Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 586 of 1013.
- CVE-2026-49252 deepstream is vulnerable to prototype pollution
- CVE-2026-49250 Conform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields
- CVE-2026-4925 Missing authorization in Server
- CVE-2026-49249 Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2
- CVE-2026-49248 Path traversal in onedev
- CVE-2026-49247 Jellyfin: Potential Authenticated path traversal in /ClientLog/Document
- CVE-2026-49246 Jellyfin: Potential MKV attachment filename path traversal to RCE
- CVE-2026-49245 SFTPGo: Stored XSS via inline parameter on public shares and user file download
- CVE-2026-49244 SFTPGo: Path confinement bypass in public browsable share partial ZIP download
- CVE-2026-49243 Webmin: Reflected XSS in the Configuration module
- CVE-2026-49241 Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension
- CVE-2026-4924 Auth bypass in Server
- CVE-2026-49238 SFTP Server VM Escape in Canonical Multipass
- CVE-2026-49237 Local Privilege Escalation in Canonical Multipass
- CVE-2026-49235 Routinator crashes on specifically crafted RRDP XML files
- CVE-2026-49234 Routinator crashes on specifically crafted ASN strings in the API
- CVE-2026-49233 Routinator cache path traversal using rogue rsync URIs
- CVE-2026-49232 Routinator exits when accepting an incoming HTTP or RTR connection fails
- CVE-2026-49231 Apache APISIX: Identity spoofing issue in APISIX opa plugin
- CVE-2026-49230 Apache APISIX: Authentication bypass in jwe-decrypt
- CVE-2026-4923 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards
- CVE-2026-49229 Actual: Disabled OpenID users keep access through existing session tokens
- CVE-2026-49228 Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products
- CVE-2026-49227 Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts
- CVE-2026-49226 Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts
- CVE-2026-49225 Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions
- CVE-2026-49224 Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions
- CVE-2026-49223 Missing authorization in Vvveb
- CVE-2026-49222 Missing authorization in Vvveb
- CVE-2026-49221 Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets
- CVE-2026-49220 Jellyfin: Potential XSS in user management
- CVE-2026-4922 Cross-Site Request Forgery (CSRF) in GitLab
- CVE-2026-49219 ImageMagick: Policy Bypass can read disallowed files
- CVE-2026-49218 ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions
- CVE-2026-49217 Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions
- CVE-2026-49216 Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data
- CVE-2026-49215 Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted
- CVE-2026-49214 guzzlehttp/psr7 has CRLF Injection via URI Host Component
- CVE-2026-49213 TypeBot: SSRF protection bypass via IPv6 unspecified address in Typebot HTTP request execution
- CVE-2026-49212 Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding
- CVE-2026-49211 Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
- CVE-2026-49210 Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag
- CVE-2026-4921 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-49209 Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests
- CVE-2026-49208 Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor
- CVE-2026-49206 rapidcsv: Integer overflow in iterator arithmetic causes out-of-bounds access
- CVE-2026-49205 phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)
- CVE-2026-49204 Hard-coded AWS Cognito Testing Accounts
- CVE-2026-49203 Unauthenticated eSIM Configuration Manipulation
- CVE-2026-49202 Unverified Meeting Recording Endpoints & Permissive CORS
- CVE-2026-49201 Acer Wave 7 router: Hardcoded Cryptographic Key
- CVE-2026-49200 Acer Wave 7 router: Broken Access Control
- CVE-2026-4920 Next Date <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute
- CVE-2026-49199 Predator Connect W6x: RCE via MQTT
- CVE-2026-49198 Predator Connect W6x: MQTT Broker Access Control
- CVE-2026-49197 Predator Connect W6x: Improper Authentication
- CVE-2026-49196 Predator Connect W6x: Web Interface Command Injection
- CVE-2026-49195 Predator Connect W6x: unauthenticated Debug Service
- CVE-2026-49194 SCREEN_CLICK Authentication Bypass
- CVE-2026-49193 Publicly Readable AWS S3 Telemetry Buckets
- CVE-2026-49192 Summary Service Insecure Direct Object Reference
- CVE-2026-49191 Exposed Hard-coded M3WebServer Backend API Key
- CVE-2026-49190 Missing Per-Instruction Authorization Checks
- CVE-2026-4919 IBM Guardium Data Protection is affected by multiple vulnerabilities
- CVE-2026-49189 Broadcast Receiver Privilege Escalation
- CVE-2026-49188 Elevated Root Command Execution via ai_cmd Sockets
- CVE-2026-49187 Hard-coded APK Resource Credentials & Scepters
- CVE-2026-49186 Lack of MQTT Broker Topic Access Control Lists
- CVE-2026-49185 Instruction Injection via FieldX MDM
- CVE-2026-49184 Windows NTFS Remote Code Execution Vulnerability
- CVE-2026-49183 Windows Clipboard Server Elevation of Privilege Vulnerability
- CVE-2026-49181 Windows DHCP Client Elevation of Privilege Vulnerability
- CVE-2026-49180 Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability
- CVE-2026-4918 IBM Guardium Data Protection is affected by multiple vulnerabilities
- CVE-2026-49179 Windows Active Directory Domain Services Remote Code Execution Vulnerability
- CVE-2026-49178 Windows Active Directory Domain Services Remote Code Execution Vulnerability
- CVE-2026-49177 Windows TCP/IP Information Disclosure Vulnerability
- CVE-2026-49176 Windows WalletService Elevation of Privilege Vulnerability
- CVE-2026-49175 Windows DNS Client Elevation of Privilege Vulnerability
- CVE-2026-49174 DNS Client Tampering Vulnerability
- CVE-2026-49173 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-49172 Windows FTP Service Remote Code Execution Vulnerability
- CVE-2026-49171 Windows Speech Runtime Elevation of Privilege Vulnerability
- CVE-2026-49170 Windows StateRepository API Server file Elevation of Privilege Vulnerability
- CVE-2026-4917 IBM Guardium Data Protection is affected by multiple vulnerabilities
- CVE-2026-49169 Windows DNS Server Remote Code Execution Vulnerability
- CVE-2026-49168 Storage Spaces Direct Elevation of Privilege Vulnerability
- CVE-2026-49167 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-49166 Windows Print Configuration Elevation of Privilege Vulnerability
- CVE-2026-49165 Microsoft Windows App Store Information Disclosure Vulnerability
- CVE-2026-49164 Windows Active Directory Domain Services Remote Code Execution Vulnerability
- CVE-2026-49163 Application Insights Profiler Elevation of Privilege Vulnerability
- CVE-2026-49162 Microsoft Brokering File System Elevation of Privilege Vulnerability
- CVE-2026-49161 Microsoft PC Manager Security Feature Bypass Vulnerability
- CVE-2026-49160 HTTP.sys Denial of Service Vulnerability
- CVE-2026-4916 Missing Authorization in GitLab
- CVE-2026-49159 Microsoft Graph Information Disclosure Vulnerability
- CVE-2026-49158 Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb
- CVE-2026-49157 Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default
- CVE-2026-4915 Server panic via outgoing webhook responses