Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 520 of 1013.
- CVE-2026-58218 Samba: dns signing dos via tkey name cache exhaustion
- CVE-2026-58216 Memory corruption in Red Hat Enterprise Linux 10
- CVE-2026-58214 NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)
- CVE-2026-58213 NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection
- CVE-2026-58211 NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions
- CVE-2026-58210 NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory
- CVE-2026-5821 Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection
- CVE-2026-58209 NATS Server: MQTT retained and QoS replay bypass subscribe deny filters
- CVE-2026-58208 NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled
- CVE-2026-58207 NATS Server: Remote crash via integer overflow in Connz pagination
- CVE-2026-58205 GRR has a Reflected XSS issue
- CVE-2026-58203 pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size
- CVE-2026-58202 Business logic in appointment-booking-software
- CVE-2026-58201 Lokka: Azure Resource Manager URL path validation issue
- CVE-2026-58200 @jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing
- CVE-2026-5820 Zypento Blocks <= 1.0.6 - Authenticated (Author+) Stored Cross-Site Scripting via Table of Contents Block
- CVE-2026-58198 ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer
- CVE-2026-58197 ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
- CVE-2026-58196 ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)
- CVE-2026-58195 Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync
- CVE-2026-58192 Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin
- CVE-2026-58191 Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
- CVE-2026-58189 Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification
- CVE-2026-58188 Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins
- CVE-2026-58187 Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service
- CVE-2026-58186 Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses
- CVE-2026-58185 Apache Traffic Server: Use-after-free in the intercept plugin
- CVE-2026-58184 Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory
- CVE-2026-58183 Apache Traffic Server: prefetch plugin can crash on attacker-influenced input
- CVE-2026-58182 Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors
- CVE-2026-58181 Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash
- CVE-2026-58180 Apache Traffic Server: txn_box plugin overflows the stack from attacker input
- CVE-2026-5818 MCU Firmware Update Authentication Bypass on Caliptra Core
- CVE-2026-58179 Apache Traffic Server: regex_remap plugin overflows the stack from attacker input
- CVE-2026-58178 Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery
- CVE-2026-58177 Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework
- CVE-2026-58176 RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints
- CVE-2026-58175 Apache Traffic Server: HostDB SRV handling leaks memory
- CVE-2026-58174 Hermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Import
- CVE-2026-58173 Vibe-Trading < 0.1.10 - Path Traversal via Persistent Memory Type
- CVE-2026-58172 Ocelot - IP Allow/Block List Bypass for WebSocket Upgrade Requests
- CVE-2026-58171 Vibe-Trading < 0.1.10 - Path Traversal via Swarm Run Identifier
- CVE-2026-58170 Vibe-Trading < 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading Mandates
- CVE-2026-5817 Docker Model Runner container-to-host code execution via unsandboxed trust_remote_code in Python inference backends
- CVE-2026-58169 Auth bypass in Vibe-Trading
- CVE-2026-58168 DeepTutor < 1.4.10 - Insecure Default Grants Unrestricted MCP Tool Access to Non-Admin Users
- CVE-2026-58167 Nightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Users
- CVE-2026-58166 OpenBMB ChatDev - Unauthenticated Path Traversal in Upload Handler Allows Arbitrary File Write and Delete
- CVE-2026-58165 OpenZiti - Privilege Escalation to Admin via Unauthorized Enrollment Creation
- CVE-2026-58164 Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free
- CVE-2026-58163 Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server
- CVE-2026-58162 Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates
- CVE-2026-58161 Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server
- CVE-2026-58160 Apache Traffic Server: Out-of-bounds reads while parsing DNS responses
- CVE-2026-5816 Improper Resolution of Path Equivalence in GitLab
- CVE-2026-58159 Apache Traffic Server: Listener and ACL handling allow access-control bypass
- CVE-2026-58158 Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow
- CVE-2026-58157 Apache Traffic Server: Improper server-session reuse can expose data across client connections
- CVE-2026-58156 Apache Traffic Server: URL and port parsing errors allow access-control bypass
- CVE-2026-58155 Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling
- CVE-2026-58154 Apache Traffic Server: Memory-safety errors in MIME and header parsing
- CVE-2026-58153 Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely
- CVE-2026-58152 Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory
- CVE-2026-58151 Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server
- CVE-2026-58150 Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling
- CVE-2026-5815 D-Link DIR-645 hedwig.cgi hedwigcgi_main stack-based overflow
- CVE-2026-58149 Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0
- CVE-2026-58148 Joomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for Joomla 8.0 - 8.0.52
- CVE-2026-58147 Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers
- CVE-2026-58146 Unauthorized remote code execution in T-Mobile 5G Box IDU routers
- CVE-2026-58144 Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parameter
- CVE-2026-58143 Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint
- CVE-2026-5814 PHPGurukul Online Course Registration check_availability.php sql injection
- CVE-2026-58139 DuckDB AWS Extension Security Policy Bypass via load_aws_credentials Procedure
- CVE-2026-58138 Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
- CVE-2026-5813 PHPGurukul Online Course Registration check_availability.php sql injection
- CVE-2026-58127 PACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service
- CVE-2026-58126 PACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service
- CVE-2026-58123 Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API
- CVE-2026-58122 Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing
- CVE-2026-5812 SourceCodester Pharmacy Product Management System POST Parameter add-sales.php logic error
- CVE-2026-58116 LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path
- CVE-2026-58115 Missing authorization in SIMATIC IoT2050 Advanced
- CVE-2026-58113 Cross-site scripting in Teamcenter V2412
- CVE-2026-5811 SourceCodester Online Food Ordering System POST Parameter Actions.php save_product logic error
- CVE-2026-58108 Personal access token delete filters on Session columns while deleting from PersonalAccessTokenDB
- CVE-2026-58107 Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun
- CVE-2026-58106 Memory corruption in CodeChecker
- CVE-2026-58102 Memory corruption in Crypt::OpenSSL::X509
- CVE-2026-58101 Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference
- CVE-2026-58100 Memory safety bugs in kqueue copy-on-fork implementation
- CVE-2026-5810 SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting
- CVE-2026-58099 Memory safety bugs in kqueue copy-on-fork implementation
- CVE-2026-58098 Heap out-of-bounds access in semop(2)
- CVE-2026-58097 ppp(8): missing length validation in mp_SetEnddisc()
- CVE-2026-58096 ppp(8): missing length validation in LcpDecodeConfig()
- CVE-2026-58095 ppp(8): incorrect length calculation in mp_Enddisc()
- CVE-2026-58094 TOCTOU race in POSIX shared memory large page configuration
- CVE-2026-58093 Kernel use-after-free via tty ioctls
- CVE-2026-58092 Unauthorized credential switching