Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 610 of 1013.
- CVE-2026-46687 Emlog Local File Inclusion (LFI)
- CVE-2026-46686 Emlog Reflected Cross-Site Scripting
- CVE-2026-46685 RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console
- CVE-2026-46684 DataEase: Unauthorized Command Execution Vulnerability
- CVE-2026-46683 Snappy: SSRF and local file read via the xsl-style-sheet option
- CVE-2026-46682 BigBlueButton: Blind SQL Injection AUTH (Moderator)
- CVE-2026-46681 @nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty
- CVE-2026-46680 containerd user ID handling bypass allows runAsNonRoot evasion
- CVE-2026-4668 Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter
- CVE-2026-46679 libp2p: Memory DoS via subscription flood of unique topics
- CVE-2026-46678 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)
- CVE-2026-46673 Russh: Unchecked CryptoVec allocation and growth handling is reachable
- CVE-2026-46672 Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper
- CVE-2026-46671 Rust OneNote File Parser: Path traversal in `Parser::parse_notebook` allows reading files outside the notebook directory
- CVE-2026-46670 YesWiki: Unauthenticated SQL Injection
- CVE-2026-4667 HP System Optimizer - Escalation of Privilege
- CVE-2026-46669 `openvm-pairing` pairing check missing proper subfield check on scaling factor
- CVE-2026-46668 SpiceDB: Caveat structures with nested lists can result in improper cache reuse
- CVE-2026-4666 Missing authorization in wpForo Forum
- CVE-2026-46657 Bludit's persistent authentication tokens not revoked upon account disablement
- CVE-2026-46656 Bludit CMS has improper authorization and mediation failure leading to persistent ghost sessions
- CVE-2026-46655 virtio-win: Integer overflow causing a heap overflow in Viosock driver
- CVE-2026-46654 Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss
- CVE-2026-46652 Path traversal in goobi-viewer-core
- CVE-2026-46651 Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer
- CVE-2026-46650 Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl
- CVE-2026-4665 WP Carousel Free <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute
- CVE-2026-46649 Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint
- CVE-2026-46645 SQLAdmin: Authorization Bypass on `ajax_lookup`
- CVE-2026-46644 symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
- CVE-2026-46643 Snappy: Binary path is never shell-escaped due to an inverted is_executable check
- CVE-2026-46642 draw.io: XSS via crafted cell label when opening a .drawio file
- CVE-2026-46640 Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
- CVE-2026-4664 Auth bypass in Customer Reviews for WooCommerce
- CVE-2026-46639 Twig: Sandbox property and method bypass via object-destructuring assignment
- CVE-2026-46638 Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
- CVE-2026-46637 Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
- CVE-2026-46636 Twig: Sandbox method allowlist bypass via `Markup` subclass
- CVE-2026-46635 Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
- CVE-2026-46634 Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
- CVE-2026-46633 Twig: PHP code injection via `{% use %}` template name
- CVE-2026-46629 Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments
- CVE-2026-46628 Twig: The `spaceless` filter implicitly marks its output as safe
- CVE-2026-46627 Twig: Sandbox resource exhaustion via unbounded `for` / `range()`
- CVE-2026-46625 JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
- CVE-2026-46624 Twenty: SQL Injection via the timeZone field
- CVE-2026-46623 OpenAM Account Takeover via Unverified Password Change in OAuth2 Module
- CVE-2026-46622 SolidInvoice: API tokens stored as plaintext in the database allowing full credential compromise on database breach
- CVE-2026-46621 Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection
- CVE-2026-46620 e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check()
- CVE-2026-4662 JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter
- CVE-2026-46619 OpenAM Authentication Bypass via MSISDN LDAP Injection
- CVE-2026-46618 Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables
- CVE-2026-46617 Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read
- CVE-2026-46616 Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers
- CVE-2026-46614 Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger
- CVE-2026-46612 Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives
- CVE-2026-46611 Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
- CVE-2026-4661 WP CTA <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection via 'fildname' Parameter
- CVE-2026-46609 Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog
- CVE-2026-46608 Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
- CVE-2026-46607 Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution
- CVE-2026-46606 Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
- CVE-2026-46605 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal
- CVE-2026-46604 Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image
- CVE-2026-46603 Excessive memory allocation during VP8L decoding in golang.org/x/image
- CVE-2026-46602 Lack of limit on tile sizes in x/image/tiff in golang.org/x/image
- CVE-2026-46601 Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image
- CVE-2026-46600 Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
- CVE-2026-4660 Go-getter may allow to arbitrary filesystem reads through git operations
- CVE-2026-46599 Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff
- CVE-2026-46598 Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent
- CVE-2026-46597 Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
- CVE-2026-46595 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
- CVE-2026-46594 Reflected XSS in PHP Poll Script
- CVE-2026-46593 Authenticated SQL Injection in PHP Poll Script
- CVE-2026-46592 Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation
- CVE-2026-46591 Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)
- CVE-2026-46590 Apache Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)
- CVE-2026-4659 Path traversal in Unlimited Elements For Elementor
- CVE-2026-46588 Apache Camel-CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input
- CVE-2026-46587 Apache Camel-Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input
- CVE-2026-46586 Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution
- CVE-2026-46585 Apache Camel-Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search query
- CVE-2026-46584 Apache Camel-Mail: The mail producer applied attacker-supplied mail.smtp.* / mail.smtps.* message headers as JavaMail session properties
- CVE-2026-46582 A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path
- CVE-2026-46581 Code injection in Eclipse Mojarra
- CVE-2026-46580 [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat
- CVE-2026-4658 Gutenberg Essential Blocks <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
- CVE-2026-46579 Auth bypass in Red Hat OpenShift Container Platform 4.12
- CVE-2026-46572 Memory corruption in tuxera:ntfs-3g
- CVE-2026-46571 Memory corruption in tuxera:ntfs-3g
- CVE-2026-46570 Memory corruption in tuxera:ntfs-3g
- CVE-2026-4657 Easy Google Fonts <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field
- CVE-2026-46569 Memory corruption in tuxera:ntfs-3g
- CVE-2026-46562 Yamcs: Remote Code Execution via Mission Database algorithm override
- CVE-2026-46561 pyLoad: SSRF via HTTP Redirect Bypass in parse_urls API
- CVE-2026-46559 ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder
- CVE-2026-46558 Missing authorization in plane
- CVE-2026-46557 ImageMagick: Stack overflow in fx operation