Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 602 of 1013.
- CVE-2026-47510 Integer overflow in GeForce
- CVE-2026-4751 NULL Pointer Dereference in tmate-io tmate
- CVE-2026-47509 Memory corruption in GeForce
- CVE-2026-47508 Integer overflow in GeForce
- CVE-2026-47507 Memory corruption in GeForce
- CVE-2026-47506 Denial of service in GeForce
- CVE-2026-47505 Use after free in GeForce
- CVE-2026-47504 Memory corruption in GeForce
- CVE-2026-47503 Memory corruption in Virtual GPU Manager
- CVE-2026-47502 Integer overflow in GeForce
- CVE-2026-47501 Memory corruption in GeForce
- CVE-2026-47500 Use after free in GeForce
- CVE-2026-4750 Out-of-bounds Read in fabiangreffrath woof
- CVE-2026-47499 Memory corruption in Virtual GPU Manager
- CVE-2026-47498 Memory corruption in Virtual GPU Manager
- CVE-2026-47497 Race condition in Virtual GPU Manager
- CVE-2026-47496 Memory corruption in Virtual GPU Manager
- CVE-2026-47495 Memory corruption in Virtual GPU Manager
- CVE-2026-47494 Memory corruption in GeForce
- CVE-2026-47493 Missing authorization in Virtual GPU Manager
- CVE-2026-47492 Missing authorization in GeForce
- CVE-2026-47491 Use after free in GeForce
- CVE-2026-4749 NVD-CWE-noinfo in albfan miraclecast
- CVE-2026-47489 Privilege escalation in GeForce
- CVE-2026-47487 Path traversal in Triton Inference Server
- CVE-2026-47486 Memory corruption in PhysX
- CVE-2026-47483 Denial of service in DCGM
- CVE-2026-47482 Denial of service in Triton Inference Server
- CVE-2026-47481 Auth bypass in Triton Inference Server
- CVE-2026-47480 Denial of service in Triton Inference Server
- CVE-2026-4748 pf silently ignores certain rules
- CVE-2026-47479 Denial of service in Triton Inference Server
- CVE-2026-47478 Other in Triton Inference Server
- CVE-2026-47477 Memory corruption in Triton Inference Server
- CVE-2026-47476 Denial of service in Triton Inference Server
- CVE-2026-47475 Denial of service in TensorRT-LLM
- CVE-2026-47473 Memory corruption in TensorRT-LLM
- CVE-2026-47472 Deserialization in TensorRT-LLM
- CVE-2026-47471 Memory corruption in TensorRT-LLM
- CVE-2026-47470 Denial of service in TensorRT-LLM
- CVE-2026-4747 Remote code execution via RPCSEC_GSS packet validation
- CVE-2026-4746 Heap Buffer Over-Write Vulenrabilty in timeplus-io/proton
- CVE-2026-4745 Arbitrary Code Execution via Crafted Bytecode in dendibakh/perf-ninja
- CVE-2026-4744 Memory corruption in Notepad3
- CVE-2026-47430 Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.
- CVE-2026-4743 Null-Pointer Dereference Vulnerability in taurusxin/ncmdump
- CVE-2026-47429 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening
- CVE-2026-47428 Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
- CVE-2026-47427 GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler
- CVE-2026-47426 OpenAM OAuth Client Impersonation via JWKS Resolver Cache
- CVE-2026-47425 Rattler vulnerable to entry-point path traversal in noarch:python install (arbitrary file write)
- CVE-2026-47424 OpenAM Authenticated RCE via Groovy Sandbox Escape
- CVE-2026-47423 DOMPurify XSS via `selectedcontent` re-clone
- CVE-2026-47422 Frappe: Unrestricted API access to save_report
- CVE-2026-4742 HTTP Request Smuggling in visualfc/liteide
- CVE-2026-47419 praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR
- CVE-2026-47418 praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR
- CVE-2026-47417 praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR
- CVE-2026-47416 praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id}
- CVE-2026-47415 praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR
- CVE-2026-47414 praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)
- CVE-2026-47413 praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members
- CVE-2026-47412 praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}
- CVE-2026-47411 praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}
- CVE-2026-47410 praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset
- CVE-2026-4741 Path Traversal Vulnerability in TeamJCD/JoyConDroid
- CVE-2026-47409 praisonai-platform: Missing authorization on member removal enables full workspace takeover by any user regardless of role
- CVE-2026-47408 praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership
- CVE-2026-47407 PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation
- CVE-2026-47406 praisonai-platform: IDOR in dependency endpoints allows cross-workspace issue linking, reading, and deletion due to missing ownership checks
- CVE-2026-47405 PraisonAI Platform missing role checks let any workspace member become owner and take over workspace membership
- CVE-2026-4740 Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation
- CVE-2026-47399 PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID
- CVE-2026-47398 Code injection in PraisonAI
- CVE-2026-47397 PraisonAI has an Arbitrary File Write in Python API
- CVE-2026-47396 PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset
- CVE-2026-47395 PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
- CVE-2026-47394 PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate
- CVE-2026-47393 PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default
- CVE-2026-47392 PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)
- CVE-2026-47391 PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
- CVE-2026-47390 PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
- CVE-2026-4739 Integer overflow vulnerabilities in InsightSoftwareConsortium/ITK
- CVE-2026-47389 Mastodon: SSRF protection bypass on older Ruby versions
- CVE-2026-47388 NocoDB: Missing Ownership Check in MCP Attachment Read
- CVE-2026-47387 NocoDB: Stored Cross-Site Scripting via Form View Redirect URL
- CVE-2026-47386 NocoDB: OAuth Authorization Code Race Condition
- CVE-2026-47385 NocoDB: Path Traversal via SQLite Source Filename
- CVE-2026-47384 NocoDB: SQL Injection via Column Title in Bulk GroupBy
- CVE-2026-47383 NocoDB: Stored Cross-Site Scripting via Row Comments
- CVE-2026-47382 NocoDB: Server-Side Request Forgery via Database Connection Host
- CVE-2026-47381 NocoDB: Cross-Workspace Integration Use in Connection Test
- CVE-2026-47380 NocoDB: User Enumeration via Sign-In Timing
- CVE-2026-4738 Memory corruption in gdal
- CVE-2026-47379 NocoDB: Plaintext Password Comparison in Shared Views
- CVE-2026-47378 NocoDB: Hidden Column Exposure in Public Shared View Endpoints
- CVE-2026-47377 NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin
- CVE-2026-47376 NocoDB: Reflected Cross-Site Scripting via Password Reset Token
- CVE-2026-47375 NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`
- CVE-2026-47373 Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks