Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 545 of 1013.
- CVE-2026-55185 Miniflux 2: Open Redirect Bypass
- CVE-2026-55184 EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled
- CVE-2026-55183 RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page
- CVE-2026-55182 LibreNMS: Remote Code Execution by Signal Alert Transportation Module
- CVE-2026-55181 Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false
- CVE-2026-55180 pnpm: Repository config can expand victim environment secrets into registry requests before scripts run
- CVE-2026-55179 Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID
- CVE-2026-55178 GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
- CVE-2026-55177 CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard
- CVE-2026-55176 Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer token
- CVE-2026-55175 Spinnaker: Improper yaml processing on kustomize bake operations
- CVE-2026-55174 UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to missing DLEQ binding
- CVE-2026-55173 AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink
- CVE-2026-55170 OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions
- CVE-2026-55168 Runtipi: Authenticated arbitrary file write via backup restore symlink planting
- CVE-2026-55167 LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session
- CVE-2026-55166 Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise
- CVE-2026-55165 Lemur: JWT verifier honors attacker-supplied alg, enabling ATO
- CVE-2026-55164 Lemur: Plaintext password storage in Lemur user-update path
- CVE-2026-55163 Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membership
- CVE-2026-55162 Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF
- CVE-2026-55160 Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer
- CVE-2026-5516 IBM WebSphere Application Server Liberty is affected by a security bypass vulnerability
- CVE-2026-55159 Command injection in luci-app-adblock-fast
- CVE-2026-55158 Conflibot: Command injection via crafted pull request branch names under pull_request_target
- CVE-2026-55157 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info
- CVE-2026-55156 Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints
- CVE-2026-55154 EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export
- CVE-2026-55153 mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"
- CVE-2026-5515 IBM App Connect Enterprise is vulnerable to a confidential disclosure
- CVE-2026-55149 Vouch Proxy: Unbounded Multipart Cookie Allocation DoS
- CVE-2026-55145 Outlook Copilot Tampering Vulnerability
- CVE-2026-55144 Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability
- CVE-2026-55142 Microsoft Word Information Disclosure Vulnerability
- CVE-2026-55141 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55140 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-55139 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-55138 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-55137 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55136 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55135 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-55134 Microsoft Word Remote Code Execution Vulnerability
- CVE-2026-55133 Microsoft OneNote Remote Code Execution Vulnerability
- CVE-2026-55132 Microsoft Word Remote Code Execution Vulnerability
- CVE-2026-55131 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55130 Microsoft Word Remote Code Execution Vulnerability
- CVE-2026-5513 Cross-site scripting in Online Scheduling and Appointment Booking System – Bookly
- CVE-2026-55129 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-55128 Microsoft Word Remote Code Execution Vulnerability
- CVE-2026-55127 Microsoft Word Remote Code Execution Vulnerability
- CVE-2026-55126 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-55125 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-55124 Microsoft Word Information Disclosure Vulnerability
- CVE-2026-55123 Microsoft PowerPoint Remote Code Execution Vulnerability
- CVE-2026-55122 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-55121 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-55120 Microsoft PowerPoint Remote Code Execution Vulnerability
- CVE-2026-5512 Missing authorization in Enterprise Server
- CVE-2026-55119 Privilege escalation in UniFi Talk Application
- CVE-2026-55118 Privilege escalation in UniFi Network Application
- CVE-2026-55117 Path traversal in UniFi Access Application
- CVE-2026-55116 Missing authorization in Cloud Gateways
- CVE-2026-55115 Server-side request forgery in UniFi Protect Application
- CVE-2026-55114 Privilege escalation in UniFi Network Application
- CVE-2026-55113 Server-side request forgery in UniFi Talk Application
- CVE-2026-55112 Privilege escalation in Cloud Gateways
- CVE-2026-55111 Path traversal in UniFi Protect Floodlight
- CVE-2026-55110 Misconfiguration in Cloud Gateways
- CVE-2026-5511 Information Disclosure via Diagnostic Interface Due to Improper Input Validation on TP-Link's Archer AX72
- CVE-2026-55108 KubeVela Terraform remote loader DoS via unbounded file read
- CVE-2026-55107 Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
- CVE-2026-55106 authentik: Unauthenticated LDAP directory data disclosure
- CVE-2026-55105 Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer
- CVE-2026-55103 Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening
- CVE-2026-55102 hashi-vault-js: Vault token and secret values exposed in thrown errors
- CVE-2026-55100 hashi-vault-js has a path traversal and query parameter injection
- CVE-2026-5510 GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-55099 icalendar: Algorithmic Complexity in Equality
- CVE-2026-55096 SSRF via DNS-resolution gap in _validate_url_security (file download by URL)
- CVE-2026-55095 OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields
- CVE-2026-55094 Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)
- CVE-2026-55093 tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load
- CVE-2026-55092 Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts
- CVE-2026-55091 flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key
- CVE-2026-55090 Etherpad: Stored XSS in HTML export via unescaped attribute-pool values
- CVE-2026-5509 Arbitrary Command Injection via Browser Developer Console in TP-Link Archer BE450 and BE7200
- CVE-2026-55089 Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint
- CVE-2026-55088 ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token
- CVE-2026-55087 ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header
- CVE-2026-55086 ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite
- CVE-2026-55085 Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite
- CVE-2026-55084 SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read
- CVE-2026-55083 DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)
- CVE-2026-55082 DHIS2 SQL injection in SQL View filter values
- CVE-2026-55081 DHIS2 Reflected XSS in OpenAPI HTML scope parameter
- CVE-2026-5508 WowPress <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-55079 Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service
- CVE-2026-55078 Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service
- CVE-2026-55077 Coder: User-admin role can reset owner account password
- CVE-2026-55076 Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking