Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 494 of 1013.
- CVE-2026-61567 AVideo-Encoder: unauthenticated command execution through streamer login trust
- CVE-2026-61564 AVideo-Encoder: unauthenticated installer PHP code injection
- CVE-2026-61560 @zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
- CVE-2026-6156 Totolink A7100RU CGI cstecgi.cgi setIpQosRules os command injection
- CVE-2026-61559 @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
- CVE-2026-61556 LiquidJS: An infinite loop vulnerability in `strip_html` filter
- CVE-2026-61555 OpenEXR: Empty multiView viewFromChannelName file crash
- CVE-2026-61554 emp3r0r has an unauthenticated HTTP Polling DoS
- CVE-2026-61552 Icinga 2 DSL Injection via Unescaped Import Template Name
- CVE-2026-61551 Icinga 2: Stack overflow via deeply nested JSON objects
- CVE-2026-61550 Icinga 2: Improper access control for JSON-RPC update certificate messages
- CVE-2026-6155 Totolink A7100RU CGI cstecgi.cgi setWanCfg os command injection
- CVE-2026-61549 Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend
- CVE-2026-61548 Rsyslog: mmpstrucdata stack buffer overflow with oversized RFC5424 structured data
- CVE-2026-61546 AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools
- CVE-2026-61544 libp2p-quic: Remote panic via certificate expiry race during QUIC handshake
- CVE-2026-61542 Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools
- CVE-2026-61541 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service
- CVE-2026-6154 Totolink A7100RU CGI cstecgi.cgi setWizardCfg os command injection
- CVE-2026-61539 Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing
- CVE-2026-61536 Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE
- CVE-2026-61534 Yayson: Prototype pollution in the Store/LegacyStore deserialization
- CVE-2026-6153 code-projects Vehicle Showroom Management System StaffDetailsFunction.php sql injection
- CVE-2026-61529 Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)
- CVE-2026-61526 AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler
- CVE-2026-61525 Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller
- CVE-2026-61524 WebsiteBaker CMS < 2.13.10 File Upload RCE via Module Installation
- CVE-2026-61523 WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor
- CVE-2026-61520 Simple Machines Forum SSRF via image proxy
- CVE-2026-6152 code-projects Vehicle Showroom Management System StaffAddingFunction.php sql injection
- CVE-2026-61519 Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember()
- CVE-2026-61518 ISPConfig Authenticated SQL Injection via Remote API primary_id Parameter
- CVE-2026-61517 Netis NX10 OS Command Injection via Ping Diagnostic Handler
- CVE-2026-61516 Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint
- CVE-2026-61515 Puwell IP Camera 2.x - 4.x Unauthenticated Command Injection via DebugShell
- CVE-2026-61514 Puwell IP Camera 2.x - 4.x Unauthenticated Access via TCP Port 23456
- CVE-2026-61511 vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
- CVE-2026-6151 code-projects Vehicle Showroom Management System PaymentStatusFunction.php sql injection
- CVE-2026-61505 Rejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang Parameter
- CVE-2026-61504 Rejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listing
- CVE-2026-61503 Rejetto HFS < 3.2.1 Username Enumeration via Login Response Differences
- CVE-2026-61502 Rejetto HFS < 3.2.1 Cross-Site Request Forgery via GET Requests
- CVE-2026-61501 Rejetto HFS < 3.2.1 Stored XSS in Admin Log Viewer
- CVE-2026-61500 Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key
- CVE-2026-6150 code-projects Simple Laundry System checkupdatestatus.php cross site scripting
- CVE-2026-61498 Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via gen_graphs.php
- CVE-2026-61492 Cross-site scripting in YouTrack
- CVE-2026-6149 code-projects Vehicle Showroom Management System BookVehicleFunction.php sql injection
- CVE-2026-61487 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations
