Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 535 of 1013.
- CVE-2026-56321 Capgo - Missing Authentication Middleware on GET /private/role_bindings Endpoint
- CVE-2026-56320 Capgo - Org/App Scope Mismatch in Device Creation Endpoint
- CVE-2026-5632 assafelovic gpt-researcher HTTP REST API Endpoint missing authentication
- CVE-2026-56319 Capgo - App Existence Oracle via GET /statistics/app/:app_id
- CVE-2026-56318 Capgo - Information Disclosure via /private/validate_password_compliance Endpoint
- CVE-2026-56317 Nuxt - Cross-Site Scripting via NoScript Component Slot Content
- CVE-2026-56316 Cap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/*
- CVE-2026-56315 picklescan - Remote Code Execution via Unblocked Standard Library Modules
- CVE-2026-56314 Capgo - Deleted Bundle Selection via Missing Deletion Filter in /updates Endpoint
- CVE-2026-56313 Capgo - Cross-Organization Account Disruption via SSO Prelink Endpoint
- CVE-2026-56312 Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint
- CVE-2026-56311 Capgo - Unauthenticated Cross-Tenant Disclosure via get_current_plan_max_org RPC
- CVE-2026-56310 Cap-go - Authorization Bypass in Organization Members Endpoint via API Key Scope Bypass
- CVE-2026-5631 assafelovic gpt-researcher ws Endpoint server_utils.py extract_command_data code injection
- CVE-2026-56309 Capgo - Plan Bypass via Unrestricted Attachment Upload Endpoint
- CVE-2026-56308 Capgo - Insufficient Authentication in Email Change Endpoint
- CVE-2026-56307 Cap-go - Broken Cursor Pagination in /private/devices Endpoint
- CVE-2026-56306 Capgo - Subkey Enforcement Bypass via x-limited-key-id Header Parsing
- CVE-2026-56305 Capgo - Authentication Bypass in Password Change via Missing Current Password Validation
- CVE-2026-56304 picklescan - Arbitrary File Creation via logging.FileHandler Deserialization
- CVE-2026-56303 Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC Function
- CVE-2026-56302 Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security
- CVE-2026-56301 Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux
- CVE-2026-56300 Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions
- CVE-2026-5630 assafelovic gpt-researcher Report API app.py cross site scripting
- CVE-2026-56299 Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint
- CVE-2026-56298 Capgo - EXIF Metadata Exposure in App Information Image Upload
- CVE-2026-56297 FreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel Callback
- CVE-2026-56296 Cap-go - App Existence Oracle via Unauthenticated transfer_app RPC
- CVE-2026-56295 Capgo - Policy Enforcement Bypass in Webhook Management Endpoints via Non-Expiring API Keys
- CVE-2026-56294 capacitor-native-biometric - Authentication Bypass via Unvalidated CryptoObject in onAuthenticationSucceeded
- CVE-2026-56293 Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app()
- CVE-2026-56292 Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1
- CVE-2026-56291 Balbooa Forms Unrestricted Upload of File with Dangerous Type
- CVE-2026-56290 Joomlack Page Builder Improper Access Control
- CVE-2026-5629 Belkin F9K1015 formSetFirewall stack-based overflow
- CVE-2026-56289 Loop with Unreachable Exit Condition in GNU patch
- CVE-2026-56288 NULL Pointer Dereference in GNU patch
- CVE-2026-56287 Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure
- CVE-2026-56286 Capgo - Account Deletion Without Password Confirmation
- CVE-2026-56285 Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint
- CVE-2026-56284 Capgo - Unauthenticated Metrics Disclosure via get_total_metrics RPC
- CVE-2026-56283 Capgo - HTML Injection Leading to Open Redirection in Organization Settings
- CVE-2026-56282 Capgo - Information Disclosure via Unauthenticated /replication Endpoint
- CVE-2026-56281 Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint
- CVE-2026-56280 Cap-go - Privilege Inversion in Build Log Stream via SSE Disconnect
- CVE-2026-5628 Belkin F9K1015 Setting formSetSystemSettings stack-based overflow
- CVE-2026-56279 Capgo - Information Disclosure via get_orgs_v7 RPC Endpoint
- CVE-2026-56278 Flowise - Session Hijacking via Weak Default Express Session Secret
