Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 555 of 1013.
- CVE-2026-54085 Wazuh: Missing input validation in multiple active response scripts allows argument injection
- CVE-2026-54084 Wazuh agent enrollment NULL pointer dereference via malformed manager response
- CVE-2026-54083 Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion
- CVE-2026-54082 veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs
- CVE-2026-54081 veraPDF Parser DoS via PostScript Type 1 Font Programs
- CVE-2026-54080 veraPDF Parser DoS via PostScript CMap Streams
- CVE-2026-5408 Uncontrolled Recursion in Wireshark
- CVE-2026-54079 veraPDF Validation XXE via XFA
- CVE-2026-54078 veraPDF Validation XXE via Rich Text
- CVE-2026-54077 ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users
- CVE-2026-54076 ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)
- CVE-2026-54074 @tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels
- CVE-2026-54073 VeraCrypt: Hidden volume quick format weakens plausible deniability
- CVE-2026-54072 Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL
- CVE-2026-54071 BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py
- CVE-2026-54070 SiYuan: Stored XSS in Bazaar marketplace via package README event handlers
- CVE-2026-5407 Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
- CVE-2026-54069 SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist
- CVE-2026-54068 SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon
- CVE-2026-54067 SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()
- CVE-2026-54066 SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)
- CVE-2026-54063 Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)
- CVE-2026-54061 Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import
- CVE-2026-54060 Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
- CVE-2026-5406 Uncontrolled Recursion in Wireshark
- CVE-2026-54059 Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
- CVE-2026-54058 Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
- CVE-2026-54057 Kitty vulnerable to command injection via unsanitized OSC 21 query reply
- CVE-2026-54056 Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging
- CVE-2026-54055 Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol
- CVE-2026-54054 Transmute has full-read SSRF in URL file import (POST /api/files/url) — no host/IP validation, follows redirects
- CVE-2026-54053 Many Notes: Path Traversal via ZIP import allows arbitrary file write and stored XSS in other users' vaults
- CVE-2026-54052 n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments
- CVE-2026-54051 Network-AI has an an OS Command Injection issue
- CVE-2026-54050 Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image
- CVE-2026-5405 Heap-based Buffer Overflow in Wireshark
- CVE-2026-54049 Sakai Conversations has a Stored XSS Issue
- CVE-2026-54048 Apache Impala: Avro Schema URL Server-Side Request Forgery
- CVE-2026-54047 Laci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration Manipulation
- CVE-2026-54040 LibreChat: 2FA Backup Code Regeneration Without OTP Verification Allows 2FA Bypass
- CVE-2026-5404 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Wireshark
- CVE-2026-54037 LibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/fork
- CVE-2026-54036 LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification
- CVE-2026-54033 LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs
- CVE-2026-54030 LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow
- CVE-2026-5403 Heap-based Buffer Overflow in Wireshark
- CVE-2026-54029 LibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filter
- CVE-2026-54027 LibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorization
- CVE-2026-54025 LibreChat: Stored XSS via unescaped image alt text in markdown artifact preview
- CVE-2026-54024 LibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limits
- CVE-2026-54022 Open WebUI: Any authenticated user can read other users' private notes via Socket.IO
- CVE-2026-54021 Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter
- CVE-2026-54020 Open WebUI: DNS Rebinding SSRF Bypass
- CVE-2026-5402 Heap-based Buffer Overflow in Wireshark
- CVE-2026-54019 Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode
- CVE-2026-54018 Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
- CVE-2026-54017 Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
- CVE-2026-54016 Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration
- CVE-2026-54015 Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion
- CVE-2026-54014 Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui
- CVE-2026-54013 Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI
- CVE-2026-54012 Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
- CVE-2026-54011 Open WebUI: Stored XSS in Mermaid Markdown Preview
- CVE-2026-54010 Open WebUI: Forged chat-file link allows cross-user file read and deletion
- CVE-2026-5401 Uncontrolled Recursion in Wireshark
- CVE-2026-54009 Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field
- CVE-2026-54008 Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url`
- CVE-2026-54007 Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
- CVE-2026-54006 Open WebUI: Calendar event re-parenting allows writing events into another user's calendar
- CVE-2026-54005 Kirby: `pages.access` permission is not checked in the `site/find` REST API route
- CVE-2026-54004 Kirby: Access to files of top-level drafts is not protected by permissions
- CVE-2026-54003 Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
- CVE-2026-54002 Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
- CVE-2026-54001 osquery: Heap buffer overflow via `authenticode` table (Windows)
- CVE-2026-54000 osquery: Heap buffer overflow in `getProcessCurrentDirectory()` via `processes` table (Windows)
- CVE-2026-5400 Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input
- CVE-2026-53999 Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)
- CVE-2026-53997 Netherman Portal del Hermano Account Takeover via Password Reset Oracle
- CVE-2026-53996 NetBSD hdaudio(4) Driver Privilege Bypass Use-After-Free via HDAUDIO_FGRP_SETCONFIG ioctl
- CVE-2026-53995 MLflow 3.17.1 and prior Path Traversal via Trace ID API
- CVE-2026-53994 ProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size Truncation
- CVE-2026-53992 Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters
- CVE-2026-5399 Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value
- CVE-2026-53989 Dockhand < 1.0.36 Open Redirect via OIDC Initiation Endpoint
- CVE-2026-53988 Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints
- CVE-2026-53987 Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering
- CVE-2026-53986 Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure
- CVE-2026-53985 Ground Station prior to 0.6.0 Unauthenticated DoS via service_control Socket.IO
- CVE-2026-53984 Missing authorization in Ground Station
- CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL
- CVE-2026-53982 Cap-go Console < 12.28.2 Account Deletion DoS via Device Identifier Association
- CVE-2026-53981 Cap-go < v12.128.2 Account Takeover via Unauthenticated Email Change Mechanism
- CVE-2026-5398 Kernel use-after-free bug in the TIOCNOTTY handler
- CVE-2026-53977 OpenChamber 1.11.7 Unauthenticated DoS via /api/system/shutdown
- CVE-2026-53976 OpenChamber 1.11.7 Path Traversal File Read via allowOutsideWorkspace Parameter
- CVE-2026-53975 OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec
- CVE-2026-53970 ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb
- CVE-2026-5397 Vulnerability Related to an Uncontrolled Search Path Element in a UPS Management Application
- CVE-2026-53966 XWiki Platform: Privilege escalation from edit to script right through Live Data editing
- CVE-2026-53965 MCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of service