Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 626 of 1013.
- CVE-2026-45042 RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source
- CVE-2026-45041 RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery
- CVE-2026-45040 RustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode]
- CVE-2026-4504 eosphoros-ai db-gpt Incomplete Fix editor sql injection
- CVE-2026-45039 RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation
- CVE-2026-45038 Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution
- CVE-2026-45037 Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation
- CVE-2026-45036 Command injection in tabby
- CVE-2026-45035 Tabby: RCE via `tabby://run` URL Scheme
- CVE-2026-45034 PhpSpreadsheet: File::prohibitWrappers bypass
- CVE-2026-45033 GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor
- CVE-2026-45031 ImageMagick: Policy Bypass in PSD decoder
- CVE-2026-4503 Unauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint
- CVE-2026-45028 Astro: Server island encrypted parameters vulnerable to cross-component replay
- CVE-2026-45027 WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.php
- CVE-2026-45026 WeGIA: Stored XSS in html/atendido/processo_aceitacao.php
- CVE-2026-45025 WeGIA: Stored XSS in html/atendido/etapa_processo.php
- CVE-2026-45023 AutoGPT: Credit system bypassed via direct block execution in POST /api/blocks/{block_id}/execute
- CVE-2026-45022 go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git
- CVE-2026-45021 Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin
- CVE-2026-4502 Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API
- CVE-2026-45019 Chainlit: SSRF via MCP SSE and streamable-http transports allows unauthenticated internal network access
- CVE-2026-45018 Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution
- CVE-2026-45017 Python Liquid: Absolute paths escape filesystem loader search path
- CVE-2026-45014 Apostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in Draft Version Tooltip
- CVE-2026-45013 Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation
- CVE-2026-45012 Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget
- CVE-2026-45011 Apostrophe has stored XSS via javascript: URL in Image Widget Link
- CVE-2026-45010 phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint
- CVE-2026-45009 phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints
- CVE-2026-45008 phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter
- CVE-2026-45007 phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure
- CVE-2026-45006 OpenClaw < 2026.4.23 - Unsafe Config Mutation via Gateway Tool Denylist Bypass
- CVE-2026-45005 OpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After Rotation
- CVE-2026-45004 OpenClaw < 2026.4.23 - Arbitrary Code Execution via setup-api.js in Current Working Directory
- CVE-2026-45003 OpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv Files
- CVE-2026-45002 OpenClaw < 2026.4.20 - Hook Session-Key Bypass via Template Mapping
- CVE-2026-45001 OpenClaw < 2026.4.20 - Gateway Config Mutation Guard Bypass via Agent Tool Access
- CVE-2026-45000 OpenClaw < 2026.4.20 - Server-Side Request Forgery via Browser CDP Profile Creation
- CVE-2026-4500 bagofwords1 bagofwords code_execution.py generate_df injection
- CVE-2026-44999 OpenClaw < 2026.4.20 - Improper Trust Labeling in Isolated Cron Awareness Events
- CVE-2026-44998 OpenClaw < 2026.4.20 - Tool Policy Bypass via Bundled MCP/LSP Tools
- CVE-2026-44997 OpenClaw < 2026.4.22 - Security Envelope Constraint Bypass in ACP Child Sessions
- CVE-2026-44996 OpenClaw < 2026.4.15 - Arbitrary Local File Read via Webchat Audio Embedding
- CVE-2026-44995 OpenClaw < 2026.4.20 - Arbitrary Code Execution via MCP stdio Environment Variables
- CVE-2026-44994 OpenClaw < 2026.4.22 - Authentication Bypass in Gateway Control UI Bootstrap Config Endpoint
- CVE-2026-44993 OpenClaw < 2026.4.20 - Direct Message Misclassification in Feishu Card Actions
- CVE-2026-44992 OpenClaw 2026.4.5 through 2026.4.19 - MiniMax API Host Override via Workspace dotenv
- CVE-2026-44991 OpenClaw < 2026.4.21 - Authorization Bypass in Owner-Enforced Commands via Wildcard Channel Senders
- CVE-2026-44990 Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
- CVE-2026-4499 D-Link DIR-820LW SSDP ssdpcgi_main os command injection
- CVE-2026-44988 LibVNCClient Tight Gradient decoding allows malicious server-triggered heap/stack OOB writes
- CVE-2026-44987 SysReptor: Privilege Escalation from User Admin to Superuser
- CVE-2026-44986 Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile
- CVE-2026-44985 Dozzle: Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpoints bypasses authentication
- CVE-2026-44983 smallbitvec: Safe API Triggered Heap Buffer Overflow via Integer Overflow
- CVE-2026-44982 CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests
- CVE-2026-44981 CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression
- CVE-2026-4498 Privilege escalation in Kibana
- CVE-2026-44979 @hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects
- CVE-2026-44978 xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification
- CVE-2026-44977 countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context
- CVE-2026-44976 Frappe: IDOR in update_onboarding_step
- CVE-2026-44975 Frappe: Missing authorization on reset form tours
- CVE-2026-44974 Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters
- CVE-2026-44973 Billy: Path traversal vulnerabilities
- CVE-2026-44972 GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content
- CVE-2026-44971 GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
- CVE-2026-44970 dbt MCP Server Transmits All MCP Tool Arguments Including Raw SQL and --vars Credentials to dbt Labs Telemetry by Default Without Redaction
- CVE-2026-4497 Totolink WA300 cstecgi.cgi recvUpgradeNewFw os command injection
- CVE-2026-44969 dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled
- CVE-2026-44968 dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters
- CVE-2026-44967 opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response
- CVE-2026-44966 Velocity.js: Prototype Pollution in #set path assignment
- CVE-2026-44965 Missing authorization in Android App
- CVE-2026-44964 Missing authorization in Android App
- CVE-2026-44963 Deserialization in Backup and Replication
- CVE-2026-44962 Code injection in Plesk
- CVE-2026-44961 Security feature bypass in Adserver
- CVE-2026-44960 Cross-site scripting in Adserver
- CVE-2026-4496 sigmade Git-MCP-Server gitUtils.ts child_process.exec os command injection
- CVE-2026-44959 Code injection in Adserver
- CVE-2026-44958 Missing authorization in Adserver
- CVE-2026-44957 Missing authorization in Adserver
- CVE-2026-44956 Cross-site scripting in Adserver
- CVE-2026-44955 Exposure of Sensitive System Information to an Unauthorized Control Sphere in Panduit IntraVUE by Pronetiqs
- CVE-2026-44950 fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2
- CVE-2026-4495 atjiu pybbs CommentApiController.java create cross site scripting
- CVE-2026-44949 Unauthenticated namespace creation and RBAC injection via rancher-webhook FleetWorkspace mutating webhook
- CVE-2026-44948 Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler
- CVE-2026-44947 Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher
- CVE-2026-44946 SAML Authentication Replay in Rancher
- CVE-2026-44945 Cross-Cluster Impersonation Confused-Deputy Privilege Escalation
- CVE-2026-44944 iscsiuio control-socket authentication bypass in open-iscsi
- CVE-2026-44943 remote limited file-write as root via discovery in open-iscsi
- CVE-2026-44942 libzypp .repo files can have an optional path which can lead to path traversal attacks
- CVE-2026-44941 libzypp path traversal via "keyhint" in repomd.xml
- CVE-2026-44940 Service token exposure and potential privilege escalation in SUSE Observability
- CVE-2026-4494 atjiu pybbs TopicApiController.java create cross site scripting
- CVE-2026-44939 Command injection through unsanitized YAML parameter in Rancher