Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 621 of 1013.
- CVE-2026-45585 Windows BitLocker Security Feature Bypass Vulnerability
- CVE-2026-45584 Microsoft Defender Remote Code Execution Vulnerability
- CVE-2026-45583 Microsoft Exchange Server Remote Code Execution Vulnerability
- CVE-2026-45582 n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters
- CVE-2026-45581 fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode
- CVE-2026-45580 WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute
- CVE-2026-4558 Linksys MR9600 SmartConnect.lua smartConnectConfigure os command injection
- CVE-2026-45579 DIRAC: RCE in RequestManager due to eval on untrusted input
- CVE-2026-45578 WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
- CVE-2026-45577 Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass
- CVE-2026-45576 zrok copy writes attacker-controlled WebDAV paths outside the destination root
- CVE-2026-45575 epa4all-client: Improper Verification of Cryptographic Signature
- CVE-2026-45574 epa4all-client: TLS Certificate Validation Disabled in Production
- CVE-2026-45573 Decidim: Push subscriptions can be abused for server-side requests
- CVE-2026-45572 Decidim: HTML content blocks allow stored script execution
- CVE-2026-45571 go-git: Crafted repositories may modify main and submodule .git directories
- CVE-2026-45570 go-git: Improper single-quote escaping in go-git SSH transport
- CVE-2026-4557 code-projects Exam Form Submission update_s1.php cross site scripting
- CVE-2026-45569 Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug)
- CVE-2026-45568 zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths
- CVE-2026-45567 Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpt
- CVE-2026-45566 Roxy-WI: Open redirect on /login?next= via basic-auth userinfo syntax bypass
- CVE-2026-45565 Path traversal in roxy-wi
- CVE-2026-45564 Roxy-WI: Authenticated RCE via 'configver' URL parameter (os.system sink in /config/versions/.../save)
- CVE-2026-45563 Roxy-WI: IDOR — any authenticated user can read another user's full action history
- CVE-2026-45562 FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module
- CVE-2026-45561 Roxy-WI: SSRF in /smon/agent/<endpoint>/<server_ip> reachable to cloud metadata IPs
- CVE-2026-45560 Roxy-WI: Stored XSS in log viewer (wrap_line/highlight_word produce unescaped HTML)
- CVE-2026-4556 macOS Exam4 Local Privilege Escalation via Command Injection
- CVE-2026-45559 Roxy-WI: LDAP injection in /user/ldap/<username> (admin-only)
- CVE-2026-45558 Roxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section save
- CVE-2026-45557 Technitium DNS Server excessive DNSSEC requests
- CVE-2026-45556 Path traversal in roxy-wi
- CVE-2026-45555 Roslyn CodeLens MCP Server: Untrusted Roslyn Analyzer Execution via get_diagnostics Leads to Arbitrary Code Execution
- CVE-2026-45554 NiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routes
- CVE-2026-45553 NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()
- CVE-2026-45552 Roxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered server
- CVE-2026-45551 Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write
- CVE-2026-45550 Roxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/body
- CVE-2026-4555 D-Link DIR-513 boa formEasySetTimezone memory corruption
- CVE-2026-45549 Roxy-WI: Authorization bypass on POST /smon/agent/action/<action> — guest can stop or restart smon-agent on any host
- CVE-2026-45548 Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation
- CVE-2026-45545 Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
- CVE-2026-45544 Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService
- CVE-2026-45543 Missing authorization in security-advisories
- CVE-2026-45542 ESF-IDF: Heap buffer overflow in protocomm Security2 over Bluetooth
- CVE-2026-45541 ESF-IDF: Remote Null Pointer Dereference in WebSocket Server
- CVE-2026-4554 Tenda F453 WriteFacMac FormWriteFacMac privilege escalation
- CVE-2026-45539 Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree
- CVE-2026-45538 OpenSIPS: Stack Buffer Overflow in sip_to_json() Header Name Copy
- CVE-2026-45537 OpenSIPS: Global Buffer Overflow in construct_uri
- CVE-2026-45536 Netty: Unix-socket fd receive leaks descriptors when peer sends two at once
- CVE-2026-45535 DataEase: Stored SQL Injection Vulnerability
- CVE-2026-45534 DataEase: RCE Vulnerability
- CVE-2026-45533 DataEase: Path Traversal Vulnerability
- CVE-2026-45532 DataEase has a Path Traversal Vulnerability
- CVE-2026-45531 Memory corruption in Android
- CVE-2026-4553 Tenda F453 Parameters Natlimit fromNatlimit stack-based overflow
- CVE-2026-45528 Privilege escalation in Android
- CVE-2026-45527 Integer overflow in Android
- CVE-2026-45525 Information disclosure in Android
- CVE-2026-45524 Missing authorization in Android
- CVE-2026-45521 Missing authorization in Android
- CVE-2026-45520 Auth bypass in Android
- CVE-2026-4552 Tenda F453 Parameters VirtualSer fromVirtualSer memory corruption
- CVE-2026-45519 Information disclosure in Android
- CVE-2026-45515 Memory corruption in Android
- CVE-2026-4551 Tenda F453 Parameters SafeClientFilter fromSafeClientFilter memory corruption
- CVE-2026-45505 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass
- CVE-2026-45504 Microsoft Exchange Server Elevation of Privilege Vulnerability
- CVE-2026-45503 Microsoft Exchange Server Information Disclosure Vulnerability
- CVE-2026-45502 Microsoft Exchange Server Information Disclosure Vulnerability
- CVE-2026-45501 Microsoft Exchange Server Spoofing Vulnerability
- CVE-2026-45500 Microsoft Exchange Server Spoofing Vulnerability
- CVE-2026-4550 code-projects Simple Gym Management System func.php sql injection
- CVE-2026-45499 Azure OpenAI Elevation of Privilege Vulnerability
- CVE-2026-45498 Microsoft Defender Denial of Service
- CVE-2026-45497 Microsoft M365 Copilot Remote Code Execution Vulnerability
- CVE-2026-45496 Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-45495 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-45494 Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2026-45492 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- CVE-2026-45491 .NET Tampering Vulnerability
- CVE-2026-45490 .NET SDK Elevation of Privilege Vulnerability
- CVE-2026-4549 mickasmt next-saas-stripe-starter Stripe API open-customer-portal.ts openCustomerPortal authorization
- CVE-2026-45489 Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2026-45488 Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2026-45487 Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability
- CVE-2026-45486 Microsoft Word Remote Code Execution Vulnerability
- CVE-2026-45485 Microsoft Office Information Disclosure Vulnerability
- CVE-2026-45484 Microsoft SharePoint Elevation of Privilege Vulnerability
- CVE-2026-45483 Microsoft Office Project Server Spoofing Vulnerability
- CVE-2026-45482 Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability
- CVE-2026-45481 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-45480 Azure Active Directory Elevation of Privilege Vulnerability
- CVE-2026-4548 mickasmt next-saas-stripe-starter update-user-role.ts updateUserrole improper authorization
- CVE-2026-45479 Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-45476 Microsoft Azure Network Adapter Elevation of Privilege Vulnerability
- CVE-2026-45475 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-45474 Microsoft Office Remote Code Execution Vulnerability