Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 632 of 1013.
- CVE-2026-44414 Other in Industrial Edge Cloud Device (IECD)
- CVE-2026-44413 Missing authorization in TeamCity
- CVE-2026-44412 Memory corruption in Solid Edge SE2026
- CVE-2026-44411 Memory corruption in Solid Edge SE2026
- CVE-2026-44410 Function Abusement Vulnerability in ZTE ZXUniPOS NDS-LTE
- CVE-2026-4441 Use after free in Chrome
- CVE-2026-44409 Information disclosure vulnerability in ZTE MU5250
- CVE-2026-44408 Unauthorized access vulnerability in ZTE MU5250
- CVE-2026-44407 Remote Denial of Service Vulnerability Exists in ZTE Cloud PC Client uSmartview
- CVE-2026-44406 DLL Hijacking Vulnerability in ZTE Cloud PC Client uSmartview
- CVE-2026-44405 Paramiko rsakey.py allows the SHA-1 algorithm
- CVE-2026-44403 Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization
- CVE-2026-44402 Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi
- CVE-2026-44401 Typemill CMS 2.x Persistent XSS via Markdown javascript URI
- CVE-2026-44400 MailEnable Enterprise Premium < 10.55 Authorization Bypass via WebAdmin
- CVE-2026-4440 Memory corruption in Chrome
- CVE-2026-44394 OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token
- CVE-2026-44393 OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake
- CVE-2026-44392 Missing authorization in Movable Type
- CVE-2026-44390 Unbounded name compression in certain cases causes degradation of service
- CVE-2026-4439 Memory corruption in Chrome
- CVE-2026-44387 Cross-site scripting in WAB-I1750-PS
- CVE-2026-44383 Hydro-Québec Le Circuit Electrique charging station backend Insufficient Session Expiration
- CVE-2026-44381 MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings
- CVE-2026-44380 MISP: Improper access control in auth key reset allows privilege escalation to site administrator
- CVE-2026-4438 gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
- CVE-2026-44379 MISP: Improper UUID validation in MISP Collections
- CVE-2026-44378 Botan: Quadratic complexity decoding BER indefinite length encodings
- CVE-2026-44377 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
- CVE-2026-44376 CubeCart: Reflected XSS in Store Search Bar
- CVE-2026-44375 Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException
- CVE-2026-44374 Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks
- CVE-2026-44373 Nitro: Proxy scope bypass via percent-encoded path traversal in `routeRules`
- CVE-2026-44372 Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules
- CVE-2026-44371 Open OnDemand: Specially crafted filenames can execute javascript in the file browser
- CVE-2026-4437 gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response
- CVE-2026-44369 CVAT: Stored XSS via annotation guides
- CVE-2026-44368 PyQuorum: Timing side‑channel in mul_mod
- CVE-2026-44367 Klaw: user lockout due to case sensitivity inconsistency
- CVE-2026-44366 Vvveb: Stored XSS via Comment Author Field
- CVE-2026-44364 misp-modules website - Missing CSRF protection in the website home blueprint
- CVE-2026-44363 Unsafe remote resource fetching in expansion misp-modules
- CVE-2026-44362 OP-TEE's subkey rollback protection can be bypassed with older subkey versions
- CVE-2026-4436 GPL Odorizers GPL750 Missing Authentication for Critical Function
- CVE-2026-44359 Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow
- CVE-2026-44358 Espressif Shared GitHub DangerJS: Untrusted Search Path in DangerJS Action Entrypoint
- CVE-2026-44353 Streamlink: Arbitrary local file read via file:// URI in HLS and DASH
- CVE-2026-44352 Flowsint: Broken Access Control allows reading of sketch logs from any user
- CVE-2026-44351 fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass
- CVE-2026-44349 Daptin fuzzy search injects unvalidated column name into raw SQL
- CVE-2026-44348 PoDoFo: Double-free vulnerability in compute_hash_to_sign()
- CVE-2026-44347 Warpgate: SSO CSRF -- State Token Not Validated on Return
- CVE-2026-44346 BentoML: Dockerfile command injection via envs[*].name in bentofile.yaml
- CVE-2026-44345 BentoML: Dockerfile command injection via docker.base_image
- CVE-2026-44343 WGDashboard: Critical Vulnerability in 4.3.2
- CVE-2026-44342 New API CSRF in email and WeChat account binding endpoints
- CVE-2026-44341 GoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval Endpoint
- CVE-2026-44340 PraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
- CVE-2026-4434 Security feature bypass in Server
- CVE-2026-44339 PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute
- CVE-2026-44338 PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution
- CVE-2026-44337 PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries
- CVE-2026-44336 PraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injection
- CVE-2026-44335 SSRF bypass in PraisonAI
- CVE-2026-44334 PraisonAI: Unauthenticated RCE via `tool_override.py`
- CVE-2026-44332 Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer
- CVE-2026-44331 SQL injection in ProFTPD
- CVE-2026-44330 free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions
- CVE-2026-4433 Misconfiguration in Tenable Operation Technology
- CVE-2026-44329 free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers
- CVE-2026-44328 free5GC's SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating
- CVE-2026-44327 free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler
- CVE-2026-44326 free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions
- CVE-2026-44325 free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types)
- CVE-2026-44324 free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)
- CVE-2026-44323 free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)
- CVE-2026-44322 free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference
- CVE-2026-44321 free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)
- CVE-2026-44320 free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path
- CVE-2026-4432 YITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDOR
- CVE-2026-44319 free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)
- CVE-2026-44318 free5GC's BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions
- CVE-2026-44317 free5GC's PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference
- CVE-2026-44316 free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference
- CVE-2026-44315 free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions
- CVE-2026-44314 Traccar: Missing edit authorization on device image upload allows read-only users to write files
- CVE-2026-44313 LinkWarden: Server-Side Request Forgery (SSRF) in Link Creation via fetchTitleAndHeaders Function
- CVE-2026-44312 css_parser allows to MITM included https css urls
- CVE-2026-44311 Fabric.js: Improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization
- CVE-2026-44310 gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
- CVE-2026-4431 Easy Post Submission <= 2.3.0 - Missing Authorization
- CVE-2026-44309 gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits
- CVE-2026-44308 Spring Cloud AWS: Missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications
- CVE-2026-44307 Mako: Path traversal via backslash URI on Windows in TemplateLookup
- CVE-2026-44306 Statamic: Email enumeration via forgot password endpoint
- CVE-2026-44305 Lemur: LDAP TLS certificate verification globally disabled enables credential interception
- CVE-2026-44304 Lemur: LDAP Filter Injection enables post-authentication privilege escalation
- CVE-2026-44302 Snappier: Infinite loop in SnappyStream decompression on malformed framed input
- CVE-2026-44301 Hugo: Node tool execution allows file system access outside the project directory
- CVE-2026-44300 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection