Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 542 of 1013.
- CVE-2026-55553 urllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
- CVE-2026-55552 Yamcs: Unauthenticated Directory Traversal
- CVE-2026-55550 NextCRM has RBAC Bypass in MCP Product Tools that Allows Low-Privileged Users to Modify the CRM Product Catalog
- CVE-2026-5555 code-projects Concert Ticket Reservation System Parameter login.php sql injection
- CVE-2026-55549 Yamcs: Reflected XSS in the URL of the Authorize Endpoint
- CVE-2026-55548 Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets
- CVE-2026-55547 Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration
- CVE-2026-55546 QWED-MCP: Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input
- CVE-2026-55545 Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce
- CVE-2026-55544 NextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and Tampering
- CVE-2026-55543 TuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file
- CVE-2026-55542 Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL
- CVE-2026-55541 PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
- CVE-2026-55540 PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks
- CVE-2026-5554 code-projects Concert Ticket Reservation System Parameter process_search.php sql injection
- CVE-2026-55539 PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete
- CVE-2026-55538 PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated
- CVE-2026-55537 PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114
- CVE-2026-55536 PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
- CVE-2026-55535 PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation
- CVE-2026-55534 PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution
- CVE-2026-55533 PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret
- CVE-2026-55532 PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server
- CVE-2026-55531 PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)
- CVE-2026-55530 praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool
- CVE-2026-5553 itsourcecode Online Cellphone System Parameter available.php sql injection
- CVE-2026-55529 PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server
- CVE-2026-55528 praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862)
- CVE-2026-55527 praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location
- CVE-2026-55526 PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
- CVE-2026-55525 PraisonAI: SSRF via redirect-following in praisonaiagents web_crawl
- CVE-2026-55524 PraisonAI: SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)
- CVE-2026-55523 PraisonAI has a`web_crawl` SSRF protection bypass via unchecked redirect targets
- CVE-2026-55522 PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code
- CVE-2026-55521 Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API
- CVE-2026-55520 Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matching
- CVE-2026-5552 PHPGurukul Online Shopping Portal Project Parameter sub-category.php sql injection
- CVE-2026-55519 Snipe-IT: Improper Authorization in File Deletion (IDOR)
- CVE-2026-55518 Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation
- CVE-2026-55517 Deno: Denial of service via non-ASCII bytes in WebSocket response headers
- CVE-2026-55516 Snipe-IT: Cross-company asset maintenance re-parenting via API update
- CVE-2026-55515 Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint
- CVE-2026-55514 vLLM denial of service via prompt embeds on M-RoPE models
- CVE-2026-55513 nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens
- CVE-2026-55512 nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting
- CVE-2026-55511 Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`
- CVE-2026-55510 ImageMagick: Use-After-Free in crafted 8BIM when identifying an image
- CVE-2026-5551 itsourcecode Free Hotel Reservation System Parameter login.php sql injection
- CVE-2026-55509 WsgiDAV: Blind SQL injection in the MySQL provider
- CVE-2026-55502 Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials
- CVE-2026-55501 9router: Login brute-force protection bypass via spoofed X-Forwarded-For header
- CVE-2026-55500 9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover
- CVE-2026-5550 Tenda AC10 httpd fromSysToolChangePwd stack-based overflow
- CVE-2026-55499 Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings
- CVE-2026-55498 FileRise Shared Folder Symlink Escape
- CVE-2026-55497 Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)
- CVE-2026-55496 Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emails
- CVE-2026-55495 Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account
- CVE-2026-55494 Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset
- CVE-2026-55491 BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name
- CVE-2026-55490 OpenWrt: EAD Integer Underflow → Pre-Auth Denial of Service
- CVE-2026-5549 Tenda AC10 RSA 2048-bit Private Key privkeySrv.pem hard-coded key
- CVE-2026-55489 BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass
- CVE-2026-55488 motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read
- CVE-2026-55487 pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle
- CVE-2026-55486 Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS
- CVE-2026-55485 Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.
- CVE-2026-55484 alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server
- CVE-2026-55483 Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation
- CVE-2026-55482 Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update
- CVE-2026-55481 Snipe-IT: CSS Injection via `header_color` Setting
- CVE-2026-55480 CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)
- CVE-2026-5548 Tenda AC10 httpd fromSysToolChangePwd stack-based overflow
- CVE-2026-55479 Snipe-IT: Incorrect permission for legacy license checkin API
- CVE-2026-55478 Snipe-IT: Missing object-level authorization in Kits API
- CVE-2026-55477 Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation
- CVE-2026-55476 Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter
- CVE-2026-55475 Snipe-IT: Import created_by can be overwritten
- CVE-2026-55474 Snipe-IT: Directory traversal in displaySig
- CVE-2026-55473 Server-side request forgery in homebox
- CVE-2026-55472 Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation
- CVE-2026-55471 HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
- CVE-2026-55470 HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
- CVE-2026-5547 Tenda AC10 httpd formAddMacfilterRule os command injection
- CVE-2026-55469 Snipe-IT: Path traversal vulnerability via CSV import `image` field
- CVE-2026-55468 Wagtail: Improper restriction handling on Pages admin API
- CVE-2026-55467 CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)
- CVE-2026-55466 Snipe-IT: Stored XSS via inline-served attachment
- CVE-2026-55465 Goobi viewer: Solr injection via unvalidated region parameter in spatial search
- CVE-2026-55464 Snipe-IT: Stored XSS via Markdown custom field
- CVE-2026-55463 Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation
- CVE-2026-55462 Snipe-IT: Authorization bypass on print inventory page
- CVE-2026-55461 Snipe-IT: Open Redirect After User Edit
- CVE-2026-55460 Snipe-IT: Authorization bypass on bulk editing users
- CVE-2026-5546 Campcodes Complete Online Learning Management System Crud_model.php add_lesson unrestricted upload
- CVE-2026-55459 Goobi viewer: OpenID JWT audience not enforced by the verifier
- CVE-2026-55457 Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass
- CVE-2026-55455 Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist
- CVE-2026-55454 Appsmith: Caddy admin API exposed without authentication
- CVE-2026-55453 CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip