Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 558 of 1013.
- CVE-2026-5375 runZero Platform API credential information leak
- CVE-2026-53742 Simple Link Directory through 9.0.4 Stored XSS via Embed Shortcode Attributes
- CVE-2026-53741 Simple Link Directory through 9.0.4 Stored XSS via sld_no_results_found Option
- CVE-2026-53740 Yoast Duplicate Post through 4.6 Stored Cross-Site Scripting via Scheduled Republish Notice
- CVE-2026-5374 runZero Platform MCP information leak
- CVE-2026-53739 Yoast Duplicate Post through 4.6 Cross-Site Request Forgery via duplicate_post_dismiss_notice
- CVE-2026-53738 Copy & Delete Posts through 1.5.4 Privilege Escalation via cdp_action_handling Handler
- CVE-2026-53737 Juicer through 1.12.18 Stored Cross-Site Scripting via Unescaped API Response
- CVE-2026-53736 Easy Twitter Feeds before 1.2.13 Cross-Site Request Forgery via duplicate_post Action
- CVE-2026-53730 DataEase: Unauthorized Access to Engine Database via previewSql Endpoint
- CVE-2026-5373 runZero Platform superuser privilege escalation
- CVE-2026-53729 DataEase ExportCenter IDOR allows cross-user export task access
- CVE-2026-53728 Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage
- CVE-2026-53727 css_parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`
- CVE-2026-53726 Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL
- CVE-2026-53725 parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied
- CVE-2026-53724 Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist
- CVE-2026-53723 guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator
- CVE-2026-53722 Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL
- CVE-2026-53721 Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher
- CVE-2026-53720 pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small
- CVE-2026-5372 runZero Platform SQL injection in saved queries
- CVE-2026-53719 Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization
- CVE-2026-53718 Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass
- CVE-2026-53717 Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header
- CVE-2026-53716 Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit
- CVE-2026-53715 Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock
- CVE-2026-53714 Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode
- CVE-2026-53713 Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure
- CVE-2026-53712 SCRAM: Silent channel-binding authentication downgrade via unsupported certificate algorithms
- CVE-2026-53711 MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI
- CVE-2026-53710 MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
- CVE-2026-5371 Missing authorization in MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)
- CVE-2026-53709 Hardcoded credentials in mcp-context-forge
- CVE-2026-53708 ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)
- CVE-2026-53706 Security feature bypass in prevail
- CVE-2026-53705 Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow
- CVE-2026-53704 Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer fileinfo metadata parser
- CVE-2026-53703 Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer audio stream header parser
- CVE-2026-53702 Gstreamer1-plugins-bad-free: gstreamer: stack buffer overflow in h.265 buffering period sei parser
- CVE-2026-53701 Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds write in h.266/vvc pps picture partition parser
- CVE-2026-5370 krayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scripting
- CVE-2026-53698 Silverpeas mishandles the "Personal space" feature that is selected when no componentId is set
- CVE-2026-53694 Potential local privileges escalation through argument injection in the nxchmod.sh script
- CVE-2026-53693 MISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labels
- CVE-2026-53692 Weak hashing algorithm in Redeight CMS
- CVE-2026-53691 Remote Code Execution in Redeight CMS
- CVE-2026-53690 SQL Injection in Redeight CMS
- CVE-2026-53689 Integer overflow in libnfs
- CVE-2026-53683 Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html
- CVE-2026-53682 Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts
- CVE-2026-5368 projectworlds Car Rental Project Parameter login.php sql injection
- CVE-2026-53676 Code injection in ThingsBoard
- CVE-2026-53675 BuddyPress 14.4.0 Friends List IDOR via REST API
- CVE-2026-53674 BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution
- CVE-2026-53673 BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter
- CVE-2026-53671 PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verification
- CVE-2026-53670 PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification
- CVE-2026-5367 Ovn: ovn: information disclosure via crafted dhcpv6 packets
- CVE-2026-53669 React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
- CVE-2026-53668 React Router: Open redirect can lead to XSS
- CVE-2026-53667 React Router: RSCErrorHandler Missing Protocol Validation (XSS)
- CVE-2026-53666 React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
- CVE-2026-53663 React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass
- CVE-2026-53662 immich: One-click account takeover via XSS in login page continue redirect
- CVE-2026-53661 boruta-server sent sensitive session cookies without the Secure attribute
- CVE-2026-53660 OpenAM Insecure SSO Cookie Initialization
- CVE-2026-5366 Git Argument Injection in prefecthq/prefect
- CVE-2026-53659 http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
- CVE-2026-53658 Fabric CA: LDAP Injection via Unescaped Username in GetUser Filter
- CVE-2026-53657 Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket
- CVE-2026-53656 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
- CVE-2026-53655 node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
- CVE-2026-53654 Grav: Unauthenticated open redirect via login twofa_cancel _redirect
- CVE-2026-53653 Grav: Unauthenticated denial of service via unbounded image derivative dimensions
- CVE-2026-5365 LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route
- CVE-2026-53649 Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE
- CVE-2026-53648 FOSSBilling: Downloadable product files can be overwritten through filename collisions
- CVE-2026-53647 FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint
- CVE-2026-53646 FOSSBilling: Client password reset token reuse allows persistent account takeover
- CVE-2026-53645 FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation
- CVE-2026-53644 FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders
- CVE-2026-53643 FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints
- CVE-2026-53642 FOSSBilling: Unverified clients can access client-area pages when email confirmation is required
- CVE-2026-53641 FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal
- CVE-2026-53640 Missing authorization in FOSSBilling
- CVE-2026-5364 File upload in Drag and Drop File Upload for Contact Form 7
- CVE-2026-53639 Sylius: IDOR on Shop Payment Request API endpoints
- CVE-2026-53638 Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint
- CVE-2026-53637 Sylius: Cart FormComponent allows modification or deletion of an already-completed order
- CVE-2026-53636 Open edX LTI OAuth Replay Attack
- CVE-2026-53635 Open edX Platform: Insufficient Permission on set_course_mode_price()
- CVE-2026-53634 Sharp: Missing Authorization Check in Quick Creation Command Endpoints
- CVE-2026-53633 Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
- CVE-2026-53632 NTLMv2 hash disclosure via UNC path handling on Windows
- CVE-2026-5363 Use of weak cryptographic key in TP-Link Archer C7
- CVE-2026-53629 GLPI: SQL injection in history tab
- CVE-2026-53628 GLPI: Unallowed authentication method update by administrator
- CVE-2026-53627 GLPI: Unexpected access to update operations through the API
- CVE-2026-53626 GLPI: Arbitrary Document Read via Form Context Authorization Bypass