Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 596 of 1013.
- CVE-2026-48136 Authenticated Administrator Role-Based Access Control Bypass in Compliance
- CVE-2026-48135 HTTP service can incorrectly process malformed HTTP requests
- CVE-2026-48134 SQL injection issue in UserCheck Portal when DLP Software Blade is active
- CVE-2026-48133 Identity Awareness Captive Portal - Unauthenticated Local File Inclusion
- CVE-2026-48132 VPN service may restart unexpectedly when processing IKE traffic over NAT-T 4500/UDP
- CVE-2026-48131 VPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number Zero
- CVE-2026-4813 Code injection in the Lutece Core
- CVE-2026-48129 Kestra task inputFiles accepts traversal filenames for worker file writes
- CVE-2026-48128 Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step
- CVE-2026-48127 Frappe: Arbitrary Attachment Injection via add_attachments and upload_file
- CVE-2026-48126 Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir
- CVE-2026-48125 UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`
- CVE-2026-48124 Cursor Desktop sandbox escape via Claude hook configuration
- CVE-2026-48122 Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension
- CVE-2026-48121 @langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access
- CVE-2026-48120 Kakoune has a Critical RCE via Autorestore Backup Filename Injection
- CVE-2026-4812 Missing authorization in Advanced Custom Fields (ACF®)
- CVE-2026-48119 Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services
- CVE-2026-48117 DroneAware's Improper Account Activation in Registration and SSO Flows Leads to Account Takeover
- CVE-2026-48116 AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill
- CVE-2026-48115 Misskey: Improper Authorization in the Announcements API
- CVE-2026-48114 Metacat has an unauthenticated SQL injection vulnerability
- CVE-2026-48113 Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injection
- CVE-2026-48112 GHSL-2026-122 7-Zip Ar SYMDEF OOB Read
- CVE-2026-48111 GHSL-2026-121 7-Zip UEFI DEPEX OOB Read
- CVE-2026-48110 Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds
- CVE-2026-4811 Cross-site scripting in WPB Floating Menu or Categories – Sticky Floating Side Menu & Categories with Icons
- CVE-2026-48109 MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input
- CVE-2026-48108 Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input
- CVE-2026-48107 Russh: Unchecked keyboard-interactive prompt count in client auth path
- CVE-2026-48106 Auth bypass in arc
- CVE-2026-48105 Path traversal in arc
- CVE-2026-48104 GHSL-2026-120: 7-Zip SquashFS BlockToNode uninitialized heap read
- CVE-2026-48103 GHSL-2026-119 7-Zip WIM SecurityId OOB read
- CVE-2026-48102 GHSL-2026-118: 7-Zip UDF Field OOB Read
- CVE-2026-48101 GHSL-2026-117: 7-Zip UEFI Capsule uninitialized heap memory disclosure
- CVE-2026-48100 Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages
- CVE-2026-4810 Remote Code Execution in Google Agent Development Kit (ADK)
- CVE-2026-48099 WsgiDAV encoded dot segments can escape filesystem share roots
- CVE-2026-48098 NexTOR IP Changer Unsafely Uses sudo and shell=True
- CVE-2026-48097 NexTOR_IP_CHANGER has PATH Injection Leading to Arbitrary Command Execution
- CVE-2026-48096 OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning
- CVE-2026-48095 GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation
- CVE-2026-48094 ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output
- CVE-2026-48093 Code Embed - Contributor Stored Cross-Site Scripting via Remote URL Embed
- CVE-2026-48092 7-Zip SquashFS Fragment Offset Overflow (GHSL-2026-116)
- CVE-2026-48090 Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)
- CVE-2026-4809 Unsafe Client MIME Type Handling Can Enable Arbitrary File Upload in plank/laravel-mediable
- CVE-2026-48089 DevGuard has improper authorization on public assets
- CVE-2026-48088 OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory
- CVE-2026-48087 OpenReception: WebAuthn passkey injection allows account takeover
- CVE-2026-48086 OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN
- CVE-2026-48085 OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap
- CVE-2026-48084 OpenReception doesn't rate limit passphrase login attempts
- CVE-2026-48083 OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limits
- CVE-2026-48082 Security feature bypass in appointment-booking-software
- CVE-2026-48081 OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer
- CVE-2026-48080 Information disclosure in appointment-booking-software
- CVE-2026-4808 Gerador de Certificados – DevApps <= 1.3.6 - Authenticated (Administrator+) Arbitrary File Upload
- CVE-2026-48079 Auth bypass in appointment-booking-software
- CVE-2026-48078 OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers
- CVE-2026-48077 OpenReception: GET appointment by ID returns full appointment record without authorization
- CVE-2026-48076 OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels
- CVE-2026-48075 OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections
- CVE-2026-48074 OpenReception: Staff deletion removes pending invites cross-tenant by email match
- CVE-2026-48073 Docmost: Page export can include restricted same-space attachments through forged attachmentId
- CVE-2026-48072 Docmost: Public image fileName path traversal leads to unauthorized local file read
- CVE-2026-48071 OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout
- CVE-2026-48070 Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion
- CVE-2026-4807 Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion
- CVE-2026-48069 @grpc/grps-js: An incoming malformed compressed message can cause a client or server crash
- CVE-2026-48068 @grpc/grps-js: A malformed request can cause a server crash
- CVE-2026-48067 Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields
- CVE-2026-48066 pam_usb: Thread-unsafe static pointer in log.c causes data race under concurrent PAM authentication
- CVE-2026-48065 Integer overflow in pam usb
- CVE-2026-48064 pam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authentication bypass
- CVE-2026-48063 Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload
- CVE-2026-48062 CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule
- CVE-2026-48061 Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header
- CVE-2026-48060 Litestar: HTML Injection Through CSRF Token
- CVE-2026-4806 Missing authorization in Custom Thank You Page for WooCommerce
- CVE-2026-48059 Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion
- CVE-2026-48058 nebula-mesh: Session and OIDC state cookies lack the Secure attribute
- CVE-2026-48056 Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler
- CVE-2026-48055 Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction
- CVE-2026-48054 OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri
- CVE-2026-48053 Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset
- CVE-2026-48052 Papra: Cross-organization tag deletion and modification via authenticated cross-tenant request
- CVE-2026-48051 Papra: SSRF via HTTP redirect bypass in webhook delivery
- CVE-2026-48050 Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS
- CVE-2026-4805 Cross-site scripting in Woostify
- CVE-2026-48049 @hapi/inert: Static-file confinement bypass via sibling-prefix path
- CVE-2026-48048 XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests
- CVE-2026-48047 XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin
- CVE-2026-48046 Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler
- CVE-2026-48045 Zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood
- CVE-2026-48044 Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion
- CVE-2026-48043 netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion
- CVE-2026-48042 Envoy: Stack overflow in destructor of highly nested JSON
- CVE-2026-48040 netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access