Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 518 of 1013.
- CVE-2026-58482 Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
- CVE-2026-58481 Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
- CVE-2026-58480 Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments
- CVE-2026-5848 jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injection
- CVE-2026-58479 Sustainable Irrigation Platform 5.2.16 RCE via cli_control Plugin Command Injection
- CVE-2026-58478 Sustainable Irrigation Platform 5.2.16 SSRF via Node-RED Callback URL
- CVE-2026-58477 Sustainable Irrigation Platform 5.2.16 Mass Assignment via HTTP Parameters
- CVE-2026-58476 Sustainable Irrigation Platform 5.2.16 CSRF via Administrative GET Requests
- CVE-2026-58475 Sustainable Irrigation Platform 5.2.16 Stored XSS via Program Name
- CVE-2026-58474 whichllm < 0.5.16 Code Injection via run and snippet commands
- CVE-2026-58473 Cognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings
- CVE-2026-58472 GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Encoding
- CVE-2026-58471 GNU Wget 1.25.0 Heap Buffer Overflow via convert_fname() in url.c
- CVE-2026-58470 GNU Wget 1.25.0 Integer Overflow via Content-Range Header Parsing
- CVE-2026-5847 code-projects Movie Ticketing System SQL Database Backup File moviedb.sql information disclosure
- CVE-2026-58469 GNU Wget 1.25.0 Heap Buffer Underread via Metalink URL Parsing
- CVE-2026-58468 NocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrapper
- CVE-2026-58467 Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php
- CVE-2026-58466 AutoBangumi < 3.2.8 - Hard-coded Default Credentials via add_default_user()
- CVE-2026-58465 Eclipse Wakaama CoAP Block1 Handler Unbounded Memory Allocation DoS
- CVE-2026-58460 react-native-receive-sharing-intent Path Traversal via _display_name
- CVE-2026-5846 Hard-coded Cryptographic Key in Watchfire Controllers
- CVE-2026-58459 gpsd gpsprof Command Injection via gnuplot plot title subtype field
- CVE-2026-58458 Don't Starve Together Memory Corruption via world_gen_data
- CVE-2026-58457 Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp
- CVE-2026-58455 Dockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.php
- CVE-2026-58454 JAIOTlink C492A-W6 4.8.30.57701411 RCE via /Anyka/config Endpoint
- CVE-2026-58453 JAIOTlink C492A-W6 4.8.30.57701411 Hard-coded Credentials via anyka_ipc
- CVE-2026-58452 JAIOTlink C492A-W6 4.8.30.57701411 OS Command Injection via SetMAC Endpoint
- CVE-2026-58451 Horde IMP < 7.0.1 Path Traversal via Compose.php img src
- CVE-2026-58450 Invoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameter
- CVE-2026-5845 Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server
- CVE-2026-58449 txtai - Unauthenticated Remote Code Execution via Unsafe Reflection in API /reindex function Parameter
- CVE-2026-58448 yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API
- CVE-2026-58447 Invidious - Cross-User Playlist Video Deletion via Missing Ownership Check
- CVE-2026-58446 Presenton < 0.8.8-beta - Authentication Bypass of Session Auth via Unprotected MCP Endpoint
- CVE-2026-58445 Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
- CVE-2026-58444 Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
- CVE-2026-58443 Public-only repository tokens can update private PR head branches
- CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass
- CVE-2026-58441 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
- CVE-2026-58440 Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content
- CVE-2026-5844 D-Link DIR-882 HNAP1 SetNetworkSettings prog.cgi sprintf os command injection
- CVE-2026-58439 Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
- CVE-2026-58438 Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
- CVE-2026-58437 Repository Visibility Manipulation via Git Push Options
- CVE-2026-58436 ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
- CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation
- CVE-2026-58434 Private Repository Metadata Remains Accessible After Access Revocation
- CVE-2026-58433 Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
- CVE-2026-58432 Gitea: draft release attachment disclosure via missing web authorization
- CVE-2026-58431 Public-only API token restriction is not enforced on team API routes
- CVE-2026-5843 Docker Model Runner container-to-host code execution via MLX-LM model_file importlib loading
- CVE-2026-58429 Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
- CVE-2026-58428 Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
- CVE-2026-58427 Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
- CVE-2026-58426 Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
- CVE-2026-58425 OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
- CVE-2026-58424 Permanent Fork PR Workflow Approval Gate Bypass
- CVE-2026-58423 LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
- CVE-2026-58422 Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
- CVE-2026-58421 Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
- CVE-2026-58420 Local File Inclusion via file:// URI in Migration Restore
- CVE-2026-5842 decolua 9router Administrative API Endpoint api authorization
- CVE-2026-58419 Notification API leaks private issue metadata after access revocation
- CVE-2026-58418 SSRF via HTTP Redirect in Repository Migration
- CVE-2026-58417 REST API exposes organization membership of private organizations to public
- CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
- CVE-2026-58415 Apache HTTP Server: mod_dav_fs property database read access
- CVE-2026-58414 Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups
- CVE-2026-58413 EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data
- CVE-2026-58411 ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values
- CVE-2026-58410 ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records
- CVE-2026-5841 Tenda i3 HTTP R7WebsSecurityHandler path traversal
- CVE-2026-58409 ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload
- CVE-2026-58408 ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII
- CVE-2026-58404 Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings
- CVE-2026-58403 Hugo symlink confinement bypass in os.ReadFile
- CVE-2026-58402 Hugo default code block renderer XSS via unescaped code-fence language
- CVE-2026-58400 GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter
- CVE-2026-5840 PHPGurukul News Portal Project check_availability.php sql injection
- CVE-2026-58399 @acastellon/auth has an authentication bypass via spoofable headers in validateToken()
- CVE-2026-58395 OPNsense: XPath injection in MVC safe-delete
- CVE-2026-58394 OPNsense: Stored XSS in Administration Settings via Certificate Description
- CVE-2026-58393 OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files
- CVE-2026-58392 OPNsense: Stored XSS in Services: NTP GPS
- CVE-2026-58391 OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout
- CVE-2026-58390 OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views
- CVE-2026-5839 PHPGurukul News Portal Project add-subcategory.php sql injection
- CVE-2026-58389 Apache Thrift: Rust binary protocol non-strict path missing string size limit
- CVE-2026-58384 Gimp: gimp: integer overflow in read_rle_channel()
- CVE-2026-58381 Gimp: gimp: double-free in read_layer_block()
- CVE-2026-58380 Gimp: gimp: stack buffer overflow in pnmscanner_gettoken()
- CVE-2026-5838 PHPGurukul News Portal Project add-subadmins.php sql injection
- CVE-2026-58379 Gimp: gimp: heap buffer overflow in read_channel_data()
- CVE-2026-58378 Allwinner TV Box TV98 ADB exposed on network
- CVE-2026-58377 JeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret Keys
- CVE-2026-58376 Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints
- CVE-2026-58375 JimuReport 2.5.0 - Unauthenticated Report Export via /jmreport/auto/export
- CVE-2026-58374 Memory corruption in hostapd