Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 514 of 1013.
- CVE-2026-59247 Insufficient verification of Hex package metadata in Gleam
- CVE-2026-59246 Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory
- CVE-2026-59245 Privilege escalation in Apache Airflow FAB provider
- CVE-2026-59244 Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI
- CVE-2026-59243 Auth bypass in Apache Airflow FAB provider
- CVE-2026-59242 Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint
- CVE-2026-59241 Privilege escalation in SIMATIC WinCC V7.5
- CVE-2026-59240 IDOR in Prospero Flow CRM allows deletion of other users' notifications
- CVE-2026-5924 Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'
- CVE-2026-59239 Stored XSS in Prospero Flow CRM email body allows administrator account takeover
- CVE-2026-59238 Stored XSS in Pentestify via unsanitized finding images and report client logo
- CVE-2026-59237 IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders
- CVE-2026-59236 Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection
- CVE-2026-59235 Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts
- CVE-2026-59234 Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion
- CVE-2026-59233 Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation
- CVE-2026-59232 Stored Cross-site Scripting in Prospero Flow CRM lead name field
- CVE-2026-59231 Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs
- CVE-2026-59230 Apache Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled
- CVE-2026-5923 Poly Voice – Potential Unauthorized Modification of WebUI using CSRF Attack
- CVE-2026-59229 Apache IoTDB: Legacy Pipe Privilege Escalation
- CVE-2026-59227 Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission
- CVE-2026-59226 Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation
- CVE-2026-59225 Open WebUI: Arena task endpoints can bypass underlying model access controls
- CVE-2026-59224 Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)
- CVE-2026-59223 Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching
- CVE-2026-59222 Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials
- CVE-2026-59221 open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
- CVE-2026-59220 Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config
- CVE-2026-5922 Poly Voice – Potential Unauthorized Modification of WebUI using XSS Attack
- CVE-2026-59219 Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
- CVE-2026-59218 Open WebUI: Account enumeration via observable login timing discrepancy
- CVE-2026-59217 Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)
- CVE-2026-59216 Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
- CVE-2026-59215 Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding
- CVE-2026-59214 Open WebUI: Stored web worker XSS via Pyodide
- CVE-2026-59213 Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)
- CVE-2026-59212 Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
- CVE-2026-5921 Server-side request forgery in Enterprise Server
- CVE-2026-59209 n8n: Shared Credential Header Leak via HTTP Request Pagination Expression
- CVE-2026-59208 n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution
- CVE-2026-59207 n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector
- CVE-2026-59206 n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration
- CVE-2026-59205 Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch
- CVE-2026-59204 Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
- CVE-2026-59203 Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
- CVE-2026-59200 Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
- CVE-2026-5920 Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter
- CVE-2026-59199 Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
- CVE-2026-59198 Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
- CVE-2026-59197 Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
- CVE-2026-59196 pnpm: hoisted install imports lockfile alias outside node_modules
- CVE-2026-59195 pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
- CVE-2026-59194 pnpm: patch-remove could delete project-selected files outside the patches directory
- CVE-2026-59193 Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
- CVE-2026-59190 Grav Admin Plugin — IDOR Privilege Escalation via saveUser()
- CVE-2026-5919 Security feature bypass in Chrome
- CVE-2026-59189 OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin
- CVE-2026-59188 Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer
- CVE-2026-59187 OpenEXR: exrmetrics deep pixelmode heap buffer overflow
- CVE-2026-59186 OpenEXR: Heap out-of-bounds write in TiledRgbaInputFile via integer overflow on 32-bit (ILP32) builds
- CVE-2026-59185 identrail: Cross-tenant GitHub installation binding without ownership verification
- CVE-2026-59184 OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write
- CVE-2026-59183 OpenEXR: Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding
- CVE-2026-59181 OpenImageIO: Stack buffer overflow in OpenImageIO Cineon reader via unchecked numberOfElements
- CVE-2026-59180 Apprise forwards configured auth headers across cross-origin HTTP redirects
- CVE-2026-5918 Information disclosure in Chrome
- CVE-2026-59179 OpenHop: Path Traversal in Flow ID File Operations
- CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
- CVE-2026-59177 ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces
- CVE-2026-59176 Functype: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + Dynamic Import
- CVE-2026-59173 Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions
- CVE-2026-59172 Joker linter executed project-local .jokerd/linter.* files during linting
- CVE-2026-5917 libgit2 Shell Command Injection via ssh_libssh2 Backend
- CVE-2026-59168 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS
- CVE-2026-59167 SunEditor: Critical XSS vulnerability - sanitizer bypass
- CVE-2026-59164 NORA missing cross-user token-management authorization
- CVE-2026-59163 Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass
- CVE-2026-59162 Excelize: Negative shared-string index causes panic in GetCellValue and GetRows
- CVE-2026-59161 Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation
- CVE-2026-59160 Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/run
- CVE-2026-59158 Nuxt Ollama: public runtime configuration discloses the configured cloud API key
- CVE-2026-59157 webhookd: Unrestricted HTTP Header to Shell Variable Injection
- CVE-2026-59156 OpenImageIO: Unbounded recursion in FITS header parser leads to stack overflow
- CVE-2026-59155 Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API
- CVE-2026-59154 Wekan: Checklist direct DDP updates can write checklist data into private boards
- CVE-2026-59153 Anki's local HTTP server does not sufficiently validate requests
- CVE-2026-59152 Arbitrary server-side file read in LangSmith SDK TracingMiddleware
- CVE-2026-59151 Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover
- CVE-2026-5915 Memory corruption in Chrome
- CVE-2026-59149 Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
- CVE-2026-59148 Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
- CVE-2026-59147 Memory corruption in Data::DisjointSet::Shared
- CVE-2026-59146 Memory corruption in Data::SpatialHash::Shared
- CVE-2026-59145 Memory corruption in Data::Intern::Shared
- CVE-2026-59144 Memory corruption in Data::RingBuffer::Shared
- CVE-2026-59143 Memory corruption in Data::RoaringBitmap::Shared
- CVE-2026-59142 Memory corruption in Data::HashMap::Shared
- CVE-2026-59141 Memory corruption in Data::RadixTree::Shared
- CVE-2026-59140 Memory corruption in Data::SortedSet::Shared