Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 549 of 1013.
- CVE-2026-54714 Logto: XSS via unescaped RelayState in SAML auto-submit form
- CVE-2026-54713 CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions
- CVE-2026-54712 OpenTelemetry Javaagent RMI context propagation allows resource exhaustion
- CVE-2026-54711 PGHoard: Password written to debug log
- CVE-2026-54710 FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)
- CVE-2026-5471 Investory Toy Planet Trouble App app.investory.toyfactory google-services-desktop.json hard-coded key
- CVE-2026-54708 Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module
- CVE-2026-54707 OnionShare Receive mode writes uploaded files even when file uploads are disabled
- CVE-2026-54706 OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files
- CVE-2026-54705 mathlive's Lack of Escaping of HTML allows for XSS
- CVE-2026-54704 OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords
- CVE-2026-54703 Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Validation
- CVE-2026-54702 Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler
- CVE-2026-54701 Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview
- CVE-2026-54700 ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation
- CVE-2026-5470 Server-side request forgery in Google-Research-MCP
- CVE-2026-54699 Warp: OS command injection when opening terminal links from WSL
- CVE-2026-54698 Hasura: Row-level authorization bypass on table computed fields
- CVE-2026-54697 ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsing
- CVE-2026-54696 Ruby JSON: JSON generator heap buffer overflow when streaming to an IO
- CVE-2026-54695 Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID
- CVE-2026-54694 NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover
- CVE-2026-54693 ZITADEL Users Can Self-Verify Email/Phone via API
- CVE-2026-54692 SAIL: XBM X10 decoder writes 2 bytes per literal into a 1-byte-per-literal buffer (heap out-of-bounds write)
- CVE-2026-54691 datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects
- CVE-2026-54690 datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)
- CVE-2026-5469 Casdoor Webhook URL server-side request forgery
- CVE-2026-54689 mcp-searxng hardened-mode SSRF bypasses permit internal URL access
- CVE-2026-54688 mcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)
- CVE-2026-54687 n8n-nodes-sqlite3: Path traversal via user-controlled database file path (db_path parameter)
- CVE-2026-54686 Warp: DCS lifecycle hook spoofing can alter terminal session metadata
- CVE-2026-54685 FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel
- CVE-2026-54684 Path traversal in jadx
- CVE-2026-54683 NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)
- CVE-2026-54682 DiscordChatExporter: Stored XSS in HTML export when markdown formatting is disabled
- CVE-2026-54681 DiscordChatExporter: HTML attribute injection via unescaped emoji name in HTML export
- CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution
- CVE-2026-5468 Casdoor dangerouslySetInnerHTML cross site scripting
- CVE-2026-54679 jq: potential integer overflow in jvp_string_append
- CVE-2026-54677 Scoold: Authenticated user can post replies and comments to private-space questions without space membership
- CVE-2026-54676 Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled
- CVE-2026-54675 FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module
- CVE-2026-54674 Authenticated Command Injection in FreePBX UCP Interface
- CVE-2026-54673 electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`
- CVE-2026-54672 electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`
- CVE-2026-54671 WeGIA: Authorization Bypass via Empty Resource Array in InternoControle
- CVE-2026-54670 WeGIA: Unauthenticated Auth Bypass + Local File Inclusion
- CVE-2026-5467 Casdoor OAuth Authorization Request redirect
- CVE-2026-54668 XML external entity in kitodo-production
- CVE-2026-54666 swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
- CVE-2026-54665 Apache NiFi: Missing Validation for Proxy Host Headers
- CVE-2026-54664 swagger-typescript-api vulnerable to code injection via unescaped enum string values
- CVE-2026-54663 swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`
- CVE-2026-54662 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
- CVE-2026-54661 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template
- CVE-2026-54660 swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`
- CVE-2026-5466 wc_VerifyEccsiHash missing sanity check
- CVE-2026-54659 Pagy I18n locale option is not validated before being used in a file path
- CVE-2026-54658 @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
- CVE-2026-54657 Missing authorization in open-zaak
- CVE-2026-54656 `datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data
- CVE-2026-54655 `datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator
- CVE-2026-54654 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field
- CVE-2026-54653 `datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field
- CVE-2026-54652 Frigate viewer can read logs exposing admin and camera credentials
- CVE-2026-54651 pypdf: Possible infinite loop when processing threads/articles in writer
- CVE-2026-54650 openhole-server vulnerable to path traversal via URL-decoded request path
- CVE-2026-5465 Privilege escalation in Booking for Appointments and Events Calendar – Amelia
- CVE-2026-54649 Information disclosure in punchin-email
- CVE-2026-54648 CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion
- CVE-2026-54647 CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php
- CVE-2026-54646 CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
- CVE-2026-54645 CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass
- CVE-2026-54644 CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System
- CVE-2026-54643 CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php
- CVE-2026-54642 CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php
- CVE-2026-54641 OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl
- CVE-2026-54640 OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
- CVE-2026-5464 Missing authorization in ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
- CVE-2026-54639 Style Dictionary - Prototype Pollution in convertTokenData utility function
- CVE-2026-54638 td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode
- CVE-2026-54637 Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile
- CVE-2026-54636 Dokku: OS Command Injection via app.json managed Cron
- CVE-2026-54635 pytonapi has a Webhook Custom Path Authentication Bypass
- CVE-2026-54634 Hamlib: rigctld `send_raw` Stack Out-of-Bounds Write and Uninitialized Memory Disclosure
- CVE-2026-54633 PoDoFo: Heap Out-of-Bounds Read in Indexed Color Space Image Decoding (FetchScanLine)
- CVE-2026-54632 SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)
- CVE-2026-54631 Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie
- CVE-2026-54630 Part-DB: Authenticated RCE via .phar attachment upload served from public/media
- CVE-2026-5463 pymetasploit3 - Command Injection via Newline Injection in console.run_module_with_output()
- CVE-2026-54629 Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode
- CVE-2026-54628 Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode
- CVE-2026-54627 SAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth)
- CVE-2026-54626 SAIL: Heap out-of-bounds write in SAIL TGA decoder (indexed-RLE bpp/stride mismatch)
- CVE-2026-54625 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
- CVE-2026-54624 django CMS: Structure endpoint bypasses page-view permission
- CVE-2026-54623 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
- CVE-2026-54622 django CMS: Clipboard copy IDOR discloses unauthorized plugin content
- CVE-2026-54621 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description
- CVE-2026-54620 sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks