Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 560 of 1013.
- CVE-2026-53516 Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email
- CVE-2026-53515 Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso
- CVE-2026-53514 Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin
- CVE-2026-53513 Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
- CVE-2026-53512 Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
- CVE-2026-53511 calibre: Arbitrary Code Execution in Template Formatter via Book Metadata
- CVE-2026-53510 Savon::Model evaluates WSDL operation names as Ruby source
- CVE-2026-5351 Trendnet TEW-657BRM setup.cgi add_wps_client os command injection
- CVE-2026-53509 @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)
- CVE-2026-53508 oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)
- CVE-2026-53507 Server-side request forgery in oasdiff-action
- CVE-2026-53505 Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS
- CVE-2026-53504 Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter
- CVE-2026-53503 Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS
- CVE-2026-53502 Thumbor has path traversal via post-validation URL decoding bypass in file_loader
- CVE-2026-53501 Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature
- CVE-2026-53500 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
- CVE-2026-5350 Trendnet TEW-657BRM setup.cgi update_pcdb stack-based overflow
- CVE-2026-53499 FORT-validator Vulnerable to RRDP Shared Snapshot Cache Poisoning
- CVE-2026-53497 CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)
- CVE-2026-53496 ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes
- CVE-2026-53495 containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service
- CVE-2026-53493 Containerd has image-pull DoS via crafted OCI index graph amplification
- CVE-2026-53492 containerd CRI checkpoint restore CDI annotation smuggling
- CVE-2026-5349 Trendnet TEW-657BRM setup.cgi add_apcdb stack-based overflow
- CVE-2026-53489 containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore
- CVE-2026-53488 containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull
- CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview
- CVE-2026-53486 decompress: Archive extraction can create files and links outside the target directory
- CVE-2026-53483 Auth bypass in PowerProtect Data Domain
- CVE-2026-53482 Integer overflow in PowerProtect Data Domain
- CVE-2026-53481 Path traversal in PowerProtect Data Domain
- CVE-2026-53480 Path traversal in PowerProtect Data Domain
- CVE-2026-5348 Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure
- CVE-2026-53479 Command injection in PowerProtect Data Domain
- CVE-2026-53478 Command injection in PowerProtect Data Domain
- CVE-2026-53477 Race condition in Dell Command Update (DCU)
- CVE-2026-53476 Assisted-migration-agent: vddk tarball chained-symlink arbitrary file write
- CVE-2026-53475 Assisted-migration-agent: tls verification disabled on all vcenter connections
- CVE-2026-53474 Migration-planner: second-order sql injection via rvtools upload
- CVE-2026-53473 Migration-planner-ui-app: stored xss via javascript: url in agent credential link
- CVE-2026-53472 Migration-planner: credentialurl validator accepts javascript: urls
- CVE-2026-53471 Migration-planner: agent api ignores jwt source_id claim
- CVE-2026-53470 Migration-planner: getsourcedownloadurl missing organization check
- CVE-2026-5347 Missing authorization in WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes
- CVE-2026-53469 Migration-planner: unprotected delete endpoint wipes all tenant data
- CVE-2026-53468 Typemill has Stored HTML Attribute Injection in Metadata Fields
- CVE-2026-53467 ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged
- CVE-2026-53466 ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow
- CVE-2026-53465 ImageMagick: Heap Buffer Over-Write in SF3 encoder when writing multi-frame image
- CVE-2026-53464 ImageMagick: Memory Leak in wand option parser when providing invalid arguments
- CVE-2026-53463 ImageMagick: Null Pointer Dereference in distort operation when passing incorrect arguments
- CVE-2026-53462 ImageMagick: Use-After-Free when allocation in CheckPrimitiveExtent fails
- CVE-2026-53461 ImageMagick: Out-of-bounds write in ICON decoder due to incorrect loop
- CVE-2026-53460 ImageMagick: Policy Bypass can trigger out-of-Memory condition
- CVE-2026-5346 huimeicloud hm_editor image-to-base64 Endpoint mcp-server.js client.get server-side request forgery
- CVE-2026-53459 Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints
- CVE-2026-53458 Blueprint Studio API exposed internal exception details
- CVE-2026-53457 Blueprint Studio terminal command working directory not bounded to config directory
- CVE-2026-53456 Blueprint Studio terminal SSH private key written to disk
- CVE-2026-53455 Blueprint Studio Git credential helper command injection
- CVE-2026-53454 Blueprint Studio stored Git credentials in plaintext Git credential store
- CVE-2026-53453 Blueprint Studio API authorization bypass for non-admin Home Assistant users
- CVE-2026-53452 Ground Station: Unauthenticated out-of-containment file read via `sigmfplayback` `recordingPath`
- CVE-2026-53451 Path traversal in ground-station
- CVE-2026-53450 Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection
- CVE-2026-53449 Coturn: Arbitrary File Write via CLI psd Command
- CVE-2026-53448 Coturn: SQL Injection in HTTPS Admin Panel Delete Operations
- CVE-2026-53447 Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID
- CVE-2026-53446 Wekan: Server-Side Request Forgery (SSRF) via webhook integration URLs
- CVE-2026-53445 Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards
- CVE-2026-53444 Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin
- CVE-2026-53442 Jenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurations
- CVE-2026-53441 Jenkins: Stored XSS vulnerability in node offline cause description
- CVE-2026-53440 Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container"
- CVE-2026-5344 Textpattern XML-RPC TXP_RPCServer.php mt_uploadImage path traversal
- CVE-2026-53439 Jenkins exposes other users' timezone and view names to users with Overall/Read permission
- CVE-2026-53438 Jenkins: Missing permission check allows unauthorized cancellation of queue items
- CVE-2026-53437 Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL
- CVE-2026-53436 Jenkins Open Redirect via Relative Path Segments in Post-Login Redirect URL
- CVE-2026-53435 Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation
- CVE-2026-53434 Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector
- CVE-2026-53433 Denial of Service in fzf
- CVE-2026-53432 Integer Overflow in fzf
- CVE-2026-53431 Boruta accepts expired JWT client assertions due to missing exp claim validation
- CVE-2026-53430 grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1
- CVE-2026-5343 SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031
- CVE-2026-53429 Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial of service
- CVE-2026-53428 Unbounded memory allocation in highlight_lines range expansion in mdex
- CVE-2026-53427 Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute
- CVE-2026-53426 Atom-table exhaustion denial-of-service via JSON parse_document in MDEx
- CVE-2026-53425 Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses
- CVE-2026-53424 Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions
- CVE-2026-53423 Unauthenticated denial-of-service via BEAM atom table exhaustion in membrane_mp4_plugin
- CVE-2026-53422 SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root
- CVE-2026-53421 Apache Syncope: Remote Code Execution via Scripted Connector
- CVE-2026-53420 Memory corruption in Zoom Workplace
- CVE-2026-5342 LibRaw TIFF/NEF decoders_libraw.cpp nikon_load_padded_packed_raw out-of-bounds
- CVE-2026-53418 Privilege escalation in Zoom Workplace
- CVE-2026-53416 Zoom VDI - Path Traversal