Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 612 of 1013.
- CVE-2026-46442 Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape
- CVE-2026-46441 Flowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource Reassignment
- CVE-2026-46440 Flowise: Basic Auth Credentials Exposed via API
- CVE-2026-4644 Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover
- CVE-2026-46439 compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
- CVE-2026-46438 wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry
- CVE-2026-46437 wger: API credentials remain valid after logout/password change
- CVE-2026-46434 wger: Trainer Privilege Escalation - Improper Privilege Management
- CVE-2026-46433 lldpd: Heap OOB Read in VLAN Decapsulation memmove
- CVE-2026-46432 LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization
- CVE-2026-46431 Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *
- CVE-2026-46430 Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS
- CVE-2026-4643 Calling window.close() from server-side content causes crash in the Mattermost Desktop App
- CVE-2026-46428 lettre has TLS hostname verification disabled when using Boring TLS backend
- CVE-2026-46427 Budibase: Snowflake private key returned unmasked from datasource API to BASIC users
- CVE-2026-46426 Budibase: Unrestricted Upload of File with Dangerous Type
- CVE-2026-46425 Budibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant users
- CVE-2026-46424 Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour
- CVE-2026-46423 Rocket.Chat: SAML signature validation skipped when IdP certificate field is empty
- CVE-2026-46421 Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)
- CVE-2026-46420 setup-php: Command Injection in Repository-Derived PHP Version Resolution
- CVE-2026-46419 Auth bypass in webauthn-server-core
- CVE-2026-46417 Angular: SSRF via Hostname Hijacking in @angular/platform-server
- CVE-2026-46416 Microsoft UFO shared WebSocket handler state causes cross-client response hijacking
- CVE-2026-46415 Caddy Defender trusted proxy client IP bypass
- CVE-2026-46414 Microsoft UFO WebSocket role spoofing allows authenticated peer task hijacking
- CVE-2026-46413 Discourse: Regular users can route multipart uploads into the admin backup store
- CVE-2026-46412 Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm
- CVE-2026-46411 FlashMQ: Client can trigger uncaught exception on FlashMQ 1.26.1 and older
- CVE-2026-46410 FileBrowser Quantum: unauthenticated user share share info
- CVE-2026-46409 OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution
- CVE-2026-46408 Vvveb: checkout IDOR allows unauthorized reuse of another user's cart
- CVE-2026-46407 Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens
- CVE-2026-46406 Claude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write
- CVE-2026-46405 OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens
- CVE-2026-46404 BigBlueButton: Presentation URL Security Hardening
- CVE-2026-46403 Klever-Go KVM read-only execution can commit contract delete and upgrade side effects
- CVE-2026-46402 Path traversal in UFO
- CVE-2026-46401 HAX CMS PHP has Insufficient Session Expiration
- CVE-2026-46400 HAXCMS PHP has a File Upload Validation Bypass
- CVE-2026-4640 Galaxy Software Services｜Vitals ESP - Missing Authentication
- CVE-2026-46399 Authenticated Remote Code Execution via File Overwrite
- CVE-2026-46398 HAX CMS Missing Secure Flag on Cookie
- CVE-2026-46397 haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0
- CVE-2026-46396 HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover
- CVE-2026-46395 HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation
- CVE-2026-46394 HAX CMS Vulnerable to Command Injection using Git.php
- CVE-2026-46393 HAXcms createSite SSRF Enables Arbitrary File Read
- CVE-2026-46392 HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation
- CVE-2026-46391 HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis
- CVE-2026-46390 HAX CMS has Unauthenticated Git Access via User-Controlled Key
- CVE-2026-4639 Galaxy Software Services｜Vitals ESP - Incorrect Authorization
- CVE-2026-46389 UDS Identity Config has a client authentication bypass in `ClientIdAndKubernetesSecretAuthenticator`
- CVE-2026-46388 osquery: Unprivileged users can temporarily read file carve contents
- CVE-2026-46387 Suricata http2: decompression bomb can cause denial of service in Suricata
- CVE-2026-46386 Hardcoded credentials in openproject
- CVE-2026-46385 iskorotkov/avro: CPU Exhaustion in Avro Decoder
- CVE-2026-46384 iskorotkov/avro: Integer Overflow in Avro Decoder
- CVE-2026-46383 Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`
- CVE-2026-46382 Meeting Room Booking System has server-side request forgery in import functionality
- CVE-2026-46380 compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem
- CVE-2026-4638 Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network Monitor
- CVE-2026-46378 Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal
- CVE-2026-46377 Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string
- CVE-2026-46376 FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface
- CVE-2026-46374 SQLFluff: Uncontrolled Resource Consumption in Parser
- CVE-2026-46373 SQLFluff: Recursive Stack Overflow in Parser
- CVE-2026-46372 SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl
- CVE-2026-46371 Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint
- CVE-2026-46370 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint
- CVE-2026-4637 Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor
- CVE-2026-46369 Nimiq: Validity store off by one error
- CVE-2026-46368 luci-app-https-dns-proxy Authenticated Command Injection via setInitAction
- CVE-2026-46367 phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering
- CVE-2026-46366 phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass
- CVE-2026-46365 phpMyFAQ - Missing Authorization in Tag Deletion Endpoint
- CVE-2026-46364 phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha
- CVE-2026-46363 phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass
- CVE-2026-46362 phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check
- CVE-2026-46361 phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig
- CVE-2026-46360 phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer
- CVE-2026-4636 Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.
- CVE-2026-46359 phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields
- CVE-2026-46358 OpenBao's Inline Auth Incorrectly Redacted Headers
- CVE-2026-46357 HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request
- CVE-2026-46356 Fleet: IP spoofing allows bypassing API rate limiting
- CVE-2026-46355 BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser
- CVE-2026-46354 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft
- CVE-2026-46353 BigBlueButton API checksum bypass via presentationUploadExternalUrl
- CVE-2026-46352 Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlock
- CVE-2026-46351 BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them
- CVE-2026-4635 Persistent notification timing attack causing server denial of service
- CVE-2026-46349 Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring
- CVE-2026-46348 Mastodon: SSRF Bypass via IPv6 Unspecified Address (::)
- CVE-2026-46347 Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset
- CVE-2026-46346 Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset
- CVE-2026-46345 compliance-trestle - jinja has an Arbitrary File Write via Path Traversal
- CVE-2026-46344 liboqs: Heap-buffer-overflow in XMSS verification path via OID-controlled parameter mismatch (xmss_commons.c:194)
- CVE-2026-46343 Wazuh: Arbitrary File Deletion via Cluster Protocol – Incomplete Path Validation in end_receiving_file()
- CVE-2026-46342 Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning