Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 543 of 1013.
- CVE-2026-55452 Snipe-IT: CSV formula injection in Activity Report export
- CVE-2026-55451 gettext-converter: Prototype pollution in js2i18next() via crafted translation keys
- CVE-2026-55450 Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak
- CVE-2026-5545 wrong reuse of HTTP Negotiate connection
- CVE-2026-55448 mise: Local credential_command executes untrusted config
- CVE-2026-55447 Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
- CVE-2026-55446 Langflow: Unauthenticated DoS through multipart form boundary file upload
- CVE-2026-55445 Qinglong: Incomplete fix for CVE-2026-3965: Improper Authentication
- CVE-2026-55444 Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters
- CVE-2026-55443 LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
- CVE-2026-55442 Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection
- CVE-2026-55441 mise: Arbitrary command execution via task-include files in an untrusted, config-less repository
- CVE-2026-55440 Missing authorization in UFO
- CVE-2026-5544 UTT HiPER 1250GW formRemoteControl stack-based overflow
- CVE-2026-55439 Halo: Path Traversal in Backup Download Leads to Arbitrary File Read
- CVE-2026-55438 Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing
- CVE-2026-55437 Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component
- CVE-2026-55436 Coder's AI Bridge Proxy skips TLS certificate verification in default configuration
- CVE-2026-55435 Suspended Coder users retain access to AI Bridge LLM proxy endpoints
- CVE-2026-55434 Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints
- CVE-2026-55433 Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers
- CVE-2026-55432 Coder's sub-agent app registration bypasses template port-sharing policy enforcement
- CVE-2026-55431 Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps
- CVE-2026-55430 Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access
- CVE-2026-5543 PHPGurukul User Registration & Login and User Management System yesterday-reg-users.php sql injection
- CVE-2026-55429 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID
- CVE-2026-55428 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator
- CVE-2026-55427 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`
- CVE-2026-55426 linuxfabrik-lib: Local privilege escalation using embedded command
- CVE-2026-55425 Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields
- CVE-2026-55424 Discourse: Topic featured link susceptible to stored XSS
- CVE-2026-55423 Langflow: Logout button does not clear session
- CVE-2026-55422 conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard
- CVE-2026-55421 Open edX Platform: SSRF in Studio Video Download Endpoint
- CVE-2026-55420 Discourse: Remote code execution via pdf uploads
- CVE-2026-5542 code-projects Simple Laundry System Parameter modstaffinfo.php cross site scripting
- CVE-2026-55419 Reachy Mini: Unrestricted Upload of File with Dangerous Type
- CVE-2026-55418 FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)
- CVE-2026-55417 Chevereto private profile setting leaks username on /json endpoint
- CVE-2026-55416 Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration
- CVE-2026-55415 datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements
- CVE-2026-55414 NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)
- CVE-2026-55413 ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution
- CVE-2026-55412 ToolJet Cloud - SSRF to Azure Cloud Infrastructure Compromise
- CVE-2026-55411 Missing authorization in ToolJet
- CVE-2026-55410 NocoBase backup restore schema name allows command injection
- CVE-2026-5541 code-projects Simple Laundry System Parameter modmemberinfo.php cross site scripting
- CVE-2026-55409 Filament: Disabled RichEditor field state can be used for XSS
- CVE-2026-55408 Koodo Reader: Remote code execution via malicious epub file
- CVE-2026-55407 Buffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
- CVE-2026-55406 Buffa: Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref
- CVE-2026-55405 LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector
- CVE-2026-55404 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
- CVE-2026-55403 datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas
- CVE-2026-55402 Memory corruption in Secure Access
- CVE-2026-55401 Null dereference in Secure Access
- CVE-2026-55400 Integer overflow in Secure Access
- CVE-2026-5540 code-projects Simple Laundry System Parameter modifymember.php sql injection
- CVE-2026-55399 Resource exhaustion vulnerability in the Secure Access publisher
- CVE-2026-55398 Memory management vulnerability in Secure Access clients
- CVE-2026-55396 Unencrypted UDP Control Traffic in Teledyne FLIR Robots running Aware2
- CVE-2026-55395 Hardcoded Passwords in Teledyne FLIR Robots running Aware2
- CVE-2026-55394 Unencrypted 802.11 Network in Teledyne FLIR Robots running Aware2
- CVE-2026-55393 Local File Inclusion in Teledyne FLIR Robots running Aware2
- CVE-2026-55392 NILFS utilities - Undefined Behavior and Out-of-Memory via Unvalidated s_log_block_size
- CVE-2026-55391 datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
- CVE-2026-55390 Arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate
- CVE-2026-5539 code-projects Simple Laundry System Parameter modifymember.php cross site scripting
- CVE-2026-55389 datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`
- CVE-2026-55388 piscina: Prototype Pollution Gadget → RCE via inherited options.filename
- CVE-2026-55387 InvoiceShelf bulk deletion lacks company scoping
- CVE-2026-55386 InvoiceShelf ORDER BY SQL injection through orderByField
- CVE-2026-55385 InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration
- CVE-2026-55384 InvoiceShelf trusts client-supplied document totals
- CVE-2026-55383 InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure
- CVE-2026-55382 InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)
- CVE-2026-55381 Missing authorization in InvoiceShelf
- CVE-2026-55380 Pillow GdImageFile decompression bomb protection bypass
- CVE-2026-5538 QingdaoU OnlineJudge judge_server_heartbeat Endpoint JudgeServer.service_url server-side request forgery
- CVE-2026-55379 Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
- CVE-2026-55378 JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values
- CVE-2026-55377 Logto: Account Center MFA management step-up bypass via WebAuthn registration verification
- CVE-2026-55376 heym Python Tool Sandbox Escape
- CVE-2026-55375 canto-saas-api: OAuth credentials exposed in URL query string and exception messages
- CVE-2026-55374 canto-saas-api: Authenticated API requests can be redirected via unencoded path variables
- CVE-2026-55373 OpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts
- CVE-2026-55371 OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length
- CVE-2026-55370 Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation)
- CVE-2026-5537 halex CourseSEL HTTP GET Parameter IndexController.class.php check_sel sql injection
- CVE-2026-55369 Waline login accepts a non-string email as a match-all MongoDB query
- CVE-2026-55366 Auth bypass in Android
- CVE-2026-55365 Memory corruption in Android
- CVE-2026-5536 FedML-AI FedML gRPC server grpc_server.py sendMessage deserialization
- CVE-2026-55359 Security feature bypass in Android
- CVE-2026-55351 Integer overflow in Android
- CVE-2026-5535 FedML-AI FedML MQTT Message FileUtils.java path traversal
- CVE-2026-55343 Memory corruption in Android
- CVE-2026-5534 itsourcecode Online Enrollment System Parameter index.php sql injection
- CVE-2026-55332 Memory corruption in Android
- CVE-2026-55331 Memory corruption in Android