Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 579 of 1013.
- CVE-2026-50285 Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback
- CVE-2026-50284 Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
- CVE-2026-50283 Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
- CVE-2026-50282 Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves
- CVE-2026-50281 Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
- CVE-2026-50280 Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
- CVE-2026-5028 Eight Day Week Print Workflow <= 1.2.6 - Authenticated (Subscriber+) SQL Injection via 'title' Parameter
- CVE-2026-50279 Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
- CVE-2026-50278 iccDEV: CIccEmbedIO::Read8() size_t underflow
- CVE-2026-50277 dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS
- CVE-2026-50276 dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS
- CVE-2026-50275 Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS
- CVE-2026-50274 dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS
- CVE-2026-50273 Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS
- CVE-2026-50272 dd-trace: Improper parsing of W3C baggage headers may lead to DoS
- CVE-2026-50271 dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
- CVE-2026-50270 dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
- CVE-2026-5027 Langflow - Path Traversal Arbitrary File Write via upload_user_file
- CVE-2026-50269 AIOHTTP: CRLF injection in multipart headers
- CVE-2026-50268 Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding
- CVE-2026-50267 Steeltoe: TLS private keys written to /tmp with default permissions, never deleted
- CVE-2026-50266 OpenStack Neutron: Neutron port RBAC policy bypass allows project managers to set trusted device owners on shared networks
- CVE-2026-50264 Memory corruption in Red Hat Enterprise Linux 10
- CVE-2026-50263 Use after free in Red Hat Enterprise Linux 10
- CVE-2026-50262 Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds read/write in glx changedrawableattributes
- CVE-2026-50261 Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()
- CVE-2026-50260 Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()
- CVE-2026-5026 Langflow - Stored XSS via Malicious SVG Upload
- CVE-2026-50259 Memory corruption in Red Hat Enterprise Linux 10
- CVE-2026-50258 Memory corruption in Red Hat Enterprise Linux 10
- CVE-2026-50257 Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()
- CVE-2026-50256 Memory corruption in Red Hat Enterprise Linux 10
- CVE-2026-50255 Misconfiguration in Optical Disc Archive Software for Windows
- CVE-2026-50254 OFFIS DCMTK Toolkit Missing Release of Memory after Effective Lifetime
- CVE-2026-50252 Possible cache poisoning attack by mapping source port population per thread
- CVE-2026-50251 Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush
- CVE-2026-5025 Langflow - Application Logs Exposed to All Authenticated Users
- CVE-2026-50248 BOGUS configured primary hostname accepted for XFR in auth/rpz zones
- CVE-2026-50245 Brickcom Cameras Missing Authentication for Critical Function
- CVE-2026-50244 Naxclow IoT Platform Missing Authorization
- CVE-2026-50243 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL
- CVE-2026-50242 Auth bypass in Hub
- CVE-2026-5024 D-Link DIR-513 formSetEmail stack-based overflow
- CVE-2026-50237 Server-side request forgery in Red Hat OpenShift Container Platform 4.12
- CVE-2026-50236 Server-side request forgery in Red Hat OpenShift Container Platform 4.14
- CVE-2026-50235 Lyrion Music Server 9.2.0 Reflected XSS via search Parameters
- CVE-2026-50234 Lyrion Music Server 9.2.0 Path Traversal File Read
- CVE-2026-50233 Lyrion Music Server 9.2.0 Arbitrary Directory Listing
- CVE-2026-50232 Lyrion Music Server 9.2.0 Stored XSS via Metadata Tags
- CVE-2026-50231 Lyrion Music Server 9.2.0 Unauthenticated Stored XSS via server.log
- CVE-2026-50230 Lyrion Music Server 9.2.0 Reflected XSS via server.log
- CVE-2026-5023 DeDeveloper23 codebase-mcp RepoMix codebase.ts saveCodebase os command injection
- CVE-2026-50229 Apache Tomcat: XSS in number guess example
- CVE-2026-50228 Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense
- CVE-2026-50227 MQTT WebSocket Command Execution Vulnerability in NitroSense
- CVE-2026-50226 Firmware Theft & IMEI Spoofing via Connect-OTA
- CVE-2026-50225 Account Creation Exhaustion
- CVE-2026-50224 Unauthenticated IPv6 WAN Management Exposure
- CVE-2026-50223 Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution
- CVE-2026-50222 Apache CloudStack: Improper access control in Userdata reference APIs
- CVE-2026-50221 OpenStack Swift vulnerable to authenticated server-side request forgery
- CVE-2026-5022 Langflow - Missing Authorization on download_image Endpoint
- CVE-2026-50219 Use after free in libexpat
- CVE-2026-50218 Auth bypass in Guardicore Platform Agent
- CVE-2026-50217 Use after free in Guardicore Platform Agent
- CVE-2026-50216 Integer overflow in Guardicore Platform Agent
- CVE-2026-50215 Use after free in Guardicore Platform Agent
- CVE-2026-50214 Shared Secret Quota Inflation
- CVE-2026-50213 Bulk User Private Data Harvesting
- CVE-2026-50212 Arbitrary Remote Device Unbinding
- CVE-2026-50211 Exposed Factory Testing App Boundaries
- CVE-2026-50210 Weak Static Cryptographic Initialization Vectors
- CVE-2026-5021 Tenda F453 httpd PPTPUserSetting fromPPTPUserSetting stack-based overflow
- CVE-2026-50209 MDM Server Registration Overriding
- CVE-2026-50208 Permissive TrustAllCerts TLS Verification
- CVE-2026-50207 Local Modem Manipulation via Binder Interfaces
- CVE-2026-50206 VPN Command Injection Vulnerability
- CVE-2026-50205 Plaintext Log Credential Leakage
- CVE-2026-50203 Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory
- CVE-2026-50202 Steeltoe's static JWKS cache shared across schemes and never invalidated
- CVE-2026-50201 Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission
- CVE-2026-50200 Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords
- CVE-2026-5020 Totolink A3600R Parameter cstecgi.cgi setNoticeCfg command injection
- CVE-2026-50199 Wallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refresh
- CVE-2026-50198 Wallos: Cross-user subscription cost inference via replacement_subscription_id
- CVE-2026-50197 Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests
- CVE-2026-50196 Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch
- CVE-2026-50195 containerd: CRI checkpoint import allows local image tag poisoning
- CVE-2026-50194 Steeltoe vulnerable to management-port isolation bypass via spoofed Host header
- CVE-2026-50193 jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()
- CVE-2026-50192 Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect
- CVE-2026-50191 4gaBoards: Pre-Account Takeover via SSO Email Linkage
- CVE-2026-50190 Shaarli vulnerable to stored XSS via raw bookmark title in document <title> element on public permalink page
- CVE-2026-5019 code-projects Simple Food Order System Parameter all-orders.php sql injection
- CVE-2026-50189 Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route
- CVE-2026-50188 Kirby: Request header injection in `Http\Remote`
- CVE-2026-50187 Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env files
- CVE-2026-50186 4gaBoards: Path Traversal leading to Arbitrary File Read and Deletion in Board Export
- CVE-2026-50185 RustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set
- CVE-2026-50184 Angular: Request Credential & Cache Policy Stripping in Angular Service Worker