Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 590 of 1013.
- CVE-2026-48824 Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)
- CVE-2026-48823 Shaarli has Stored Cross-Site Scripting (XSS) via Tags Search
- CVE-2026-48822 Shaarli has Stored Cross-Site Scripting (XSS) via Markdown Reference Links
- CVE-2026-48821 Shaarli: DOM-based Cross-Site Scripting (XSS) in Thumbnail Synchronizer
- CVE-2026-48820 CakePHP: View::element() is missing a path containment check
- CVE-2026-4882 User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload
- CVE-2026-48819 Hey API: `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key
- CVE-2026-48818 Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
- CVE-2026-48817 Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
- CVE-2026-48816 sigstore-js: Insufficient Verification of Data Authenticity
- CVE-2026-48815 sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced
- CVE-2026-48814 Network-AI: Empty default secret still authorizes all requests (Incomplete fix for CVE-2026-46701)
- CVE-2026-48813 Flawfinder output manipulation via untrusted filenames and source text
- CVE-2026-48812 FreeScout Allows Unauthenticated Access to Legacy Attachment Files
- CVE-2026-48811 FreeScout: Thread Deletion Bypasses Mailbox Access Revocation
- CVE-2026-48810 FreeScout: Thread Edit Authorization Bypass via Missing Mailbox Check
- CVE-2026-4881 Missing authorization in Octopus Server
- CVE-2026-48809 python-engineio has possible denial of service due to maximum payload size sometimes not being enforced
- CVE-2026-48808 Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
- CVE-2026-48807 Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
- CVE-2026-48806 Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
- CVE-2026-48805 Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
- CVE-2026-48804 python-socketio: Binary attachment accumulation can cause denial of service
- CVE-2026-48802 python-engineio has unbound thread allocation that can cause denial of service
- CVE-2026-48801 linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop
- CVE-2026-48800 Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection
- CVE-2026-4880 Barcode Scanner (+Mobile App) <= 1.11.0 - Unauthenticated Privilege Escalation via Insecure Token Authentication
- CVE-2026-48799 Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook
- CVE-2026-48798 SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames
- CVE-2026-48797 Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
- CVE-2026-48796 CefSharp: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder
- CVE-2026-48795 Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser
- CVE-2026-48794 Authelia has an Edge Case Access Control Rule Mismatch
- CVE-2026-48793 Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path
- CVE-2026-48792 Auth bypass in pam usb
- CVE-2026-48791 Sigstore Java has a vulnerability with bundle verification of integratedTime
- CVE-2026-48790 turso-cli persists Turso platform JWT with world-readable (0o644) file permissions
- CVE-2026-4879 Missing Authorization in GitLab
- CVE-2026-48789 AnythingLLM: Windows path containment bypass in document folder route
- CVE-2026-48788 Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing
- CVE-2026-48787 gin-vue-admin vulnerable to RCE
- CVE-2026-48786 Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint
- CVE-2026-48785 Apptainer: Incorrect path matching for 'limit container paths' directive
- CVE-2026-48784 Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
- CVE-2026-48783 Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription
- CVE-2026-48782 pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)
- CVE-2026-48781 Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery
- CVE-2026-48780 Forem vulnerable to bypass of email address domain restrictions
- CVE-2026-4878 Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()
- CVE-2026-48779 ws: Memory exhaustion DoS from tiny fragments and data chunks
- CVE-2026-48778 Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter
- CVE-2026-48777 FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directory
- CVE-2026-48776 LangGraph SDK has unsafe URL path construction
- CVE-2026-48775 LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading
- CVE-2026-48774 ProxySQL MCP run_sql_readonly executes side-effecting MySQL multi-statements despite read-only contract
- CVE-2026-48773 ProxySQL pre-auth heap overflow in MySQL and PostgreSQL first-packet handling
- CVE-2026-48772 ProxySQL: PROXY-Protocol-v1 UNKNOWN parses spoofed source IP, bypassing mysql_query_rules.client_addr ACL
- CVE-2026-48771 ishankportfolio: Stored Contact Form Submission Exposure via Public Client-Side Database Configuration
- CVE-2026-48770 Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash
- CVE-2026-4877 itsourcecode Payroll Management System index.php cross site scripting
- CVE-2026-48769 Incus has an arbitrary file write on its client due to trusted image hash
- CVE-2026-48768 TypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileName
- CVE-2026-48767 Google Sheets OAuth access token disclosure to guest members via getAccessToken
- CVE-2026-48766 TypeBot vulnerable to OpenAI API key exfiltration in listModels via attacker-controlled baseUrl
- CVE-2026-48765 TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding
- CVE-2026-48764 TypeBot has SSRF in HTTP request and script fetch flows via DNS rebinding bypass
- CVE-2026-48763 TypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePath
- CVE-2026-48762 TypeBot Vulnerable to Server-Side Request Forgery (SSRF) in OpenAI Transcription Handler
- CVE-2026-48761 Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes
- CVE-2026-48760 Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
- CVE-2026-4876 itsourcecode Free Hotel Reservation System index.php sql injection
- CVE-2026-48759 TypeBot: Cross-Workspace Theme Template IDOR (Modification and Deletion)
- CVE-2026-48758 sigstore-js: DSSE payloadType type-binding failure
- CVE-2026-48756 Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)
- CVE-2026-48755 Incus has an argument injection in backup compression algorithm leading to AFW and ACE
- CVE-2026-48754 Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}
- CVE-2026-48753 Incus has an arbitrary file write via path traversal in S3 multipart upload
- CVE-2026-48752 Incus has arbitrary file read+write on host via templates/ symlink in malicious image
- CVE-2026-48751 Incus has a restricted project bypass leading to arbitrary command execution
- CVE-2026-48750 Incus has an arbitrary file write on host via `exec-output` symlink in crafted image
- CVE-2026-4875 itsourcecode Free Hotel Reservation System index.php unrestricted upload
- CVE-2026-48749 Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image
- CVE-2026-48748 Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion
- CVE-2026-48747 Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
- CVE-2026-48746 vLLM: OpenAI auth bypass
- CVE-2026-48745 Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetry
- CVE-2026-48744 Saleor: Anonymous users can modify channel settings via `channelUpdate` due to `all([])` bypass in permission check
- CVE-2026-48743 Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length
- CVE-2026-48741 libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS
- CVE-2026-4874 Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation
- CVE-2026-48737 pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs
- CVE-2026-48736 Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
- CVE-2026-48735 pypdf: Manipulated XMP metadata streams can exhaust RAM
- CVE-2026-48734 ImageMagick: Stack Overflow in MVG decoder
- CVE-2026-48733 ImageMagick: Infinite Loop in subimage-search with crafted image
- CVE-2026-48732 Warp: Remote SSH cwd can lead to unauthorized remote command execution
- CVE-2026-48731 Warp: Linux external editor command injection
- CVE-2026-4873 connection reuse ignores TLS requirement
- CVE-2026-48726 Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path
- CVE-2026-48725 Warp may allow terminal output to access the local clipboard through OSC 52