Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 619 of 1013.
- CVE-2026-45779 Open XDMoD Vulnerable to Unauthenticated SQL Injection Leading to Full Database Compromise
- CVE-2026-45778 Open XDMoD Vulnerable to Reflected Cross-Site Scripting (XSS) in Password Reset
- CVE-2026-45777 Open XDMoD Vulnerable to Unauthenticated Remote Code Execution (RCE) via OS Command Injection
- CVE-2026-45776 Open XDMoD has Broken Access Control via Client-Controlled Session Variable
- CVE-2026-45775 Discourse: Cross-site backup access via path traversal in multisite local backups
- CVE-2026-45774 compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal
- CVE-2026-45773 Turborepo: Login callback CSRF/session fixation
- CVE-2026-45772 Turborepo: Unexpected local code execution during Yarn Berry detection
- CVE-2026-45771 Freeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion
- CVE-2026-45770 Suricata lua: excessive flow variable registration can bypass sandbox
- CVE-2026-4577 code-projects Exam Form Submission update_s4.php cross site scripting
- CVE-2026-45769 ikev2: unbounded client transform storage can lead to resource exhaustion
- CVE-2026-45768 Suricata ldap: unbounded responses per transaction can lead to resource exhaustion
- CVE-2026-45767 Suricata datasets: save to absolute filename can be bypassed when combined with load command
- CVE-2026-45766 Suricata nfs: unbounded stateful structures can lead to resource exhaustion
- CVE-2026-45765 Suricata dnp3: unbounded reassembly can lead to resource exhaustion
- CVE-2026-45764 Suricata http2: protocol-change type confusion can lead to denial of service
- CVE-2026-45763 Suricata lua: sandbox allocation limit not enforced for new allocations
- CVE-2026-45762 Suricata defrag: missing address-family check can lead to remote crash
- CVE-2026-45761 Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rule load
- CVE-2026-45760 Apache Camel K: Camel K Cross-Namespace Build Deputy Attack
- CVE-2026-4576 code-projects Exam Form Submission update_s5.php cross site scripting
- CVE-2026-45759 Suricata http1: quadratic Content-Disposition processing can lead to denial of service
- CVE-2026-45758 Malicious code in guardrails-ai 0.10.1 (supply chain compromise)
- CVE-2026-45757 Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokens
- CVE-2026-45756 Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS
- CVE-2026-45755 Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection
- CVE-2026-45754 Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
- CVE-2026-45753 Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS)
- CVE-2026-45752 Suricata detect/transform: use-after-free in decompress transforms
- CVE-2026-45751 Suricata detect/transform: use-after-free in dotprefix transform
- CVE-2026-45750 Termix Vulnerable to Arbitrary Command Execution in File Manager
- CVE-2026-4575 code-projects Exam Form Submission update_s2.php cross site scripting
- CVE-2026-45749 Termix's TOTP two-factor authentication can be disabled or bypassed using only the account password
- CVE-2026-45748 Termix Vulnerable to Remote Code Execution via SSH Tunnel Forward Command Injection
- CVE-2026-45747 Suricata lua/tls: null dereference in TlsGetCertInfo
- CVE-2026-45746 Termix Vulnerable to Arbitrary Command Execution via Session Hijacking
- CVE-2026-45745 Termix has improper certificate validation in Electron desktop client that enables MITM credential/token theft
- CVE-2026-45744 Termix has an OS Command Injection in File Manager resolvePath endpoint
- CVE-2026-45743 Termix has a File-Manager Session Hijack via Missing Ownership Check (IDOR)
- CVE-2026-45742 Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
- CVE-2026-45741 Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes
- CVE-2026-45740 protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion
- CVE-2026-4574 SourceCodester Simple E-learning System User Profile Update sql injection
- CVE-2026-45739 Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs
- CVE-2026-45738 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
- CVE-2026-45737 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
- CVE-2026-45736 ws: Uninitialized memory disclosure
- CVE-2026-45734 MyBB: Default CAPTCHA missing invalidation
- CVE-2026-45733 Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app
- CVE-2026-45732 n8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints
- CVE-2026-45731 WWBN AVideo: Authenticated Arbitrary File Read in view/update.php
- CVE-2026-45730 Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project
- CVE-2026-4573 SourceCodester Simple E-learning System HTTP GET Parameter delete_post.php sql injection
- CVE-2026-45729 ThorVG: Null pointer dereference in SVG loader causes crash via 6-byte malformed input
- CVE-2026-45728 Algernon: Single-file mode unconditionally enables debug mode
- CVE-2026-45727 CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion
- CVE-2026-45726 Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService
- CVE-2026-45725 compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal
- CVE-2026-45723 Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic
- CVE-2026-45722 Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views
- CVE-2026-45721 Algernon: handler.lua discovery walks parent directories above the server root
- CVE-2026-45720 Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token
- CVE-2026-4572 SourceCodester Sales and Inventory System HTTP POST Request view_product.php sql injection
- CVE-2026-45719 Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API
- CVE-2026-45718 Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows
- CVE-2026-45717 Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL
- CVE-2026-45716 Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration
- CVE-2026-45715 Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration
- CVE-2026-45714 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
- CVE-2026-45713 Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes
- CVE-2026-45712 Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)
- CVE-2026-45711 Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs
- CVE-2026-4571 SourceCodester Sales and Inventory System HTTP POST Request view_payments.php sql injection
- CVE-2026-45709 Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer
- CVE-2026-45708 CubeCart: Authenticated RCE via Invoice Template → Order Print
- CVE-2026-45707 n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete
- CVE-2026-45705 OpenSIPS: OOB Read in Multipart Body Boundary Parsing
- CVE-2026-45704 Pimcore: CustomReports Share Bypass
- CVE-2026-45703 Pimcore: WordExport Authorization Bypass for Unauthorized Document Export
- CVE-2026-45702 OP-TEE has FF-A type confusion in SPMC tmem path that causes S-EL1 kernel panic
- CVE-2026-45701 Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens
- CVE-2026-45700 Heap-buffer-overflow write in planar bitmap decoder
- CVE-2026-4570 SourceCodester Sales and Inventory System HTTP POST Request view_customers.php sql injection
- CVE-2026-45699 Netatalk has Integer Underflow → Stack Buffer Overflow in copydir()
- CVE-2026-45698 Netatalk has Integer Underflow → Stack Buffer Overflow in deletedir()
- CVE-2026-45697 Formie: Pre-authenticated server-side template injection in Hidden fields
- CVE-2026-45696 OpenEXR HTJ2K decoder heap buffer over-read in ht_undo_impl() (DoS)
- CVE-2026-45695 Kopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is used
- CVE-2026-45694 LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters
- CVE-2026-45692 Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
- CVE-2026-45691 Nextcloud: Bypass of second factor authentication on DAV endpoints
- CVE-2026-45690 Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay
- CVE-2026-4569 SourceCodester Sales and Inventory System HTTP POST Request view_category.php sql injection
- CVE-2026-45689 Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO
- CVE-2026-45688 Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijack
- CVE-2026-45687 Rocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMessage
- CVE-2026-45686 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI
- CVE-2026-45685 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages
- CVE-2026-45684 OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers