Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 536 of 1013.
- CVE-2026-56230 Capgo - Broken Object Level Authorization via x-limited-key-id Header
- CVE-2026-5623 hcengineering Huly Platform Import Endpoint index.ts server-side request forgery
- CVE-2026-56229 Capgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status and /build/logs
- CVE-2026-56228 Capgo - Denial of Service via Improper Password Policy Length Validation
- CVE-2026-56227 Capgo - Server-Side Request Forgery via Webhook URL Validation
- CVE-2026-56226 Capgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPC
- CVE-2026-56225 Capgo - Authorization Bypass in API Key Management via App-Limited Keys
- CVE-2026-56224 Capgo - Login CSRF and Session Fixation via URL Query Parameters
- CVE-2026-56223 Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user
- CVE-2026-56222 Capgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /private/role_bindings
- CVE-2026-56221 Cap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts
- CVE-2026-56220 Capgo - Unauthorized Manifest Insertion via Read-Only Org Member
- CVE-2026-5622 hcengineering Huly Platform JWT Token token.ts hard-coded key
- CVE-2026-56219 Capgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NULL-auth Bypass
- CVE-2026-56218 Capgo - EXIF Metadata Exposure via Image Upload
- CVE-2026-56217 Capgo - Encrypted Bundle Policy Bypass via Direct PostgREST Update
- CVE-2026-56216 Capgo - Scope Escalation via API Key Creation in /functions/v1/apikey
- CVE-2026-56215 Capgo - Account Merge via Poisoned public.users.email in SSO Provisioning
- CVE-2026-56214 Capgo - Unauthenticated Organization Enumeration and Billing Status Disclosure via Supabase RPC
- CVE-2026-56213 Capgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert_version_meta RPC
- CVE-2026-56212 Capgo - Improper 2FA Enforcement Logic via Team Security Settings
- CVE-2026-56211 Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames
- CVE-2026-56210 Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id
- CVE-2026-5621 ChrisChinchilla Vale-MCP HTTP index.ts os command injection
- CVE-2026-56209 Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack
- CVE-2026-56208 Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode
- CVE-2026-56207 Apache Impala: SAML authentication bypass via forged bearer token
- CVE-2026-5620 itsourcecode Construction Management System Parameter borrowed_equip_report.php sql injection
- CVE-2026-56198 Microsoft Trace Data Helper Elevation of Privilege Vulnerability
- CVE-2026-56197 Windows Admin Center (WAC) Remote Code Execution Vulnerability
- CVE-2026-56196 Windows Admin Center (WAC) Remote Code Execution Vulnerability
- CVE-2026-56195 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-56194 Windows NFS Server Elevation of Privilege Vulnerability
- CVE-2026-56193 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-56192 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-56191 Microsoft Exchange Online Tampering Vulnerability
- CVE-2026-56190 Remote Desktop Protocol Remote Code Execution Vulnerability
- CVE-2026-5619 Braffolk mcp-summarization-functions summarize_command mcp-server.ts os command injection
- CVE-2026-56189 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
- CVE-2026-56188 Windows Server Network driver Remote Code Execution Vulnerability
- CVE-2026-56187 Windows MIDI Service Module Elevation of Privileges Vulnerability
- CVE-2026-56186 Windows Secure Channel Information Disclosure Vulnerability
- CVE-2026-56185 Windows Admin Center Information Disclosure Vulnerability
- CVE-2026-56184 Win32k Information Disclosure Vulnerability
- CVE-2026-56183 Windows MIDI Service Module Elevation of Privileges Vulnerability
- CVE-2026-56182 Windows NTFS Elevation of Privilege Vulnerability
- CVE-2026-56181 Windows Network Address Translation (NAT) Spoofing Vulnerability
- CVE-2026-5618 kalcaddle kodbox shareMake/shareCheck server-side request forgery
- CVE-2026-56179 Windows Network Address Translation (NAT) Spoofing Vulnerability
- CVE-2026-56178 Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability
- CVE-2026-56177 Windows Server Elevation of Privilege Vulnerability
- CVE-2026-56176 Windows Win32k Elevation of Privilege Vulnerability
- CVE-2026-56175 Windows NTFS Elevation of Privilege Vulnerability
- CVE-2026-56174 Windows Narrator Braille Elevation of Privilege Vulnerability
- CVE-2026-56173 Windows WebView Elevation of Privilege Vulnerability
- CVE-2026-56172 Windows VHD miniport driver Elevation of Privilege Vulnerability
- CVE-2026-56171 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
- CVE-2026-56170 ASP.NET Core Denial of Service Vulnerability
- CVE-2026-5617 Login as User <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation via 'oclaup_original_admin' Cookie
- CVE-2026-56169 Windows Admin Center Elevation of Privilege Vulnerability
- CVE-2026-56168 Windows SMB Server Denial of Service Vulnerability
- CVE-2026-56167 Azure AI Search Elevation of Privilege Vulnerability
- CVE-2026-56165 Microsoft Account Remote Code Execution Vulnerability
- CVE-2026-56164 Microsoft SharePoint Server Missing Authentication for Critical Function
- CVE-2026-56163 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
- CVE-2026-56162 Azure SQL Database Elevation of Privilege Vulnerability
- CVE-2026-56161 Azure Logic Apps Information Disclosure Vulnerability
- CVE-2026-56160 Azure Red Hat OpenShift (ARO) Elevation of Privilege Vulnerability
- CVE-2026-5616 JeecgBoot AI Chat JeecgBizToolsProvider.java missing authentication
- CVE-2026-56159 DHCP Server Service Remote Code Execution Vulnerability
- CVE-2026-56157 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-56156 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-56155 Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
- CVE-2026-56154 Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}
- CVE-2026-56153 Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char
- CVE-2026-56152 Incorrect Authorization in Kibana Leading to Information Disclosure
- CVE-2026-56151 Improper Input Validation in Kibana Leading to Denial of Service
- CVE-2026-56150 Allocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service
- CVE-2026-5615 givanz Vvvebjs File Upload Endpoint upload.php cross site scripting
- CVE-2026-56149 Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
- CVE-2026-56148 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-56147 Missing authorization in Kibana
- CVE-2026-56146 Improper Access Control in Kibana Leading to Unauthorized Data Modification and Information Disclosure
- CVE-2026-56145 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
- CVE-2026-56144 Incorrect Authorization in Elasticsearch Leading to Information Disclosure
- CVE-2026-56143 Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
- CVE-2026-56142 Privilege escalation in Hub
- CVE-2026-56141 Weak cryptography in Hub
- CVE-2026-56140 Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy
- CVE-2026-5614 Belkin F9K1015 formSetPassword stack-based overflow
- CVE-2026-56139 Apache Camel-Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body
- CVE-2026-56138 Authenticated Path Traversal in AIL framework /objects/item/diff Allows Reading Gzip-Compressed Files
- CVE-2026-56137 Command injection in RPG MAKER MV
- CVE-2026-56136 Memory corruption in tuxera:ntfs-3g
- CVE-2026-56135 Memory corruption in tuxera:ntfs-3g
- CVE-2026-56132 Memory corruption in libexpat
- CVE-2026-56131 Use after free in libexpat
- CVE-2026-56130 Apache Shiro: Remember-me cookie isn't checked for expiry on the server
- CVE-2026-5613 Belkin F9K1015 formReboot stack-based overflow
- CVE-2026-56129 Missing authorization in Generic IO & Memory Access driver