Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 629 of 1013.
- CVE-2026-44737 Grav: Stored XSS via page title (data[header][title]) in admin panel
- CVE-2026-44736 OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects
- CVE-2026-44735 OpenProject: Shares API Information Disclosure
- CVE-2026-44734 Missing authorization in openproject
- CVE-2026-44733 Business logic in openproject
- CVE-2026-44732 Missing authorization in openproject
- CVE-2026-44731 Information disclosure in openproject
- CVE-2026-44730 OpenCTI: Privilege escalation via graphQL API is abusable by organization admins, due to incorrect ACL on userEdit relationAdd
- CVE-2026-4473 itsourcecode Online Doctor Appointment System appointment_action.php sql injection
- CVE-2026-44729 Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)
- CVE-2026-44728 @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
- CVE-2026-44727 Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP
- CVE-2026-44726 Deno: TLS retry copies stale upgrade hook, risking plaintext traffic
- CVE-2026-44725 EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution
- CVE-2026-44724 Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
- CVE-2026-44723 Command injection in vowpal wabbit
- CVE-2026-44722 pyzipper: Encryption bypass for small files encrypted with pyzipper
- CVE-2026-44721 Open WebUI: Stored XSS via Model Description
- CVE-2026-44720 OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover
- CVE-2026-4472 itsourcecode Online Frozen Foods Ordering System admin_edit_supplier.php sql injection
- CVE-2026-44719 Mathesar: Missing collaborator checks allowed access to database-scoped Mathesar metadata
- CVE-2026-44718 Mathesar: Missing collaborator checks allowed access to saved explorations in other databases
- CVE-2026-44717 MCP Calculate Server: Prompt Injection to RCE
- CVE-2026-44716 Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator
- CVE-2026-44715 OpenMRS has Broken Access Control in HL7 Configuration
- CVE-2026-44714 bitcoinj: ScriptExecution P2PKH/P2WPKH Verification Bypass
- CVE-2026-44713 pam_usb: Command injection via $TMUX environment variable leads to RCE as root
- CVE-2026-44712 pam_usb: Shell injection via device UUID and username in pamusb-conf and pamusb-agent
- CVE-2026-44711 pam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruption
- CVE-2026-44710 pam_usb: NULL pointer dereference from UDisks device fields causes PAM crash and login denial-of-service
- CVE-2026-4471 itsourcecode Online Frozen Foods Ordering System admin_edit_employee.php sql injection
- CVE-2026-44709 pam_usb: PINENTRY_FALLBACK_APP environment variable allows arbitrary command execution
- CVE-2026-44708 Mistune Math Plugin XSS Escape Bypass
- CVE-2026-44707 Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Accounts
- CVE-2026-44706 Chatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute Values
- CVE-2026-44705 tmp: Path Traversal via unsanitized prefix/postfix enables directory escape
- CVE-2026-44700 Elixir WebRTC: Missing DTLS peer fingerprint validation in ex_webrtc client-role handshake
- CVE-2026-4470 itsourcecode Online Frozen Foods Ordering System admin_edit_menu.php sql injection
- CVE-2026-44699 LibJWT: Algorithm confusion allows JWT forgery with RSA JWK as empty-key HMAC
- CVE-2026-44698 Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection
- CVE-2026-44697 Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload
- CVE-2026-44696 OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltration
- CVE-2026-44695 Outline: Slack OAuth state can link a victim Outline account to an attacker Slack identity
- CVE-2026-44694 n8n-MCP: Authenticated SSRF in n8n-mcp webhook and API client paths
- CVE-2026-44693 Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer
- CVE-2026-44692 Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint
- CVE-2026-44691 [Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions
- CVE-2026-44690 Cross-zone wildcard cache poisoning via RRSIG.labels manipulation
- CVE-2026-4469 itsourcecode Online Frozen Foods Ordering System admin_edit_menu_action.php sql injection
- CVE-2026-44688 [Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat
- CVE-2026-44687 Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN
- CVE-2026-44682 Privilege escalation in Acronis DeviceLock DLP
- CVE-2026-44681 Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization
- CVE-2026-44680 MikroORM: SQL injection via runtime-controlled identifiers and JSON-path keys
- CVE-2026-4468 Comfast CF-AC100 mbox-config command injection
- CVE-2026-44679 Tuist: Forgot password flow lacks throttling for reset email delivery
- CVE-2026-44678 Tuist: IDOR in preview deletion API allows cross-tenant deletion of any preview by UUID
- CVE-2026-44673 libyang: lyb_read_string() integer overflow → heap buffer overflow
- CVE-2026-44672 mapfish-print: Remote Code Injection (RCE) in Dynamic table
- CVE-2026-44671 ZITADEL: LDAP Filter Injection in Login Flow
- CVE-2026-44670 SiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuan
- CVE-2026-4467 Comfast CF-AC100 mbox-config command injection
- CVE-2026-44669 Faction: Stored XSS in Assessment Attachment Filename Preview Rendering
- CVE-2026-44668 Faction: Unauthenticated Read, Modify, and Delete of Boilerplate Templates
- CVE-2026-44667 Faction: Stored XSS in Remediation Verification Attachment Filename Preview Rendering
- CVE-2026-44666 HRConvert2: Missing Sanitization enables Unauthenticated Remote Command Execution
- CVE-2026-44665 fast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributes
- CVE-2026-44664 fast-xml-builder: Comment Value bypass regex
- CVE-2026-44663 OpenEXR: Integer overflow in the HTJ2K decoder leads to heap-buffer-overflow
- CVE-2026-44662 rust-openssl: Heap buffer overflow when encrypting with AES key-wrap-with-padding
- CVE-2026-44661 python-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol
- CVE-2026-44660 UltraJSON: Memory Leak in ujson.dump() on Write Failure
- CVE-2026-4466 Comfast CF-AC100 mbox-config command injection
- CVE-2026-44659 Zen Browser Mac - Address Bar Spoofing via Long Subdomain
- CVE-2026-44658 Zen Browser: RSS Live-Folder Item URLs Are Not Scheme-Restricted Before Trusted Tab Creation
- CVE-2026-44657 MantisBT: Stored XSS in File Download
- CVE-2026-44656 Vim: OS Command Injection via 'path' completion
- CVE-2026-44655 MantisBT: Stored XSS on Move Attachments Admin Page
- CVE-2026-44654 LibreChat: Shared-agent editor can globally delete owner's file records — breaks owner's other private agents
- CVE-2026-44653 LibreChat Shared MCP Server View Leaks Decrypted Admin Secrets
- CVE-2026-44652 SillyTavern: SSRF vulnerability in the CORS proxy middleware
- CVE-2026-44651 SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware
- CVE-2026-44650 SillyTavern: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CVE-2026-4465 D-Link DIR-513 formSysCmd os command injection
- CVE-2026-44649 SillyTavern: Authentication Bypass via SSO Header Injection
- CVE-2026-44648 SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover
- CVE-2026-44647 OneDev: Path Traversal (read capability via Git LFS pointer resolution)
- CVE-2026-44646 LiquidJS: `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`
- CVE-2026-44645 LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body
- CVE-2026-44644 LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS
- CVE-2026-44643 Angular Expressions - Remote Code Execution using filters
- CVE-2026-44642 Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)
- CVE-2026-44641 Microsoft APM: plugin.json component paths escape plugin root and copy arbitrary host files during install
- CVE-2026-44640 NanoMQ: QUIC Dialer Close Type Confusion
- CVE-2026-4464 Integer overflow in Chrome
- CVE-2026-44639 NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing
- CVE-2026-44638 libsixel: NULL pointer dereference
- CVE-2026-44637 libsixel: integer overflow in parser
- CVE-2026-44636 libsixel: integer overflow in encoder
- CVE-2026-44635 Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`