Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 585 of 1013.
- CVE-2026-49364 Information disclosure in Apache ActiveMQ Artemis
- CVE-2026-49363 Missing authorization in Apache ActiveMQ Artemis
- CVE-2026-49362 Missing authorization in Apache ActiveMQ Artemis
- CVE-2026-49361 Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability
- CVE-2026-49360 Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB
- CVE-2026-4936 Power System Insufficient Entropy
- CVE-2026-49359 PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option
- CVE-2026-49358 PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles
- CVE-2026-49357 Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication
- CVE-2026-49356 Babel: Arbitrary File Read via sourceMappingURL Comment in @babel/core
- CVE-2026-49355 OpenProject: Private work package data disclosure through single meeting agenda item API
- CVE-2026-49353 9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING
- CVE-2026-49352 9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass
- CVE-2026-4935 SureTriggers < 1.1.23 – Unauthenticated SQLi
- CVE-2026-49349 regclient may leak authentication credentials to external blob stores
- CVE-2026-49347 Quest Bot: Ticket creation has no per-user open-ticket limit or cooldown
- CVE-2026-49346 libde265 has a heap buffer overflow in de265_image_get_buffer via SPS dimension integer overflow
- CVE-2026-49345 Mercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF)
- CVE-2026-49344 Mercator has a Personal Identifiable Information Leak from Query Executor feature
- CVE-2026-49343 Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS
- CVE-2026-49342 YARD static cache reads raw traversal paths before router sanitization
- CVE-2026-49340 gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host
- CVE-2026-49339 gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists
- CVE-2026-49338 Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)
- CVE-2026-49337 libde265 has an unbounded memory leak via orphaned slice headers in `read_slice_NAL`
- CVE-2026-49336 @microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter
- CVE-2026-49332 Auth bypass in Red Hat OpenShift Container Platform 4.12
- CVE-2026-49331 Openshift/oauth-proxy: openshift/oauth-proxy: unauthenticated identity header injection on whitelisted paths
- CVE-2026-4933 Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-029
- CVE-2026-49329 Denial of service in Red Hat OpenShift Container Platform 4.14
- CVE-2026-49328 Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF
- CVE-2026-49326 Apache HBase: Missing scanner instance owner check in thrift delegation service
- CVE-2026-49325 Indian Scout Bobber 2025 WCM voltage-based shutdown
- CVE-2026-49324 Indian Scout Bobber 2025 WCM brute-force
- CVE-2026-49323 Indian Scout Bobber 2025 WCM-to-ECM weak authentication
- CVE-2026-49322 Indian Scout Bobber 2025 Infotainment-to-WCM weak authentication allows recovery of user PIN from observed exchange
- CVE-2026-4932 This Power System update is being released to address Insufficient Entropy
- CVE-2026-49319 Alps Electric Co., Ltd. R53R0 Remote Keyless Entry System (RKES) Replay Attack
- CVE-2026-49318 Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot
- CVE-2026-49317 Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot
- CVE-2026-49316 Indian Scout Bobber 2025 WCM CAN bus-off attack silently bypasses anti-theft shutdown
- CVE-2026-49315 Denial of service in EMUI
- CVE-2026-49314 Memory corruption in HarmonyOS
- CVE-2026-49313 Missing authorization in HarmonyOS
- CVE-2026-49312 Missing authorization in HarmonyOS
- CVE-2026-49311 Missing authorization in HarmonyOS
- CVE-2026-49310 Missing authorization in HarmonyOS
- CVE-2026-4931 CVE-2026-4931
- CVE-2026-49309 Missing authorization in EMUI
- CVE-2026-49308 Missing authorization in HarmonyOS
- CVE-2026-49307 Missing authorization in HarmonyOS
- CVE-2026-49306 Use after free in HarmonyOS
- CVE-2026-49305 Missing authorization in EMUI
- CVE-2026-49304 Missing authorization in HarmonyOS
- CVE-2026-49303 Missing authorization in EMUI
- CVE-2026-49302 Missing authorization in HarmonyOS
- CVE-2026-49301 Missing authorization in EMUI
- CVE-2026-4930 DPA Countermeasures weakening on Series 3 devices
- CVE-2026-49299 OpenStack Neutron has an Incorrect Authorization issue
- CVE-2026-49298 Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments
- CVE-2026-49297 Apache Airflow Google provider allows path traversal through GCS object names
- CVE-2026-49296 Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}
- CVE-2026-49295 libde265 has an out-of-bounds write in process_reference_picture_set via predicted short-term RPS
- CVE-2026-49294 Valhalla has reflected XSS via unsanitized JSONP callback parameter
- CVE-2026-49293 CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals
- CVE-2026-49292 Kiwi TCMS: The /init-db/ page renders and responds to requests after first use
- CVE-2026-49291 mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call
- CVE-2026-49290 Slopsmith has path traversal in archive extractors that allows arbitrary file write → potential RCE
- CVE-2026-4929 Simple Hierarchical Select (Drupal 7) XSS in term-derived output
- CVE-2026-49289 SimpleSAMLphp SAML2: Possible DoS via XPath Transform
- CVE-2026-49288 Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources
- CVE-2026-49287 Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction
- CVE-2026-49286 PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
- CVE-2026-49284 SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`
- CVE-2026-49283 SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass
- CVE-2026-49282 Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashes
- CVE-2026-49279 WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)
- CVE-2026-49278 Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor Impersonation
- CVE-2026-49277 Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivation
- CVE-2026-49276 Kirby: Self cross-site scripting (self-XSS) in the writer field
- CVE-2026-49274 Kirby: `pages.access` permission is not checked in the pages picker for parent pages
- CVE-2026-49271 libheif: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder
- CVE-2026-49270 Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Exposure of Sensitive Information Through Metadata vulnerability
- CVE-2026-4927 Information disclosure in Server
- CVE-2026-49269 Apple M1 GPUs retain register file data between compute shader dispatches from different processes.
- CVE-2026-49268 Apache Shiro: LDAP DN Injection in DefaultLdapRealm
- CVE-2026-49267 Apache Airflow: No certificate validation on SMTP STARTTLS connections
- CVE-2026-49265 OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison
- CVE-2026-49264 OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
- CVE-2026-49263 Capstone WASM `br_table` instruction-size truncation can cause no-progress disassembly and parser desynchronization
- CVE-2026-49262 Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy
- CVE-2026-49261 MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`
- CVE-2026-49260 php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)
- CVE-2026-4926 path-to-regexp vulnerable to Denial of Service via sequential optional groups
- CVE-2026-49258 Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)
- CVE-2026-49257 mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind
- CVE-2026-49256 Discourse: Hidden tag names leaked via category serializers
- CVE-2026-49255 electerm: Command Injection in File System Operations (rmrf, mv, cp)
- CVE-2026-49254 Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth
- CVE-2026-49253 electerm: Path Traversal in Zmodem and Trzsz Download Filename Handling