Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 513 of 1013.
- CVE-2026-59502 Priority - CWE-203: Observable Discrepancy
- CVE-2026-59501 Priority – CWE-284: Improper Access Control
- CVE-2026-59500 Priority - CWE-287: Improper Authentication
- CVE-2026-5950 Unbounded resend loop in BIND 9 resolver
- CVE-2026-59499 Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CVE-2026-5947 SIG(0) validation during query flood may lead to undefined behavior
- CVE-2026-5946 Invalid handling of CLASS != IN
- CVE-2026-5944 Cisco Intersight Device Connector for Nutanix Prism Central Unauthenticated API Access
- CVE-2026-5943 Foxit PDF Editor/Reader AcroForm Annotation Use-After-Free Remote Code Execution Vulnerability
- CVE-2026-5942 Foxit PDF Editor/Reader AcroForm Signature Use-After-Free Vulnerability
- CVE-2026-5941 Foxit PDF Editor/Reader AcroForm Signature Remote Code Execution Vulnerability
- CVE-2026-5940 Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
- CVE-2026-5939 UAF in Foxit PDF Editor/Reader via XFA calculate event
- CVE-2026-5938 Foxit PDF Editor/Reader Infinite Loop Denial-of-Service Vulnerability
- CVE-2026-5937 Foxit PDF Editor/Reader's insufficient parameter validation leads to denial-of-service vulnerability
- CVE-2026-5936 Server-Side Request Forgery (SSRF) via URL Parameter in Foxit PDF Services API
- CVE-2026-59358 UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type
- CVE-2026-59357 Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions
- CVE-2026-59355 Spring Authorization Server: Open Redirect via request_uri parameter
- CVE-2026-59354 Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata
- CVE-2026-5935 TSSC/IMC is vulnerable to OS Command Injection
- CVE-2026-59347 VMware Workstation and Fusion HGFS stack-based buffer-overflow vulnerability
- CVE-2026-59346 VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability
- CVE-2026-59341 Sealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpoints
- CVE-2026-5934 Cross-site scripting in WP Rocket
- CVE-2026-59335 Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise
- CVE-2026-59328 Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips
- CVE-2026-59327 Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations
- CVE-2026-59326 HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server
- CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
- CVE-2026-59323 Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability
- CVE-2026-59322 EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders
- CVE-2026-59321 Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check
- CVE-2026-59320 In Spring AMQP the link credit never replenished on listener exception path
- CVE-2026-59319 RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure
- CVE-2026-59318 DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection
- CVE-2026-59317 Denial of service in Spring for Apache Kafka
- CVE-2026-59316 Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)
- CVE-2026-59315 Spring Cloud Config Monitor Denial of Service
- CVE-2026-59314 Spring Framework response splitting in ContentDisposition
- CVE-2026-59313 Server Sent Event stream corruption in Spring MVC functional web framework
- CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation
- CVE-2026-59310 Broadcom VMware vCenter Path Traversal
- CVE-2026-59309 vCenter authentication-bypass vulnerability
- CVE-2026-59308 Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation
- CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference
- CVE-2026-59306 Potential for deserialization of untrusted types in Spring Cloud Stream
- CVE-2026-59305 Partition interceptor may be improperly added while sending message
- CVE-2026-59304 Improper caching of the original content type in Spring Cloud Stream Avro
- CVE-2026-59303 Dynamic destination cache size is not properly bound in Spring Cloud Stream
- CVE-2026-59302 Potential for logging sensitive data in Spring Cloud Stream
- CVE-2026-59301 Potential for logging sensitive data in Spring Cloud Function Azure
- CVE-2026-59300 Potential for logging sensitive data in Spring Cloud Function AWS
- CVE-2026-59299 Composition lookup can potentially poison base function in Spring Cloud Function
- CVE-2026-59298 Potential for improper filtering of HTTP headers in Spring Cloud Function
- CVE-2026-59297 Spring Cloud Function can incorrectly determine if URI is secure
- CVE-2026-59296 Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability
- CVE-2026-59295 Micrometer instrumentation of Apache HttpAsyncClient DoS vulnerability
- CVE-2026-59294 Arbitrary File Write via Path Traversal in ResourceCacheService
- CVE-2026-59293 SMB minimum protocol dialect defaults to SMB1
- CVE-2026-59292 World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)
- CVE-2026-59291 Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function
- CVE-2026-59289 Spring for GraphQL Denial of Service via pagination support
- CVE-2026-59288 Spring for GraphQL Information Exposure in GraphiQL support
- CVE-2026-59287 Spring for GraphQL WebSocket Client Denial of Service
- CVE-2026-59286 Spring for GraphQL loads Untrusted Resources in GraphiQL support
- CVE-2026-59285 Spring for GraphQL Unsafe Deserialization in pagination support
- CVE-2026-59284 Spring Cloud Commons no allow list for writable env actuator endpoint
- CVE-2026-59283 Spring Framework Safety Guard Bypass via SpEL Expression Compilation
- CVE-2026-59282 Spring Framework Denial of Service via Unbounded List Growth in Data Binding
- CVE-2026-59281 Spring Framework Cross-site Scripting via EscapedErrors
- CVE-2026-59280 Spring Framework Path Traversal via Backslash in SpringTemplateLoader
- CVE-2026-5928 Potential buffer under-read in ungetwc
- CVE-2026-59279 Unbounded persistent session allocation via repeated initialize requests
- CVE-2026-59278 Server-side request forgery in Spring for Apache Kafka
- CVE-2026-59277 Spring Security InetAddressMatchers Incomplete Internal Network Classification
- CVE-2026-59276 Timing Attack via Non-Constant-Time Comparison of Sensitive Values
- CVE-2026-59275 Deserialization in Spring AMQP
- CVE-2026-59274 Unbounded decompression in UnZipTransformer enables zip-bomb DoS
- CVE-2026-59272 Log4j2 AmqpAppender disables TLS hostname verification by default
- CVE-2026-59271 Admin password disclosed in BrokerNotAliveException message
- CVE-2026-59270 Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
- CVE-2026-59269 Privilege escalation in Pinniped
- CVE-2026-59265 Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover
- CVE-2026-59262 AFFiNE - Unauthorized Document Edit History Access via GraphQL histories Field
- CVE-2026-59261 OpenClaw < 2026.5.28 - Credential Override via Workspace Dotenv Files
- CVE-2026-59260 OpenWrt luci-app-samba4 read ACL remote code execution via smbd
- CVE-2026-5926 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-59259 n8n - Permission Bypass via Expression Parser Mismatch in External Secrets
- CVE-2026-59258 immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser
- CVE-2026-59257 n8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpolation
- CVE-2026-59256 WWBN AVideo Unbound Token Authorization Bypass via Gallery
- CVE-2026-59255 BloodHound Missing Authorization on Custom Node Management API
- CVE-2026-59254 n8n - External Secrets Disclosure via Workflow Node Expressions
- CVE-2026-59253 n8n - Improper Authorization in Workflow Assignment to Folders
- CVE-2026-59252 Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain
- CVE-2026-59251 Denial of service via exponential certificate policy tree growth in path validation
- CVE-2026-59250 Megaco flex scanner buffer overflow via oversized property parm name
- CVE-2026-59249 Other in mint
- CVE-2026-59248 Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS