Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 627 of 1013.
- CVE-2026-44938 Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent
- CVE-2026-44937 SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components
- CVE-2026-44936 Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml
- CVE-2026-44935 Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
- CVE-2026-44934 Exposed tokens in SUSE Rancher AI Agent logs
- CVE-2026-44933 Path Traversal in Plugin Loading in libzypp
- CVE-2026-44932 indirect remote shell command injection via unsanitized DHCP options in wicked
- CVE-2026-44931 malcontent: Disk Space Exhaustion via Globally Accessible D-Bus API
- CVE-2026-44930 Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository
- CVE-2026-4493 Tenda A18 Pro MAC Filtering Configuration Endpoint setMacFilterCfg sub_423B50 stack-based overflow
- CVE-2026-44928 Security feature bypass in uriparser
- CVE-2026-44927 Integer overflow in uriparser
- CVE-2026-44926 InfoScale CmdServer before 7.4.2 mishandles access control.
- CVE-2026-44925 Cross-site request forgery in veritas:infoscale operations manager
- CVE-2026-44924 InfoScale VIOM 9.1.3 allows XSS.
- CVE-2026-44923 SQL injection in veritas:infoscale operations manager
- CVE-2026-4492 Tenda A18 Pro formSetQosBand set_qosMib_list stack-based overflow
- CVE-2026-44919 OpenStack Ironic: Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices
- CVE-2026-44918 Missing authorization in Ironic
- CVE-2026-44917 Information disclosure in Ironic
- CVE-2026-44916 Code injection in Ironic
- CVE-2026-44915 Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value
- CVE-2026-44914 Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents
- CVE-2026-44913 Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL
- CVE-2026-44911 Apache NiFi: Incorrect Authorization for Configuration Verification Requests
- CVE-2026-4491 Tenda A18 Pro SetIpMacBind fromSetIpMacBind stack-based overflow
- CVE-2026-44909 Denial of service in proxygen
- CVE-2026-44907 react-server-dom: Denial of Service in Server Functions
- CVE-2026-44905 Vanetza: Remote Denial of Service via Uncaught OER Encoding Exception in Cryptographic Verification
- CVE-2026-44903 Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI
- CVE-2026-44902 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request
- CVE-2026-44901 Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2026-44900 epa4all-client: VAU Signature bypass
- CVE-2026-4490 Tenda A18 Pro openSchedWifi setSchedWifi stack-based overflow
- CVE-2026-44899 Mistune Image Directive CSS Injection Vulnerability
- CVE-2026-44898 Mistune TOC Anchor Injection XSS
- CVE-2026-44897 Mistune Heading ID Attribute Injection XSS
- CVE-2026-44896 Mistune: XSS via unescaped figclass/figwidth in Figure directive
- CVE-2026-44895 GitLab MCP Server: SSE transport has no authentication and wildcard CORS, exposing all GitLab tools
- CVE-2026-44894 Netty's Default QUIC token handler accepts any client-supplied token
- CVE-2026-44893 Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length
- CVE-2026-44892 Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size
- CVE-2026-44891 Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder
- CVE-2026-44890 Netty has Unbounded Direct Memory Consumption in its RedisDecoder
- CVE-2026-4489 Tenda A18 Pro fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflow
- CVE-2026-44889 WebOb: Location header normalization during redirect leads to open redirect
- CVE-2026-44888 Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Interger)
- CVE-2026-44887 Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Path)
- CVE-2026-44886 Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection
- CVE-2026-44885 Portainer: Path traversal in backup archive extraction allows arbitrary file write
- CVE-2026-44884 Portainer: Missing authorization on custom template file endpoint exposes template content
- CVE-2026-44883 Portainer: JWT accepted in URL query leaks tokens to logs and referers
- CVE-2026-44882 Portainer: Kubernetes middleware continues after token validation failure, bypassing endpoint authorization
- CVE-2026-44881 Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Update
- CVE-2026-44880 Low-Privilege Authenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX
- CVE-2026-4488 UTT HiPER 1250GW setSysAdm strcpy buffer overflow
- CVE-2026-44879 Authenticated Command Injection allows arbitrary command execution in CLI Interface
- CVE-2026-44878 Authenticated Path Traversal allows Unauthorized Access in Web Interface
- CVE-2026-44877 Unauthenticated Remote Disclosure of Cryptographic Secrets
- CVE-2026-44874 Authenticated Arbitrary File Download via AOS-10 Web-Based Management Interface
- CVE-2026-44873 Insufficient Session Invalidation on User Account Deactivation in AOS-8 Operating System
- CVE-2026-44872 Authenticated Arbitrary File Upload via Command Injection in AOS-8 AND AOS-10 Web-Based Management Interface
- CVE-2026-44871 Command injection in HPE Aruba Networking Wireless Operating System (AOS)
- CVE-2026-44870 Command injection in HPE Aruba Networking Wireless Operating System (AOS)
- CVE-2026-4487 UTT HiPER 1200GW websHostFilter strcpy buffer overflow
- CVE-2026-44869 Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10
- CVE-2026-44868 Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10
- CVE-2026-44867 Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10
- CVE-2026-44866 Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10
- CVE-2026-44865 Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10
- CVE-2026-44864 Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
- CVE-2026-44863 Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
- CVE-2026-44862 Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
- CVE-2026-44861 Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
- CVE-2026-44860 Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
- CVE-2026-4486 D-Link DIR-513 Web Service formEasySetPassword stack-based overflow
- CVE-2026-44859 Authenticated Stack-Based Buffer Overflow in PAPI Services
- CVE-2026-44858 Authenticated Stack-Based Buffer Overflow in PAPI Services
- CVE-2026-44857 Authenticated Stack-Based Buffer Overflow in PAPI Services
- CVE-2026-44856 Authenticated Stack-Based Buffer Overflow in PAPI Services
- CVE-2026-44855 Authenticated Stack-Based Buffer Overflow in PAPI Services
- CVE-2026-44854 Authenticated Remote Code Execution via Arbitrary File Write in AOS-8 and AOS-10 Web-Based Management Interface
- CVE-2026-44853 Authenticated Remote Code Execution via Arbitrary File Write in AOS-8 and AOS-10 Web-Based Management Interface
- CVE-2026-44852 Authenticated Remote Code Execution via Arbitrary File Overwrite in the AOS-8 and AOS-10 Web-Based Management Interface
- CVE-2026-44850 Portainer: Bind-mount restriction bypass via HostConfig.Mounts
- CVE-2026-4485 itsourcecode College Management System search_student.php sql injection
- CVE-2026-44849 Portainer: Endpoint security bypass via Swarm service create/update
- CVE-2026-44848 Portainer: Missing authorization on Docker plugin endpoints allows host RCE
- CVE-2026-44847 MaxKB: Webhook Trigger Authentication Bypass
- CVE-2026-44846 JumpServer: Privilege Overwrite via Organization Invite Logic Flaw
- CVE-2026-44845 JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment
- CVE-2026-44844 eml_parser: Recursion DoS via nested message/rfc822 attachments
- CVE-2026-44843 LangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists
- CVE-2026-44840 Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query
- CVE-2026-4484 Masteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator
- CVE-2026-44839 RabbitMQ: Unsanitized vhost names allow for XSS in management UI
- CVE-2026-44838 RabbitMQ MQTT Topic Permission Authorization Bypass
- CVE-2026-44837 view_component: System Test Entry Point Path Check Allows Sibling Directory Escape
- CVE-2026-44836 view_component: Preview Route Can Dispatch Inherited Helper Methods
- CVE-2026-44833 Snipe-IT: Open redirect vulnerability