Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 552 of 1013.
- CVE-2026-54408 Auth bypass in UniFi Protect Application
- CVE-2026-54407 Auth bypass in UniFi Protect Application
- CVE-2026-54406 Path traversal in UniFi Network Application
- CVE-2026-54405 Denial of service in UniFi Network Application
- CVE-2026-54404 SQL injection in Cloud Gateways
- CVE-2026-54403 Path traversal in Cloud Gateways
- CVE-2026-54402 Command injection in Cloud Gateways
- CVE-2026-54401 Server-side request forgery in Cloud Gateways
- CVE-2026-54400 Privilege escalation in UniFi Access Application
- CVE-2026-5440 Memory Exhaustion via Unbounded Content-Length
- CVE-2026-54399 Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration
- CVE-2026-54398 MISP object edit authorization bypass allows unauthorized sharing group assignment
- CVE-2026-54397 MISP event editing allows unauthorized assignment to undisclosed sharing groups
- CVE-2026-54396 MISP AuthKey edit endpoint allows authenticated user email enumeration
- CVE-2026-54395 MISP UiBeta event index reflected XSS in advanced filter popup
- CVE-2026-54394 MISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG files
- CVE-2026-54393 MISP Overmind theme stored XSS via unvalidated homepage setting
- CVE-2026-54390 JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer
- CVE-2026-5439 Memory Exhaustion via Forged ZIP Metadata
- CVE-2026-54389 Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb
- CVE-2026-54388 Tinyproxy - HTTP Request Smuggling via Duplicate Content-Length Headers
- CVE-2026-54387 Tinyproxy - HTTP Request Smuggling via CL/TE Desynchronization
- CVE-2026-54386 marimo < 0.23.9 XSS via file Query Parameter in assets.py
- CVE-2026-5438 Gzip Decompression Bomb via Content-Encoding Header
- CVE-2026-54371 attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr
- CVE-2026-54370 acl < 2.4.0 TOCTOU Symlink Traversal via getfacl/setfacl/chacl
- CVE-2026-5437 Out-of-Bounds Read in DicomStreamReader
- CVE-2026-54369 acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions
- CVE-2026-54368 CentreStack < 17.4 SQL Injection via x-glad-filter Header
- CVE-2026-54367 CentreStack < 17.2 Unauthenticated API Authorization Bypass
- CVE-2026-54366 CentreStack < 17.4 XXE via SharePoint Storage Configuration
- CVE-2026-54365 CentreStack < 17.3 Unauthenticated User Creation via Deserialization in GSNamespace.dll
- CVE-2026-54364 CentreStack < 17.4 Session Injection via SelectProvider.aspx
- CVE-2026-54363 CentreStack < 17.5 Hardcoded Key Token Forgery RCE
- CVE-2026-54362 MISP template builder exposes non-visible custom galaxies across organisations
- CVE-2026-54361 MISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation records
- CVE-2026-54360 MISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groups
- CVE-2026-5436 MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys
- CVE-2026-54359 MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default
- CVE-2026-54358 MISP organization administrators can target site administrator accounts for password reset
- CVE-2026-54357 MISP improper authorization allows organization administrators to modify site administrator user settings
- CVE-2026-54356 Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`
- CVE-2026-54355 MapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST`
- CVE-2026-54354 MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation
- CVE-2026-54353 Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validation
- CVE-2026-54352 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload
- CVE-2026-54351 Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override
- CVE-2026-54350 Budibase: Anonymous NoSQL operator injection via published-app query templates
- CVE-2026-5435 Potential buffer overflow in ns_sprintrrf TSIG handling path
- CVE-2026-54348 Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
- CVE-2026-54347 Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover
- CVE-2026-54345 GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)
- CVE-2026-54344 ToolJet GitHub Actions comment body shell injection exposes deployment secrets
- CVE-2026-54343 Frappe LMS: Path Traversal in SCORM File Serving
- CVE-2026-54342 TLS Certificate Verification Disabled on CXF Transport Clients in epa4all
- CVE-2026-54341 Dragonfly: RESTORE operations may crash the server
- CVE-2026-54340 h2o has HTTP/2 state amplification
- CVE-2026-5434 Improper storage of sensitive information
- CVE-2026-54339 Glean: Server-Side Request Forgery (SSRF) with Full Response Disclosure via Malicious RSS Feed in /api/feeds/discover
- CVE-2026-54338 JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
- CVE-2026-54337 Fireshare has Unauthenticated Argument Injection to Arbitrary File Write/Overwrite
- CVE-2026-54336 JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset
- CVE-2026-54335 Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__
- CVE-2026-54334 UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen`
- CVE-2026-54333 UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTable
- CVE-2026-54332 GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS
- CVE-2026-54330 Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation
- CVE-2026-5433 Improper sanitization
- CVE-2026-54329 Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API
- CVE-2026-54328 Pi: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
- CVE-2026-54327 Pi: Race condition in auth.json writes could expose stored credentials
- CVE-2026-54326 Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypass
- CVE-2026-54325 Pi loads project-local extensions without approval
- CVE-2026-54324 Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join
- CVE-2026-54323 Daytona: Git credential leak via git clone with TLS verification disabled
- CVE-2026-54322 Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles
- CVE-2026-54321 Daytona: Public sandbox previews remain accessible for up to one hour after being made private
- CVE-2026-54320 Daytona: Cross-tenant organization takeover via invitation acceptance with an unverified email
- CVE-2026-54319 Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape
- CVE-2026-54318 Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location
- CVE-2026-54317 Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
- CVE-2026-54316 Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch
- CVE-2026-54314 n8n: Denial of Service via ZIP decompression in webhook workflow
- CVE-2026-54313 n8n: NoSQL Injection in MongoDB Node Find And Replace Operation
- CVE-2026-54312 n8n: Microsoft SQL Node Prototype Pollution
- CVE-2026-54311 n8n: Merge Node SQL Mode Prototype Pollution
- CVE-2026-54310 n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes
- CVE-2026-54309 n8n: n8n MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions
- CVE-2026-54308 n8n: Missing Token Validation on Microsoft Agent 365 Trigger Node
- CVE-2026-54307 n8n: Credential Exfiltration via Permission Bypass
- CVE-2026-54306 n8n: Prototype Pollution enables confused-deputy execution via public webhooks
- CVE-2026-54305 n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
- CVE-2026-54304 n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
- CVE-2026-54303 n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints
- CVE-2026-54302 n8n: Stored XSS in Chat Trigger Node
- CVE-2026-54301 n8n: Same-Origin XSS in Respond to Webhook Node
- CVE-2026-54300 @astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config
- CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability
- CVE-2026-54299 Astro: Host header SSRF in prerendered error page fetch
- CVE-2026-54298 Astro: XSS via Unescaped Attribute Names in Spread Props