Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 493 of 1013.
- CVE-2026-61722 FluidSynth: DLS Articulation Chunk Integer Overflow
- CVE-2026-61721 FluidSynth: Heap-based buffer overrun for DLS samples
- CVE-2026-61720 FluidSynth: SF2 DMOD Chunk Unsigned Underflow
- CVE-2026-6172 Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter
- CVE-2026-61719 WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field
- CVE-2026-61718 bunkerweb: Read-only Web UI users can delete job cache files due to missing authorization on /cache/ routes
- CVE-2026-61714 FluidSynth: Heap Buffer Overflow in MIDI Player
- CVE-2026-61712 BuildKit: Possible runtime DoS via unbounded group parsing
- CVE-2026-61711 BuildKit: Custom frontend could bypass Seccomp/AppArmor
- CVE-2026-6171 Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
- CVE-2026-61709 OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user
- CVE-2026-61707 SOCFortress CoPilot: Stored case-report template injection permits backend code execution
- CVE-2026-61704 link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
- CVE-2026-61702 OpenPrinting CUPS: root-side banner file disclosure
- CVE-2026-61701 Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution
- CVE-2026-61700 MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests
- CVE-2026-6170 Cross-site scripting in Bold Page Builder
- CVE-2026-61699 nebula-mesh: Certificate revocation is never enforced at the mesh
- CVE-2026-61696 Forem: Stored XSS in Admin Abuse Report Rendering
- CVE-2026-61695 Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service
- CVE-2026-61690 Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
- CVE-2026-6169 affiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution
- CVE-2026-61688 SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props
- CVE-2026-61687 hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState
- CVE-2026-61686 SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop
- CVE-2026-61685 ReactPress has SQL injection via dynamic column names in TypeORM query builders
- CVE-2026-61684 FastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE_TOKEN_SECRET='token')
- CVE-2026-61682 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
- CVE-2026-61681 Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler
- CVE-2026-6168 TOTOLINK A7000R cstecgi.cgi setWiFiEasyGuestCfg stack-based overflow
- CVE-2026-61674 Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handler
- CVE-2026-61673 WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover
- CVE-2026-61672 Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement
- CVE-2026-61671 WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes
- CVE-2026-61670 microsandbox: Secret values exposed in world-readable process arguments
- CVE-2026-6167 code-projects Faculty Management System subject-print.php sql injection
- CVE-2026-61668 DIRAC: Pilot code downloaded over unverified HTTPS connection
- CVE-2026-61667 DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval
- CVE-2026-61666 websocket-driver: Denial of service via malformed Host header
- CVE-2026-61663 django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
- CVE-2026-6166 code-projects Vehicle Showroom Management System UpdateVehicleFunction.php sql injection
- CVE-2026-61654 Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key
- CVE-2026-61652 Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)
- CVE-2026-6165 code-projects Vehicle Showroom Management System Login_check.php sql injection
- CVE-2026-61647 @roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory
- CVE-2026-61646 FastGPT: Shared axios SSRF guard validates only the initial URL before following redirects
- CVE-2026-61645 Docat has Arbitrary File Upload exists in Upload API
- CVE-2026-61644 Missing authorization in FastGPT
- CVE-2026-61643 FastGPT: workflow runtime can execute another user's private HTTP toolset
- CVE-2026-61642 Squid Request Smuggling in HTTP Transfer-Encoding
- CVE-2026-61641 Wallos: OIDC account takeover via email-based account linking without `email_verified` check
- CVE-2026-61640 Wallos: SSRF via OIDC Token/UserInfo URL Configuration
- CVE-2026-6164 code-projects Lost and Found Thing Management addcat.php sql injection
- CVE-2026-61639 Wallos: Zip Slip path traversal in database restore writes files to webroot
- CVE-2026-61638 Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port
- CVE-2026-61634 RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max
- CVE-2026-61633 NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS
- CVE-2026-61632 PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
- CVE-2026-61630 nginx ignition has TOTP Reuse During Validity Window
- CVE-2026-6163 code-projects Lost and Found Thing Management catageory.php sql injection
- CVE-2026-61629 nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware
- CVE-2026-61628 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition
- CVE-2026-61625 VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root
- CVE-2026-6162 PHPGurukul Company Visitor Management System bwdates-reports-details.php cross site scripting
- CVE-2026-61617 Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion
- CVE-2026-61614 Information disclosure in SolidInvoice
- CVE-2026-61613 Cursor: Cloud Agent Browser Sandbox Escape
- CVE-2026-61612 @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
- CVE-2026-61611 Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks
- CVE-2026-61610 Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous
- CVE-2026-6161 code-projects Simple ChatBox Endpoint insert.php sql injection
- CVE-2026-61609 Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)
- CVE-2026-61608 Auth bypass in SolidInvoice
- CVE-2026-61607 Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer
- CVE-2026-61604 ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass
- CVE-2026-6160 code-projects Simple ChatBox Endpoint chatbox.sql SimpleChatbox_PHP file information disclosure
- CVE-2026-61599 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
- CVE-2026-61598 Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler
- CVE-2026-61597 djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags
- CVE-2026-61596 djust has broken object-level access control (IDOR)
- CVE-2026-61595 djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data
- CVE-2026-61594 djust has an authorization bypass on the WebSocket/SSE mount path
- CVE-2026-61593 djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session
- CVE-2026-61592 djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)
- CVE-2026-61591 djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)
- CVE-2026-61590 djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG
- CVE-2026-6159 code-projects Simple ChatBox Endpoint insert.php cross site scripting
- CVE-2026-61589 djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path
- CVE-2026-61588 djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client
- CVE-2026-6158 Totolink N300RH upgrade.so setUpgradeUboot os command injection
- CVE-2026-61576 Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key
- CVE-2026-61575 AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles
- CVE-2026-61574 authentik RAC: access any endpoint via an unrelated application
- CVE-2026-61573 AVideo-Encoder: reflected cross-site scripting in the login interface
- CVE-2026-61572 AVideo-Encoder: unauthenticated full-response server-side request forgery
- CVE-2026-61571 AVideo-Encoder: missing authentication on control and status endpoints
- CVE-2026-61570 MPXJ: XXE Vulnerability in MerlinReader
- CVE-2026-6157 Totolink A800R app.so setAppEasyWizardConfig buffer overflow
- CVE-2026-61569 AVideo-Encoder: pre-authentication streamer-login SQL injection
- CVE-2026-61568 @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport