Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 623 of 1013.
- CVE-2026-45370 python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection
- CVE-2026-4537 Cudy TR1200 ipsec.lua action_ipsec_conn command injection
- CVE-2026-45369 python-utcp: Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol
- CVE-2026-45368 Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend
- CVE-2026-45367 HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
- CVE-2026-45366 typescript-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol
- CVE-2026-45365 Open WebUI: Authenticated users can bypass model access control via exposed query parameter
- CVE-2026-45364 Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation
- CVE-2026-45363 `jwt` (Ruby gem) - empty-key HMAC bypass
- CVE-2026-45362 Information disclosure in Switchvox
- CVE-2026-45361 Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default
- CVE-2026-45360 Apache Airflow: Arbitrary import in custom deadline-reference deserialization
- CVE-2026-4536 Acrel Environmental Monitoring Cloud Platform unrestricted upload
- CVE-2026-45359 ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define
- CVE-2026-45358 ImageMagick: Out-of-Bounds Read of a single byte in meta encoder
- CVE-2026-45357 LiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime)
- CVE-2026-45353 electerm: Local code through electerm's single-instance socket
- CVE-2026-45352 cpp-httplib DoS: Negative chunk-size in chunked Transfer-Encoding
- CVE-2026-45351 Open WebUI: Exposure of System Prompt to Regular User [Non-Admin]
- CVE-2026-45350 Open WebUI: Chat completion API allows tool restrictions to be bypassed
- CVE-2026-4535 Tenda FH451 WrlclientSet stack-based overflow
- CVE-2026-45349 Open WebUI: Broken Access Control for Completions API
- CVE-2026-45348 pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal
- CVE-2026-45347 Open WebUI: Blind server side request forgery (SSRF) via the PDF generate function
- CVE-2026-45346 Open WebUI: Stored Cross-Site Scripting in SVG Renderer
- CVE-2026-45345 Open WebUI: Missing authorization check at the model update function - models from other users can be updated
- CVE-2026-45344 LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances
- CVE-2026-45343 LinkAce - Stored XSS via Unsanitized SSO User's Name Rendered in Admin Audit Log Allows Session Hijacking
- CVE-2026-45342 LinkAce: IDOR in Update Policies Allows Any Authenticated User to Overwrite Other Users' Links, Lists, Tags, and Notes
- CVE-2026-4534 Tenda FH451 WrlExtraSet formWrlExtraSet stack-based overflow
- CVE-2026-45339 Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints
- CVE-2026-45338 Open WebUI: SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)
- CVE-2026-45337 Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
- CVE-2026-45336 HireFlow: Use of Hard-coded Credentials
- CVE-2026-45335 WeGIA: Middleware whitelist bypass → open redirect via InternoControle.nextPage
- CVE-2026-45334 Kirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions
- CVE-2026-45332 Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint
- CVE-2026-45331 Open WebUI: Full SSRF Vulnerability in the RAG Web Search Feature
- CVE-2026-45330 Decidim: Verification admins can access supplied IDs from other organisations
- CVE-2026-4533 code-projects Simple Food Ordering System all-tickets.php sql injection
- CVE-2026-45329 ESF-IDF: Out-of-Bounds Read in ESP-TEE Secure Service Wrappers
- CVE-2026-45328 ESF-IDF: Out-of-Bounds Write in ESP-TEE Secure Service Wrappers
- CVE-2026-45327 TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection
- CVE-2026-45325 Gestor de Oferta: Prototype pollution in @tmlmobilidade/utils setValueAtPath
- CVE-2026-45324 Rizin: Double free in cmd_search.c
- CVE-2026-45323 MeshCore Card: XSS vulnerability through meshcore node name
- CVE-2026-45322 OS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSON
- CVE-2026-45321 TanStack Unspecified
- CVE-2026-45320 DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection
- CVE-2026-4532 code-projects Simple Food Ordering System Database Backup food.sql file access
- CVE-2026-45318 Open WebUI: Stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)
- CVE-2026-45317 Open WebUI: Cross-Site Request Forgery (CSRF) via Image URL Manipulation
- CVE-2026-45316 Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)
- CVE-2026-45315 Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
- CVE-2026-45314 Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image
- CVE-2026-45313 Sandboxie-Plus: Sandboxie APC Injection Sandbox Escape
- CVE-2026-45312 RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution
- CVE-2026-45311 CodeWhale: run_tests Tool Enables RCE via Malicious Repository Without Approval
- CVE-2026-45310 CodeWhale: SSRF via HTTP Redirect Bypass in fetch_url Tool
- CVE-2026-4531 Free5GC AMF handler.go HandleRegistrationComplete denial of service
- CVE-2026-45309 AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username
- CVE-2026-45307 Speakr: Open redirect in is_safe_url via parser mismatch on next parameter
- CVE-2026-45306 pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory
- CVE-2026-45305 Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
- CVE-2026-45304 Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
- CVE-2026-45303 Open WebUI: Stored XSS via the HTML renedering view
- CVE-2026-45302 Prototype Pollution in parse-nested-form-data via `__proto__` in FormData field names
- CVE-2026-45301 Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file
- CVE-2026-45300 async-http-client: Cookie header not stripped on cross-origin redirect
- CVE-2026-4530 apconw Aix-DB terminology_retriever.py sql injection
- CVE-2026-45299 Open WebUI: Stored Cross-Site Scripting In Profile Picture
- CVE-2026-45298 Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)
- CVE-2026-45297 Cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch
- CVE-2026-45296 OpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant binding
- CVE-2026-45295 Missing authorization in freescout
- CVE-2026-45294 FreeScout: User Account Enumeration via Password Reset Response Differentiation
- CVE-2026-45293 WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability
- CVE-2026-45292 opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation
- CVE-2026-45291 Cloudburst Network erroneously handles invalid connections
- CVE-2026-45290 Cloudburst Network has DoS in RakNet connection handling due to missing bound checks
- CVE-2026-4529 D-Link DHP-1320 SOAP redirect_count_down_page stack-based overflow
- CVE-2026-45289 CloudburstMC Protocol: Partially missing validation for FULL type authentication tokens
- CVE-2026-45288 Marten has an SQL injection vulnerability in its full-text search regConfig parameter
- CVE-2026-45287 OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse
- CVE-2026-45286 Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint
- CVE-2026-45285 Nextcloud: Hidden Public Link creation when sharing to a Team External Member
- CVE-2026-45284 Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
- CVE-2026-45283 Nextcloud: Files Lock app allows users to lock and unlock files of other users
- CVE-2026-45282 Missing authorization in security-advisories
- CVE-2026-45281 Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update
- CVE-2026-4528 trueleaf ApiFlow URL Validation http_proxy.service.ts validateUrlSecurity server-side request forgery
- CVE-2026-45279 Nextcloud: Limited path traversal via template API if using `{lang}` in config
- CVE-2026-45278 Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass
- CVE-2026-45277 Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations
- CVE-2026-45275 Nextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approvers
- CVE-2026-45274 MyBooks: Unauthenticated Registration Bypass via Missing Server-Side ALLOW_REGISTER Enforcement
- CVE-2026-45273 MyBooks: Privilege Escalation via Missing Authorization on Admin Settings Endpoint
- CVE-2026-45272 MyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python Config File
- CVE-2026-45271 picotls has infinite recursion in the minicrypto ASN.1 decoder
- CVE-2026-45270 CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule