Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 584 of 1013.
- CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation
- CVE-2026-49472 FreeSWITCH includes a vulnerable function, PREFIX(prologTok)() from libexpat
- CVE-2026-49471 Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE
- CVE-2026-49470 GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force
- CVE-2026-4947 Insecure Direct Object Reference (IDOR) Leading to Signature Forgery in Foxit eSign
- CVE-2026-49469 GLPI: LDAP filter injection in user import feature
- CVE-2026-49468 LiteLLM: Authentication Bypass via Host Header Injection
- CVE-2026-49467 TOTP enrollment hijack: password gate skipped due to unawaited promise
- CVE-2026-49466 Draft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Template Attributes
- CVE-2026-49465 n8n: Git Node Clone and Push Operations Bypass File Sandbox
- CVE-2026-49464 NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak
- CVE-2026-49463 NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries
- CVE-2026-49462 nl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default
- CVE-2026-49461 pypdf: Possible large memory usage for form XObjects during text extraction
- CVE-2026-49460 pypdf: Inefficient decoding of FlateDecode PNG predictor streams
- CVE-2026-4946 NSA Ghidra Auto-Analysis Annotation Command Execution
- CVE-2026-49459 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
- CVE-2026-49458 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
- CVE-2026-49457 QUIC has Broken TLS verification
- CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper
- CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch
- CVE-2026-49454 Relyra SAML SignatureValue not cryptographically verified -> authentication bypass
- CVE-2026-49453 Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory
- CVE-2026-49452 WeasyPrint: CSS Injection via Presentational Hints
- CVE-2026-49451 Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing
- CVE-2026-49450 Security feature bypass in joplin
- CVE-2026-4945 Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass
- CVE-2026-49449 Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows
- CVE-2026-49448 authentik: SourceStage bypass via empty POST
- CVE-2026-49447 Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens
- CVE-2026-49446 Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server
- CVE-2026-49445 Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access
- CVE-2026-49444 n8n: Python sandbox escape
- CVE-2026-49443 authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API
- CVE-2026-49442 Cacti: User Enumeration via Error Messages
- CVE-2026-49441 Path traversal in wazuh
- CVE-2026-49440 Deno: Miller-Rabin Primality Test Allows Zero Rounds
- CVE-2026-4944 Hardcoded trust_remote_code=True in vllm-project/vllm Bypasses User Security Control
- CVE-2026-49439 OpenRemote read-only asset users can write predicted datapoints
- CVE-2026-49436 LinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link API
- CVE-2026-49435 Keysight IxChariot-related products stack-based buffer overflow
- CVE-2026-49434 Server-side request forgery in Apache ActiveMQ
- CVE-2026-49433 DeepAI api.deepai.org/change_user_email CSRF
- CVE-2026-49432 Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service
- CVE-2026-49431 Incorrect user validation in ZFS_IOC_SET_PROP ioctl
- CVE-2026-49430 Kernel heap overflow in ZFS_IOC_RECV_NEW ioctl
- CVE-2026-49429 Kernel heap overflow in ZFS_IOC_USERSPACE_MANY ioctl
- CVE-2026-49428 posixshm: system calls can incorrectly free memory of largepage objects
- CVE-2026-49427 posixshm: largepage shared memory objects not explicitly wired
- CVE-2026-49426 Incorrect audit records for ptrace(2) syscall requests
- CVE-2026-49425 Kernel stack disclosure in 32-bit compatibility support
- CVE-2026-49424 Kernel stack disclosure in Linux compatibility layer
- CVE-2026-49423 Remote DOS via uninitialized memory access in KTLS receive
- CVE-2026-49422 Use-after-free in TCP RACK stack option handler
- CVE-2026-49421 unlinkat(2) ignores AT_RESOLVE_BENEATH flag
- CVE-2026-49420 Buffer overflow in libalias RTSP handler
- CVE-2026-4942 IBM i is Affected by Algorithm Downgrade in Transport Layer Security []
- CVE-2026-49419 Jail reference count underflow
- CVE-2026-49418 Use-after-free in device pager page list
- CVE-2026-49417 Multiple vulnerabilities in the sound(4) mmap path
- CVE-2026-49416 Integer overflow in vt(4) CONS_HISTORY ioctl
- CVE-2026-49415 Local privilege escalation via execve(2) TOCTOU race
- CVE-2026-49414 ASLR bypass for setuid executables via procctl(2)
- CVE-2026-49413 Flaw in Linuxulator execution of setugid binaries
- CVE-2026-49412 Use-after-free bug in the IPV6_MSFILTER socket option handler
- CVE-2026-49411 Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks
- CVE-2026-49410 OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation
- CVE-2026-49406 Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions
- CVE-2026-49402 Deno: Command Injection via spawnSync & spawn on Windows
- CVE-2026-49401 Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
- CVE-2026-49400 October CMS: PHP Object Injection via Backend Widget Session Storage
- CVE-2026-49397 Nezha's private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data
- CVE-2026-49396 Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents
- CVE-2026-49394 Frappe: Auth. bypass via update_page
- CVE-2026-49392 Wazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd
- CVE-2026-49391 Frappe: Stored XSS in Column Headers via Data Import
- CVE-2026-49386 Missing authorization in YouTrack
- CVE-2026-49385 Missing authorization in YouTrack
- CVE-2026-49384 Cross-site scripting in PyCharm
- CVE-2026-49383 XML external entity in IntelliJ IDEA
- CVE-2026-49382 Code injection in IntelliJ IDEA
- CVE-2026-49381 Cross-site scripting in TeamCity
- CVE-2026-49380 Open redirect in TeamCity
- CVE-2026-4938 Incorrect Authorization in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-49379 Information disclosure in TeamCity
- CVE-2026-49378 Information disclosure in TeamCity
- CVE-2026-49377 Information disclosure in TeamCity
- CVE-2026-49376 Auth bypass in TeamCity
- CVE-2026-49375 Cross-site scripting in TeamCity
- CVE-2026-49374 Missing authorization in TeamCity
- CVE-2026-49373 Command injection in TeamCity
- CVE-2026-49372 Server-side request forgery in TeamCity
- CVE-2026-49371 Cross-site scripting in TeamCity
- CVE-2026-49370 Information disclosure in YouTrack
- CVE-2026-4937 Power System Insufficient Entropy
- CVE-2026-49369 Information disclosure in YouTrack
- CVE-2026-49368 Cross-site scripting in YouTrack
- CVE-2026-49367 Missing authorization in IntelliJ IDEA
- CVE-2026-49366 Command injection in IntelliJ IDEA
- CVE-2026-49365 Apache Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body