Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 592 of 1013.
- CVE-2026-48557 Spatie Laravel Media Library < 11.23.0 File Upload Restriction Bypass via FileAdder.php
- CVE-2026-48555 Spatie Laravel Media Library < 11.23.0 SSRF via addMediaFromUrl()
- CVE-2026-48554 Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution
- CVE-2026-48553 Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection
- CVE-2026-48552 Nagios Core / XI DOM-based XSS via jsonquery.js
- CVE-2026-48551 Nagios Core / XI CSRF Protection Bypass via Double-Submit Cookie
- CVE-2026-48550 Nagios Core / XI cmd.cgi Reflected XSS via NagFormId Parameter
- CVE-2026-48549 Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie
- CVE-2026-48548 Nagios Core CSRF via cmd.cgi
- CVE-2026-48547 KanaDojo < 0.1.18 Command Injection via patchNotesData.json in release.yml
- CVE-2026-48546 KanaDojo < 0.1.18 Sandbox Escape RCE via messages.cjs
- CVE-2026-48545 Gradio < 6.15.0 Cookie Injection via Shared Proxy Client
- CVE-2026-48544 Taipy 4.1.1 Path Traversal via ElementLibrary.get_resource()
- CVE-2026-48543 Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description
- CVE-2026-48542 Krayin CRM 2.2.6 Stored Template Injection XSS via Product Name Field
- CVE-2026-48541 Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field
- CVE-2026-48540 Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title
- CVE-2026-48539 GFI Archiver < 15.14 Stored XSS via MailInsights.aspx
- CVE-2026-48538 GFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashx
- CVE-2026-48537 GFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspx
- CVE-2026-48536 GFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspx
- CVE-2026-48535 GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx
- CVE-2026-48534 GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx
- CVE-2026-48532 GFI Archiver < 15.13 Stored XSS via FAARetentionPolicyWizard.aspx
- CVE-2026-48531 GFI Archiver < 15.13 Stored XSS via RetentionPolicyWizard.aspx
- CVE-2026-48530 GFI Archiver < 15.14 Stored XSS via CategorizationPolicyWizard.aspx
- CVE-2026-4853 Path traversal in JetBackup – Backup, Restore & Migrate
- CVE-2026-48529 GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion
- CVE-2026-48528 Metacat has an unauthenticated SQL injection vulnerability
- CVE-2026-48527 HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint
- CVE-2026-48526 PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
- CVE-2026-48525 PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS
- CVE-2026-48524 PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
- CVE-2026-48523 PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys
- CVE-2026-48522 PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes
- CVE-2026-48521 Null dereference in envoy
- CVE-2026-48520 Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read
- CVE-2026-4852 Cross-site scripting in Image Source Control Lite – Show Image Credits and Captions
- CVE-2026-48519 Langflow: Unauthenticated RCE in Shareable Playgrounds
- CVE-2026-48518 MultiJuicer: Login CSRF allows attacker to force victims into their team
- CVE-2026-48517 MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments
- CVE-2026-48516 MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings
- CVE-2026-48515 MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions
- CVE-2026-48514 MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length
- CVE-2026-48513 MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement
- CVE-2026-48512 MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement
- CVE-2026-48511 MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps
- CVE-2026-48510 MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths
- CVE-2026-4851 GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization
- CVE-2026-48509 MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies
- CVE-2026-48508 Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission
- CVE-2026-48507 Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users
- CVE-2026-48506 MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth
- CVE-2026-48505 Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
- CVE-2026-48504 OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagation
- CVE-2026-48503 Information disclosure in libiec61850
- CVE-2026-48502 MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows
- CVE-2026-48501 GitHub CLI tokens leak via `gh attestation` commands
- CVE-2026-48500 Filament: Unauthenticated temporary file upload on auth pages
- CVE-2026-4850 code-projects Simple Laundry System Parameter checkregisitem.php sql injection
- CVE-2026-48499 Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache
- CVE-2026-48497 Envoy: Abnormal process termination in DNS UDP filter
- CVE-2026-48496 opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent
- CVE-2026-48495 TypeBot Google Sheets OAuth callback can create credentials in unauthorized workspaces and modify arbitrary typebots
- CVE-2026-48494 TypeBot vulnerable to cross-typebot WhatsApp preview webhook resume via global `wa-preview-{phone}` session ids
- CVE-2026-48493 Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment
- CVE-2026-48492 Snipe-IT's selectlist visibility is too permissive
- CVE-2026-48491 Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass
- CVE-2026-48490 ArduinoCore-AVR: Stack-Based Buffer Overflow in String float/double concatenation handler
- CVE-2026-4849 code-projects Simple Laundry System Parameter modify.php cross site scripting
- CVE-2026-48489 Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
- CVE-2026-48488 phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing
- CVE-2026-48487 Zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet
- CVE-2026-48486 Signum Node: Integer overflow in SMART_FEES fee distribution allows arbitrary miner reward inflation
- CVE-2026-48485 Quest Bot: Stored warn reasons can still trigger bot-powered mass mentions through `/warns`.
- CVE-2026-48484 pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination
- CVE-2026-48483 TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server
- CVE-2026-48482 GLPI: RCE via Form import
- CVE-2026-48480 OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation
- CVE-2026-4848 dameng100 muucmf list.html cross site scripting
- CVE-2026-4847 dameng100 muucmf list.html cross site scripting
- CVE-2026-4846 dameng100 muucmf autoReply.html cross site scripting
- CVE-2026-4845 dameng100 muucmf index.html cross site scripting
- CVE-2026-48449 Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
- CVE-2026-48448 SQL injection in Adobe Campaign Classic
- CVE-2026-48447 Lightroom Classic | Incorrect Authorization (CWE-863)
- CVE-2026-48446 CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- CVE-2026-48445 CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-48444 CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-48443 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-48442 CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- CVE-2026-48441 Lightroom Classic | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- CVE-2026-48440 ColdFusion | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-4844 code-projects Online Food Ordering System Admin Login admin.php sql injection
- CVE-2026-48439 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-48438 CAI Content Credentials | NULL Pointer Dereference (CWE-476)
- CVE-2026-48437 CAI Content Credentials | Improper Certificate Validation (CWE-295)
- CVE-2026-48436 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-48435 CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)
- CVE-2026-48434 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)