Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 509 of 1013.
- CVE-2026-60001 Security feature bypass in OpenSSH
- CVE-2026-60000 Denial of service in OpenSSH
- CVE-2026-6000 code-projects Online Library Management System SQL Database Backup File library.sql information disclosure
- CVE-2026-59999 Security feature bypass in OpenSSH
- CVE-2026-59998 Security feature bypass in OpenSSH
- CVE-2026-59997 Security feature bypass in OpenSSH
- CVE-2026-59996 Path traversal in OpenSSH
- CVE-2026-59995 Path traversal in OpenSSH
- CVE-2026-59994 EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received
- CVE-2026-59992 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)
- CVE-2026-59991 psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry
- CVE-2026-59990 Jawn: Uncontrolled nesting depth in JSON parser
- CVE-2026-5999 JeecgBoot SysAnnouncementController improper authorization
- CVE-2026-59989 Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)
- CVE-2026-59985 OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32
- CVE-2026-59984 OpenEXR: Scratch buffer overflow decoding B44-compressed InputFile on ILP32
- CVE-2026-59983 OpenEXR: Out-of-bounds read in DeepTiledInputFile sample-count table decode on ILP32
- CVE-2026-59982 OpenEXR: DWAA InputFile AC buffer overflow on ILP32 platforms
- CVE-2026-59981 OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow
- CVE-2026-59980 hpack: Unbounded variable integer decoding can cause run-away computation on malformed input
- CVE-2026-5998 zhayujie chatgpt-on-wechat CowAgent API Memory Content Endpoint service.py dispatch path traversal
- CVE-2026-59979 YosemiteCrew: Missing organization authorization on service and PMS library/template routes
- CVE-2026-59977 ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction
- CVE-2026-59976 ConvertX: Path Traversal vulnerability leading to Arbitrary File Write
- CVE-2026-59974 Stanza: Zip Slip Path Traversal in Model/Resource Extraction
- CVE-2026-59973 mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi
- CVE-2026-59971 MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)
- CVE-2026-59970 Tandoor Recipes: Blind SSRF via AI provider URL (api_base)
- CVE-2026-5997 Totolink A7100RU CGI cstecgi.cgi setLoginPasswordCfg os command injection
- CVE-2026-59969 Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
- CVE-2026-59967 Missing authorization in recipes
- CVE-2026-59966 Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns
- CVE-2026-59965 @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission
- CVE-2026-59963 Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints
- CVE-2026-59962 Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes
- CVE-2026-59960 Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core
- CVE-2026-5996 Totolink A7100RU CGI cstecgi.cgi setAdvancedInfoShow os command injection
- CVE-2026-59959 SAIL: WebP decoder division by zero through malformed animated canvas metadata
- CVE-2026-59956 OpenImageIO: Heap-buffer-overread in IffInput::readimg() when ZBUFFER flag is set
- CVE-2026-59955 Apollo ConfigService access key authentication bypass via raw config file appId parsing
- CVE-2026-59954 Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching
- CVE-2026-59952 Valibot: record() issue paths can make flatten() throw for inherited Object property names
- CVE-2026-59951 MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
- CVE-2026-59950 MCP Python SDK: WebSocket server transport does not support Host/Origin validation
- CVE-2026-5995 Totolink A7100RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection
- CVE-2026-59949 LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges
- CVE-2026-59948 Composer: Arbitrary file write outside vendor via malicious transitive package name
- CVE-2026-59947 Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
- CVE-2026-59946 Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
- CVE-2026-59944 Composer: CVE-2026-59946 fix bypass via symlinked package bin path
- CVE-2026-59943 Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem
- CVE-2026-59942 Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
- CVE-2026-59941 Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
- CVE-2026-59940 seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
- CVE-2026-5994 Totolink A7100RU CGI cstecgi.cgi setTelnetCfg os command injection
- CVE-2026-59939 httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
- CVE-2026-59938 pypdf: Possible large memory usage for wrong image dimensions
- CVE-2026-59937 pypdf: Possible long runtimes for repeated malformed cross-reference entries
- CVE-2026-59936 pypdf: Possible infinite loop for not terminated inline images
- CVE-2026-59935 pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
- CVE-2026-59933 PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
- CVE-2026-59932 PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
- CVE-2026-59931 PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
- CVE-2026-59930 Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content
- CVE-2026-5993 Totolink A7100RU CGI cstecgi.cgi setWiFiGuestCfg os command injection
- CVE-2026-59929 Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
- CVE-2026-59928 Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
- CVE-2026-59927 Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
- CVE-2026-59926 Mistune: XSS via unescaped class option in Admonition directive
- CVE-2026-59925 inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
- CVE-2026-59924 Mistune: Arbitrary File Read via Include directive path traversal
- CVE-2026-59923 Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
- CVE-2026-59922 Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
- CVE-2026-59921 Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
- CVE-2026-59920 Netty: STOMP CONNECT Frame Header Injection
- CVE-2026-5992 Tenda F451 P2pListFilter fromP2pListFilter stack-based overflow
- CVE-2026-59919 Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address
- CVE-2026-59917 Privilege escalation in Display and Peripheral Manager (DDPM Windows)
- CVE-2026-59916 Privilege escalation in Display and Peripheral Manager (DDPM Windows)
- CVE-2026-59915 Privilege escalation in Alienware Command Center (AWCC)
- CVE-2026-59914 Auth bypass in Display and Peripheral Manager (DDPM Windows)
- CVE-2026-59913 Missing authorization in Display and Peripheral Manager (DDPM Mac)
- CVE-2026-59912 Privilege escalation in Display and Peripheral Manager (DDPM Mac)
- CVE-2026-59911 Information disclosure in ObjectScale
- CVE-2026-59910 Command injection in ObjectScale
- CVE-2026-5991 Tenda F451 WrlExtraSet formWrlExtraSet stack-based overflow
- CVE-2026-59909 Path traversal in ObjectScale
- CVE-2026-59903 Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite
- CVE-2026-59902 Netty: Memory Exhaustion in SctpMessageCompletionHandler
- CVE-2026-59901 Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang
- CVE-2026-59900 Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass
- CVE-2026-5990 Tenda F451 SafeEmailFilter fromSafeEmailFilter stack-based overflow
- CVE-2026-59899 Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service
- CVE-2026-59898 Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation
- CVE-2026-59897 Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
- CVE-2026-59896 hono/jsx does not isolate context per request, leading to cross-request data disclosure
- CVE-2026-59895 Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
- CVE-2026-59894 sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes
- CVE-2026-59893 sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
- CVE-2026-59892 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header