Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 559 of 1013.
- CVE-2026-53625 GLPI: Privilege Escalation via authtype API manipulation
- CVE-2026-53624 Fiber: HSTS header never set in helmet middleware due to incorrect protocol check
- CVE-2026-53622 Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
- CVE-2026-53620 Missing authorization in GROWI
- CVE-2026-5362 Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering
- CVE-2026-53615 util-linux libblkid DOS extended-partition overflow produces invalid partition metadata
- CVE-2026-53614 util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass
- CVE-2026-53613 util-linux mount target TOCTOU allows local privilege escalation
- CVE-2026-53612 util-linux mount hook_owner TOCTOU allows local privilege escalation
- CVE-2026-53611 Looking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validation
- CVE-2026-53610 GLPI: Reflected XSS in dashboards
- CVE-2026-5361 Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter
- CVE-2026-53609 Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
- CVE-2026-53608 @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag
- CVE-2026-53607 @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header
- CVE-2026-53606 sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes
- CVE-2026-53605 Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant
- CVE-2026-53604 nebula-mesh: CA private key not zeroized on web mobile-bundle error paths
- CVE-2026-53603 nebula-mesh: Operator session tokens stored in plaintext in the database
- CVE-2026-53602 nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate
- CVE-2026-53600 async-tar PAX extension-header desync enables tar entry/content smuggling
- CVE-2026-5360 Free5GC aper type confusion
- CVE-2026-53599 Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers
- CVE-2026-53598 Prompty: Arbitrary File Read via ${file:path} Reference Expansion
- CVE-2026-53597 Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader
- CVE-2026-53596 FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)
- CVE-2026-53595 FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL
- CVE-2026-53594 FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path
- CVE-2026-53593 File upload in freescout
- CVE-2026-53592 FreeScout vulnerable to prototype pollution in getQueryParam
- CVE-2026-53591 FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails
- CVE-2026-53587 libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data
- CVE-2026-53586 libgit2: HTTP transport can leak credentials to an offsite redirect target
- CVE-2026-53585 libgit2: Unbounded Memory Allocation via Delta Object Result-Size Header
- CVE-2026-53584 libgit2: Submodule path traversal
- CVE-2026-53583 libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend
- CVE-2026-53582 OPNsense: XPATH Injection can disclose any secret in config.xml
- CVE-2026-53581 ntp: write path traversal
- CVE-2026-53580 Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature
- CVE-2026-53579 Trilium: Note Import to RCE via Book Note
- CVE-2026-53578 Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml
- CVE-2026-53577 Kestra: Cross-Execution File Read via Preview Endpoint (IDOR)
- CVE-2026-53576 Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass
- CVE-2026-53575 EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user
- CVE-2026-53574 EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression
- CVE-2026-53573 core-geonetwork has an Open Redirect Bypass
- CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping
- CVE-2026-53571 Vite: `server.fs.deny` bypass on Windows alternate paths
- CVE-2026-5357 Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-53569 Frappe: Missing authorization in toggle_like and mark_as_seen
- CVE-2026-53568 Frappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'
- CVE-2026-53566 Out-of-bounds memory read
- CVE-2026-53565 Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges
- CVE-2026-53564 Arbitrary file read and write
- CVE-2026-53563 Persistent Command Execution
- CVE-2026-53562 Local Privilege Escalation
- CVE-2026-53561 Auth bypass in Apache Hive
- CVE-2026-5356 Business logic in LatePoint – Calendar Booking Plugin for Appointments and Events
- CVE-2026-53557 SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution
- CVE-2026-53556 SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read
- CVE-2026-53555 Stored XSS via SVG Upload
- CVE-2026-53554 SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing
- CVE-2026-53553 Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise
- CVE-2026-53552 Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers
- CVE-2026-53551 free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure
- CVE-2026-53550 js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases
- CVE-2026-5355 Trendnet TEW-657BRM setup.cgi vpn_drop os command injection
- CVE-2026-53549 Termix: Server-Side Request Forgery via Proxy Connectivity Test
- CVE-2026-53548 Termix: IDOR — Authenticated user can fetch SSH passwords for hosts owned by other users
- CVE-2026-53547 Termix: Account Takeover via Global Settings Disclosure
- CVE-2026-53546 Termix: Missing authorization in SSH host credential resolution exposes stored credentials
- CVE-2026-53545 Termix: Remote Code Execution via Tunnel Disconnect pkill Command Injection
- CVE-2026-53542 Termix: Tar option injection in file-manager archive creation allows command execution on managed SSH hosts
- CVE-2026-53541 OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering
- CVE-2026-53540 Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory
- CVE-2026-5354 Trendnet TEW-657BRM setup.cgi vpn_connect os command injection
- CVE-2026-53539 Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
- CVE-2026-53538 Python-Multipart: Semicolon treated as querystring field separator enables parameter smuggling
- CVE-2026-53537 Python-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
- CVE-2026-53536 Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL
- CVE-2026-53535 Activepieces: Arbitrary file write in git-sync via path traversal and symlinks
- CVE-2026-53534 JabRef CAYW Sublime Text integration permits operating-system command injection
- CVE-2026-53533 aiosmtplib: SMTP command injection via CR/LF in sender/recipient address
- CVE-2026-53532 OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS)
- CVE-2026-53531 ratex-parser has unbounded parser recursion that leads to stack overflow (process abort)
- CVE-2026-53530 ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)
- CVE-2026-5353 Trendnet TEW-657BRM setup.cgi ping_test os command injection
- CVE-2026-53529 LeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML)
- CVE-2026-53528 FileWiki has path traversal in RenameAsset via unsanitized oldFilename parameter
- CVE-2026-53527 LeafWiki Vulnerable to Privilege Escalation via User Self-Service Update
- CVE-2026-53525 WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication
- CVE-2026-53524 WeeChat has a Decompression Bomb in Relay WebSocket (DoS)
- CVE-2026-53523 Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection
- CVE-2026-53522 Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS
- CVE-2026-53521 Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context
- CVE-2026-53520 Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing
- CVE-2026-5352 Trendnet TEW-657BRM setup.cgi edit os command injection
- CVE-2026-53519 Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key
- CVE-2026-53518 Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption
- CVE-2026-53517 Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking