Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 546 of 1013.
- CVE-2026-55075 Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass
- CVE-2026-55074 Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)
- CVE-2026-55073 WeasyPrint restrictive URL fetcher bypass allows local file read and SSRF
- CVE-2026-55072 Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
- CVE-2026-55071 MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`
- CVE-2026-5507 Session Cache Restore — Arbitrary Free via Deserialized Pointer
- CVE-2026-55069 Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack
- CVE-2026-55068 free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints
- CVE-2026-55067 Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment
- CVE-2026-55066 Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id
- CVE-2026-55065 Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api
- CVE-2026-55064 Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0
- CVE-2026-55062 uniget: Path Traversal in Hook Files - Directory Escape Vulnerability
- CVE-2026-55061 uniget: EDITOR Command Injection in uniget CLI
- CVE-2026-55060 GoCD is vulnerable to authorization bypass via support process list API
- CVE-2026-5506 Wavr <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-55059 OpenEXR: OpenEXRUtil SampleCountChannel row setter heap has an out-of-bounds write vulnerability
- CVE-2026-55058 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55057 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-55056 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-55055 Microsoft Word Remote Code Execution Vulnerability
- CVE-2026-55054 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-55053 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55052 Microsoft SharePoint Elevation of Privilege Vulnerability
- CVE-2026-55051 Microsoft SharePoint Server Information Disclosure Vulnerability
- CVE-2026-55050 Microsoft Word Information Disclosure Vulnerability
- CVE-2026-5505 WP-Clippy <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-55049 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-55048 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55047 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-55046 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-55045 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-55044 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55043 Microsoft PowerPoint Remote Code Execution Vulnerability
- CVE-2026-55042 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-55041 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55040 Microsoft SharePoint Weak Authentication
- CVE-2026-5504 PKCS7 CBC Padding Oracle — Plaintext Recovery
- CVE-2026-55039 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55038 Microsoft Word Remote Code Execution Vulnerability
- CVE-2026-55037 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55036 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55035 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-55034 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-55033 Microsoft Word Remote Code Execution Vulnerability
- CVE-2026-55032 Microsoft Word Remote Code Execution Vulnerability
- CVE-2026-55031 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55030 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-5503 out-of-bounds write in TLSX_EchChangeSNI via attacker-controlled publicName
- CVE-2026-55029 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55028 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-55027 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-55026 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-55025 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55024 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-55023 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-55022 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-55021 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-55020 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-5502 Missing authorization in Tutor LMS – eLearning and online course solution
- CVE-2026-55019 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-55018 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-55017 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-55016 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-55015 Microsoft Remote Help Denial of Service Vulnerability
- CVE-2026-55014 Windows Remote Help Defense Elevation of Privilege Vulnerability
- CVE-2026-55013 Windows Remote Help Defense Spoofing Vulnerability
- CVE-2026-55012 Microsoft Defender Remote Code Execution Vulnerability
- CVE-2026-55011 Microsoft Defender Remote Code Execution Vulnerability
- CVE-2026-55010 Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability
- CVE-2026-5501 Improper Certificate Signature Verification in X.509 Chain Validation Allows Forged Leaf Certificates
- CVE-2026-55009 Microsoft Exchange Server Elevation of Privilege Vulnerability
- CVE-2026-55008 Microsoft Exchange Server Spoofing Vulnerability
- CVE-2026-55007 Microsoft Exchange Server Remote Code Execution Vulnerability
- CVE-2026-55006 Microsoft Exchange Server Elevation of Privilege Vulnerability
- CVE-2026-55005 Microsoft Exchange Server Remote Code Execution Vulnerability
- CVE-2026-55004 Windows Print Configuration Elevation of Privilege Vulnerability
- CVE-2026-55003 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
- CVE-2026-55002 Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-55001 Active Directory Domain Services Elevation of Privilege Vulnerability
- CVE-2026-55000 Windows USB Print Driver Elevation of Privilege Vulnerability
- CVE-2026-5500 Improper Validation of AES-GCM Authentication Tag Length in PKCS#7 Envelope Allows Authentication Bypass
- CVE-2026-54999 Windows TCP/IP Remote Code Execution Vulnerability
- CVE-2026-54998 Microsoft Exchange Online Elevation of Privilege Vulnerability
- CVE-2026-54997 Windows SMB Information Disclosure Vulnerability
- CVE-2026-54996 Windows USB Print Driver Elevation of Privilege Vulnerability
- CVE-2026-54995 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
- CVE-2026-54993 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
- CVE-2026-54992 Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability
- CVE-2026-54991 Windows USB Print Driver Elevation of Privilege Vulnerability
- CVE-2026-54990 Remote Desktop Client Remote Code Execution Vulnerability
- CVE-2026-54989 Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability
- CVE-2026-54988 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-54987 Windows Overlay Filter Elevation of Privilege Vulnerability
- CVE-2026-54986 Windows Win32k Elevation of Privilege Vulnerability
- CVE-2026-54984 Windows Imaging Component Remote Code Execution Vulnerability
- CVE-2026-54983 Windows Active Directory Federation Services Denial of Service Vulnerability
- CVE-2026-54982 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
- CVE-2026-54981 Visual Studio Code Python Extension Security Feature Bypass Vulnerability
- CVE-2026-5497 Unbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllm