Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 556 of 1013.
- CVE-2026-53964 Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
- CVE-2026-53963 Discourse: Stored-XSS in 2FA delete confirmation modal
- CVE-2026-53962 Discourse: Insufficient SVG sanitization logic
- CVE-2026-53961 Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)
- CVE-2026-53960 Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD
- CVE-2026-5396 Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter
- CVE-2026-53959 4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated user
- CVE-2026-53958 4gaBoards: SSO Pre-Account Takeover / Hijacking via Mass Assignment
- CVE-2026-53957 Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint
- CVE-2026-53956 Rattler vulnerable to package cache path traversal via conda package build string
- CVE-2026-53954 Bugsink: DOS using large numbers of event tags
- CVE-2026-53953 GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover
- CVE-2026-53952 GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw
- CVE-2026-53951 Copier: trust-prefix bypass via path traversal runs tasks unprompted
- CVE-2026-53950 @tryghost/activitypub: XSS in Ghost's ActivityPub client
- CVE-2026-5395 Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter
- CVE-2026-53949 Ghost Content API filter bypass reveals private fields
- CVE-2026-53948 Ghost: File Upload Content-Type Spoofing
- CVE-2026-53947 Ghost: Member existence leak via magic link sign-in response
- CVE-2026-53946 Ghost: Mobiledoc image-size fetch SSRF
- CVE-2026-53945 Ghost: Server-side request forgery via DNS rebinding in external request handling
- CVE-2026-53944 Ghost: Private IP filtering bypass to make server-side requests to internal services
- CVE-2026-53943 Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header
- CVE-2026-53942 Code injection in infrastructure
- CVE-2026-53941 Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS
- CVE-2026-53940 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation
- CVE-2026-5394 Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling
- CVE-2026-53939 OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption
- CVE-2026-53938 OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)
- CVE-2026-53937 MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)
- CVE-2026-53935 CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation
- CVE-2026-53933 Maravel-Framework Vulnerable to Side-Channel Information Disclosure (Error Oracle) via Dynamic Route Fuzzing
- CVE-2026-53932 laravel-backup-restore has an OS Command Injection during database restore
- CVE-2026-53931 NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint
- CVE-2026-53930 NocoDB: Server-Side Request Forgery via Base Migration URL
- CVE-2026-5393 OOB Read in DoTls13CertificateVerify with WOLFSSL_DUAL_ALG_CERTS
- CVE-2026-53929 NocoDB: Stored Cross-Site Scripting via Secure Attachment
- CVE-2026-53928 NocoDB: Refresh Tokens Persist Through Password Recovery
- CVE-2026-53927 NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
- CVE-2026-53926 NocoDB: OAuth Tokens Persist Through Security Events
- CVE-2026-53925 Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
- CVE-2026-53924 Gardens v2: Permissionless syncOutflow bypasses streaming proposal disputes
- CVE-2026-53923 vLLM GGUF Kernels: int64_t to int truncation of tensor dimensions causes GPU buffer overflow
- CVE-2026-53922 odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)
- CVE-2026-53921 odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)
- CVE-2026-53920 odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure
- CVE-2026-5392 wolfSSL heap OOB read in PKCS7 SignedData streaming
- CVE-2026-53918 odhcpd DHCPv6 IA dangling first pointer use-after-free
- CVE-2026-53917 Denial of service in Apache ActiveMQ
- CVE-2026-53916 Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec
- CVE-2026-53915 Code injection in GoLand
- CVE-2026-53914 JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution
- CVE-2026-53913 Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities
- CVE-2026-53912 Cerebrate self-registration password hash exposure via inbox and audit log views
- CVE-2026-53911 Cerebrate primary key mass assignment in CRUD edit operations allows authenticated users to overwrite unrelated records
- CVE-2026-53910 Heap-based Buffer Overflow in GNU diffutils
- CVE-2026-5391 LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-53909 Arbitrary File Upload in MCO
- CVE-2026-53908 User Enumeration in MCO
- CVE-2026-53907 Stored Cross‑Site Scripting in MCO
- CVE-2026-53906 Path Disclosure and Path Traversal in MCO
- CVE-2026-53905 Unauthorized Access to Administrator ACL View in MCO
- CVE-2026-53904 Account Denial of Service in MCO
- CVE-2026-53903 Insecure Direct Object Reference in MCO
- CVE-2026-53902 Privilege Escalation in MCO
- CVE-2026-53901 Cerebrate before v1.37 allows mass assignment of record identifiers during object creation
- CVE-2026-53900 Cookie injection was possible when opening a PDF link
- CVE-2026-53899 Cross-origin cookies could be leaked when opening a PDF link
- CVE-2026-5389 justhtml before 1.13.0 XSS via code fence breakout
- CVE-2026-53882 Path Traversal in Virtualization Station VM Import
- CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues
- CVE-2026-53878 Header injection possibility since DomainNameValidator accepted newlines in input
- CVE-2026-53877 Heap buffer over-read in GDALRaster
- CVE-2026-53876 Command injection in RadiX AX6600 WiFi 6 Tri-Band Gaming Router
- CVE-2026-53875 picklescan - Scanning Bypass via Dynamic Eval in scan_pytorch
- CVE-2026-53874 picklescan - Arbitrary Code Execution via Obfuscated eval Call
- CVE-2026-53873 picklescan - Arbitrary Code Execution via profile.run() Blocklist Bypass
- CVE-2026-53872 picklescan - Arbitrary File Read via Unsafe Pickle Deserialization
- CVE-2026-53871 Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookie
- CVE-2026-53870 Hermes Agent < 0.16.0 - Sensitive File Permission Vulnerability in Store Files
- CVE-2026-5387 AVEVA Pipeline Simulation Missing Authorization
- CVE-2026-53869 Hermes Agent < 0.16.0 - DNS Rebinding Bypass via WebSocket Endpoints
- CVE-2026-53868 Capgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and Deletion
- CVE-2026-53867 Capgo < 12.128.2 - Orphaned File Retention via Profile Image Replacement
- CVE-2026-53866 OpenClaw < 2026.5.12 - Allowlist Bypass in Shell Inline-Command Parsing
- CVE-2026-53865 OpenClaw < 2026.5.2 - Arbitrary Command Execution via Workspace-Derived Service PATH
- CVE-2026-53864 OpenClaw < 2026.5.26 - Insufficient Environment Variable Sanitization in Node.js Control Variables
- CVE-2026-53863 OpenClaw < 2026.4.25 - Unvalidated Group ID Acceptance in Tool Group Policy
- CVE-2026-53862 OpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope Widening
- CVE-2026-53861 OpenClaw < 2026.5.6 - Allowlist Bypass via Combined POSIX Inline Flags on macOS
- CVE-2026-53860 OpenClaw < 2026.5.7 - Sender Policy Bypass via Mutable Conversation Identifiers in BlueBubbles
- CVE-2026-5386 KMW CCTV Security Cameras Unverified Password Change
- CVE-2026-53859 OpenClaw < 2026.5.26 - Hostname Validation Bypass via Trailing-Dot Inconsistency
- CVE-2026-53858 OpenClaw < 2026.5.2 - Arbitrary Runtime Dependency Loading via STATE_DIRECTORY Environment Variable
- CVE-2026-53857 OpenClaw < 2026.5.3 - Mutable Display Name Binding in Zalo allowFrom Policy
- CVE-2026-53856 OpenClaw 2026.4.23 < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.json
- CVE-2026-53855 OpenClaw < 2026.4.2 - Shell Positional Parameters Bypass in Inline-Eval Checks
- CVE-2026-53854 OpenClaw < 2026.4.25 - Privilege Escalation via ownerAllowFrom Wildcard Inheritance in Internal/Webchat Commands
- CVE-2026-53853 OpenClaw < 2026.5.12 - Argument Pattern Bypass in Exec Allowlist via Linux and macOS
- CVE-2026-53852 OpenClaw < 2026.4.25 - Scope Bypass via Empty-Scope Device Re-pairing