- CVE-2026-56277 Flowise - Hardcoded CORS Wildcard in TTS Endpoint
- CVE-2026-56276 Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override
- CVE-2026-56275 Flowise - Server-Side Request Forgery via Execute Flow Base URL
- CVE-2026-56274 Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess
- CVE-2026-56273 Flowise - Path Traversal in Vector Store basePath Parameter
- CVE-2026-56272 Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing
- CVE-2026-56271 Flowise - Weak Default JWT Secrets in Authentication Middleware
- CVE-2026-56270 Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint
- CVE-2026-5627 Path Traversal in mintplex-labs/anything-llm
- CVE-2026-56269 Flowise - Weak Default Token Hash Secret in JWT Token Encryption
- CVE-2026-56268 Flowise - Cross-Workspace Information Disclosure via chatflows/apikey Endpoint
- CVE-2026-56267 Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint
- CVE-2026-56266 Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints
- CVE-2026-56265 Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key
- CVE-2026-56264 Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint
- CVE-2026-56263 Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard
- CVE-2026-56262 Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server
- CVE-2026-56261 Crawl4AI - Server-Side Request Forgery via Webhook URLs
- CVE-2026-56260 Crawl4AI - Arbitrary File Write via output_path Parameter
- CVE-2026-5626 Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export
- CVE-2026-56259 Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution
- CVE-2026-56258 Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU
- CVE-2026-56257 Capgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST Update
- CVE-2026-56256 Capgo - Two-Factor Authentication Bypass via Organization Management API
- CVE-2026-56255 Capgo - Denial of Service via Unlimited Demo App Creation
- CVE-2026-56254 capacitor-updater - End-to-End Encryption Bypass via Private Key Distribution
- CVE-2026-56253 Capgo - Unauthenticated Organization Member Email Disclosure via get_org_members RPC
- CVE-2026-56252 Capgo - Scope Isolation Failure in Webhook Test Endpoint
- CVE-2026-56251 Capgo - Privilege Escalation via Broken Row Level Security in org_users
- CVE-2026-56250 Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versions
- CVE-2026-5625 assafelovic gpt-researcher WebSocket researcher.py cross site scripting
- CVE-2026-56249 Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision
- CVE-2026-56248 Capgo - Unauthenticated Denial-of-Service via audit_logs RLS Policy
- CVE-2026-56247 Capgo - Privilege Escalation via Cross-Scope RBAC Role Assignment
- CVE-2026-56246 Capgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege Inheritance
- CVE-2026-56245 Supabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPC
- CVE-2026-56244 Capgo - Webhook Signing Secret Disclosure via Non-Admin API Key
- CVE-2026-56243 Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane
- CVE-2026-56242 Capgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get_identity_apikey_only RPC
- CVE-2026-56241 Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_right
- CVE-2026-56240 Capgo - Billing Authorization Bypass via Exhausted Usage Credits
- CVE-2026-5624 ProjectSend upload.php cross-site request forgery
- CVE-2026-56239 Capgo - Privilege Escalation via SECURITY DEFINER Function apply_usage_overage
- CVE-2026-56238 Capgo - Unauthenticated Information Disclosure via PostgREST global_stats Endpoint
- CVE-2026-56237 Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation
- CVE-2026-56236 Capgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credential Operations
- CVE-2026-56235 Capgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC Functions
- CVE-2026-56234 Capgo - Password Spraying via Public-Key Accessible Credential Validation Endpoint
- CVE-2026-56233 Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload Proxy
- CVE-2026-56232 Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header
- CVE-2026-56231 Capgo - Broken Object Level Authorization in Build Job Control via jobId Parameter