Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 611 of 1013.
- CVE-2026-46556 FlaskBB: SSRF in get_image_info() via unrestricted avatar URL
- CVE-2026-46555 WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration
- CVE-2026-46554 NocoDB: Stale Auth Cache After API Token Deletion
- CVE-2026-46553 NocoDB: Attachment Size Limit Bypass via Upload-by-URL
- CVE-2026-46552 NocoDB: Shared-base link access can invite arbitrary users as persistent base members
- CVE-2026-46551 NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion
- CVE-2026-46550 NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags
- CVE-2026-4655 Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor
- CVE-2026-46549 NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation
- CVE-2026-46548 NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)
- CVE-2026-46547 NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL
- CVE-2026-46546 Frappe LMS: HTML injection in user-controlled metadata
- CVE-2026-46545 nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item
- CVE-2026-46544 Missing authorization in UFO
- CVE-2026-46543 nimiq-blockchain: Genesis batch set request
- CVE-2026-46542 nimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve points
- CVE-2026-46541 Nimiq network-libp2p: DHT query poisoning via first-record verification failure
- CVE-2026-46540 Nimiq light-blockchain: Light blockchain rebranch issue
- CVE-2026-4654 Missing authorization in Awesome Support – WordPress HelpDesk & Support Plugin
- CVE-2026-46539 nimiq-primitives: BlockInclusionProof interlink issue when hops are empty
- CVE-2026-46538 Microsoft UFO accepts cross-device TASK_END messages by session_id only, allowing peer task-result injection
- CVE-2026-46532 ESF-IDF: Heap Out-of-Bounds Read in Bluedroid AVRCP Target Parser
- CVE-2026-46531 SQL injection in cacti
- CVE-2026-4653 Cross-site scripting in Block, Suspend, Report for BuddyPress
- CVE-2026-46529 PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen
- CVE-2026-46527 Null dereference in cpp-httplib
- CVE-2026-46526 Local Deep Research: SSRF bypass in `safe_get`
- CVE-2026-46523 ImageMagick: Use-After-Free in MSL decoder.
- CVE-2026-46522 ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion
- CVE-2026-46521 ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression
- CVE-2026-46520 ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions
- CVE-2026-4652 Remote denial of service via null pointer dereference
- CVE-2026-46519 MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement
- CVE-2026-46518 OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics
- CVE-2026-46517 LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out
- CVE-2026-46516 Frogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments)
- CVE-2026-46515 Frogman: Multiple read-tier tools expose admin-grade data and arbitrary GraphQL execution
- CVE-2026-46514 Frogman: Plaintext passwords and secrets persisted to audit log
- CVE-2026-46513 Frogman: API tokens stored in plaintext
- CVE-2026-46512 Frogman: Dialplan template parameters interpolated into extensions_custom.conf without escaping
- CVE-2026-46511 HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack
- CVE-2026-46510 Prototype pollution in form-data-objectizer via bracket-notation form keys
- CVE-2026-46509 deepobj: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- CVE-2026-46508 Turborepo: VSCode Extension command injection
- CVE-2026-4650 Missing authorization in FundPress – WordPress Donation Plugin
- CVE-2026-46498 OpenAM Arbitrary OAuth Token Minting via Push Registration
- CVE-2026-46497 SSRF via sitemap-derived URLs in Crawlee for Python
- CVE-2026-46496 HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft
- CVE-2026-46495 OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI
- CVE-2026-46493 haxtheweb/haxcms-php uses insecure method for generating salt
- CVE-2026-46492 md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)
- CVE-2026-46491 SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion
- CVE-2026-46490 samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions
- CVE-2026-4649 Auth bypass in Apache Artemis allows reading all internal messages
- CVE-2026-46489 SolidInvoice: Unrestricted file upload with no MIME validation allows stored XSS via malicious SVG logo
- CVE-2026-46488 motionEye: Authentication possible via password hash
- CVE-2026-46486 Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
- CVE-2026-46485 Dash: Users can write to config despire permissions (OIDC tested)
- CVE-2026-46484 Headplane: Path Traversal + RBAC Bypass in renameNode allows authenticated OIDC users to expire or rename any node/user
- CVE-2026-46483 Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag
- CVE-2026-46482 MyBB: Security Question insufficient validation
- CVE-2026-46481 OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users
- CVE-2026-46480 Flowise: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover
- CVE-2026-4648 Insufficient Encryption Level in CasfID Servicios Tecnológicos NFC Wristbands
- CVE-2026-46479 Flowise: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover
- CVE-2026-46478 Flowise: DatasetRow create+update mass-assignment allows cross-workspace row takeover
- CVE-2026-46477 Flowise: Dataset create+update mass-assignment allows cross-workspace dataset takeover
- CVE-2026-46476 Flowise: CustomTemplate create+update mass-assignment allows cross-workspace template takeover
- CVE-2026-46475 Flowise: Assistant create+update mass-assignment allows cross-workspace assistant takeover
- CVE-2026-46474 Trog::TOTP versions before 1.006 for Perl generate secrets using rand
- CVE-2026-46473 Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand
- CVE-2026-46472 An issue was discovered in GStreamer gst-plugins-good before 1.28.2.
- CVE-2026-46471 An issue was discovered in GStreamer gst-plugins-good before 1.28.2.
- CVE-2026-46470 Denial of service in Good Plug-ins
- CVE-2026-4647 Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library
- CVE-2026-46469 Denial of service in Good Plug-ins
- CVE-2026-46468 Path traversal in PowerProtect Data Domain
- CVE-2026-46467 Information disclosure in PowerProtect Data Domain
- CVE-2026-46466 Security feature bypass in PowerProtect Data Domain
- CVE-2026-46465 Memory corruption in PowerProtect Data Domain
- CVE-2026-46464 Path traversal in PowerProtect Data Domain
- CVE-2026-46463 Integer overflow in PowerProtect Data Domain
- CVE-2026-46461 Privilege escalation in Server Hardware Manager
- CVE-2026-46460 Missing authorization in PowerScale OneFS
- CVE-2026-4646 Insufficient input validation in GitHub plugin API causes denial of service
- CVE-2026-46459 Missing Authorization in ICU Scandinavia Boomerang
- CVE-2026-46458 Credential exposure in ICU Scandinavia Boomerang
- CVE-2026-46457 Apache Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers
- CVE-2026-46456 Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers
- CVE-2026-46455 Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted
- CVE-2026-46454 Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers
- CVE-2026-46453 Apache Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation
- CVE-2026-46452 Apache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failure
- CVE-2026-46449 Command injection in Guardicore Platform Agent
- CVE-2026-46448 OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints
- CVE-2026-46447 OpenStack Ironic allows Boot Script Injection
- CVE-2026-46446 SQL injection in SOGo
- CVE-2026-46445 SQL injection in SOGo
- CVE-2026-46444 Flowise: Vector Store No Permission Checks
- CVE-2026-46443 Flowise: Credential Data Leak