Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 625 of 1013.
- CVE-2026-45153 Nextcloud: PIN bypass in PassCodeActivity via back button
- CVE-2026-45152 uniget: Command Injection in tool.Check Leading to Arbitrary Code Execution
- CVE-2026-45151 NanoMQ: NULL Pointer Dereference
- CVE-2026-45150 Zen Browser - Missing Fullscreen Security Notification Allows Origin Spoofing
- CVE-2026-4515 Foundation Agents MetaGPT operator.py code_generate code injection
- CVE-2026-45149 brace-expansion: Large numeric range defeats documented `max` DoS protection
- CVE-2026-45148 SiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadata
- CVE-2026-45147 SiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk
- CVE-2026-45143 Chamilo LMS: Student-to-admin stored XSS in private messages via v-html
- CVE-2026-45140 Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
- CVE-2026-4514 PbootCMS Backend UserController.php access control
- CVE-2026-45139 CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
- CVE-2026-45138 CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
- CVE-2026-45137 Anchor: Program<'info, System> is not properly validated
- CVE-2026-45136 claude-code-cache-fix: Local code execution via Python triple-quote injection in tools/quota-statusline.sh
- CVE-2026-45135 Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
- CVE-2026-45134 LangSmith Client SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
- CVE-2026-45133 Symfony: [Yaml] Harden the parser when handling untrusted input
- CVE-2026-45132 Information disclosure in helm-charts
- CVE-2026-45131 Code injection in helm-charts
- CVE-2026-45130 Vim: Heap Buffer Overflow in spell file loading
- CVE-2026-4513 vanna-ai vanna base.py ask sql injection
- CVE-2026-45129 MyBB: ACP Recovery Codes CSRF
- CVE-2026-45128 MyBB: ACP Users View Manager default CSRF
- CVE-2026-45127 MyBB: ACP Mass Mail draft resend CSRF
- CVE-2026-45126 MyBB: ACP Questions state CSRF
- CVE-2026-45125 MyBB: Email User CRLF injection
- CVE-2026-45124 MyBB: Mod CP report resolution missing authorization
- CVE-2026-45123 MyBB: IPv6 SSRF
- CVE-2026-45122 MyBB: Insufficient permission check for calendar event move
- CVE-2026-45121 MyBB: Insufficient permission check for calendar select
- CVE-2026-45120 MyBB: Insufficient authorization for private calendar events
- CVE-2026-4512 WP reCaptcha by WebDesignBy < 2.0 – Admin+ Stored XSS
- CVE-2026-45119 MyBB: ACP UTF-8 Conversion CSRF
- CVE-2026-45118 MyBB: Contact page reflected XSS
- CVE-2026-45117 MyBB: Installer database configuration RCE
- CVE-2026-45116 MyBB: Profile field type confusion XSS
- CVE-2026-45115 MyBB: Buddy/ignore list username XSS
- CVE-2026-45112 Apache Thrift: Unbounded Read Leading to Denial of Service
- CVE-2026-4511 vanna-ai vanna legacy exec injection
- CVE-2026-45109 Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
- CVE-2026-45108 Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow
- CVE-2026-45106 Weblate: Stored HTML injection in editor search preview
- CVE-2026-45104 MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`
- CVE-2026-45103 OpenSIPS: SIP Message Smuggling via TCP Content-Length Integer Overflow
- CVE-2026-45102 OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion
- CVE-2026-45100 OpenSIPS: Buffer Overflow in Base64 Encode Transformation
- CVE-2026-4510 PbootCMS Parameter MemberController.php alert_location cross site scripting
- CVE-2026-45099 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
- CVE-2026-45091 sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
- CVE-2026-45090 Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)
- CVE-2026-4509 PbootCMS File Upload file.php incomplete blacklist
- CVE-2026-45089 Dalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server Mode
- CVE-2026-45088 Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file`
- CVE-2026-45087 Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode
- CVE-2026-45086 Decidim: Forms admin question editor lacks authorization
- CVE-2026-45085 Discourse: Chat misauthorization and information disclosure
- CVE-2026-45084 OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type state
- CVE-2026-45083 Goobi viewer: Unauthenticated Solr Streaming Expression Proxy
- CVE-2026-45082 Karakeep has a SSRF Protection Bypass via Redirect Handling
- CVE-2026-45081 Frappe HR: Permission Bypass in HRMS Leave Details API
- CVE-2026-45080 Klaw: Improper Access Control Allows Disclosure of Password Hash
- CVE-2026-4508 PbootCMS Member Login MemberController.php checkUsername sql injection
- CVE-2026-45078 Synapse CPU starvation (Denial of Service)
- CVE-2026-45077 Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
- CVE-2026-45076 Synapse pagination denial of service
- CVE-2026-45075 Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
- CVE-2026-45074 Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
- CVE-2026-45073 Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
- CVE-2026-45072 Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
- CVE-2026-45071 Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
- CVE-2026-45070 Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names
- CVE-2026-4507 Mindinventory MindSQL mindsql_core.py ask_db sql injection
- CVE-2026-45069 Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
- CVE-2026-45068 Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
- CVE-2026-45067 Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
- CVE-2026-45066 Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
- CVE-2026-45065 Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
- CVE-2026-45064 Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
- CVE-2026-45063 Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator
- CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files
- CVE-2026-45061 Budibase: SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)
- CVE-2026-45060 ClipBucket: Blind SQL Injection in progress_video.php
- CVE-2026-4506 Mindinventory MindSQL mindsql_core.py ask_db code injection
- CVE-2026-45058 electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark
- CVE-2026-45057 matrix-sdk-ui: Incomplete edit validation
- CVE-2026-45056 Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution
- CVE-2026-45055 CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header
- CVE-2026-45054 CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing
- CVE-2026-45053 CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API
- CVE-2026-45052 OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints
- CVE-2026-45051 OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage
- CVE-2026-4505 eosphoros-ai DB-GPT FastAPI Endpoint controller.py module_plugin.refresh_plugins unrestricted upload
- CVE-2026-45049 OpenAM Session Hijacking via CDSSO
- CVE-2026-45048 OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC
- CVE-2026-45047 bird-lg-go: Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding
- CVE-2026-45046 Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content
- CVE-2026-45045 Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward
- CVE-2026-45044 RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers
- CVE-2026-45043 RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root