting template properties
- CVE-2026-6182 code-projects Simple Content Management System login.php sql injection
- CVE-2026-61819 pg_partman privilege escalation via SQL injection in when using pg_jobmon and encountering exception
- CVE-2026-61818 pg_partman SQL injection in undo partition time encoder
- CVE-2026-61817 pg_partman privilege escalation via SQL injection in several functions via time decoder
- CVE-2026-61816 zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME
- CVE-2026-61815 zbateson/mail-mime-parser has CRLF header injection via attachment filename
- CVE-2026-61814 Jawn: Quadratic parsing effort in AsyncParser
- CVE-2026-61811 Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion
- CVE-2026-6181 Auth bypass in AXIS OS
- CVE-2026-61808 LightRAG: Missing Authentication for Critical API Functions in Default Configuration
- CVE-2026-61807 Snipe-IT: Stored DOM XSS via table selected-count IDs
- CVE-2026-61802 Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config
- CVE-2026-61801 github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files
- CVE-2026-61800 Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)
- CVE-2026-6180 PaperCut MF: Card truncation on HP readers
- CVE-2026-61795 Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation
- CVE-2026-61794 Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic
- CVE-2026-61793 Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
- CVE-2026-61792 Path traversal in weblate
- CVE-2026-61791 OCO-Server: Stored XSS through agent hostnames in command buttons
- CVE-2026-61790 Weblate: Team-enforced 2FA is bypassed for global permissions
- CVE-2026-6179 Stored Cross Site Scripting in NightWolf Penetration Testing Platform
- CVE-2026-61788 @bytebase/dbhub's read-only mode does not prevent database writes
- CVE-2026-61784 xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS
- CVE-2026-61783 Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key
- CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata
- CVE-2026-61781 pg_partman has privilege escalation through SQL injection in create_partition_time()
- CVE-2026-6178 Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode
- CVE-2026-61779 Deserialization in Megatron Bridge
- CVE-2026-61778 Deserialization in Megatron Bridge
- CVE-2026-61777 Deserialization in Megatron Bridge
- CVE-2026-61776 Deserialization in Megatron Bridge
- CVE-2026-61775 Deserialization in Megatron Bridge
- CVE-2026-61774 Deserialization in Megatron Bridge
- CVE-2026-61773 Deserialization in Megatron Bridge
- CVE-2026-61772 Deserialization in Megatron Bridge
- CVE-2026-61771 Deserialization in Megatron Bridge
- CVE-2026-61770 Deserialization in Megatron Bridge
- CVE-2026-6177 Custom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet Text
- CVE-2026-61769 Deserialization in Megatron Bridge
- CVE-2026-61768 Deserialization in Megatron Bridge
- CVE-2026-61767 Deserialization in Megatron Bridge
- CVE-2026-61766 Deserialization in Megatron Bridge
- CVE-2026-61765 Deserialization in Megatron Bridge
- CVE-2026-61764 Deserialization in Megatron Bridge
- CVE-2026-61763 Deserialization in Megatron Bridge
- CVE-2026-61762 Deserialization in Megatron Bridge
- CVE-2026-61761 Deserialization in Megatron Bridge
- CVE-2026-61760 Deserialization in Megatron Bridge
- CVE-2026-6176 Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form
- CVE-2026-61759 Deserialization in Megatron Bridge
- CVE-2026-61758 Deserialization in Megatron Bridge
- CVE-2026-61757 Deserialization in Megatron Bridge
- CVE-2026-61756 Deserialization in Megatron Bridge
- CVE-2026-61755 Deserialization in Megatron Bridge
- CVE-2026-61754 Deserialization in Megatron Bridge
- CVE-2026-61753 Deserialization in Megatron Bridge
- CVE-2026-61752 Deserialization in Megatron Bridge
- CVE-2026-61751 Deserialization in Megatron Bridge
- CVE-2026-61750 Deserialization in Megatron Bridge
- CVE-2026-61749 InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure
- CVE-2026-61748 InvenTree: Report/Label print endpoints ignore per-model permissions
- CVE-2026-61747 Missing authorization in InvenTree
- CVE-2026-61746 InvenTree: Plugin-settings GET endpoints are readable without authentication
- CVE-2026-61745 Missing authorization in InvenTree
- CVE-2026-61744 Missing authorization in InvenTree
- CVE-2026-61743 Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation
- CVE-2026-61742 DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution
- CVE-2026-61741 http4s-scala-xml has an XML External Entity (XXE) processing issue
- CVE-2026-61740 LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
- CVE-2026-6174 CC Child Pages <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more' Parameter
- CVE-2026-61736 LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
- CVE-2026-61732 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
- CVE-2026-6173 Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter
- CVE-2026-61726 Missing authorization in recipes
- CVE-2026-61723 FluidSynth: DLS ptbl Chunk Integer Overflow