Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 550 of 1013.
- CVE-2026-5462 Wahoo Fitness SYSTM App com.WahooFitness.SYSTM BuildConfig.java hard-coded key
- CVE-2026-54619 sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity
- CVE-2026-54618 Obsidian Web MCP: Unauthenticated vault access: /oauth/authorize auto-approves without authenticating the user
- CVE-2026-54617 GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler
- CVE-2026-54616 NanaZip: Heap out-of-bounds read in NanaZip SquashFS LZ4 decompressor via unchecked negative return value
- CVE-2026-54615 Cross-site scripting in Part-DB-server
- CVE-2026-54614 DebugKit: MailPreview contains unsafe reflection
- CVE-2026-54613 Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter
- CVE-2026-54612 Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global
- CVE-2026-54611 InstantCMS has Remote Code Execution in package installer
- CVE-2026-54609 QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding
- CVE-2026-54608 MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up
- CVE-2026-54607 FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard)
- CVE-2026-54606 SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed
- CVE-2026-54605 OAuth: Cross-origin token-request redirects can expose signed request metadata
- CVE-2026-54604 OpenSlide: openslide_read_region() returns uninitialized memory with libtiff 4.7.1
- CVE-2026-54603 OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host
- CVE-2026-54602 FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord
- CVE-2026-54601 FastGPT: reTrainingCollection allows server-owned datasetId override causing cross-tenant authorization confusion
- CVE-2026-54600 Wallos: Unauthenticated database replacement via import endpoint on fresh install
- CVE-2026-5460 Heap Use-After-Free in PQC Hybrid KeyShare Error Cleanup in wolfSSL TLS 1.3
- CVE-2026-54599 Wallos: OIDC state parameter never validated — login CSRF / account takeover
- CVE-2026-54598 Missing Authentication for Critical Function in wallos
- CVE-2026-54597 ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter
- CVE-2026-54596 ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration
- CVE-2026-54594 OmniBlocks: Spamming in Discussions tab possible via disc.yml
- CVE-2026-54593 Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
- CVE-2026-54592 Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input
- CVE-2026-54591 AsyncSSH: SCP Path Traversal to Arbitrary File Write
- CVE-2026-54590 AsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion
- CVE-2026-5459 Missing authorization in User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration
- CVE-2026-54588 Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.
- CVE-2026-54587 mport directory asset installation is vulnerable to symlink and path traversal races
- CVE-2026-54586 mport permits repository and package mirror fetches over insecure transport
- CVE-2026-54585 mport sample file handling can write outside the configured root
- CVE-2026-54584 mport trusts environment-controlled temporary directories in privileged metadata extraction
- CVE-2026-54583 mport package bundle downloads allow unsafe destination filenames
- CVE-2026-54582 mport package installation can overwrite existing unmanaged or differently owned files
- CVE-2026-54581 mport bootstrap index fetch can continue after hash verification failure
- CVE-2026-54580 mport index decompression can leave partial or corrupt index data after zstd failures
- CVE-2026-5458 Noelse Individuals & Pro App com.afone.noelse BuildConfig.java hard-coded key
- CVE-2026-54579 mport mirror-selection ping accepts insufficiently validated ICMP replies
- CVE-2026-54578 mport verify can compare stale checksum data after hashing failures
- CVE-2026-54577 mport audit can inspect the wrong package when options are present
- CVE-2026-54576 mport package installation has symlink TOCTOU in chown and chmod handling
- CVE-2026-54575 mport package fetch and clean paths are vulnerable to TOCTOU filesystem races
- CVE-2026-54574 `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive
- CVE-2026-54573 Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy
- CVE-2026-54572 rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote
- CVE-2026-54571 ESPAsyncWebServer: Integer overflow in multipart boundary parser causes denial of service
- CVE-2026-54570 AngleSharp: HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass
- CVE-2026-5457 PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded key
- CVE-2026-54569 senaite.core Vulnerable to Eval Injection and Missing Authorization
- CVE-2026-54568 Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info
- CVE-2026-54567 Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)
- CVE-2026-54566 Code injection in vscode-markdown-preview-enhanced
- CVE-2026-54565 rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages
- CVE-2026-54563 Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root
- CVE-2026-54562 Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses
- CVE-2026-54561 MCP Memory Keeper: Arbitrary local file read in mcp-memory-keeper context_import via unvalidated filePath
- CVE-2026-54560 Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim
- CVE-2026-5456 Align Technology My Invisalign App com.aligntech.myinvisalign.emea BuildConfig.java hard-coded key
- CVE-2026-54559 PocketSphinx: Buffer overflows in language and acoustic model loading code
- CVE-2026-54557 mise HTTP backend uses raw version path for install symlink destination
- CVE-2026-54556 Http4s: HTTP/2 Denial of Service with Ember Backend
- CVE-2026-54555 rtk: Permission-gate bypass in rtk rewrite auto-allow via unsplit shell separators
- CVE-2026-54554 FOG adInfo endpoint is reported to disclose the Active Directory join password
- CVE-2026-54553 Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS
- CVE-2026-54552 sh _uid does not drop supplementary groups (incomplete privilege drop)
- CVE-2026-54551 Missing authorization in wg-portal
- CVE-2026-54550 IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries
- CVE-2026-5455 Dialogue App ca.diagram.dialogue config.json hard-coded key
- CVE-2026-54549 Meta Ads MCP: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch
- CVE-2026-54548 kas: Persistent SSH Host Key Checking Disablement
- CVE-2026-54547 Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token
- CVE-2026-54546 CloudTAK: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard
- CVE-2026-54545 @wakaru/cli arbitrary file write during bundle unpack
- CVE-2026-54544 Fireshare has unauthenticated SSRF via missing login_required on webhook test endpoints
- CVE-2026-54543 Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields
- CVE-2026-54542 Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof
- CVE-2026-54541 Nimiq: Panic in TrieProof::verify via child_index unwrap on equal-length keys
- CVE-2026-54540 Authenticated terminal command whitelist bypass in Pheditor
- CVE-2026-5454 GRID Organiser App co.gridapp.organiser app.json hard-coded key
- CVE-2026-54538 xrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER
- CVE-2026-54533 vantage6 node has an Improper Access Control issue
- CVE-2026-54532 CloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theft
- CVE-2026-54531 pypdf: Possible infinite loop when processing outlines/bookmarks in writer
- CVE-2026-54530 pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction
- CVE-2026-5453 Rico só vantagem pra investir App br.com.rico.mobile SegmentSettingsModule.java hard-coded key
- CVE-2026-54529 SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`
- CVE-2026-54528 jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
- CVE-2026-54527 JupyterLab Git: Stored XSS leading to RCE
- CVE-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
- CVE-2026-54525 Markdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows
- CVE-2026-54524 Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report
- CVE-2026-54523 Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system
- CVE-2026-54522 MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
- CVE-2026-54521 FairEmail: Cross-site scripting (XSS) in AMP message rendering (ActivityAMP)
- CVE-2026-54520 AI Agent Automation: Workflow file step path traversal allows read and write outside the expected directory
- CVE-2026-5452 UCC CampusConnect App campusconnect.ucc BuildConfig.java hard-coded key