Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 599 of 1013.
- CVE-2026-47847 Hardcoded credentials in bitnami/mariadb-galera
- CVE-2026-47846 Hardcoded credentials in bitnami/cassandra
- CVE-2026-47845 Reactor Netty HTTP Server may incorrectly evaluate proxy addresses
- CVE-2026-47844 Reactor Netty HTTP Server Leaks Exception Details
- CVE-2026-47843 Reactor Netty may incorrectly route traffic due to DNS resolver reuse
- CVE-2026-47842 Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation
- CVE-2026-47841 WebAuthn User Verification Bypass via Session Serialization
- CVE-2026-47840 LDAP StartTLS unconditionally disables hostname verification
- CVE-2026-4784 code-projects Simple Laundry System Parameter checkcheckout.php sql injection
- CVE-2026-47839 Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin
- CVE-2026-47838 Unauthorized User Impersonation when Using X.509 Client Certificates
- CVE-2026-47837 Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
- CVE-2026-47836 Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
- CVE-2026-47835 Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores
- CVE-2026-47834 Spring Data JPA Sort expression validation bypass
- CVE-2026-47833 Privilege escalation in bpm-release
- CVE-2026-47831 Cryptographically Weak Password Generation in bosh-windows-stemcell-builder Allows Remote SSH Brute-Force Attacks
- CVE-2026-47830 Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable Overwrite
- CVE-2026-4783 itsourcecode College Management System Parameter add-single-student-results.php sql injection
- CVE-2026-47829 Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director
- CVE-2026-47828 Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay
- CVE-2026-47827 CVE-2026-47827 – BOSH CLI Powershell Injection
- CVE-2026-47826 blobs.yaml Path Traversal Allows File Writes
- CVE-2026-47825 Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations
- CVE-2026-4782 Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
- CVE-2026-4781 SourceCodester Sales and Inventory System HTTP GET Parameter update_purchase.php sql injection
- CVE-2026-4780 SourceCodester Sales and Inventory System HTTP GET Parameter update_out_standing.php sql injection
- CVE-2026-47790 Privilege Escalation via QuFTP Log-based XSS
- CVE-2026-4779 SourceCodester Sales and Inventory System HTTP GET Parameter update_customer_details.php sql injection
- CVE-2026-47786 Pre-Authentication Command Injection
- CVE-2026-47784 Information disclosure in memcached
- CVE-2026-47783 Information disclosure in memcached
- CVE-2026-47782 Security feature bypass in Android App "RoboForm Password Manager"
- CVE-2026-47781 pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing
- CVE-2026-47780 free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence
- CVE-2026-4778 SourceCodester Sales and Inventory System HTTP GET Parameter update_category.php sql injection
- CVE-2026-47778 Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)
- CVE-2026-47777 Mastodon has a consent-check bypass in its remote Collections
- CVE-2026-47775 Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption
- CVE-2026-47774 Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification
- CVE-2026-47773 ArduinoBLE: Memory corruption via malformed ATT write request
- CVE-2026-47770 jq: stack overflow in deep structural equality
- CVE-2026-4777 SourceCodester Sales and Inventory System POST Parameter view_supplier.php sql injection
- CVE-2026-47769 APIFold Vulnerable to Unauthenticated Webhook Event Injection
- CVE-2026-47768 nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)
- CVE-2026-47767 SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
- CVE-2026-47766 crun follows rootfs /dev symlink while creating default devices
- CVE-2026-47765 Frappe: Lack of Permissions in restore/bulk_restore
- CVE-2026-47764 pdm: Path traversal in wheel installation via overridden write_to_fs
- CVE-2026-47763 pdm: Project-Local State and Config Writes Follow Symlinks
- CVE-2026-47762 TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
- CVE-2026-47761 TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
- CVE-2026-47760 TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
- CVE-2026-4776 Mautic has SQL Injection in API Contact Filtering
- CVE-2026-47759 TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
- CVE-2026-47755 ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal
- CVE-2026-47754 unauthenticated path traversal in Metacat 2.x
- CVE-2026-47753 Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)
- CVE-2026-47752 Tugtainer has Server-Side Template Injection in notification templates that leads to Remote Code Execution
- CVE-2026-47751 Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration
- CVE-2026-47750 stable-diffusion.cpp: Heap buffer overflow in GLOBAL opcode parsing for PyTorch checkpoint files
- CVE-2026-4775 Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing
- CVE-2026-47749 stable-diffusion.cpp: Heap buffer overflow in SHORT_BINUNICODE parsing for PyTorch checkpoint files
- CVE-2026-47748 stable-diffusion.cpp: Out-of-bounds reads in PyTorch checkpoint pickle opcode parsing
- CVE-2026-47747 stable-diffusion.cpp has a Heap-based Buffer Overflow
- CVE-2026-47746 Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks
- CVE-2026-47745 Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables
- CVE-2026-47744 Shopper: Authorization bypass and RBAC privilege escalation in team settings
- CVE-2026-47743 Shopper: Multiple data integrity and disclosure issues in admin Livewire components
- CVE-2026-47742 Shopper: Missing authorization on Product admin Livewire sub-form components
- CVE-2026-47741 Shopper: Race condition on Discount.usage_limit allows silent over-redemption
- CVE-2026-47740 Shopper: Authorization bypass in multiple Livewire admin components
- CVE-2026-47739 Frappe: Stored XSS in Note
- CVE-2026-47737 Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections
- CVE-2026-47736 Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
- CVE-2026-47735 Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks
- CVE-2026-47734 Dulwich has unbounded memory allocation in receive-pack from crafted thin packs
- CVE-2026-47733 Rocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in markdown images
- CVE-2026-47732 Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
- CVE-2026-47731 NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)
- CVE-2026-47730 Twig: XSS in profiler HtmlDumper via unescaped template and profile names
- CVE-2026-4773 OTP Bypass in Magarsus' IDM-MFA
- CVE-2026-47729 Squid: Memory disclosure in FTP gateway
- CVE-2026-47728 Bugsink: Project scoping missing in sourcemap and debug-file lookup
- CVE-2026-47727 Code injection in Trilium
- CVE-2026-47726 nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator
- CVE-2026-47725 nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints
- CVE-2026-47724 nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation
- CVE-2026-47723 nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)
- CVE-2026-47722 nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml
- CVE-2026-47721 FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions
- CVE-2026-47720 FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString
- CVE-2026-4772 Stored XSS in TR7's WAF-ASP
- CVE-2026-47719 FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
- CVE-2026-47718 FUXA provides guest and invalid-token access to protected read APIs in secure mode
- CVE-2026-47717 FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
- CVE-2026-47716 Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known
- CVE-2026-47715 Bugsink: Issue event views can show an event from another project if its UUID is known
- CVE-2026-47714 libheif has integer overflow in inline mask size calculation that causes undersized buffer allocation
- CVE-2026-47713 AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration