Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 534 of 1013.
- CVE-2026-56416 Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name
- CVE-2026-56415 OS Command Injection in StoneFly Storage Concentrator
- CVE-2026-56414 H.VIEW HV-500S6 IP Camera Unrestricted Upload of File with Dangerous Type
- CVE-2026-56413 OS Command Injection in StoneFly Storage Concentrator
- CVE-2026-56412 Use after free in libexpat
- CVE-2026-56411 Integer overflow in libexpat
- CVE-2026-56410 Integer overflow in libexpat
- CVE-2026-5641 PHPGurukul Online Shopping Portal Project Parameter update-image1.php sql injection
- CVE-2026-56409 Integer overflow in libexpat
- CVE-2026-56408 Integer overflow in libexpat
- CVE-2026-56407 Integer overflow in libexpat
- CVE-2026-56406 Integer overflow in libexpat
- CVE-2026-56405 Integer overflow in libexpat
- CVE-2026-56404 Integer overflow in libexpat
- CVE-2026-56403 Integer overflow in libexpat
- CVE-2026-56402 NanoClaw < 2.1.17 - Privilege Escalation via Unverified Approval Response Handler
- CVE-2026-56400 open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation
- CVE-2026-5640 PHPGurukul Online Shopping Portal Project Parameter update-image2.php sql injection
- CVE-2026-56399 Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web
- CVE-2026-56398 Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI
- CVE-2026-56397 SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README
- CVE-2026-56396 phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights()
- CVE-2026-56394 Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter
- CVE-2026-56393 Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options
- CVE-2026-56392 Heap-based Buffer Overflow in GNU coreutils
- CVE-2026-56391 Out‑of‑bounds Read in GNU coreutils
- CVE-2026-56390 Arbitrary Output Location Change in GNU Bison
- CVE-2026-5639 PHPGurukul Online Shopping Portal Project Parameter update-image3.php sql injection
- CVE-2026-56389 Arbitrary Command Execution in GNU Bison
- CVE-2026-56388 Apache bRPC: Out-of-Bounds Write in Redis Command Parser
- CVE-2026-56387 Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
- CVE-2026-56386 Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser
- CVE-2026-56385 Craft CMS - Authorization Bypass in assets/preview-file Endpoint
- CVE-2026-56384 Craft CMS - Missing Authorization in assets/preview-thumb Endpoint
- CVE-2026-56383 Craft CMS - Stored XSS in Table Field via Row Heading Column Type
- CVE-2026-56382 Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController
- CVE-2026-56381 Craft CMS - Stored XSS via User Group Name in User Permissions Page
- CVE-2026-56380 AVideo feed/index.php Exposure of Channel Owner Email Address
- CVE-2026-5638 HerikLyma CPPWebFramework path traversal
- CVE-2026-56379 ImageMagick - Command Injection via SVG Decoder
- CVE-2026-56378 ImageMagick - Heap Out-of-Bounds Read in PCD Decoder
- CVE-2026-56377 ImageMagick - Policy Bypass via Incorrect Path Validation
- CVE-2026-56376 ImageMagick - Heap Use-After-Free in Meta Coder
- CVE-2026-56375 ImageMagick - Memory Leak in ASHLAR Coder Action Failure
- CVE-2026-56374 ImageMagick - Heap Buffer Overflow in FTXT Encoder via format Parameter
- CVE-2026-56373 ImageMagick - Use-After-Free Write in PDB Decoder
- CVE-2026-56372 ImageMagick - Heap Buffer Overflow Read via Unrecognized Magnify Method
- CVE-2026-56371 ImageMagick - Memory Leak in TXT File Processing via Texture Attribute
- CVE-2026-56370 ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components Artifact
- CVE-2026-5637 projectworlds Car Rental System Parameter message_admin.php sql injection
- CVE-2026-56369 ImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImage
- CVE-2026-56368 ImageMagick - Memory Leak in Raw Pixel Data Coders
- CVE-2026-56367 ImageMagick - Heap Out-of-Bounds Read in PSB RLE Decoding
- CVE-2026-56366 ImageMagick - Memory Leak in META Reader APP1JPEG Error Path
- CVE-2026-56365 ImageMagick - Memory Leak in PNG Encoder via MNG Image Writing
- CVE-2026-56364 ImageMagick - Memory Leak in LoadOpenCLDeviceBenchmark() via Malformed XML
- CVE-2026-56363 ImageMagick - Division by Zero in Binomial Kernel Processing
- CVE-2026-56362 ImageMagick - Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache Metadata Desynchronization
- CVE-2026-56361 ImageMagick - Heap Buffer Overflow via Off-by-One in Morphology Processing
- CVE-2026-56360 n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger
- CVE-2026-5636 PHPGurukul Online Shopping Portal Project Parameter cancelorder.php sql injection
- CVE-2026-56359 n8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URL
- CVE-2026-56358 n8n - Stored Cross-Site Scripting in Form Trigger Node
- CVE-2026-56357 n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger
- CVE-2026-56356 n8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Field
- CVE-2026-56355 Auth bypass in Savane
- CVE-2026-56354 n8n - Cross-Site Scripting and Open Redirect in Form Node
- CVE-2026-56353 n8n - Authentication Bypass in Chat Trigger Node
- CVE-2026-56352 n8n - Arbitrary File Read and Execution via ExecuteWorkflow localFile Parameter
- CVE-2026-56351 n8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL Nodes
- CVE-2026-56350 n8n - SSO Enforcement Bypass via API
- CVE-2026-5635 PHPGurukul Online Shopping Portal Project Parameter categorywise-products.php sql injection
- CVE-2026-56349 n8n - Guardrail Node Bypass via Crafted Input
- CVE-2026-56348 n8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpoint
- CVE-2026-56347 AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields
- CVE-2026-56346 AVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php Endpoint
- CVE-2026-56345 AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint
- CVE-2026-56342 AVideo - Server-Side Request Forgery in Live/test.php via statsURL Parameter
- CVE-2026-56341 AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php
- CVE-2026-56340 vLLM - Denial of Service via Unvalidated Multimodal Embeddings
- CVE-2026-5634 projectworlds Car Rental Project Parameter book_car.php sql injection
- CVE-2026-56339 Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC
- CVE-2026-56338 Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint
- CVE-2026-56337 Capgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2
- CVE-2026-56336 Capgo - Information Disclosure via Unauthenticated SSO check-domain Endpoint
- CVE-2026-56335 Capgo - Channel Configuration Mutation via Write-Scoped API Keys
- CVE-2026-56334 Capgo - Missing UPDATE RLS Policy for Build Status Persistence
- CVE-2026-56333 Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings Updates
- CVE-2026-56332 Capgo - Open Redirect via confirmation_url Parameter
- CVE-2026-56331 Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic String
- CVE-2026-56330 Capgo - Open Redirect via Unvalidated Stripe Billing URLs
- CVE-2026-5633 assafelovic gpt-researcher ws Endpoint server-side request forgery
- CVE-2026-56329 Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding
- CVE-2026-56328 Capgo - Integrity Issue in Release Routing via Multiple Public Channels
- CVE-2026-56327 Capgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPC
- CVE-2026-56326 Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo
- CVE-2026-56325 Capgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain Lookup
- CVE-2026-56324 Capgo - Rate Limit Bypass via User-Controlled device_id Parameter
- CVE-2026-56323 Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_self
- CVE-2026-56322 Capgo - Information Disclosure via Unauthenticated /updates defaultChannel Parameter