Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 517 of 1013.
- CVE-2026-58593 NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User
- CVE-2026-58592 Ladybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM Integration
- CVE-2026-58591 Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069
- CVE-2026-58590 FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068
- CVE-2026-5859 Integer overflow in Chrome
- CVE-2026-58589 FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067
- CVE-2026-58588 Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066
- CVE-2026-58587 Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065
- CVE-2026-58586 Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp
- CVE-2026-58583 FluxInk Color Management Driver local privilege escalation
- CVE-2026-58580 LobeChat 2.2.9 - Broken Object-Level Authorization in Message Sub-Resource Writes
- CVE-2026-5858 Memory corruption in Chrome
- CVE-2026-58579 RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name
- CVE-2026-58578 LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Import
- CVE-2026-58575 Auth bypass in PowerStore 1000T
- CVE-2026-58574 Missing authorization in PowerStore 1000T
- CVE-2026-58572 Code injection in PowerStore 1000T
- CVE-2026-58571 Command injection in PowerStore 1000T
- CVE-2026-5857 Contiki-NG MQTT Client Out-of-Bounds Write in PUBLISH Topic Parser via Persistent State Between TCP Segments
- CVE-2026-58569 Privilege escalation in PowerStore 1000T
- CVE-2026-58567 Command injection in PowerStore 1000T
- CVE-2026-58566 Privilege escalation in PowerStore 1000T
- CVE-2026-58565 Missing authorization in Dell Command Update (DCU)
- CVE-2026-58564 Misconfiguration in Dell Command Update (DCU)
- CVE-2026-58562 Missing authorization in Dell Command Update (DCU)
- CVE-2026-58561 Null dereference in HarmonyOS
- CVE-2026-58560 Null dereference in HarmonyOS
- CVE-2026-5856 Contiki-NG DNS/mDNS Resolver Out-of-Bounds Read via Unchecked skip_name Traversal Before Transaction-ID Validation
- CVE-2026-58559 Denial of service in EMUI
- CVE-2026-58558 Missing authorization in EMUI
- CVE-2026-58557 Denial of service in HarmonyOS
- CVE-2026-58556 Missing authorization in EMUI
- CVE-2026-58555 Security feature bypass in HarmonyOS
- CVE-2026-58554 Missing authorization in EMUI
- CVE-2026-58553 Memory corruption in HarmonyOS
- CVE-2026-58552 Memory corruption in HarmonyOS
- CVE-2026-58551 Memory corruption in HarmonyOS
- CVE-2026-58550 Memory corruption in HarmonyOS
- CVE-2026-5855 Contiki-NG LwM2M TLV Parser Out-of-Bounds Read via Unchecked Buffer Length in lwm2m_tlv_read
- CVE-2026-58549 Memory corruption in HarmonyOS
- CVE-2026-58547 Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability
- CVE-2026-58546 Windows Remote Desktop Client Information Disclosure Vulnerability
- CVE-2026-58545 Windows Kernel Security Feature Bypass Vulnerability
- CVE-2026-58544 Windows Management Services Elevation of Privilege Vulnerability
- CVE-2026-58543 Universal Print Management Service Elevation of Privilege Vulnerability
- CVE-2026-58542 Windows Media Remote Code Execution Vulnerability
- CVE-2026-58541 Microsoft DWM Core Library Elevation of Privilege Vulnerability
- CVE-2026-58540 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-5854 Totolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injection
- CVE-2026-58539 Windows Remote Desktop Client Information Disclosure Vulnerability
- CVE-2026-58538 Windows Bluetooth Service Elevation of Privilege Vulnerability
- CVE-2026-58537 Microsoft NAT Helper Components (ipnathlp.dll) Elevation of Privilege Vulnerability
- CVE-2026-58536 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
- CVE-2026-58535 Windows Remote Desktop Client Information Disclosure Vulnerability
- CVE-2026-58534 Windows Input Method Editor (IME) Elevation of Privilege Vulnerability
- CVE-2026-58533 Windows Remote Desktop Client Information Disclosure Vulnerability
- CVE-2026-58532 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-58531 Windows SMB Elevation of Privilege Vulnerability
- CVE-2026-58530 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
- CVE-2026-5853 Totolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injection
- CVE-2026-58529 Windows Active Directory Federation Services (ADFS) Information Disclosure Vulnerability
- CVE-2026-58528 Windows USB Audio Class Driver Information Disclosure Vulnerability
- CVE-2026-58527 Windows Runtime Elevation of Privilege Vulnerability
- CVE-2026-58526 Windows Storage Elevation of Privilege Vulnerability
- CVE-2026-58525 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- CVE-2026-58524 Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2026-58523 Microsoft Edge for Android Security Feature Bypass Vulnerability
- CVE-2026-58522 Microsoft Edge for Android Information Disclosure Vulnerability
- CVE-2026-58521 SQLi in Cargo extension via year range filter
- CVE-2026-58520 UrlShortener defaults to ineffective validation open to third-party redirects
- CVE-2026-5852 Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injection
- CVE-2026-58519 Stored XSS through Cargo's map format
- CVE-2026-58518 Cross-site request forgery in Mediawiki - RedirectManager Extension
- CVE-2026-58517 Blocked users can create and edit WikiLambda objects
- CVE-2026-58511 Webhook Authorization Header Returned in Plaintext via API
- CVE-2026-58510 Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
- CVE-2026-5851 Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injection
- CVE-2026-58508 Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
- CVE-2026-58507 Private Repository Existence Disclosure via go-get Meta Endpoint
- CVE-2026-58504 draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642
- CVE-2026-58503 Frappe: Unauthenticated User Enumeration via reset_password
- CVE-2026-58502 githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow
- CVE-2026-58501 Zeep SSRF because Settings.forbid_external is not enforced
- CVE-2026-58500 MCP Appium: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)
- CVE-2026-5850 Totolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injection
- CVE-2026-58499 Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id
- CVE-2026-58497 Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests
- CVE-2026-58496 ThorVG: Out-of-bounds Read in SFNT/TTF Font Loader via Memory API
- CVE-2026-58494 Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
- CVE-2026-58493 grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction
- CVE-2026-58492 grav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name Interpolation
- CVE-2026-58491 Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter
- CVE-2026-5849 Tenda i12 HTTP path traversal
- CVE-2026-58489 HedgeDoc: CSRF in GitHub Gist export callback
- CVE-2026-58488 HedgeDoc: Rate-limit bypass via CF-Connecting-IP header spoofing
- CVE-2026-58487 HedgeDoc: Stored HTML injection via email local-part
- CVE-2026-58486 HedgeDoc: Denial-of-service via YAML alias expansion in note frontmatter
- CVE-2026-58485 mcp-searxng: DNS-resolved Private Hostname SSRF in `web_url_read`
- CVE-2026-58484 Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning
- CVE-2026-58483 mcp-searxng: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`