Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 539 of 1013.
- CVE-2026-5588 PKIX draft CompositeVerifier accepts empty signature sequence as valid.
- CVE-2026-55879 OpenReplay: Unauthenticated stored XSS leads to dashboard account takeover
- CVE-2026-55878 Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest
- CVE-2026-55877 Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses
- CVE-2026-55876 Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts
- CVE-2026-55875 Helium: SSRF via External Calendar URL Allows Authenticated Users to Probe Internal Network
- CVE-2026-55874 SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read
- CVE-2026-55873 SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets
- CVE-2026-55872 GYM One admin user list is vulnerable to stored cross-site scripting
- CVE-2026-55871 GYM One: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in admin/users/index.php
- CVE-2026-55870 GoCD is vulnerable to credential exposure when admins insecurely configure material URLs
- CVE-2026-5587 wbbeyourself MAC-SQL Refiner Agent agents.py _execute_sql sql injection
- CVE-2026-55867 Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens
- CVE-2026-55866 SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected
- CVE-2026-55865 Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
- CVE-2026-55864 GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool
- CVE-2026-55863 motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution
- CVE-2026-55862 pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow
- CVE-2026-55860 org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
- CVE-2026-5586 zhongyu09 openchatbi Multi-stage Text2SQL Workflow sql injection
- CVE-2026-55859 org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output
- CVE-2026-55858 MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client
- CVE-2026-55857 MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
- CVE-2026-55856 MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake
- CVE-2026-55855 MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets
- CVE-2026-55854 MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
- CVE-2026-55852 Frappe: TarSlip RCE in Package Import
- CVE-2026-55851 Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion
- CVE-2026-55850 Element Web: A malicious homeserver can inject HTML in Element Web using its homepage
- CVE-2026-5585 Tencent AI-Infra-Guard Task Detail Endpoint task_manager.go information disclosure
- CVE-2026-55849 @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument
- CVE-2026-55848 mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types
- CVE-2026-55847 Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering
- CVE-2026-55846 Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read
- CVE-2026-55844 Information disclosure in core
- CVE-2026-55843 Snipe-IT: Improper Privilege Management
- CVE-2026-55842 Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domain
- CVE-2026-55841 Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message
- CVE-2026-55840 Scoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypass
- CVE-2026-5584 Fosowl agenticSeek query Endpoint PyInterpreter.py PyInterpreter.execute code injection
- CVE-2026-55839 Kestra: Stored XSS via custom Markdown [[link]] attribute injection
- CVE-2026-55838 RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metrics
- CVE-2026-55837 dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
- CVE-2026-55836 Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)
- CVE-2026-55835 Lookyloo: Potential sub-system DoS due to parameter missmatch in notification
- CVE-2026-55834 Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none
- CVE-2026-55833 Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation
- CVE-2026-55832 Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx
- CVE-2026-55831 Netty SPDY SETTINGS frame count materializes unbounded settings map
- CVE-2026-55830 RestrictedPython guard hooks can be shadowed via positional-only arguments
- CVE-2026-5583 PHPGurukul Online Shopping Portal Project Parameter my-profile.php sql injection
- CVE-2026-55828 qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)
- CVE-2026-55827 FreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decode
- CVE-2026-55826 Information disclosure in gtm-server-side-wordpress-plugin
- CVE-2026-55825 Contao: Possible path traversal in job download URIs
- CVE-2026-55824 Contao crawler leaks auth credentials to external hosts
- CVE-2026-55823 Frappe: Possibility of SQL injection in reportview
- CVE-2026-5582 FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle
- CVE-2026-55814 Apache Ranger: Download APIs expose plugin data without authentication
- CVE-2026-55810 Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050
- CVE-2026-5581 Multi Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion
- CVE-2026-55809 Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049
- CVE-2026-55808 Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009
- CVE-2026-55807 Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008
- CVE-2026-55806 Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007
- CVE-2026-55805 Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012
- CVE-2026-55804 Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006
- CVE-2026-55803 Drupal core - Critical - PHP object injection - SA-CORE-2026-005
- CVE-2026-5580 CodeAstro Online Classroom Parameter addvideos.php sql injection
- CVE-2026-55799 Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator
- CVE-2026-55798 Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
- CVE-2026-55797 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
- CVE-2026-55796 Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
- CVE-2026-55795 Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
- CVE-2026-55794 Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
- CVE-2026-55793 Craft CMS: Stored XSS via Structure entry title in table view
- CVE-2026-55792 Craft CMS: Sensitive File Disclosure / Server-Side File Read
- CVE-2026-55791 Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
- CVE-2026-55790 Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
- CVE-2026-5579 CodeAstro Online Classroom Parameter updatedetailsfromfaculty.php sql injection
- CVE-2026-55789 Code injection in logto
- CVE-2026-55787 Flyto2 Core: SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf
- CVE-2026-55786 Flyto2 Core: Unauthenticated Command Execution via HTTP MCP `execute_module`
- CVE-2026-55785 free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA
- CVE-2026-55784 free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI
- CVE-2026-55783 Null dereference in NanaZip
- CVE-2026-55782 Denial of service in NanaZip
- CVE-2026-55781 NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields
- CVE-2026-55780 NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size
- CVE-2026-5578 CodeAstro Online Classroom Parameter addassessment.php sql injection
- CVE-2026-55779 Silverstripe Versioned: XSS in archive admin restore
- CVE-2026-55778 Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist
- CVE-2026-55777 GoAccess: Out-of-bounds heap read in parse_ios() via crafted User-Agent leads to remote crash/DoS
- CVE-2026-55776 OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types
- CVE-2026-55775 OpenBao's System Backend allows Unauthorized Management of the containing Namespace
- CVE-2026-55774 OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808
- CVE-2026-55773 CedarJava has a policy injection vulnerability
- CVE-2026-55772 CedarJava has a type confusion vulnerability
- CVE-2026-55771 CedarJava has policy injection, type confusion, and incorrect equality comparison vulnerabilities
- CVE-2026-55770 OpenBao: LDAPi ldaputil (wrong escape func)