Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 597 of 1013.
- CVE-2026-4804 Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API
- CVE-2026-48039 Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token
- CVE-2026-48038 joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas
- CVE-2026-48037 Hulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture
- CVE-2026-48036 Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
- CVE-2026-48035 Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakened
- CVE-2026-48034 HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
- CVE-2026-48033 Hulumi: Policy packs bypassed by a forged Pulumi-URN logical name
- CVE-2026-48032 Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers
- CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery
- CVE-2026-48030 Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)
- CVE-2026-4803 Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor
- CVE-2026-48029 libheif: heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow
- CVE-2026-48028 Mastodon: Removal of integrity-protected JSON entries from signed activities
- CVE-2026-48027 Nx Console Embedded Malicious Code
- CVE-2026-48026 lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML
- CVE-2026-48025 nebula-mesh: Decrypted CA private key persists in heap after signing
- CVE-2026-48024 Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager
- CVE-2026-48022 @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects
- CVE-2026-48021 Weak cryptography in epa4all
- CVE-2026-48020 Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
- CVE-2026-4802 Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui
- CVE-2026-48019 CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
- CVE-2026-48017 DbGate: Remote Code Execution via functionName injection in loadReader endpoint
- CVE-2026-48016 Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment
- CVE-2026-48015 Shopware: Stored XSS via SVG file upload — no SVG sanitization
- CVE-2026-48014 Shopware: Admin API ACL Bypass in Order State Transition Endpoints
- CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
- CVE-2026-48012 Shopware SSO referer trust leading to an arbitrary redirect target
- CVE-2026-48011 Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames
- CVE-2026-48010 Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts
- CVE-2026-4801 Cross-site scripting in Page Builder Gutenberg Blocks – CoBlocks
- CVE-2026-48009 Shopware: Admin Account Takeover via User Recovery Hash Exposure
- CVE-2026-48008 Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass
- CVE-2026-48007 Element Call reports full URLs of visited pages to analytics server
- CVE-2026-48006 Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator
- CVE-2026-48005 Apache HTTP Server: mod_auth_digest reauthentication attack
- CVE-2026-48001 Adobe Commerce | Information Exposure (CWE-200)
- CVE-2026-48000 Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
- CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names
- CVE-2026-47999 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47998 Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-47997 Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-47996 Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-47995 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47994 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47993 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-47992 Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
- CVE-2026-47991 Adobe Experience Manager | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
- CVE-2026-47990 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-4799 Open redirect vulnerability in Search Guard Kibana Plugin via manipulated requests
- CVE-2026-47989 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-47988 Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-47987 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-47986 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-47985 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-47984 Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-47983 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-47982 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-47981 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47980 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-4798 Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter
- CVE-2026-47979 Media Encoder | Out-of-bounds Read (CWE-125)
- CVE-2026-47978 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47977 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47976 Media Encoder | Out-of-bounds Write (CWE-787)
- CVE-2026-47975 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47974 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47973 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47972 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47971 Media Encoder | Stack-based Buffer Overflow (CWE-121)
- CVE-2026-47970 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47969 Audition | Out-of-bounds Read (CWE-125)
- CVE-2026-47968 Audition | Out-of-bounds Write (CWE-787)
- CVE-2026-47967 Audition | Out-of-bounds Write (CWE-787)
- CVE-2026-47966 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47965 Acrobat Reader | Out-of-bounds Write (CWE-787)
- CVE-2026-47964 DNG SDK | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-47963 DNG SDK | Out-of-bounds Read (CWE-125)
- CVE-2026-47962 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47961 Acrobat Reader | Out-of-bounds Read (CWE-125)
- CVE-2026-47960 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- CVE-2026-47959 Acrobat Reader | Stack-based Buffer Overflow (CWE-121)
- CVE-2026-47958 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47957 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47956 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47955 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-47954 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47953 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47952 Acrobat Reader | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-47951 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47950 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-4795 Missing authorization in GS1200-10v3 firmware
- CVE-2026-47949 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47948 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47947 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-47946 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-47945 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47944 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-47943 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)