Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 604 of 1013.
- CVE-2026-47273 pam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queries
- CVE-2026-47272 pam_usb: OTP pad authentication bypass via missing system pad check and uninitialized RNG buffer
- CVE-2026-47271 pam_usb: OOM guards removed by -DNDEBUG cause NULL dereference and authentication process crash
- CVE-2026-47270 pam_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny_remote result
- CVE-2026-4727 Denial-of-service in the Libraries component in NSS
- CVE-2026-47269 pam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as local
- CVE-2026-47268 Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host
- CVE-2026-47267 Gogs: SSRF in webhook deliveries
- CVE-2026-47266 Formie: Unauthenticated front-end submission editing can overwrite existing submissions
- CVE-2026-47265 AIOHTTP vulnerable to cross-origin redirect with per-request cookies
- CVE-2026-47264 Discourse: Don't leak restricted tag group names via tag info
- CVE-2026-47263 Discourse: Prevent webhook payload disclosure on event redelivery
- CVE-2026-47262 containerd image-triggered runtime DoS via unbounded group parsing
- CVE-2026-47261 Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
- CVE-2026-47260 Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs
- CVE-2026-4726 Denial-of-service in the XML component
- CVE-2026-47256 opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token
- CVE-2026-47255 AgenticMail API/storage and outbound relay hardening
- CVE-2026-47254 libheif Has Heap Buffer Overflow in `Track::get_next_sample_raw_data()` -- OOB Chunk Vector Access
- CVE-2026-47253 Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion
- CVE-2026-47252 Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS plugins (Brave, Chrome, Edge, Reminders, Safari)
- CVE-2026-47251 libheif has an incomplete fix for CVE-2026-3949: integer overflow bypass in vvdec_push_data2
- CVE-2026-47250 mcp-server-kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration
- CVE-2026-4725 Sandbox escape due to use-after-free in the Graphics: Canvas2D component
- CVE-2026-47249 Klever-Go KVM: Hash-array amplification in P2P resolver request handling
- CVE-2026-47248 Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers
- CVE-2026-47247 libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation
- CVE-2026-47245 MyBB: Buddy list corruption
- CVE-2026-47244 Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced
- CVE-2026-47243 Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs
- CVE-2026-47242 Net::IMAP: Command Injection via ID command argument
- CVE-2026-47241 Net::IMAP: Denial of Service via incomplete raw argument validation
- CVE-2026-47240 Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument
- CVE-2026-4724 Undefined behavior in the Audio/Video component
- CVE-2026-47238 ClipBucket: IDOR in videos subtitle editor
- CVE-2026-47237 Kubeflow Community Distribution: Overly Permissive Istio Permissions Allows Kubeflow Authorization Token Stealing
- CVE-2026-47236 Missing authorization in solidtime
- CVE-2026-47235 SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in SimulationCraft's gem_id Array
- CVE-2026-47234 Admidio writes session IDs and auto-login cookie values to application logs
- CVE-2026-47233 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024
- CVE-2026-47232 Admidio PKCS#12 private key export action lacks CSRF protection
- CVE-2026-47231 Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders
- CVE-2026-47230 Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders
- CVE-2026-4723 Use-after-free in the JavaScript Engine component
- CVE-2026-47229 Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation
- CVE-2026-47228 Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords
- CVE-2026-47227 Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`
- CVE-2026-47226 Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges
- CVE-2026-47225 Improper Search Cache Isolation for Scoped Search API Keys in Typesense
- CVE-2026-47224 NanaZip: Heap buffer-overflow read in NanaZip LVM metadata CRC check
- CVE-2026-47223 NanaZip: Heap out-of-bounds read in NanaZip AVB hashtree descriptor parser via 32-bit unsigned integer overflow
- CVE-2026-47222 NanaZip: Heap out-of-bounds read in NanaZip AVB property descriptor parser via unsigned integer underflow
- CVE-2026-47221 Envoy: Null pointer deref in internal redirects
- CVE-2026-47220 Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format
- CVE-2026-4722 Privilege escalation in the IPC component
- CVE-2026-47219 find-my-way is Vulnerable to DDoS with HTTP2
- CVE-2026-47218 runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox
- CVE-2026-47216 Typesense: Unauthenticated Denial of Service in the Typesense /multi_search Endpoint
- CVE-2026-47215 Singularity: Incorrect path matching for 'limit container paths' directive
- CVE-2026-47214 Docling: Unsafe URI and Path Handling in HTML Backend
- CVE-2026-47213 BoxLite: Timeout Bypass Vulnerability
- CVE-2026-47212 Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification
- CVE-2026-47211 Ouroboros: Remote Code Execution via Untrusted Project-Directory .env
- CVE-2026-47210 vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass
- CVE-2026-4721 Memory corruption in Firefox
- CVE-2026-47209 vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
- CVE-2026-47208 vm2: Sandbox Breakout Using Promise Species
- CVE-2026-47207 Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message
- CVE-2026-47206 Dragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer
- CVE-2026-47205 Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides
- CVE-2026-47204 Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes
- CVE-2026-47203 Authelia Missing Username Canonicalization in Basic Auth (LDAP)
- CVE-2026-47202 Kavita: Pre-Auth Account Takeover
- CVE-2026-47201 authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user
- CVE-2026-47200 Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`
- CVE-2026-4720 Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
- CVE-2026-47199 Frappe: check_safe_sql_query Permits SELECT INTO OUTFILE
- CVE-2026-47198 Paymenter: URL parameter injection bypasses paid plan limits at checkout
- CVE-2026-47197 Quest Bot: Discord moderation role hierarchy bypass in ban, kick, mute, unmute, warn, and nickname commands
- CVE-2026-47196 Quest Bot: Empty automod rule causes every guild message to be deleted
- CVE-2026-47195 Quest Bot: Per-channel permission overwrite bypass in purge and slowmode commands.
- CVE-2026-47194 Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain
- CVE-2026-47193 OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks
- CVE-2026-47192 kas's late signature validation may allow unnoticed repository manipulations
- CVE-2026-47191 kas checks out SHA-like git branches as valid commits
- CVE-2026-47190 IPAM controller service account granted unnecessary full access to Secrets
- CVE-2026-4719 Incorrect boundary conditions in the Graphics: Text component
- CVE-2026-47189 Quest Bot: AutoMod removal can delete rules from another guild by global rule ID
- CVE-2026-47188 Quest Bot: Unban and unwarn reason fields still allow bot-powered mass mentions.
- CVE-2026-47187 SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write
- CVE-2026-47185 Frappe Has Broken Access Control in its Workspace Save API
- CVE-2026-47184 Zeroconf: Unbounded DNS record cache allows LAN-local memory exhaustion via multicast flood
- CVE-2026-47183 zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion
- CVE-2026-47182 Frappe: Broken Access Control on Private Files
- CVE-2026-47181 PenguinMod-BackendApi: NoSQL Injection in Password Reset Endpoint Allows Account Takeover
- CVE-2026-47180 Zeroconf: Unbounded recursion in DNS compression-pointer decoder allows LAN-local denial of service
- CVE-2026-4718 Undefined behavior in the WebRTC: Signaling component
- CVE-2026-47179 Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane
- CVE-2026-47178 libheif has Heap Out Of Bounds Write in unci subsystem
- CVE-2026-47177 Quest Bot: Ticket transcripts can disclose private ticket contents to a lower-visibility channel