Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 553 of 1013.
- CVE-2026-54297 Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters
- CVE-2026-54293 NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read
- CVE-2026-54291 Silent channel-binding authentication downgrade via unsupported certificate algorithms
- CVE-2026-54290 Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
- CVE-2026-5429 Kiro IDE Webview Cross-Site Scripting via Workspace Color Theme
- CVE-2026-54289 Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
- CVE-2026-54288 Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`
- CVE-2026-54287 hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice
- CVE-2026-54286 Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
- CVE-2026-54285 opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation
- CVE-2026-54284 sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
- CVE-2026-54283 Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
- CVE-2026-54282 Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
- CVE-2026-54281 Nest: Middleware Bypass on Fastify via Trailing Slash
- CVE-2026-54280 AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect
- CVE-2026-5428 Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field
- CVE-2026-54279 AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
- CVE-2026-54278 AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
- CVE-2026-54277 AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines
- CVE-2026-54276 AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
- CVE-2026-54275 AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
- CVE-2026-54274 AIOHTTP: Incomplete websocket frame payloads bypass memory limits
- CVE-2026-54273 AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit
- CVE-2026-54272 ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
- CVE-2026-54271 protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names
- CVE-2026-54270 protobufjs: Memory amplification from preserved unknown fields in binary decode
- CVE-2026-5427 Missing authorization in Kubio AI Page Builder
- CVE-2026-54269 protobufjs: Schema-derived names can shadow runtime-significant properties
- CVE-2026-54268 Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
- CVE-2026-54267 Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
- CVE-2026-54266 Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
- CVE-2026-54265 Angular: Two-Way Property Binding Sanitization Bypass (XSS)
- CVE-2026-54264 Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker
- CVE-2026-54263 Wagtail: Reflected XSS in dynamic image URL generator view
- CVE-2026-54262 Wagtail: Pages translations can be created without page permissions when using simple_translation
- CVE-2026-54261 Wagtail: Improper permission handling in image preview
- CVE-2026-54260 Wagtail: Denial of service via unbounded filter specs in the image preview
- CVE-2026-5426 KnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey value
- CVE-2026-54259 Wagtail: Improper restriction handling on Documents and Images chosen endpoints
- CVE-2026-54258 Cross-monitor event media authorization bypass in direct event media endpoints
- CVE-2026-54257 Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
- CVE-2026-54256 Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata
- CVE-2026-54254 Cyberdrop-DL: Pixeldrain API key shared with unverified thirdparty sites
- CVE-2026-54253 TS3 Manager: Reflected XSS via /api/download port parameter steals operator session
- CVE-2026-54251 netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service
- CVE-2026-54250 K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression
- CVE-2026-5425 Widgets for Social Photo Feed <= 1.7.9 - Unauthenticated Stored Cross-Site Scripting via feed_data
- CVE-2026-54249 Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
- CVE-2026-54248 Doco-CD has an OCI Trust Policy Bypass via Artifact-Contained Configuration
- CVE-2026-54247 Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS
- CVE-2026-54246 Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication
- CVE-2026-54245 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database
- CVE-2026-54244 Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors
- CVE-2026-54243 Statamic: CSV formula injection in form submission exports
- CVE-2026-54242 Statamic: Server-Side Request Forgery via Glide (DNS rebinding)
- CVE-2026-54241 libde265: SAO sequential filter heap buffer overflow via signed integer overflow
- CVE-2026-54240 libde265: Pixel accessor signed integer overflow causes heap OOB read/write
- CVE-2026-54239 FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope
- CVE-2026-54238 Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization
- CVE-2026-54237 Wavelog: Unauthenticated Remote Code Execution
- CVE-2026-54236 vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
- CVE-2026-54235 vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels
- CVE-2026-54234 vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection
- CVE-2026-54233 vLLM: OOM Denial of Service via Audio Decompression Bomb
- CVE-2026-54232 vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile
- CVE-2026-54231 Abrt: unsanitized systemd journal content written to dump directory files enables content injection
- CVE-2026-54230 Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites
- CVE-2026-5423 Subscription Authentication Bypass via Unverified connectionParams.jwt
- CVE-2026-54229 Abrt: chownproblemdir succeeds during active post-create event processing due to inadequate locking
- CVE-2026-54228 Abrt: toctou race condition in abrt-dbus setelement allows arbitrary file writes to dump directories
- CVE-2026-54226 Apache Kvrocks: RESTORE IntSet Integer Overflow Leads to Remote DoS
- CVE-2026-54225 Apache CXF: Denial of Service attack via large attachments
- CVE-2026-54224 Denial of Service in UBB.threads
- CVE-2026-54223 Remote Code Execution via arbitrary file read and write in UBB.threads
- CVE-2026-54222 Blind SQL Injection in UBB.threads
- CVE-2026-54221 Reflected XSS in UBB.threads
- CVE-2026-54220 Cross-Site Request Forgery in UBB.threads
- CVE-2026-5422 Path Traversal in jupyter/jupyter
- CVE-2026-54219 Stored XSS in UBB.threads
- CVE-2026-54218 TeamDavid: Weak Cryptography and Insecure Password Storage
- CVE-2026-54217 TeamDavid: Stored XSS in web application
- CVE-2026-54216 TeamDavid: Reflected Cross Site Scripting (XSS) via the 'EntryInfo' parameter
- CVE-2026-54215 TeamDavid: Open Redirect via the 'replyUrl' parameter
- CVE-2026-54214 TeamDavid: Header Injection through the 'cType' URL parameter
- CVE-2026-54213 TeamDavid: Denial of Service via endpoint 'internalRestart'
- CVE-2026-54212 TeamDavid: Buffer Overflow in JSON-parsing
- CVE-2026-54211 TeamDavid: Buffer Overflow in multiple form data parameters
- CVE-2026-54210 TeamDavid: Buffer Overflow in file names of file upload functionalities
- CVE-2026-54209 TeamDavid: Buffer Overflow in 'editini' function
- CVE-2026-54208 TeamDavid: Arbitrary File Write leading to Stored XSS
- CVE-2026-54207 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in move archive functionality
- CVE-2026-54206 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in sending functionality
- CVE-2026-54205 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in link storing functionality
- CVE-2026-54204 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathnameroot' parameter in search functionality
- CVE-2026-54203 TeamDavid: Memory Leak leaking sensitive information
- CVE-2026-54202 TeamDavid: Path Traversal in the archive creation functionality
- CVE-2026-54201 TeamDavid: Missing Authorization
- CVE-2026-54200 TeamDavid: Local File Inclusion via the form field 'scjob'
- CVE-2026-5420 Shinrays Games Goods Triple App cats.goods.sort.sorting.games jRwTX.java hard-coded key
- CVE-2026-54199 TeamDavid: Header Injection through request body in link storing functionality