Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 531 of 1013.
- CVE-2026-56915 Race condition in Android
- CVE-2026-56914 Use after free in Android
- CVE-2026-5691 Totolink A7100RU cstecgi.cgi setFirewallType os command injection
- CVE-2026-56907 Memory corruption in Android
- CVE-2026-56906 Use after free in Android
- CVE-2026-5690 Totolink A7100RU cstecgi.cgi setRemoteCfg os command injection
- CVE-2026-56892 Information disclosure in Android
- CVE-2026-5689 Totolink A7100RU cstecgi.cgi setNtpCfg os command injection
- CVE-2026-56889 Integer overflow in Android
- CVE-2026-56888 Information disclosure in Android
- CVE-2026-56882 Information disclosure in Android
- CVE-2026-56881 Privilege escalation in Android
- CVE-2026-5688 Totolink A7100RU cstecgi.cgi setDdnsCfg os command injection
- CVE-2026-56879 Memory corruption in Android
- CVE-2026-56877 Business logic in SCORM Lab Launch Integration
- CVE-2026-56876 extract-zip unvalidated symlink path traversal
- CVE-2026-5687 Tenda CX12L NatStaticSetting fromNatStaticSetting stack-based overflow
- CVE-2026-56866 HTTP/1 client connection desynchronization after CONNECT rejection in net/http
- CVE-2026-56865 Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
- CVE-2026-56864 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
- CVE-2026-56862 Limit handshake messages we are willing to accept post-handshake in crypto/tls
- CVE-2026-56860 Avoid quadratic complexity in resolvePath in net/url
- CVE-2026-5686 Tenda CX12L RouteStatic fromRouteStatic stack-based overflow
- CVE-2026-56859 Add recursion depth guard during decode in encoding/xml
- CVE-2026-56858 Fix Javascript regexp context tracking in html/template
- CVE-2026-56857 Root.Mkdir(All) can follow junctions out of the root on Windows in os
- CVE-2026-56855 Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
- CVE-2026-56854 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
- CVE-2026-56853 Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
- CVE-2026-56852 Infinite loop on invalid input in golang.org/x/text
- CVE-2026-56851 Panic parsing crafted input in x/text/secure/precis in golang.org/x/text
- CVE-2026-56850 Auth bypass in node
- CVE-2026-5685 Tenda CX12L addressNat fromAddressNat stack-based overflow
- CVE-2026-56848 Use after free in node
- CVE-2026-56847 Security feature bypass in node
- CVE-2026-56846 Denial of service in node
- CVE-2026-56845 Path traversal in Rocket.Chat
- CVE-2026-56844 Path traversal in Backup and Replication
- CVE-2026-56843 Missing authorization in Plesk
- CVE-2026-56842 Privilege escalation in UniFi Network Application
- CVE-2026-56841 SQL injection in UniFi Protect Application
- CVE-2026-56840 PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools
- CVE-2026-5684 Tenda CX12L webExcptypemanFilter fromwebExcptypemanFilter stack-based overflow
- CVE-2026-56839 PraisonAI Code agent tools fail open without a workspace boundary
- CVE-2026-56838 PraisonAI recipe.run_stream skips dangerous-tool policy enforcement
- CVE-2026-56837 PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing
- CVE-2026-56836 PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard
- CVE-2026-56835 PraisonAI Slack app_mention bypasses configured user/channel authorization
- CVE-2026-56834 PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
- CVE-2026-56833 PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
- CVE-2026-56832 PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
- CVE-2026-56831 Shopper: Negative discount values accepted and propagated through order calculation pipeline
- CVE-2026-56830 Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization
- CVE-2026-5683 Tenda CX12L P2pListFilter fromP2pListFilter stack-based overflow
- CVE-2026-56829 Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
- CVE-2026-56828 Shopper: read-only team permissions allow administrator creation and permission escalation
- CVE-2026-56827 Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
- CVE-2026-56826 Shopping privilege escalation through missing authorization in Settings components
- CVE-2026-56825 Shopper: Missing authorization on product removal actions in CollectionProducts component
- CVE-2026-56823 AutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping Triggering
- CVE-2026-56822 Netty: TOCTOU in OcspServerCertificateValidator
- CVE-2026-56821 Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator
- CVE-2026-56820 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
- CVE-2026-5682 Meesho Online Shopping App com.meesho.supply endpoint risky encryption
- CVE-2026-56819 Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
- CVE-2026-56818 Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state
- CVE-2026-56817 Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled
- CVE-2026-56816 Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types
- CVE-2026-56815 Path traversal in pwnlift
- CVE-2026-56814 Denial of service in plug
- CVE-2026-56813 Cookie attribute injection in Plug.Conn.Cookies.encode/2
- CVE-2026-56812 Phoenix: Presence keys colliding with `Object.prototype` members break existence checks
- CVE-2026-56811 Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service
- CVE-2026-56810 mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5
- CVE-2026-5681 itsourcecode sanitize or validate this input Parameter borrowedequip.php sql injection
- CVE-2026-56809 Cross-site scripting in Multiple MFPs which implement Ricoh Web Image Monitor
- CVE-2026-56808 Command injection in DGM3103SCT
- CVE-2026-5680 Undertow-core: undertow: denial of service via websocket permessage-deflate processing
- CVE-2026-56797 Race condition in Dell Command Update (DCU)
- CVE-2026-56796 Privilege escalation in Dell Command Update (DCU)
- CVE-2026-56795 Privilege escalation in Driver Pack For Linux OS
- CVE-2026-56794 Path traversal in Dell OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-56793 Auth bypass in Dell OpenManage Server Administrator Managed Node for RHEL 8.10
- CVE-2026-56792 Privilege escalation in Rugged Control Center (RCC)
- CVE-2026-56790 CANBoat - Off-by-One Global Buffer Overflow in searchForPgn()
- CVE-2026-5679 Totolink A3300R cstecgi.cgi vsetTr069Cfg os command injection
- CVE-2026-56789 RTKLIB 2.4.3 - Heap Buffer Overflow and Stack Read via Oversized RINEX Epoch Satellite Count
- CVE-2026-56788 RTKLIB 2.4.3 - Out-of-bounds Read via Negative Array Index in getcodepri
- CVE-2026-56787 RTKLIB 2.4.3 - Off-by-One Out-of-Bounds Read in decode_ssr3 via RTCM3 SSR Message
- CVE-2026-56786 RTKLIB 2.4.3 - Out-of-bounds Write in decode_type1033 via Crafted RTCM3 Message
- CVE-2026-56785 FlatPress - Stored Cross-Site Scripting via Unescaped Comment and Contact Form Fields
- CVE-2026-56784 OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint
- CVE-2026-56783 Parseable < 2.9.2 - Cleartext Credential Exposure in Notification Target API
- CVE-2026-56782 Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints
- CVE-2026-56781 Teable - Unauthenticated Hidden Field Disclosure via Projection Parameter Override
- CVE-2026-56780 Modoboa < 2.9.0 - Insecure Direct Object Reference in Account Password Change API
- CVE-2026-5678 Totolink A7100RU cstecgi.cgi setScheduleCfg os command injection
- CVE-2026-56779 MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters
- CVE-2026-56778 n8n - Authorization Bypass in Public API Execution Retry Endpoint
- CVE-2026-56777 n8n - AST Validator Bypass in Python Code Node