Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 511 of 1013.
- CVE-2026-59793 Path traversal in TeamCity
- CVE-2026-59792 Path traversal in IntelliJ IDEA
- CVE-2026-59791 Cross-site scripting in YouTrack
- CVE-2026-5979 D-Link DIR-605L POST Request formVirtualServ buffer overflow
- CVE-2026-59788 Stored XSS vulnerability in OAuth configuration form
- CVE-2026-59787 SNMP trap injection in zabbix_trap_receiver.pl
- CVE-2026-59786 Active agent heartbeat missing TLS check
- CVE-2026-59785 Hidden host credentials inferable via multiselect.get filtering
- CVE-2026-59783 Server DoS via binary items
- CVE-2026-59782 JavaScript preprocessing memory disclosure
- CVE-2026-59781 Misconfiguration in Zabbix
- CVE-2026-59780 Apache CloudStack: LDAP provider configuration disclosure
- CVE-2026-5978 Totolink A7100RU CGI cstecgi.cgi setWiFiAclRules os command injection
- CVE-2026-59776 Weak cryptography in FeliCa IC chips
- CVE-2026-59774 Gitea Org-mode file disclosure and code execution
- CVE-2026-5977 Totolink A7100RU CGI cstecgi.cgi setWiFiBasicCfg os command injection
- CVE-2026-59769 Hardcoded credentials in FA-50
- CVE-2026-59766 Gitea private repository metadata disclosure after access revocation
- CVE-2026-59765 SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
- CVE-2026-59764 Command injection in WRC-X3000GS3-B
- CVE-2026-59763 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
- CVE-2026-59762 BIG-IP HTTP/2 vulnerability
- CVE-2026-5976 Totolink A7100RU CGI cstecgi.cgi setStorageCfg os command injection
- CVE-2026-5975 Totolink A7100RU CGI cstecgi.cgi setDmzCfg os command injection
- CVE-2026-5974 FoundationAgents MetaGPT terminal.py Bash.run os command injection
- CVE-2026-59739 Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
- CVE-2026-59734 Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution
- CVE-2026-59733 rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories
- CVE-2026-59732 rclone archive extract allows S3 destination prefix escape via crafted archive paths
- CVE-2026-59731 Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
- CVE-2026-59730 @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect
- CVE-2026-5973 FoundationAgents MetaGPT common.py get_mime_type os command injection
- CVE-2026-59729 Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
- CVE-2026-59728 @astrojs/rss: XML Injection via Unescaped RSS Feed Fields
- CVE-2026-59727 Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
- CVE-2026-59726 Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment
- CVE-2026-59725 Socket.IO: Engine.IO Polling Transport Connection Exhaustion
- CVE-2026-59724 Socket.IO: Engine.IO WebTransport SID DoS
- CVE-2026-59723 Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
- CVE-2026-59721 Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection
- CVE-2026-59720 Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server
- CVE-2026-5972 FoundationAgents MetaGPT terminal.py Terminal.run_command os command injection
- CVE-2026-59717 Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing
- CVE-2026-59715 Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)
- CVE-2026-59714 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
- CVE-2026-59713 Leantime - OIDC Login CSRF via Unconditional State Verification Stub
- CVE-2026-59712 Leantime - JSON-RPC API Broken Access Control via users.getUser
- CVE-2026-59711 showdown - Cross-Site Scripting via Unescaped Metadata Title in completeHTMLDocument
- CVE-2026-59710 showdown - Stored XSS via Unescaped Table Header ID Attribute Injection
- CVE-2026-5971 FoundationAgents MetaGPT XML action_node.py ActionNode.xml_fill eval injection
- CVE-2026-59709 Ghostfolio - Unauthorized Portfolio Holding Tag Modification via Missing Permission Check
- CVE-2026-59708 Ghostfolio - Unauthorized Portfolio Data Exposure via Public Endpoint
- CVE-2026-59707 LocalAI - Server-Side Request Forgery via POST /models/apply
- CVE-2026-59706 mem0 - Unauthenticated Config API Exposure and SSRF via ollama_base_url
- CVE-2026-59705 mem0 - OpenMemory API Unauthenticated Access via Memory Endpoints
- CVE-2026-59704 Cap - Missing Access Control in Video AI Metadata Endpoint
- CVE-2026-59703 repomix - Local File Inclusion via file:// URL Scheme in Git Clone Endpoint
- CVE-2026-59702 repomix - Server-Side Request Forgery via Unvalidated Repository URLs in POST /api/pack
- CVE-2026-59701 Memory corruption in Simcenter Femap
- CVE-2026-59700 Memory corruption in Simcenter Femap
- CVE-2026-5970 FoundationAgents MetaGPT HumanEvalBenchmark/MBPPBenchmark check_solution code injection
- CVE-2026-59696 uri_string does not bound the port component of a URI before integer conversion
- CVE-2026-59695 Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain
- CVE-2026-59694 Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment
- CVE-2026-59693 Denial of service in Desigo DXR2
- CVE-2026-59692 Gstreamer1-plugins-bad-free: gstreamer: dtls certificate subject dn stack buffer overflow in openssl_verify_callback
- CVE-2026-59691 Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer
- CVE-2026-59690 Missing authorization in ECS Connection Manager
- CVE-2026-59689 Privilege escalation in ECS Connection Manager
- CVE-2026-59688 Command injection in ECS Connection Manager
- CVE-2026-59687 Command injection in ECS Connection Manager
- CVE-2026-59686 Command injection in ECS Connection Manager
- CVE-2026-59685 Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM
- CVE-2026-59683 OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings
- CVE-2026-59682 Arbitrary file overwrite and deletion local and remote in OpenRGB
- CVE-2026-59681 yast2-auth-client: OS command injection via unsanitized Organizational Unit / dnsHostName in AD join
- CVE-2026-59680 yast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute
- CVE-2026-59679 fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2
- CVE-2026-59678 Missing authorization in PortProtonQt
- CVE-2026-59677 Process Kill Attack Vector in killall() in seunshare
- CVE-2026-59676 Local File Deletion Attack Vector in rm_rf() in seunshare
- CVE-2026-59675 Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service
- CVE-2026-59674 LPE from suricata user to root due to chown in %post in suricata packaging
- CVE-2026-59673 Multiple vulnerabilities in the Repasat application
- CVE-2026-59672 Multiple vulnerabilities in the Repasat application
- CVE-2026-59671 Multiple vulnerabilities in the Repasat application
- CVE-2026-59670 Multiple vulnerabilities in the Repasat application
- CVE-2026-5967 TeamT5｜ThreatSonar Anti-Ransomware - Privilege Escalation
- CVE-2026-59669 Multiple vulnerabilities in the Repasat application
- CVE-2026-59668 Multiple vulnerabilities in the Repasat application
- CVE-2026-59667 Multiple vulnerabilities in the Repasat application
- CVE-2026-59666 Multiple vulnerabilities in the Repasat application
- CVE-2026-59665 Multiple vulnerabilities in the Repasat application
- CVE-2026-59664 Multiple vulnerabilities in the Repasat application
- CVE-2026-59663 Multiple vulnerabilities in the Repasat application
- CVE-2026-59662 Multiple vulnerabilities in the Repasat application
- CVE-2026-59661 Multiple vulnerabilities in the Repasat application
- CVE-2026-59660 Multiple vulnerabilities in the Repasat application
- CVE-2026-5966 TeamT5｜ThreatSonar Anti-Ransomware - Arbitrary File Deletion
- CVE-2026-59659 Multiple vulnerabilities in the Repasat application