Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 605 of 1013.
- CVE-2026-47176 Quest Bot: Logging module can disclose private-channel message contents to a lower-visibility log channel
- CVE-2026-47175 Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings
- CVE-2026-47174 Duck Site: Untrusted pull request code can trigger privileged production deployment
- CVE-2026-47173 Quest Bot: Ticket reason allows mass-mention injection
- CVE-2026-47172 Quest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_run` deployment.
- CVE-2026-47171 Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`
- CVE-2026-47170 Garlic-Hub: SSRF vulnerability in uploadFromUrl endpoint
- CVE-2026-4717 Privilege escalation in the Netmonitor component
- CVE-2026-47169 Quest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accounts
- CVE-2026-47168 EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params
- CVE-2026-47167 Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex
- CVE-2026-47166 ImageMagick: Heap Buffer Over-Read in distributed pixel cache server
- CVE-2026-47165 ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model
- CVE-2026-47164 Vaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity
- CVE-2026-47163 Quest Bot: Unprivileged users can create and remove AutoMod rules.
- CVE-2026-47162 Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name
- CVE-2026-47161 RELATE Vulnerable to Remote Code Execution (RCE) via Insecure Celery Pickle Deserialization
- CVE-2026-47160 Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass
- CVE-2026-4716 Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component
- CVE-2026-47159 Auth bypass in vaultwarden
- CVE-2026-47158 Vaultwarden: CSRF in SSO Authorization Flow
- CVE-2026-47157 aiograpi: Unsafe signup challenge path handling
- CVE-2026-47156 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
- CVE-2026-47155 vLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processors
- CVE-2026-47154 Simple Metering GetProfileResponse interval-bounds bug in EmberZNet v9.0.2
- CVE-2026-47153 Level Control Step With On/Off divide-by-zero in EmberZNet v9.0.2
- CVE-2026-47152 Level Control Move divide-by-zero in EmberZNet v9.0.2
- CVE-2026-47151 Door Lock ClearWeekdaySchedule invalid table index and write in EmberZNet v9.0.2
- CVE-2026-47150 IAS Zone enroll invalid table index and write in EmberZNet 9.0.2
- CVE-2026-4715 Uninitialized memory in the Graphics: Canvas2D component
- CVE-2026-47149 Door Lock GetUserType invalid table index in EmberZNet v9.0.2
- CVE-2026-47148 Groups GetGroupMembership count/list-length mismatch in EmberZNet v9.0.2
- CVE-2026-47147 OTA server raw parser missing per-field bounds validation in EmberZNet v9.0.2
- CVE-2026-47146 Color Control color-temperature assertion abort in EmberZNet v9.0.2
- CVE-2026-47145 Color Control hue/saturation assertion abort in EmberZNet v9.0.2
- CVE-2026-47144 Shamefile has an arbitrary file read via shamefile.yaml in shame next
- CVE-2026-47143 Capstone has a NULL Pointer Dereference with 3DNow! opcodes
- CVE-2026-47141 vm2: NodeVM observability builtins leak host process and HTTP request data
- CVE-2026-47140 vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
- CVE-2026-4714 Incorrect boundary conditions in the Audio/Video component
- CVE-2026-47139 vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server
- CVE-2026-47138 Parse Server: Pre-authentication denial of service via client version header regex backtracking
- CVE-2026-47137 vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE
- CVE-2026-47136 RustFS: Unauthenticated RustFS console license endpoint exposes license metadata
- CVE-2026-47135 vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks
- CVE-2026-47134 Misconfiguration in clearancekit
- CVE-2026-47133 ClearanceKit's signed policy tables lack monotonic counter, allowing replay of older legitimately-signed snapshots
