Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 580 of 1013.
- CVE-2026-50183 WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section
- CVE-2026-50182 AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination
- CVE-2026-50181 Langroid: Path traversal in the file tools allows read/write outside configured current directory
- CVE-2026-50180 Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read
- CVE-2026-5018 code-projects Simple Food Order System Parameter register-router.php sql injection
- CVE-2026-50179 Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
- CVE-2026-50178 Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension
- CVE-2026-50176 EVoke Systems EVoke CSMS Improper Restriction of Excessive Authentication Attempts
- CVE-2026-50173 Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only users
- CVE-2026-50171 Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
- CVE-2026-50170 Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
- CVE-2026-5017 code-projects Simple Food Order System Parameter all-tickets.php sql injection
- CVE-2026-50169 Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
- CVE-2026-50168 Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass
- CVE-2026-50167 Kurrier: Authenticated cross-user authorization bypass in Kurrier API
- CVE-2026-50166 Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured
- CVE-2026-50165 alf.io has Improper Access Control for Organization Owners that Exposes System Secrets
- CVE-2026-50163 `oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution
- CVE-2026-50162 oras-go: file store write outside workingDir via symlink traversal
- CVE-2026-50161 libre: Integer overflow in websock_decode() masked frame length check leads to heap buffer overflow
- CVE-2026-50160 Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite
- CVE-2026-5016 elecV2 elecV2P URL mock eAxios server-side request forgery
- CVE-2026-50159 Mermaid allows CSS injection applying to sibling elements of the diagram
- CVE-2026-50158 yutu: Arbitrary File Write via MCP `caption-download` Tool
- CVE-2026-50157 Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK
- CVE-2026-50152 Missing authorization in ceph
- CVE-2026-50151 oras-go: credential forwarding via unvalidated Location header in blob upload
- CVE-2026-5015 elecV2 elecV2P Endpoint logs cross site scripting
- CVE-2026-50149 Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled
- CVE-2026-50148 Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write
- CVE-2026-50147 Metabase: Arbitrary File Read via MySQL Connection Property Injection
- CVE-2026-50146 Astro: Reflected XSS via unescaped slot name
- CVE-2026-50144 ncnn: Out-of-bounds heap write in ParamDict::load_param via unchecked negative parameter id
- CVE-2026-50143 Actor MCP path authority injection leaks Apify token
- CVE-2026-50142 libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)
- CVE-2026-50141 Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation
- CVE-2026-5014 elecV2 elecV2P Wildcard log path.join path traversal
- CVE-2026-50139 goshs: Share-link ?token=… redemption races past download limit
- CVE-2026-50138 goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
- CVE-2026-50137 Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials
- CVE-2026-50136 Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials
- CVE-2026-50135 Hugo: Symlink confinement bypass in resources.Get
- CVE-2026-50134 Hugo: security.http.urls allow-list bypass via HTTP redirects
- CVE-2026-50133 Hugo: XSS via text/html content files
- CVE-2026-50132 Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase
- CVE-2026-50131 Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
- CVE-2026-50130 Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`
- CVE-2026-5013 elecV2 elecV2P :key path.join path traversal
- CVE-2026-50129 Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER
- CVE-2026-50128 Mastodon: Spoofing of attribution domains
- CVE-2026-50127 Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)
- CVE-2026-50126 Null dereference in adaguc-server
- CVE-2026-50125 MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion
- CVE-2026-50124 DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper
- CVE-2026-5012 elecV2 elecV2P rpc pm2run os command injection
- CVE-2026-50112 Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates
- CVE-2026-50110 Use of Hard-coded Credentials in StoneFly Storage Concentrator
- CVE-2026-5011 elecV2 elecV2P JSON webhook runJSFile code injection
- CVE-2026-50108 Naxclow IoT Platform Missing Authorization
- CVE-2026-50107 NGINX Gateway Fabric vulnerability
- CVE-2026-50106 Security feature bypass in Unbound
- CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
- CVE-2026-50103 Improper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850
- CVE-2026-50101 Naxclow IoT Platform Not using password aging
- CVE-2026-50100 Privilege escalation in Multiple printer drivers
- CVE-2026-5010 Reflected Cross-Site Scripting (XSS) in Sanoma’s Clickedu
- CVE-2026-50099 Naxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directory
- CVE-2026-50096 BUG-000187164 - ArcGIS Server has a security vulnerability.
- CVE-2026-50095 BUG-000187165 - ArcGIS Server has a security vulnerability.
- CVE-2026-50093 File upload in Siveillance Control Pro V3.0
- CVE-2026-50091 Aqara Home Android SDK hardcoded keys
- CVE-2026-50090 Aqara OAuth redirect_uri validation bypass
- CVE-2026-50089 Aqara IAM/SSO Gateway open redirect
- CVE-2026-50088 Aqara Developer Portal cross-origin resource sharing
- CVE-2026-50087 Aqara IAM/SSO Gateway cross-origin resource sharing
- CVE-2026-50086 Aqara unauthenticated AES oracle
- CVE-2026-50085 Aqara Board IoT insecure debug API
- CVE-2026-50084 Aqara API cross-account access
- CVE-2026-50083 Aqara hardcoded OAuth client credentials
- CVE-2026-50082 Aqara Developer Portal insecure authentication token
- CVE-2026-50076 Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass
- CVE-2026-5007 kazuph mcp-docs-rag add_git_repository/add_text_file index.ts cloneRepository os command injection
- CVE-2026-50064 Memory corruption in Solid Edge SE2025
- CVE-2026-50063 Memory corruption in Solid Edge SE2025
- CVE-2026-50062 Memory corruption in Solid Edge SE2025
- CVE-2026-50061 Use after free in Solid Edge SE2025
- CVE-2026-50060 Use after free in Solid Edge SE2025
- CVE-2026-5006 Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths
- CVE-2026-50059 Memory corruption in Solid Edge SE2025
- CVE-2026-50058 Memory corruption in Solid Edge SE2025
- CVE-2026-50057 Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions
- CVE-2026-50056 Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection
- CVE-2026-50055 Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion
- CVE-2026-50054 Privilege escalation in Zimbra Collaboration Suite
- CVE-2026-50053 Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters
- CVE-2026-50052 Other in Varnish Cache (pre split)
- CVE-2026-5005 Stored XSS in Twiser's OKRs & Goals
- CVE-2026-50046 Possible heap use-after-free in an error path when a DoT forwarded query is jostled out
- CVE-2026-50045 'max-global-quota' reset by DNSSEC validation restarts
- CVE-2026-50044 Inadequate Encryption Strength in Panduit IntraVUE by Pronetiqs