Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 567 of 1013.
- CVE-2026-52850 Docmost: Broken access control in transclusion lookup API leaks sync-block content across private spaces
- CVE-2026-5285 Use after free in Chrome
- CVE-2026-52846 Caddy: stripHTML template function bypass
- CVE-2026-52845 Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
- CVE-2026-52844 Caddy: Windows `file_server` path authorization bypass via encoded backslash
- CVE-2026-52843 Lightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials mode
- CVE-2026-52842 Lightpanda:URL parser misidentifies page origin for URLs containing @ in the path - Same-Origin Policy bypass
- CVE-2026-52841 Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync
- CVE-2026-52840 Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network
- CVE-2026-5284 Use after free in Chrome
- CVE-2026-52839 Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass
- CVE-2026-52838 Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS
- CVE-2026-52837 Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page
- CVE-2026-52836 Memory corruption in OpenDDS
- CVE-2026-52835 Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database
- CVE-2026-52834 jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms
- CVE-2026-52833 Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE
- CVE-2026-52832 Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container
- CVE-2026-52831 Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE
- CVE-2026-52830 fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection
- CVE-2026-5283 Information disclosure in Chrome
- CVE-2026-52829 ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book
- CVE-2026-52828 Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access
- CVE-2026-52827 Kimai: Two-factor authentication bypass on the Kimai API
- CVE-2026-52826 Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation
- CVE-2026-52825 Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Visibility
- CVE-2026-52824 Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
- CVE-2026-52823 Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes
- CVE-2026-52822 Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation
- CVE-2026-52821 Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects
- CVE-2026-52820 Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass
- CVE-2026-5282 Memory corruption in Chrome
- CVE-2026-52819 Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target
- CVE-2026-52817 Linuxfabrik Monitoring Plugins Sudoers: /usr/bin/apt-get arguments allow privilege escalation
- CVE-2026-52816 Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS
- CVE-2026-52815 Gogs: Unauthenticated Organization Teams Information Disclosure via API
- CVE-2026-52814 Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)
- CVE-2026-52813 Gogs: Path Traversal in organization name results in RCE through Git hooks
- CVE-2026-52812 Gogs: LFS dedupe path leaks private repo content across tenants
- CVE-2026-52811 Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym
- CVE-2026-52810 Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion
- CVE-2026-5281 Google Dawn Use-After-Free
- CVE-2026-52809 Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES
- CVE-2026-52808 Gogs: Write-level collaborators can mutate admin-only repository settings via API
- CVE-2026-52807 Gogs: DOM-based XSS via Milestone Name on New Issue Page
- CVE-2026-52806 Gogs: RCE via git rebase --exec argument injection in pull request merge
- CVE-2026-52805 Gogs: Migration Redirect Bypass Leads to Internal Repository Theft
- CVE-2026-52804 Gogs: Privilege Escalation via Collaboration Access Mode Validation
- CVE-2026-52802 Gogs: Open Redirect via redirect_to in Gogs
- CVE-2026-52801 Gogs: Ability to import local repositories via Mirror Settings
- CVE-2026-52800 Gogs: CSRF Leading to Organization Owner Takeover
- CVE-2026-5280 Use after free in Chrome
- CVE-2026-52799 Gogs: Missing Authorization in Attachment Download
- CVE-2026-52798 Gogs: Stored XSS in `.ipynb` Preview
- CVE-2026-52797 Gogs: Overwriting critical files results in a denial of service
- CVE-2026-52796 Gogs: DoS in rendering issue index pattern
- CVE-2026-52795 Gogs: Authorization Bypass in Watch API allows any user to monitor private repository activity
- CVE-2026-52794 Sentry: Inefficient Regular Expression Complexity in sentry
- CVE-2026-52793 Froxlor: API Authentication bypasses 2FA Authentication
- CVE-2026-52792 Algernon: Server-side script source disclosure on Windows via NTFS filename
- CVE-2026-52791 fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)
- CVE-2026-5279 Memory corruption in Chrome
- CVE-2026-52785 OpenProject: SQL injection in timestamps functionality
- CVE-2026-52784 OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]"
- CVE-2026-52783 Information disclosure in openproject
- CVE-2026-52782 Missing authorization in openproject
- CVE-2026-52781 Cross-site scripting in openproject
- CVE-2026-52780 OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)
- CVE-2026-5278 Use after free in Chrome
- CVE-2026-52779 Missing authorization in openproject
- CVE-2026-52778 YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)
- CVE-2026-52777 YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize
- CVE-2026-52776 Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
- CVE-2026-52775 YesWiki Authenticated SQL Injection in ReactionManager
- CVE-2026-52774 Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki
- CVE-2026-52773 Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki
- CVE-2026-52772 YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))
- CVE-2026-52771 YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)
- CVE-2026-52770 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in yeswiki/yeswiki
- CVE-2026-5277 Integer overflow in Chrome
- CVE-2026-52769 YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`
- CVE-2026-52767 YesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`
- CVE-2026-52766 YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
- CVE-2026-52763 YesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB read
- CVE-2026-52762 YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates
- CVE-2026-52761 ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture
- CVE-2026-52760 Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console
- CVE-2026-5276 Security feature bypass in Chrome
- CVE-2026-52759 Ghidra < 12.1.1 - Denial of Service via Uncontrolled Memory Allocation in Mach-O Parser
- CVE-2026-52758 Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search
- CVE-2026-52757 Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() during decompilation
- CVE-2026-52756 Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF Server
- CVE-2026-52755 Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import
- CVE-2026-52754 Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule
- CVE-2026-52753 Ghidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed Symbol
- CVE-2026-52752 Ghidra < 12.0.2 - Path Traversal in Extension Installer via ZIP Entry Names
- CVE-2026-52751 Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection
- CVE-2026-52750 Ghidra < 12.1- Command Injection via URL Annotation Click
- CVE-2026-5275 Memory corruption in Chrome
- CVE-2026-52749 Improper Authentication in Kaon AR2140X