Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 551 of 1013.
- CVE-2026-54519 AI Agent Automation: Missing ownership checks in memory APIs allow cross-user memory read and deletion
- CVE-2026-54518 jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind
- CVE-2026-54517 jackson-databind: @JsonView bypass for setterless creator properties
- CVE-2026-54516 jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields
- CVE-2026-54515 jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
- CVE-2026-54514 jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
- CVE-2026-54513 jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
- CVE-2026-54512 jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
- CVE-2026-54511 @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys
- CVE-2026-54510 Speakr: CSRF bypass via unauthenticated API token parameter in csrf_exempt_for_api_tokens hook
- CVE-2026-5451 Cross-site scripting in Extensions for Leaflet Map
- CVE-2026-54509 TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)
- CVE-2026-54508 TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution
- CVE-2026-54507 Vvveb oEmbedProxy vulnerable to server-side request forgery
- CVE-2026-54506 Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field
- CVE-2026-54505 TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner
- CVE-2026-54504 MCP Documentation Server: Web UI API binds to all interfaces without authentication by default
- CVE-2026-54503 plone.app.textfield: Stored XSS by spoofing mime type
- CVE-2026-54502 Oj: Stack Buffer Overflow in Oj.dump via Large Indent
- CVE-2026-54501 Browsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom Behaviors
- CVE-2026-54500 Oj: intern.c form_attr has an uninitialized stack read
- CVE-2026-5450 scanf %mc off-by-one heap buffer overflow
- CVE-2026-54499 Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders
- CVE-2026-54498 view_component: around_render HTML-Safety Bypass
- CVE-2026-54497 view_component: Reused Component Instances Retain Stale Render Context
- CVE-2026-54496 Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness
- CVE-2026-54495 Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters
- CVE-2026-54494 Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4
- CVE-2026-54493 Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations
- CVE-2026-54492 Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation
- CVE-2026-54491 Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths
- CVE-2026-54490 websocket-driver: Resource limit bypass via message compression
- CVE-2026-54489 Information disclosure in Virtual Storage Integrator for VMware vSphere Client
- CVE-2026-54483 Command injection in PowerProtect Data Domain
- CVE-2026-54481 Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
- CVE-2026-5448 1-2 Byte Buffer Overflow in wolfSSL_X509_notAfter/notBefore
- CVE-2026-54479 EVoke Systems EVoke CSMS Insufficient Session Expiration
- CVE-2026-54478 DNS Cookie bypass when combined with proxy-protocol use
- CVE-2026-54477 Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax
- CVE-2026-54475 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover
- CVE-2026-54472 Hardcoded credentials in Container Storage Modules
- CVE-2026-54471 Missing authorization in SmartFabric Manager
- CVE-2026-54470 XML external entity in Unisphere for PowerMax
- CVE-2026-5447 Heap buffer overflow in CertFromX509() via AuthorityKeyIdentifier
- CVE-2026-54469 Deserialization in Unisphere for PowerMax
- CVE-2026-54468 Path traversal in Unisphere for PowerMax
- CVE-2026-54467 Memory corruption in Trusted Firmware-M
- CVE-2026-54466 websocket-driver: Message corruption via abuse of protocol length headers
- CVE-2026-54465 websocket-driver: Memory exhaustion in HTTP header parser
- CVE-2026-54464 websocket-driver: Resource limit bypass via message compression
- CVE-2026-54463 websocket-driver: Memory exhaustion via abuse of protocol length headers
- CVE-2026-54462 knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion
- CVE-2026-54461 Habitica: Regex Injection / ReDoS in Member Search
- CVE-2026-54460 OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover
- CVE-2026-5446 wolfSSL ARIA-GCM TLS 1.2/DTLS 1.2 GCM nonce reuse
- CVE-2026-54459 FileRise: Missing CSRF enforcement for file creation and share-link creation
- CVE-2026-54458 AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
- CVE-2026-54457 TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint
- CVE-2026-54455 OpenCATS: Authenticated SQL injection in activity DataGrid date filters
- CVE-2026-54454 OpenCATS: Authenticated RCE in the Import module
- CVE-2026-54453 OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)
- CVE-2026-54452 safeurl: Missing IPv6 CIDR Ranges in Blocklist
- CVE-2026-54451 Elixir protobuf: Unbounded recursion depth in embedded-message decoding
- CVE-2026-54450 ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway
- CVE-2026-5445 Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable)
- CVE-2026-54449 LangBot: Authenticated RCE Via MCP Configuration
- CVE-2026-54448 Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
- CVE-2026-54447 garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store
- CVE-2026-54446 NetLicensing MCP Server: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode
- CVE-2026-54445 Vantage6: Set admin user and password from environment or configuration
- CVE-2026-54443 Dashy: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
- CVE-2026-5444 Heap Buffer Overflow in PAM Image Buffer Allocation
- CVE-2026-54433 Cross-site scripting in Webmail
- CVE-2026-54432 Cross-site scripting in Webmail
- CVE-2026-54431 Improper Data Validation in liboauth2
- CVE-2026-54430 Server-Site Request Forgery in liboauth2
- CVE-2026-5443 Heap Buffer Overflow in DICOM Image Decoder (Palette Color Decode)
- CVE-2026-54429 Denial of service in SIMATIC S7-PLCSIM Advanced
- CVE-2026-54428 Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK
- CVE-2026-54427 Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser
- CVE-2026-54426 Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser
- CVE-2026-54425 Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding
- CVE-2026-54424 Privilege escalation in Parsec
- CVE-2026-54423 Missing authorization in Ironic
- CVE-2026-54422 Information disclosure in Ironic Python Agent
- CVE-2026-54421 OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties
- CVE-2026-54420 LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following
- CVE-2026-5442 Heap Buffer Overflow in DICOM Image Decoder via VR UL Dimensions
- CVE-2026-54419 PIAF-HMS multiple unauthenticated SQL injection vulnerabilities via mysql_query
- CVE-2026-54418 Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass
- CVE-2026-54417 Integer Overflow in rxi/microtar mtar_next() Causes Infinite Loop DoS
- CVE-2026-54416 Pluck CMS - Unrestricted File Upload via Missing .php8 Extension in Upload Blacklist
- CVE-2026-54415 Broken Access Control in Azuriom CMS Server Routes Allows Account Takeover
- CVE-2026-54414 FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover
- CVE-2026-54413 iso14229 Integer Underflow and Out-of-Bounds Read in Handle_0x27_SecurityAccess()
- CVE-2026-54412 MQTT-C Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response()
- CVE-2026-54411 Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison
- CVE-2026-54410 nanoMODBUS Off-by-One Buffer Overflow in recv_msg_header() via Crafted MBAP Length Field
- CVE-2026-5441 Out-of-Bounds Read in DicomImageDecoder (PMSCT_RLE1 Decompression)
- CVE-2026-54409 Auth bypass in UniFi Protect Application