Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 541 of 1013.
- CVE-2026-55653 Memory corruption in Red Hat Enterprise Linux 10
- CVE-2026-55652 Auth bypass in wekan
- CVE-2026-55651 Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure
- CVE-2026-55650 Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure
- CVE-2026-5565 code-projects Simple Laundry System Parameter delmemberinfo.php sql injection
- CVE-2026-55648 FreeRDP: Integer Overflow in `freerdp_image_copy_from_icon_data` Bypasses Bounds Check
- CVE-2026-55647 DataEase: authenticated stored XSS in the dashboard text components
- CVE-2026-55646 vLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit
- CVE-2026-55645 xrdp: Out-of-bounds read in Client Control PDU processing (xrdp_rdp_process_data_control)
- CVE-2026-55644 Element X iOS: io.element.call deeplink allows attacker-controlled HTTPS origin and may grant mic/camera to that origin
- CVE-2026-55643 Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode
- CVE-2026-55642 dbx: Unauthenticated arbitrary SQL execution in dbx-web (authentication fails open when no password is configured)
- CVE-2026-55641 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF
- CVE-2026-55640 nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
- CVE-2026-5564 code-projects Simple Laundry System Parameter searchguest.php sql injection
- CVE-2026-55639 Memory corruption in xrdp
- CVE-2026-55638 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass
- CVE-2026-55637 genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport
- CVE-2026-55636 Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected
- CVE-2026-55635 DataEase: Authenticated SQL Injection in Chart Quota Filters
- CVE-2026-55634 Pimcore: Remote Code Execution via DataObject Class-Definition Field Name
- CVE-2026-55633 DataEase H2 RCE via Zip Protocol & File Dropper Fix bypass
- CVE-2026-55632 GoCD is vulnerable to authorization bypass via pipeline structure API
- CVE-2026-55631 DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management
- CVE-2026-55630 Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)
- CVE-2026-5563 AutohomeCorp frostmourne Alarm Preview previewData httpTest sql injection
- CVE-2026-55629 Whistle: Path traversal
- CVE-2026-55628 ImageMagick: Policy Bypass in concatenate operation due to missing checks
- CVE-2026-55626 xrdp: No authentication required with Xvnc backend on RHEL 9
- CVE-2026-55625 GoCD is vulnerable to authorization bypass via material connection test APIs
- CVE-2026-55624 MintyItanium Lost-Auction takes items like barrier blocks out from search GUI
- CVE-2026-55622 Incus has a project restriction bypass in instance copy across projects
- CVE-2026-55621 Incus has a project restriction bypass for custom volume copy across projects
- CVE-2026-55620 eml_parser: DoS via deeply nested parens in Received headers
- CVE-2026-5562 provectus kafka-ui Endpoint testexecutions validateAccess code injection
- CVE-2026-55619 eml_parser: Parser DoS via deeply nested parentheses in e-mail headers
- CVE-2026-55618 eml_parser: URL extraction bypass via HTML entities in URLs
- CVE-2026-55617 Hydro: Insufficient session expiration when recreating sessions
- CVE-2026-55615 Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879
- CVE-2026-55611 Missing authorization in anything-llm
- CVE-2026-55610 InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover
- CVE-2026-5561 Campcodes Complete POS Management and Inventory System Environment Variable SettingsController.php injection
- CVE-2026-55609 sublinear-time-solver: Arbitrary file write in consciousness-explorer / sublinear-time-solver MCP export_state
- CVE-2026-55608 n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode
- CVE-2026-55607 Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
- CVE-2026-55606 odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()
- CVE-2026-55605 @arikusi/deepseek-mcp-server Missing Authentication on Self-Hosted HTTP MCP Endpoint
- CVE-2026-55604 @arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key
- CVE-2026-55603 http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
- CVE-2026-55602 http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
- CVE-2026-55601 MultiTail: Shell injection in execute-on-match command handling
- CVE-2026-55600 Part-DB: Stored HTML injection in BOM validation results via unescaped Part name
- CVE-2026-5560 PHPGurukul Online Shopping Portal Project Parameter payment-method.php sql injection
- CVE-2026-55599 phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access
- CVE-2026-55597 ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments
- CVE-2026-55596 Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript
- CVE-2026-55595 ImageMagick: Infinite Loop in connected-components when providing invalid arguments
- CVE-2026-55594 ImageMagick: Stack Overflow in MVG decoder due to missing depth check.
- CVE-2026-55593 Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection
- CVE-2026-55592 Dashy: XSS in workspace url parameter
- CVE-2026-55591 Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints
- CVE-2026-55590 CakePHP: Open redirect weakness via backslash bypass
- CVE-2026-5559 AntaresMugisho PyBlade AST Validation sandbox.py _is_safe_ast special elements used in a template engine
- CVE-2026-55588 ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption
- CVE-2026-55587 AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID
- CVE-2026-55586 SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM files
- CVE-2026-55585 QWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`
- CVE-2026-55584 phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
- CVE-2026-55583 Twenty: Cross-workspace IDOR in AgentTurnResolver
- CVE-2026-55582 mcp-shell: Secure Mode Allowlist Bypass via Git Shell Alias
- CVE-2026-55581 mcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` Executable
- CVE-2026-55580 mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist
- CVE-2026-5558 PHPGurukul PHPGurukul Online Shopping Portal Project Parameter pending-orders.php sql injection
- CVE-2026-55579 Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise
- CVE-2026-55578 Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
- CVE-2026-55577 ImageMagick: Heap Buffer Overflow in ImageMagick MVG decoder
- CVE-2026-55576 MaaAssistantArknights: PR-title expression injection in release-preparation.yml
- CVE-2026-55575 LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
- CVE-2026-55574 vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends
- CVE-2026-55573 e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain
- CVE-2026-55572 e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username
- CVE-2026-55571 djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls
- CVE-2026-55570 Cross-site scripting in siyuan
- CVE-2026-5557 badlogic pi-mono pi-mom Slack Bot slack.ts authentication bypass
- CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory
- CVE-2026-55568 Guzzle: Silent HTTPS-Proxy Downgrade to Cleartext
- CVE-2026-55567 BleachBit: Exploit File Delete to Escalate Privilege
- CVE-2026-55566 Yamcs: DOM XSS in Extension Routing
- CVE-2026-55565 Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)
- CVE-2026-55564 FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments
- CVE-2026-55563 Supply chain in feast
- CVE-2026-55562 Cronicle: Stored XSS in admin Activity Log via account full_name field
- CVE-2026-55561 InvoicePlane: Guest user IDOR in quote approval and rejection
- CVE-2026-5556 badlogic pi-mono loader.ts discoverAndLoadExtensions code injection
- CVE-2026-55559 Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)
- CVE-2026-55558 aiosmtplib: STARTTLS response injection
- CVE-2026-55557 browse-mcp: Arbitrary file write via unconfined download and state paths
- CVE-2026-55556 Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling
- CVE-2026-55555 Dompdf: File existence oracle via font-face stylesheet declaration
- CVE-2026-55554 Dompdf: Chroot Validation Bypass