- CVE-2026-61486 Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input
- CVE-2026-61484 Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS
- CVE-2026-61483 Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS
- CVE-2026-6148 code-projects Vehicle Showroom Management System MonthTotalReportUpdateFunction.php sql injection
- CVE-2026-61477 Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection
- CVE-2026-61474 MISP: Improper sharing group authorization check when adding attributes
- CVE-2026-6147 LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload
- CVE-2026-61466 Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation
- CVE-2026-61465 ImageMagick before 7.1.2-26 Memory Allocation Policy Bypass
- CVE-2026-61464 ImageMagick before 7.1.2-26 Heap Buffer Over-Write via X11
- CVE-2026-61463 Shiori Authenticated Privilege Escalation via PATCH /api/v1/auth/account
- CVE-2026-61462 mcp-gitlab Path Traversal via job_id Parameter
- CVE-2026-61461 Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text
- CVE-2026-61460 Krayin CRM Insecure Direct Object Reference via Controllers
- CVE-2026-6146 Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys
- CVE-2026-61459 MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools
- CVE-2026-61458 PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled Endpoint
- CVE-2026-61457 Grav before 1.0.3 Remote Code Execution via File Upload Extension Bypass
- CVE-2026-61456 Grav before 1.0.3 Stored XSS via SVG Upload API
- CVE-2026-61455 Grav before 2.0.1 Decompression Bomb via ZipArchiver
- CVE-2026-61454 Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__
- CVE-2026-61453 Grav before 2.0.1 XSS via Twig String Concatenation
- CVE-2026-61452 Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens
- CVE-2026-61451 Grav API Plugin before 1.0.4 Password Reset Token Poisoning via admin_base_url
- CVE-2026-61450 Grav before 2.0.2 Config Exfiltration via offsetGet Filter
- CVE-2026-6145 Missing authorization in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
- CVE-2026-61449 Grav before 2.0.2 Decompression Bomb via Forged ZIP Size
- CVE-2026-61448 Parse Server 9.0.0 Stored XSS via malformed Content-Type
- CVE-2026-61447 PraisonAI before 1.6.78 Remote Code Execution via CodeAgent
- CVE-2026-61446 PraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-Discovery
- CVE-2026-61445 PraisonAI before 4.6.78 Arbitrary File Write and Command Execution
- CVE-2026-61444 PraisonAI before 4.6.78 Code Injection via f-string
- CVE-2026-61443 PraisonAI before 1.6.78 Remote Code Execution via SkillTools
- CVE-2026-61442 PraisonAI Platform before 0.1.9 Authorization Bypass via PATCH
- CVE-2026-61441 PraisonAI Platform before 0.1.9 Authorization Bypass via Dependencies
- CVE-2026-61440 PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints
- CVE-2026-61439 PraisonAI before 4.6.78 Prompt Injection Defense Bypass
- CVE-2026-61438 PraisonAI before 4.6.78 Remote Code Execution via Broken AST Sandbox
- CVE-2026-61437 PraisonAI before 1.6.78 Remote Code Execution via tools.py
- CVE-2026-61436 PraisonAI before 4.6.78 Missing Webhook Signature Verification
- CVE-2026-61435 PraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing
- CVE-2026-61434 PraisonAI before 4.6.78 Allowlist Bypass via find -exec
- CVE-2026-61433 PraisonAI before 4.6.78 Code Injection via API deployment generator
- CVE-2026-61432 PraisonAI FastContext before 1.6.78 Path Traversal
- CVE-2026-61431 PraisonAI before 4.6.78 Path Traversal via ContextGatherer
- CVE-2026-61430 PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl
- CVE-2026-6143 farion1231 cc-switch ProxyServer server.rs cross-domain policy
- CVE-2026-61429 PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend
- CVE-2026-61428 PraisonAI AgentMail before 4.6.78 Message Injection via Webhook
- CVE-2026-61427 PraisonAI before 4.6.78 Authentication Bypass via HTTP-stream
- CVE-2026-61426 PraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure Defaults