Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 591 of 1013.
- CVE-2026-48724 ImageMagick: Heap Buffer Underwrite in Floyd-Steinberg depth dithering
- CVE-2026-48723 Command injection in browserstack-cypress-cli
- CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command
- CVE-2026-48721 Warp: Env-var prefixes can lead to denylisted command autoexecution
- CVE-2026-48720 Warp: SSH remote output can lead to local file overwrite and persistence
- CVE-2026-48719 Warp branch selector command injection via Git branch names
- CVE-2026-48717 OpenAM OAuth Authorization Bypass via PKCE Challenge
- CVE-2026-48716 nanobot: Path traversal via unsanitized WhatsApp document fileName enables arbitrary file write
- CVE-2026-48715 radvdump's Route Information Option Parser has a Stack Buffer Overflow
- CVE-2026-48714 i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names
- CVE-2026-48713 i18next-fs-backend: Prototype pollution via crafted missing-key string
- CVE-2026-48712 protobufjs: Denial of service through unbounded Any expansion during JSON conversion
- CVE-2026-48711 SSHFS: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
- CVE-2026-48710 Kludex Starlette HTTP Request/Response Smuggling
- CVE-2026-4871 Sports Club Management <= 1.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' Attribute
- CVE-2026-48709 OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration
- CVE-2026-48708 OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination
- CVE-2026-48707 InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning
- CVE-2026-48706 Envoy Heap Buffer Overflow in TcpStatsdSink
- CVE-2026-48704 Warp Markdown notebook links may open executable local files
- CVE-2026-48703 Warp: Command Injection via Warp code search tool arguments
- CVE-2026-48702 Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic
- CVE-2026-48700 Code injection in PCManFM-Qt
- CVE-2026-4870 Denial of service in Qiskit SDK
- CVE-2026-48697 Security feature bypass in pavel-odintsov:fastnetmon
- CVE-2026-48696 Memory corruption in pavel-odintsov:fastnetmon
- CVE-2026-48695 Command injection in pavel-odintsov:fastnetmon
- CVE-2026-48694 Command injection in pavel-odintsov:fastnetmon
- CVE-2026-48693 Other in pavel-odintsov:fastnetmon
- CVE-2026-48692 Missing authorization in pavel-odintsov:fastnetmon
- CVE-2026-48691 Integer overflow in pavel-odintsov:fastnetmon
- CVE-2026-48690 Integer overflow in pavel-odintsov:fastnetmon
- CVE-2026-4869 Potential Privilege Escalation in InstallShield
- CVE-2026-48689 Memory corruption in pavel-odintsov:fastnetmon
- CVE-2026-48688 Memory corruption in pavel-odintsov:fastnetmon
- CVE-2026-48687 Command injection in pavel-odintsov:fastnetmon
- CVE-2026-48686 Memory corruption in pavel-odintsov:fastnetmon
- CVE-2026-48685 Memory corruption in pavel-odintsov:fastnetmon
- CVE-2026-48684 Memory corruption in pavel-odintsov:fastnetmon
- CVE-2026-48683 FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read vulnerability in the NetFlow v9 data flowset processor.
- CVE-2026-48682 FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the IPv4 packet parser.
- CVE-2026-48681 OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image
- CVE-2026-4868 Authorization Bypass Through User-Controlled Key in GitLab
- CVE-2026-4867 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
- CVE-2026-4862 UTT HiPER 1250GW Parameter formConfigDnsFilterGlobal strcpy buffer overflow
- CVE-2026-48619 Denial of service in node
- CVE-2026-48618 Security feature bypass in node
- CVE-2026-48617 Security feature bypass in node
- CVE-2026-48616 Missing authorization in Rocket.Chat
- CVE-2026-48615 Information disclosure in node
- CVE-2026-48614 Privilege escalation in Plesk
- CVE-2026-48613 SQL injection in phpBB
- CVE-2026-48612 Auth bypass in phpBB
- CVE-2026-48611 Auth bypass in phpBB
- CVE-2026-48610 Missing authorization in EFG
- CVE-2026-4861 Wavlink WL-NU516U1 nas.cgi ftext stack-based overflow
- CVE-2026-4860 648540858 wvp-GB28181-pro API Endpoint RedisTemplateConfig.java GenericFastJsonRedisSerializer deserialization
- CVE-2026-48599 Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding
- CVE-2026-48598 CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection
- CVE-2026-48597 Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mint
- CVE-2026-48596 CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection
- CVE-2026-48595 Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects
- CVE-2026-48594 Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression
- CVE-2026-48593 Unbounded range expansion in cron describe causes memory exhaustion in oban_web
- CVE-2026-48592 Missing authorization check on save-job event handler in oban_web
- CVE-2026-48591 Stored XSS via unescaped HTML attribute values in earmark
- CVE-2026-48590 Element and Attribute Names Injected Verbatim into XML Output in xml_builder
- CVE-2026-4859 SP Blog Designer <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'design' Attribute
- CVE-2026-48589 Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow
- CVE-2026-48588 Potential exposure of private data via cached Set-Cookie response
- CVE-2026-48587 Potential exposure of private data via whitespace padding in Vary header
- CVE-2026-48586 Denial of service in Apache Thrift
- CVE-2026-48584 Microsoft Azure Synapse Elevation of Privilege Vulnerability
- CVE-2026-48583 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-48582 Microsoft Exchange Online Elevation of Privilege Vulnerability
- CVE-2026-48581 Surface Broker SDMA Elevation of Privilege Vulnerability
- CVE-2026-48580 Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-4858 Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.
- CVE-2026-48579 Microsoft Exchange Online Information Disclosure Vulnerability
- CVE-2026-48578 Secure Boot Security Feature Bypass Vulnerability
- CVE-2026-48576 Secure Boot Security Feature Bypass Vulnerability
- CVE-2026-48575 Secure Boot Security Feature Bypass Vulnerability
- CVE-2026-48574 Windows Media Remote Code Execution Vulnerability
- CVE-2026-48573 Secure Boot Security Feature Bypass Vulnerability
- CVE-2026-48572 Windows App Package Installer Elevation of Privilege Vulnerability
- CVE-2026-48571 Windows App Package Installer Elevation of Privilege Vulnerability
- CVE-2026-48570 Secure Boot Security Feature Bypass Vulnerability
- CVE-2026-4857 SailPoint IdentityIQ Debug UI Incorrect Authorization
- CVE-2026-48569 Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-48568 Secure Boot Security Feature Bypass Vulnerability
- CVE-2026-48567 Azure HorizonDB Elevation of Privilege Vulnerability
- CVE-2026-48566 Windows DWM Core Library Information Disclosure Vulnerability
- CVE-2026-48565 Windows Narrator Braille Elevation of Privilege Vulnerability
- CVE-2026-48564 DHCP Server Service Remote Code Execution Vulnerability
- CVE-2026-48563 Remote Desktop Client Remote Code Execution Vulnerability
- CVE-2026-48562 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-48561 Microsoft Edge Copilot Remote Code Execution Vulnerability
- CVE-2026-48560 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-48559 Lightweight Music Server 3.76.0 Stored XSS via Media File Metadata Tags
- CVE-2026-48558 SimpleHelp Authentication Bypass