- CVE-2026-47132 phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration
- CVE-2026-47131 vm2: Sandbox Escape
- CVE-2026-47130 NextCRM has a BOLA/IDOR in PATCH /api/crm/contacts/[id] that allows Cross-Tenant CRM Data Tampering
- CVE-2026-4713 Incorrect boundary conditions in the Graphics component
- CVE-2026-47129 Missing authorization in nextcrm-app
- CVE-2026-47128 nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`
- CVE-2026-47127 Ghostfolio has a Stripe subscription bypass
- CVE-2026-47125 Arcane: Missing admin authorization on global variables endpoint
- CVE-2026-47124 Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members
- CVE-2026-47123 FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path
- CVE-2026-47122 Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection
- CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta
- CVE-2026-47120 Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)
- CVE-2026-4712 Information disclosure in the Widget: Cocoa component
- CVE-2026-47119 Agent Zero < 1.15 Stored XSS via image_get API Endpoint
- CVE-2026-47118 Agent Zero < 1.15 Path Traversal File Read via image_get API
- CVE-2026-47117 OpenMed < 1.5.2 Remote Code Execution via PII Model Loading
- CVE-2026-47116 LTSecurity LTK3500SF Hard-coded Credentials via Telnet/SSH
- CVE-2026-47114 IINA < 1.4.3 Command Execution via iina://open URL Scheme
- CVE-2026-47110 Tiptap for PHP < 2.1.1 DoS via Malformed href Attribute
- CVE-2026-4711 Use-after-free in the Widget: Cocoa component
- CVE-2026-47107 Windmill < 1.703.2 Incorrect Default Permissions in nsjail Configuration
- CVE-2026-47106 Ellucian Banner Self-Service Stored XSS via getFacultyMeetingTimes API
- CVE-2026-47104 libusb < 1.0.30 Out-of-Bounds Read in parse_iad_array()
- CVE-2026-47103 Python StateMachine 3.0.0 < 3.2.0 RCE via SCXML eval() Injection
- CVE-2026-47102 LiteLLM < 1.83.10 Privilege Escalation via User Update
- CVE-2026-47101 LiteLLM < 1.83.14 Privilege Escalation via API Key Generation
- CVE-2026-47100 Funnel Builder for WooCommerce Checkout < 3.15.0.3 Missing Authorization via AJAX
- CVE-2026-4710 Incorrect boundary conditions in the Audio/Video component
- CVE-2026-47099 TeleJSON < 6.0.0 DOM-based XSS via parse() Function
- CVE-2026-47097 AJA HELO Plus < 2.1.7 Hardcoded AES Passphrase for Diagnostics Export Bundle
- CVE-2026-47096 AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter
- CVE-2026-47094 SIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/{id}
- CVE-2026-47092 Claude HUD 0.0.12 Arbitrary Command Execution via COMSPEC Environment Variable
- CVE-2026-47091 Claude HUD 0.0.12 Path Traversal via transcript_path
- CVE-2026-47090 Claude HUD 0.0.12 Terminal Injection via OSC 8 Hyperlinks
- CVE-2026-4709 Incorrect boundary conditions in the Audio/Video: GMP component
- CVE-2026-47089 Missing authorization in Cyrus IMAP
- CVE-2026-47088 Memory corruption in Cyrus IMAP
- CVE-2026-47087 Auth bypass in Cyrus IMAP
- CVE-2026-47086 Missing authorization in Cyrus IMAP
- CVE-2026-47085 Weak cryptography in Cyrus IMAP
- CVE-2026-47084 Missing authorization in Cyrus IMAP
- CVE-2026-47083 Information disclosure in Cyrus IMAP
- CVE-2026-47082 Missing authorization in Cyrus IMAP
- CVE-2026-47081 Missing authorization in Cyrus IMAP
- CVE-2026-47080 CDATA Section Breakout via Unsanitised ]]> in xml_builder
- CVE-2026-4708 Incorrect boundary conditions in the Graphics component
- CVE-2026-47079 Round-trip Corruption via Improper Entity Escaping in xml_builder
- CVE-2026-47078 Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass
- CVE-2026-47077 Unbounded body accumulation in HTTP/3 response loop in hackney
- CVE-2026-47076 SSRF allowlist bypass via percent-encoded host in hackney
- CVE-2026-47075 CR/LF injection in query parameter in hackney