Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 544 of 1013.
- CVE-2026-55330 Use after free in Android
- CVE-2026-5533 badlogic pi-mono SVG Artifact SvgArtifact.ts cross site scripting
- CVE-2026-55323 Memory corruption in Android
- CVE-2026-5532 ScrapeGraphAI scrapegraph-ai GenerateCodeNode generate_code_node.py create_sandbox_and_execute os command injection
- CVE-2026-55318 Use after free in Android
- CVE-2026-55317 Memory corruption in Android
- CVE-2026-5531 SourceCodester Student Result Management System HTTP GET Request login_credentials.txt cleartext storage in file
- CVE-2026-55307 Information disclosure in Android
- CVE-2026-55306 Denial of service in Android
- CVE-2026-55304 Privilege escalation in Android
- CVE-2026-55302 Privilege escalation in Android
- CVE-2026-55301 Memory corruption in Android
- CVE-2026-5530 Ollama Model Pull API download.go server-side request forgery
- CVE-2026-55294 Memory corruption in Android
- CVE-2026-55290 Memory corruption in Android
- CVE-2026-5529 Dromara lamp-cloud DefUserController pageUser improper authorization
- CVE-2026-55286 Memory corruption in Android
- CVE-2026-55285 Memory corruption in Android
- CVE-2026-55280 Memory corruption in Android
- CVE-2026-5528 MoussaabBadla code-screenshot-mcp HTTP os command injection
- CVE-2026-55277 Memory corruption in Android
- CVE-2026-55276 Apache Tomcat: Logged effective web.xml is incomplete
- CVE-2026-55273 Supply chain in Android
- CVE-2026-55270 Privilege escalation in Android
- CVE-2026-5527 Tenda 4G03 Pro ECDSA P-256 Private Key server.key hard-coded key
- CVE-2026-55269 Memory corruption in Android
- CVE-2026-55266 Memory corruption in Android
- CVE-2026-55265 Memory corruption in Android
- CVE-2026-5526 Tenda 4G03 Pro httpd access control
- CVE-2026-55256 Denial of service in Android
- CVE-2026-55255 Langflow Authorization Bypass Through User-Controlled Key
- CVE-2026-55254 NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
- CVE-2026-55253 LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
- CVE-2026-55252 OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect
- CVE-2026-55251 Code injection in devicetype-library
- CVE-2026-55250 Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches
- CVE-2026-5525 Stack-Based Buffer Overflow in Notepad++ File Drop Handler leads to DoS
- CVE-2026-55249 @rtk-ai/rtk-rewrite: OpenClaw Rewrite Plugin Command Injection via execSync Template String
- CVE-2026-55248 plone.app.portlets: Denial of service via RSS feed portlet
- CVE-2026-55247 plone.app.event: Denial of service via iCalendar import
- CVE-2026-55246 bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file
- CVE-2026-55245 Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL
- CVE-2026-55244 ASTEVAL: Sandbox Escape via BaseException Subclasses
- CVE-2026-55242 ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix
- CVE-2026-55241 Checkmate: Pre-auth Denial of Service via File Upload on Registration
- CVE-2026-55240 Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates
- CVE-2026-5524 File upload in Divi Form Builder
- CVE-2026-55239 Tianji: SQL Injection via unsanitized timezone parameter in analytics queries
- CVE-2026-55238 xrdp: Malformed Confirm Active capability sets cause out-of-bounds reads
- CVE-2026-55237 AutoGPT SignUp Page has DOM-Based XSS and Open Redirect
- CVE-2026-55236 langgraph-api: Incomplete assistant authorization in LangGraph Server run creation
- CVE-2026-55235 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
- CVE-2026-55234 Missing authorization in wekan
- CVE-2026-55233 OpenResty: Buffer overflow when writing PROXY protocol v2 header to upstream
- CVE-2026-55232 Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy
- CVE-2026-55231 Path traversal in Vvveb
- CVE-2026-55230 Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character
- CVE-2026-5523 Missing authorization in Divi Form Builder
- CVE-2026-55229 Gotenberg: SSRF via LibreOffice document processing
- CVE-2026-55228 Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project
- CVE-2026-55227 Observable object existence disclosure in private Weblate projects via globally scoped object lookups
- CVE-2026-55226 Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator
- CVE-2026-55225 Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`
- CVE-2026-55224 MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall
- CVE-2026-55223 c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties
- CVE-2026-55222 Isar: Unprivileged user ownership of trusted repository GPG public keys storage after bootstrap
- CVE-2026-55221 Boruta: OAuth credentials exposed in Boruta business logs
- CVE-2026-55220 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column
- CVE-2026-5522 QRadar contains hard-coded credentials
- CVE-2026-55219 Paymenter: Race condition in payWithCredit() enables credit double-spend
- CVE-2026-55217 GLPI: Unallowed modfication of knowbase items comments and translations
- CVE-2026-55215 MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`
- CVE-2026-55214 GLPI: Stored XSS in suppliers
- CVE-2026-55213 h2o: musl libc stack overflow (QPACK)
- CVE-2026-55212 Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation
- CVE-2026-55211 surfio IRAP header size fields cause out-of-bounds reads
- CVE-2026-55210 Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)
- CVE-2026-55209 resdata insufficiently validates untrusted GRDECL files
- CVE-2026-55208 Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
- CVE-2026-55207 Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass
- CVE-2026-55206 py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()
- CVE-2026-55205 Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint
- CVE-2026-55204 HAProxy - NULL Pointer Dereference in hpack_dht_insert Function
- CVE-2026-55203 HAProxy - Integer Overflow in FCGI Demux Record Length Field
- CVE-2026-55202 Tinyproxy - Stathost Detection Bypass via Host Header Manipulation
- CVE-2026-55201 Evil-WinRM - Path Traversal in download_dir() Function
- CVE-2026-55200 libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
- CVE-2026-55199 libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler
- CVE-2026-55198 Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint
- CVE-2026-55197 Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint
- CVE-2026-55196 Hermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypass
- CVE-2026-55195 py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size
- CVE-2026-55194 FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch
- CVE-2026-55193 FreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind_ack max_xmit_frag
- CVE-2026-55192 FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatch
- CVE-2026-55191 FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation
- CVE-2026-55190 Server-side request forgery in eventschedule
- CVE-2026-55189 RustFS: FTP frontend skips IAM authorization on object reads
- CVE-2026-55188 RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials
- CVE-2026-55187 Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808)