Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 510 of 1013.
- CVE-2026-59891 Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
- CVE-2026-59890 setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
- CVE-2026-5989 Tenda F451 RouteStatic fromRouteStatic stack-based overflow
- CVE-2026-59889 jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
- CVE-2026-59888 jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
- CVE-2026-59887 linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text
- CVE-2026-59886 pyasn1: Uncontrolled resource consumption when converting decoded REAL values
- CVE-2026-59885 pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
- CVE-2026-59884 pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs
- CVE-2026-59883 Guzzle: Cookie Disclosure and Injection via IP-Address Domains
- CVE-2026-59882 guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
- CVE-2026-59881 AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
- CVE-2026-59880 Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set
- CVE-2026-5988 Tenda F451 AdvSetWrlsafeset formWrlsafeset stack-based overflow
- CVE-2026-59879 Immutable.js `List` 32-bit trie overflow → unrecoverable DoS
- CVE-2026-59878 Denial of service in Apache ActiveMQ
- CVE-2026-59877 protobufjs: Denial of Service via infinite loop in .proto option parsing
- CVE-2026-59876 protobufjs: Text Format string map parsing can mutate returned map object prototype
- CVE-2026-59875 node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
- CVE-2026-59874 node-tar: Negative tar entry size causes infinite loop in archive replace
- CVE-2026-59873 node-tar: Decompression/parse DoS via unlimited input
- CVE-2026-59871 node-tar: Process crash via PAX numeric path type confusion
- CVE-2026-59870 js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing
- CVE-2026-5987 Code injection in PublicCMS
- CVE-2026-59869 js-yaml: YAML merge-key chains can force quadratic CPU consumption
- CVE-2026-59868 js-yaml: YAML merge-key chains can force quadratic CPU consumption
- CVE-2026-59867 Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
- CVE-2026-59866 Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
- CVE-2026-59865 Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
- CVE-2026-59864 Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
- CVE-2026-59863 Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF
- CVE-2026-59862 Kiota: Code Generation Literal Injection in the Python Generator
- CVE-2026-59861 Kiota: Code Generation Literal Injection in Kiota Ruby Generator
- CVE-2026-59860 Kiota: XML Doc-Comment Newline Breakout Code Injection
- CVE-2026-5986 Zod jsVideoUrlParser util.js getTime redos
- CVE-2026-59859 Kiota: Code Generation Literal Injection in the PHP Generator
- CVE-2026-59858 Vim: Arbitrary Code Execution via C Omni-Completion
- CVE-2026-59857 Vim: Out-of-bounds Write in SAL Soundfolding
- CVE-2026-59856 Vim: Arbitrary Code Execution via PHP Omni-Completion
- CVE-2026-59855 SiYuan: Store XSS To Rce via Asset.render
- CVE-2026-59854 SiYuan: Incomplete IsSensitivePath denylist: globalCopyFiles reads home-dir credential dotfiles into the workspace
- CVE-2026-59853 Missing authorization in siyuan
- CVE-2026-59851 Libssh: libssh: authentication bypass via missing gssapi principal check
- CVE-2026-59850 Libssh: libssh: use-after-free via data callbacks on closed channels
- CVE-2026-5985 code-projects Simple IT Discussion Forum crud.php sql injection
- CVE-2026-59849 Libssh: libssh: denial of service via automatic certificate authentication loop
- CVE-2026-59848 Libssh: libssh: denial of service via sftp responses with unknown request ids
- CVE-2026-59847 Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification
- CVE-2026-59846 Libssh: libssh: information disclosure via proxycommand %r username expansion
- CVE-2026-59845 Libssh: libssh: denial of service via unchecked proxycommand fork() failure
- CVE-2026-59844 Libssh: libssh: denial of service via oversized sftp read length
- CVE-2026-59843 Libssh: libssh: denial of service via zero advertised channel packet size
- CVE-2026-59842 Libssh: libssh: information disclosure via short gssapi curve25519 public key
- CVE-2026-59841 Privilege escalation in FortiSIEMWindowsAgent
- CVE-2026-59840 Memory corruption in FortiOS
- CVE-2026-5984 D-Link DIR-605L POST Request formSetLog buffer overflow
- CVE-2026-59839 Path traversal in FortiOS
- CVE-2026-59838 Cross-site scripting in FortiSIEM
- CVE-2026-59837 Memory corruption in FortiOS
- CVE-2026-59836 Security feature bypass in FortiClientEMS
- CVE-2026-59835 Information disclosure in FortiSandbox
- CVE-2026-59834 SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content
- CVE-2026-59833 SiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)
- CVE-2026-59832 Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db
- CVE-2026-59831 GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace
- CVE-2026-59830 Discourse: Stored XSS via unescaped actor name in post actions
- CVE-2026-5983 D-Link DIR-605L POST Request formSetDDNS buffer overflow
- CVE-2026-59829 Discourse: Review queue exposes flag-related private message excerpts to category group moderators
- CVE-2026-59828 Discourse: Hidden post revisions leak through adjacent visible diffs
- CVE-2026-59827 Metabase: Unsafe Deserialization of H2 Query Results
- CVE-2026-59826 Metabase: Arbitrary Code Execution via Database Connection Detail Bypass
- CVE-2026-59825 Mastodon: Unwanted deactivation of SSL/TLS certificate verification
- CVE-2026-59823 LiteLLM: Server-side request forgery via the `user_config` request parameter in LiteLLM Proxy
- CVE-2026-59822 BerriAI LiteLLM Improper Authentication
- CVE-2026-59821 LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
- CVE-2026-59820 LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CVE-2026-5982 D-Link DIR-605L POST Request formAdvNetwork buffer overflow
- CVE-2026-59819 LiteLLM: Local file read via request-supplied OIDC file references
- CVE-2026-59818 etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation
- CVE-2026-59817 Ghost: Paid gift memberships obtainable at minimal cost via the donations feature
- CVE-2026-59816 Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash
- CVE-2026-59815 Joplin: Pending share recipients can write items into shared folders before accepting invitations
- CVE-2026-59814 Joplin: Stored XSS via inline-served note attachment on published shares
- CVE-2026-5981 D-Link DIR-605L POST Request formAdvFirewall buffer overflow
- CVE-2026-59809 SiYuan before v3.8.0 Secret Exfiltration via http_request URL
- CVE-2026-59808 AVideo Authentication Bypass via Unkeyed Video Hash Disclosure
- CVE-2026-59807 Composio SDK < 0.2.32-beta.283 - Sensitive File Upload via tool-file-uploads.ts
- CVE-2026-59806 Gradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint
- CVE-2026-59805 Gumroad < 2026.07.06.2 - Insecure Direct Object Reference in PurchasesController
- CVE-2026-59804 Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket
- CVE-2026-59803 rpcx - Denial of Service via Gzip Decompression Bomb in Wire Protocol
- CVE-2026-59802 PasswordPusher < 2.8.1 - Redirect-Based XSS via data URI in URL Push Payload
- CVE-2026-59801 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers
- CVE-2026-59800 9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint
- CVE-2026-5980 D-Link DIR-605L POST Request formSetMACFilter buffer overflow
- CVE-2026-59799 Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow
- CVE-2026-59797 Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function
- CVE-2026-59796 Missing authorization in TeamCity
- CVE-2026-59795 Cross-site scripting in TeamCity
- CVE-2026-59794 Cross-site scripting in TeamCity