Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 631 of 1013.
- CVE-2026-44516 Valtimo: Sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer
- CVE-2026-44515 Nextcloud News: Authenticated blind SSRF via feed URL
- CVE-2026-44514 Kubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated users
- CVE-2026-44513 Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components
- CVE-2026-44512 ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)
- CVE-2026-44511 Katalyst Koi: Session cookies can be replayed after user logout
- CVE-2026-4451 Security feature bypass in Chrome
- CVE-2026-44506 Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations
- CVE-2026-44505 Nimiq network-libp2p: Untrusted peer can wedge DHT
- CVE-2026-44504 Aegra: Cross-user run injection in /threads/{thread_id}/runs (IDOR)
- CVE-2026-44503 Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
- CVE-2026-44502 Bugsink: SSRF bypass in `validate_webhook_url`
- CVE-2026-44501 DataHub OIDC REDIRECT_URL Cookie Deserialization Vulnerability
- CVE-2026-44500 ZEBRA: Allocation Amplification in Inbound Network Deserializers
- CVE-2026-4450 Memory corruption in Chrome
- CVE-2026-44499 ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning
- CVE-2026-44498 ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops
- CVE-2026-44497 ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer
- CVE-2026-44496 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
- CVE-2026-44495 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
- CVE-2026-44494 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
- CVE-2026-44492 axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
- CVE-2026-44490 Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
- CVE-2026-4449 Use after free in Chrome
- CVE-2026-44489 Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
- CVE-2026-44488 Axios: Allocation of Resources Without Limits or Throttling in axios
- CVE-2026-44487 Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
- CVE-2026-44486 Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
- CVE-2026-44484 Compromise of PyTorch Lightning PyPi Package Versions
- CVE-2026-44483 RVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFormData (HTTP form data)
- CVE-2026-44482 soundcloud-rpc: Remote Code Execution via XSS in Track Title
- CVE-2026-4448 Memory corruption in Chrome
- CVE-2026-44479 Vercel: Non-interactive mode includes CLI arguments in suggested command output
- CVE-2026-44478 hoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token
- CVE-2026-44477 CloudNativePG: Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE
- CVE-2026-44476 Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret
- CVE-2026-44475 Ella Core: UE Security Capability bypass on NGAP PathSwitchRequest
- CVE-2026-44474 Ella Core: Handover failures during concurrent Security Mode Command
- CVE-2026-44473 Ella Core: UE Downlink Redirection via Forged PDUSessionResourceSetupResponse
- CVE-2026-44472 Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge
- CVE-2026-44471 gitoxide: Symlink prefix-reuse allows worktree escape during checkout
- CVE-2026-44470 Claude Desktop: Local Privilege Escalation via Directory Junction in CoworkVMService
- CVE-2026-4447 Security feature bypass in Chrome
- CVE-2026-44469 Incorrect Default Permissions in CODESYS Development System
- CVE-2026-44468 Incorrect Default Permissions in CODESYS Development System
- CVE-2026-44467 Claude Desktop: SSH Host Key Verification Bypass Allows Man-in-the-Middle Attack on Remote Sessions
- CVE-2026-44466 Zed: Allowlist Bypass via Bash Arithmetic Expansion in Terminal Tool Permissions
- CVE-2026-44465 Zed: Zed IDE Arbitrary Code Execution via untrusted repository with poisoned .git/config
- CVE-2026-44463 Zed: Allowlist Bypass via Environment Variable Injection in Terminal Tool Permissions
- CVE-2026-44462 Zed: Allowlist Bypass via Bash Variable Expansion Chain in Terminal Tool Permissions
- CVE-2026-44461 Zed: Remote Command Injection via Unquoted Environment Variable Keys (SSH / WSL Remote)
- CVE-2026-44460 FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret
- CVE-2026-4446 Use after free in Chrome
- CVE-2026-44459 Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()
- CVE-2026-44458 Hono: CSS Declaration Injection via Style Object Values in JSX SSR
- CVE-2026-44457 Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage
- CVE-2026-44456 Hono: bodyLimit() can be bypassed for chunked / unknown-length requests
- CVE-2026-44455 Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection
- CVE-2026-44454 Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent
- CVE-2026-44453 h2o is vulnerable to musl libc stack overflow
- CVE-2026-44452 h2o is vulnerable to heap overrun
- CVE-2026-44451 Lumiverse: TSX component sandbox escape via DOM ref and string-split identifier bypass
- CVE-2026-44450 Lumiverse: RCE via MCP stdio argument injection
- CVE-2026-4445 Use after free in Chrome
- CVE-2026-44449 Lumiverse: SMB `exists()` basename injection via smbclient `!cmd` escape
- CVE-2026-44448 ERPNext: Unauthorised Document modification due to missing validation
- CVE-2026-44447 ERPNext: Possibility of SQL Injection due to missing validation
- CVE-2026-44446 ERPNext: Possibility of SQL Injection due to missing validation
- CVE-2026-44445 ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module
- CVE-2026-44444 Lumiverse: Spindle extension install runs untrusted lifecycle scripts before security scan
- CVE-2026-44443 Lumiverse: Sign-up nonce race condition allows unauthorized account registration
- CVE-2026-44442 ERPNext: Unauthorised Document modification due to missing validation
- CVE-2026-44441 ERPNext: Possible SSRF by any authenticated user
- CVE-2026-44440 ERPNext: Path Traversal Leading to Sensitive File Exposure
- CVE-2026-4444 Memory corruption in Chrome
- CVE-2026-44439 LookyLoo - PlaywrightCapture permits access to local files and internal network resources during page capture
- CVE-2026-44437 Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix
- CVE-2026-44436 Quicly is vulnerable to connection state corruption
- CVE-2026-44435 Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KB
- CVE-2026-44434 Quicly is vulnerable to stateless reset injection
- CVE-2026-44433 Quicly is vulnerable to memory exhaustion
- CVE-2026-44432 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
- CVE-2026-44431 urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
- CVE-2026-44430 MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist
- CVE-2026-4443 Memory corruption in Chrome
- CVE-2026-44429 MCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`
- CVE-2026-44428 MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience
- CVE-2026-44427 MCP Registry: Open Redirect
- CVE-2026-44426 ShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check
- CVE-2026-44425 ShellHub: Crash-DoS via field injection in filter and sort-by parameters
- CVE-2026-44424 ShellHub: Cross-tenant IDOR in `GET /api/devices/:uid` discloses device data of any namespace
- CVE-2026-44423 ShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session data
- CVE-2026-44422 FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusion
- CVE-2026-44421 FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypass
- CVE-2026-44420 FreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPS
- CVE-2026-4442 Memory corruption in Chrome
- CVE-2026-44418 Incomplete fix for CVE-2026-35184: SQL Injection in phili67/ecclesiacrm
- CVE-2026-44417 Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)
- CVE-2026-44416 Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation
- CVE-2026-44415 Missing authorization in Industrial Edge Device Kit - arm64 V1.10