Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 576 of 1013.
- CVE-2026-50573 pnpm: Unsafe default behavior breaks integrity check
- CVE-2026-50572 Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault
- CVE-2026-50571 WebSub: Reflected script execution through intent-verification challenges
- CVE-2026-50570 Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption
- CVE-2026-5057 ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability
- CVE-2026-50569 Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks
- CVE-2026-50568 Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape
- CVE-2026-50567 Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory
- CVE-2026-50566 Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation
- CVE-2026-50565 Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container
- CVE-2026-50564 Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape
- CVE-2026-50563 Fission Container Executor Function PodSpec Injection Leading to Node Escape
- CVE-2026-50562 FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows
- CVE-2026-50561 Yuxi has a JWT Authentication Bypass Leading to Cross-Instance Administrator Token Reuse
- CVE-2026-50560 Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature
- CVE-2026-5056 GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-50559 Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
- CVE-2026-50558 Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive
- CVE-2026-50557 Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
- CVE-2026-50556 Angular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR
- CVE-2026-50555 @angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CVE-2026-50554 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark
- CVE-2026-50553 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)
- CVE-2026-50552 Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail
- CVE-2026-50551 SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content
- CVE-2026-50550 Snipe-IT: 2FA reset privilege bypass
- CVE-2026-5055 NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
- CVE-2026-50549 Cursor Desktop sandbox escape via symlink and failed path canonicalization
- CVE-2026-50548 Cursor Desktop sandbox escape via agent-controlled working directory
- CVE-2026-50547 InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier
- CVE-2026-50545 Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover
- CVE-2026-50544 Misconfiguration in luminalshine
- CVE-2026-50543 Missing authorization in xibo-cms
- CVE-2026-50542 Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure
- CVE-2026-50541 Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export
- CVE-2026-50540 Kata Containers: Config Path Annotation Arbitrary File Loading
- CVE-2026-5054 NoMachine External Control of File Path Local Privilege Escalation Vulnerability
- CVE-2026-50539 Missing authorization in xibo-cms
- CVE-2026-50538 libvncclient Tight decoder has an attacker-controlled heap out-of-bounds write
- CVE-2026-50530 DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets
- CVE-2026-5053 NoMachine External Control of File Path Arbitrary File Deletion Vulnerability
- CVE-2026-50529 DataEase: Link Token Leakage Prior to Share Password/Ticket Validation
- CVE-2026-50528 .NET Security Feature Bypass Vulnerability
- CVE-2026-50527 .NET Framework Denial of Service Vulnerability
- CVE-2026-50526 .NET Tampering Vulnerability
- CVE-2026-50525 .NET Denial of Service Vulnerability
- CVE-2026-50524 .NET Framework Denial of Service Vulnerability
- CVE-2026-50523 Microsoft PowerShell Remote Code Execution Vulnerability
- CVE-2026-50522 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
- CVE-2026-50521 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-50520 Visual Studio Code Remote Code Execution Vulnerability
- CVE-2026-5052 Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
- CVE-2026-50519 Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability
- CVE-2026-50518 Windows DHCP Server Remote Code Execution Vulnerability
- CVE-2026-50517 Microsoft M365 Copilot Remote Code Execution Vulnerability
- CVE-2026-50516 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
- CVE-2026-50515 Azure Service Bus Remote Code Execution Vulnerability
- CVE-2026-50512 Microsoft PC Manager Elevation of Privilege Vulnerability
- CVE-2026-50511 Microsoft PC Manager Elevation of Privilege Vulnerability
- CVE-2026-50510 GitHub Copilot Remote Code Execution Vulnerability
- CVE-2026-5051 Audit Log Plugin Directory Guard Bypass via Legacy path Option
- CVE-2026-50509 Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability
- CVE-2026-50508 Windows NTLM Spoofing Vulnerability
- CVE-2026-50507 Windows BitLocker Security Feature Bypass Vulnerability
- CVE-2026-50506 OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability
- CVE-2026-50505 Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability
- CVE-2026-50504 Windows Remote Desktop Client Information Disclosure Vulnerability
- CVE-2026-50503 Windows Runtime Elevation of Privilege Vulnerability
- CVE-2026-50502 Windows Event Logging Service Remote Code Execution Vulnerability
- CVE-2026-50501 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
- CVE-2026-50500 Windows Netlogon Elevation of Privilege Vulnerability
- CVE-2026-5050 Security feature bypass in Payment Gateway for Redsys & WooCommerce Lite
- CVE-2026-50499 Windows Print Spooler Elevation of Privilege Vulnerability
- CVE-2026-50498 Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
- CVE-2026-50497 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
- CVE-2026-50496 Windows Network Policy Server SNMP Information Disclosure Vulnerability
- CVE-2026-50495 DNS Client Tampering Vulnerability
- CVE-2026-50494 Windows NTFS Remote Code Execution Vulnerability
- CVE-2026-50493 DirectX Graphics Kernel Elevation of Privilege Vulnerability
- CVE-2026-50492 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
- CVE-2026-50491 Code Integrity DLL (ci.dll) Elevation of Privilege Vulnerability
- CVE-2026-50490 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-5049 Path traversal in Brocade SANnav
- CVE-2026-50489 Win32k Elevation of Privilege Vulnerability
- CVE-2026-50488 Clipboard User Service Elevation of Privilege Vulnerability
- CVE-2026-50487 Windows DNS Client Elevation of Privilege Vulnerability
- CVE-2026-50486 Windows Runtime Elevation of Privilege Vulnerability
- CVE-2026-50485 Windows Hyper-V Denial of Service Vulnerability
- CVE-2026-50484 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-50483 Windows Graphics Component Information Disclosure Vulnerability
- CVE-2026-50482 Windows NTFS Remote Code Execution Vulnerability
- CVE-2026-50481 Azure Active Directory Elevation of Privilege Vulnerability
- CVE-2026-50480 Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability
- CVE-2026-5048 SQL injection in Brocade SANnav
- CVE-2026-50479 Windows USB Hub Driver Elevation of Privilege Vulnerability
- CVE-2026-50478 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-50477 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-50476 Windows Network Connections Service Elevation of Privilege Vulnerability
- CVE-2026-50475 Windows Kernel Information Disclosure Vulnerability
- CVE-2026-50474 Remote Desktop Client Remote Code Execution Vulnerability