Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 532 of 1013.
- CVE-2026-56776 n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint
- CVE-2026-56775 n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints
- CVE-2026-56774 Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID
- CVE-2026-56773 Teable - Missing Authorization in v2 REST API
- CVE-2026-56772 NewsBlur < 14.5.0 - Insecure Direct Object Reference in Social Interactions Endpoint
- CVE-2026-56771 NewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpoint
- CVE-2026-56770 libais 0.15 - Out-of-bounds Vector Access in VdmStream::AddLine via Invalid Sequential Message ID
- CVE-2026-5677 Totolink A7100RU cstecgi.cgi CsteSystem os command injection
- CVE-2026-56769 Huly Platform - Server-Side Request Forgery via /import Endpoint
- CVE-2026-56768 Seahub < 13.0.23 - Authentication Bypass in ShareLinkZipTaskView GET Method
- CVE-2026-56767 Maxun < 0.0.42 - Cross-Tenant IDOR in Storage and Webhook API Handlers
- CVE-2026-56766 Hydra - Stack Buffer Overflow in NTLM Authentication Handler
- CVE-2026-56765 Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR
- CVE-2026-56764 Hono - Timing Attack in basicAuth and bearerAuth Middleware
- CVE-2026-56763 Hono - Prototype Pollution via __proto__ Key in parseBody with dot Option
- CVE-2026-56762 Hono - Missing Cookie Name Validation in setCookie()
- CVE-2026-56761 hono - HTML Injection via Improper JSX Attribute Name Handling in SSR
- CVE-2026-5676 Totolink A8000R cstecgi.cgi setLanguageCfg missing authentication
- CVE-2026-56758 MZ Automation libiec61850 Out-of-bounds Read
- CVE-2026-56755 Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
- CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session
- CVE-2026-5675 itsourcecode Construction Management System Parameter borrowed_tool.php sql injection
- CVE-2026-56748 Authenticated RCE via Symlink Following in Cribl Stream Pack Git Import
- CVE-2026-56747 Code Injection in JSON Pointer Processing Component in Cribl Stream
- CVE-2026-56746 Netty has a Security Control Bypass via CORS Short-Circuit Failure
- CVE-2026-56745 Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion
- CVE-2026-56744 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction
- CVE-2026-56743 Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match
- CVE-2026-56742 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces
- CVE-2026-56741 JLine: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry
- CVE-2026-56740 JLine: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables
- CVE-2026-5674 Pipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loading
- CVE-2026-56739 Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint
- CVE-2026-56738 phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion
- CVE-2026-56737 phpMyFAQ's two-factor authentication login bypasses the password factor
- CVE-2026-56736 phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
- CVE-2026-56735 Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad
- CVE-2026-56734 Zammad: Avatar Image URL Server-Side Request Forwarding
- CVE-2026-56733 Zammad: Incorrect Authorization and Improper Privilege Management
- CVE-2026-56732 Zammad: Malicious input in Ticket Body Enables Session Termination
- CVE-2026-56731 Zammad: Cross-Site Scripting in Ticket Notifications
- CVE-2026-56730 Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers
- CVE-2026-5673 Libtheora: libtheora: denial of service or information disclosure via malformed avi file processing
- CVE-2026-56729 Zammad: Titles of knowledge base answers will be shown across all categories via the global search
- CVE-2026-56728 Zammad: Cross-User Taskbar Item Access Control Vulnerability
- CVE-2026-56727 Zammad: PGP signature spoofing via unvalidated verification return
- CVE-2026-56726 Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak
- CVE-2026-56725 Zammad: Denial of Service via OTRS Import Controller
- CVE-2026-56724 Zammad: Incorrect implementation of permission checks in the knowledge base module
- CVE-2026-56723 Zammad: Missing authorization on ticket attachment download
- CVE-2026-56722 Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
- CVE-2026-56721 CamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersController
- CVE-2026-56720 CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action
- CVE-2026-5672 code-projects Simple IT Discussion Forum Parameter edit-category.php sql injection
- CVE-2026-56719 MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 SessionSetupAndX
- CVE-2026-56718 AJCloud AJY IPC Firmware Path Traversal via jdbhttpd
- CVE-2026-56711 VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability
- CVE-2026-56710 Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock
- CVE-2026-5671 Cyber-III Student-Management-System Class Schedule Deletion Endpoint delete_batch.php cross site scripting
- CVE-2026-56709 Grav before 3.9.2 Host Header Injection via sendInvitationEmail
- CVE-2026-56708 Grav API Plugin before 1.0.16 SSRF via DNS Rebinding
- CVE-2026-56707 Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode
- CVE-2026-56706 Adminer before 5.4.3 CSRF Token Secret Recovery via XOR Masking
- CVE-2026-56705 Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection
- CVE-2026-56704 Adminer before 5.4.3 Cross-Site Scripting via MySQL Version String
- CVE-2026-56703 Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO
- CVE-2026-56702 Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload
- CVE-2026-56701 Grav - XML External Entity Injection via SVG Upload
- CVE-2026-56700 Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection
- CVE-2026-5670 Cyber-III Student-Management-System upload.php move_uploaded_file unrestricted upload
- CVE-2026-56698 Nuxt - Cross-Site Scripting via navigateTo open Option
- CVE-2026-56697 Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp
- CVE-2026-56696 OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands
- CVE-2026-56695 OpenHarness - Cross-Session Disclosure via /resume and /summary Commands
- CVE-2026-56694 NanoClaw < 2.1.0 - Privilege Escalation via Forged Channel Approval Callback
- CVE-2026-56693 NanoClaw < 2.1.17 - Privilege Escalation via Unauthorized create_agent System Action
- CVE-2026-56692 NanoClaw < 2.1.17 - Arbitrary File Read via Symlink Following in forwardAttachedFiles
- CVE-2026-56690 SQL injection in PowerFlex Manager
- CVE-2026-5669 Cyber-III Student-Management-System Parameter login.php sql injection
- CVE-2026-56689 SQL injection in PowerFlex Manager
- CVE-2026-56688 Command injection in PowerFlex Manager
- CVE-2026-56687 Security feature bypass in ThinOS 10
- CVE-2026-56686 Command injection in ObjectScale
- CVE-2026-56685 Command injection in ObjectScale
- CVE-2026-56684 Valkey: TLS pending-data processing use-after-free may allow remote code execution
- CVE-2026-56682 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
- CVE-2026-56681 9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header
- CVE-2026-5668 Cyber-III Student-Management-System add%20notice.php cross site scripting
- CVE-2026-56679 9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade
- CVE-2026-56678 9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
- CVE-2026-56677 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint
- CVE-2026-56676 9router: Image prefetch DNS rebinding allows SSRF to internal services
- CVE-2026-56675 9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs
- CVE-2026-56673 ComfyUI: Path traversal in LoadImage via the /prompt API allows arbitrary file existence probing and image exfiltration
- CVE-2026-56672 ComfyUI: Stored XSS via /userdata/{file} due to Missing Content-Type Sanitization
- CVE-2026-56671 ComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file read
- CVE-2026-56670 ComfyUI: Stored XSS via SVG file upload on the /view endpoint
- CVE-2026-5667 Information Disclosure, Information Tampering, or Denial-of-Service (DoS) Vulnerability in Multiple Home Appliances
- CVE-2026-56669 Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict
- CVE-2026-56668 ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange