Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 600 of 1013.
- CVE-2026-47712 Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`
- CVE-2026-47709 libheif has a NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe
- CVE-2026-47708 MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper
- CVE-2026-47707 Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification
- CVE-2026-47706 Strawberry GraphQL has a Circular Fragment Reference DOS
- CVE-2026-47705 TypeBot vulnerable to CSV injection in result export
- CVE-2026-47704 Missing authorization in typebot.io
- CVE-2026-47703 AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle
- CVE-2026-47702 TypeBot API tokens stored in plaintext
- CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
- CVE-2026-4770 DOM-Based XSS in TR7's WAF-ASP
- CVE-2026-47699 Path traversal in guest-components
- CVE-2026-47698 vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
- CVE-2026-47697 Missing authorization in shelf.nu
- CVE-2026-47696 WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint
- CVE-2026-47695 CC-Tweaked has an SSRF Protection Bypass with NAT64
- CVE-2026-47694 WWBN AVideo: Stored XSS via unescaped Gallery category description
- CVE-2026-47693 Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications
- CVE-2026-47692 Other in envoy
- CVE-2026-47691 Netty has Insufficient Bailiwick Validation for NS Records
- CVE-2026-47690 MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow
- CVE-2026-4769 Unauthenticated Access to Internal Diagnostic Interface
- CVE-2026-47689 FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab
- CVE-2026-47688 Missing authorization in fogproject
- CVE-2026-47687 FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint
- CVE-2026-47686 vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE
- CVE-2026-47685 FOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management page
- CVE-2026-47684 Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP
- CVE-2026-47683 vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
- CVE-2026-47682 CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes
- CVE-2026-47680 Source controller: Improper path handling allows traversal
- CVE-2026-47679 GLPI: arbitrary file deletion
- CVE-2026-47676 Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
- CVE-2026-47675 Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection
- CVE-2026-47674 Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
- CVE-2026-47673 Hono: JWT middleware accepts any Authorization scheme, not only Bearer
- CVE-2026-47672 epa4all-client: Unauthenticated REST API for Patient Record Writes
- CVE-2026-47671 Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets
- CVE-2026-47670 DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection
- CVE-2026-4767 Improper Access Control in TR7's WAF-ASP
- CVE-2026-47669 DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE
- CVE-2026-47668 DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
- CVE-2026-47667 CImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze Header
- CVE-2026-47666 Penpot: Stored XSS via custom font family name injected into a @font-face style rule
- CVE-2026-47665 Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML
- CVE-2026-47664 Pathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoning
- CVE-2026-47663 Pathling: Typed CRUD/search/batch providers can lead to server-wide PHI exfiltration and cross-resource mutation
- CVE-2026-47662 Missing authorization in pathling
- CVE-2026-47661 Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read
- CVE-2026-47660 Pathling: Explicit oauthMetadataUrl in bulk-submit allows OAuth client credential exfiltration
- CVE-2026-4766 Easy Image Gallery <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Shortcode Post Meta
- CVE-2026-47659 Pathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename}
- CVE-2026-47657 HumHub Missing Authorization on Remove All Space Members Action
- CVE-2026-47656 Windows Boot Manager Security Feature Bypass Vulnerability
- CVE-2026-47655 Microsoft Graph Information Disclosure Vulnerability
- CVE-2026-47654 Remote Desktop Client Remote Code Execution Vulnerability
- CVE-2026-47653 Remote Desktop Client Remote Code Execution Vulnerability
- CVE-2026-47652 Windows Hyper-V Remote Code Execution Vulnerability
- CVE-2026-4765 Self Cross-Site Scripting (Self-XSS) in Tallos Chat by RD Station Conversas
- CVE-2026-47648 Windows Storage Elevation of Privilege Vulnerability
- CVE-2026-47647 Dynamics 365 Elevation of Privilege Vulnerability
- CVE-2026-47646 Dynamics 365 Customer Voice Spoofing Vulnerability
- CVE-2026-47645 Microsoft 365 Copilot's Business Chat Elevation of Privilege Vulnerability
- CVE-2026-47644 Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability
- CVE-2026-47643 Azure Stack Edge Remote Code Execution Vulnerability
- CVE-2026-47642 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-47641 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-47640 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-4764 Privilege Escalation in Dialogflow CX via Playbook Import
- CVE-2026-47639 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-47638 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-47637 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-47636 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-47635 Microsoft Outlook and Word Remote Code Execution Vulnerability
- CVE-2026-47634 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-47633 Microsoft Cost Management Information Disclosure Vulnerability
- CVE-2026-47632 Azure Connected Machine Agent Elevation of Privilege Vulnerability
- CVE-2026-47631 Microsoft Exchange Server Spoofing Vulnerability
- CVE-2026-47630 Path traversal in Triton Inference Server
- CVE-2026-47629 Denial of service in Triton Inference Server
- CVE-2026-47628 Denial of service in Triton Inference Server
- CVE-2026-47627 Path traversal in Triton Inference Server
- CVE-2026-47626 Memory corruption in DGX Spark
- CVE-2026-47625 Missing authorization in Triton Inference Server
- CVE-2026-47624 Security feature bypass in DGX Spark
- CVE-2026-47623 Deserialization in Dynamo
- CVE-2026-47622 Information disclosure in Dynamo
- CVE-2026-47621 Race condition in Dynamo
- CVE-2026-47620 Race condition in Dynamo
- CVE-2026-47619 Other in Dynamo
- CVE-2026-47618 Server-side request forgery in Dynamo
- CVE-2026-47617 Server-side request forgery in Dynamo
- CVE-2026-47616 Server-side request forgery in Dynamo
- CVE-2026-47615 Server-side request forgery in Dynamo
- CVE-2026-47614 Server-side request forgery in Dynamo
- CVE-2026-47613 Server-side request forgery in Dynamo
- CVE-2026-47612 Path traversal in Dynamo
- CVE-2026-4761 Unnecessary permissions on private keys of certificates installed by Network and Security Wizard
- CVE-2026-47606 Path traversal in Triton Inference Server
- CVE-2026-47604 Missing authorization in GeForce