Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 633 of 1013.
- CVE-2026-4430 Heap Buffer Overflow in AgileEngine
- CVE-2026-44298 Kimai: Arbitrary file read in invoice PDF renderer (admin)
- CVE-2026-44296 Deskflow: TLS multiplexer DoS on failed `SSL_accept`
- CVE-2026-44295 protobufjs-cli: Code injection in pbjs static output from crafted schema names
- CVE-2026-44294 protobufjs: Denial of service from crafted field names in generated code
- CVE-2026-44293 protobufjs: Code injection through bytes field defaults in generated toObject code
- CVE-2026-44292 protobufjs: Prototype injection in generated message constructors
- CVE-2026-44291 protobufjs: Code generation gadget after prototype pollution
- CVE-2026-44290 protobufjs: Process-wide denial of service through unsafe option paths
- CVE-2026-4429 OSM <= 6.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker_name' Shortcode Attribute
- CVE-2026-44289 protobufjs: Denial of service through unbounded protobuf recursion
- CVE-2026-44288 protobufjs: Overlong UTF-8 decoding
- CVE-2026-44287 FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*\(/ is bypassable
- CVE-2026-44286 FastGPT: SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validation
- CVE-2026-44285 FastGPT: SSRF Protection Bypass via `externalFile` in Dataset Preview API
- CVE-2026-44284 FastGPT: Stored MCP tool URL SSRF in FastGPT workflow execution
- CVE-2026-44283 etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checks
- CVE-2026-44282 Election question titles allow stored script execution
- CVE-2026-44281 GLPI vulnerable to unauthorized reading of a specific asset object
- CVE-2026-4428 CRL Distribution Point Scope Check Logic Error in AWS-LC
- CVE-2026-44279 Information disclosure in FortiTokenAndroid
- CVE-2026-44278 Hardcoded credentials in FortiClientWindows
- CVE-2026-44277 Missing authorization in FortiAuthenticator
- CVE-2026-44276 Information disclosure in PowerProtect Data Manager
- CVE-2026-44275 Path traversal in Dell/Alienware Purchased Apps
- CVE-2026-44274 Path traversal in Wyse Management Suite (WMS)
- CVE-2026-44273 Hardcoded credentials in Wyse Management Suite (WMS)
- CVE-2026-44272 SQL injection in Wyse Management Suite (WMS)
- CVE-2026-44271 SQL injection in Wyse Management Suite (WMS)
- CVE-2026-44269 Path traversal in PowerProtect Data Domain
- CVE-2026-44268 Misconfiguration in PowerProtect Data Domain
- CVE-2026-44264 Weblate is vulnerable to XSS via crafted Markdown
- CVE-2026-44263 Weblate: Private Translation Enumeration via Screenshot API
- CVE-2026-44262 Scramble: Remote code execution via evaluation of user-controlled input in validation rules
- CVE-2026-44260 efw4.X: readonly Flag Not Enforced Server-Side
- CVE-2026-4426 Libarchive: libarchive: denial of service via malformed iso file processing
- CVE-2026-44259 efw4.X: Stored XSS via previewServlet
- CVE-2026-44258 efw4.X: Path Traversal via Unchecked dst Parameter leads to Remote Code Execution
- CVE-2026-44257 efw4.X: RCE via zipslip
- CVE-2026-44256 Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username
- CVE-2026-44255 Wazuh: Username Enumeration via Timing Side-Channel
- CVE-2026-44254 Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path
- CVE-2026-44253 Wazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulation
- CVE-2026-44252 Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation
- CVE-2026-44251 Integer overflow in wazuh
- CVE-2026-44250 Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays
- CVE-2026-44249 Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking
- CVE-2026-44248 Netty: Resource exhaustion in MqttDecoder
- CVE-2026-44247 Volcano: Webhook server vulnerable to OOM due to unbounded HTTP request body size
- CVE-2026-44246 nnU-Net: Agentic workflow injection in `.github/workflows/issue-triage.yml` of `MIC-DKFZ/nnUNet`
- CVE-2026-44245 Kyverno: [policy-reporter-ui] XSS via Stored Property Values in PropertyCard Component
- CVE-2026-44244 GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
- CVE-2026-44243 GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository
- CVE-2026-44242 Micronaut has Unbounded `bundleCache` in `ResourceBundleMessageSource` that Allows Memory Exhaustion via `Accept-Language` Header
- CVE-2026-44241 Micronaut has unbounded `formattersCache` in `TimeConverterRegistrar` that Allows Memory Exhaustion via `Accept-Language` Header
- CVE-2026-44240 basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering
- CVE-2026-4424 Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing
- CVE-2026-44239 FreePBX: Authenticated Local File Inclusion in Dashboard Module
- CVE-2026-44238 FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports
- CVE-2026-44237 FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module
- CVE-2026-44236 rabbitmq-c: Heap buffer overflow in AMQP login handshake via undersized connection.tune.frame_max
- CVE-2026-44235 rabbitmq-c: size_t underflow in AMQP frame length computation leads to out-of-bounds read
- CVE-2026-44232 dssrf: every IPv6 category bypasses is_url_safe
- CVE-2026-44231 RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint
- CVE-2026-44230 RT: Reflected Cross-Site Scripting in search results chart
- CVE-2026-44229 RT: Cross-Site Scripting via inline-served uploaded content
- CVE-2026-44228 RT: Stored Cross-Site Scripting via insufficient template escaping
- CVE-2026-44227 RT: Reflected Cross-Site Scripting via URL parameters
- CVE-2026-44226 pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUI
- CVE-2026-44225 Pulpy: Incomplete filesystem sandbox in pulpy.fs bridge allows packaged web apps to read arbitrary user files
- CVE-2026-44224 Wiki.js: Privilege Escalation via Missing Group Validation in users.update
- CVE-2026-44223 vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters
- CVE-2026-44222 vLLM: Remote DoS via Special-Token Placeholders
- CVE-2026-44221 ArcadeDB: Cross-database authorization bypass and unsecured newly-created databases
- CVE-2026-44220 ciguard: discover_pipeline_files follows symlinks out of scan root
- CVE-2026-44219 ciguard: SCA HTTP client reads response body without size cap
- CVE-2026-44218 ciguard: Container image runs as root (no USER directive)
- CVE-2026-44217 sse-channel: SSE Injection via unsanitized event fields
- CVE-2026-44216 Wasmtime: Panic when allocating a table exceeding the size of the host's address space
- CVE-2026-44215 NanaZip: Heap out-of-bounds write in NanaZip UFS directory parser
- CVE-2026-44214 eventsource-encoder: SSE event injection via unsanitized event and id fields
- CVE-2026-44213 OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured
- CVE-2026-44212 PrestaShop: Stored XSS executable in customer service view
- CVE-2026-44211 Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability
- CVE-2026-44210 Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations
- CVE-2026-44209 Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTI
- CVE-2026-44208 Frappe: IDOR in `submit_discussion()`
- CVE-2026-44207 Frappe: Insecure Direct Object Reference for email accounts
- CVE-2026-44206 Frappe: DB Schema Enumeration via Frappe-Authorization-Source
- CVE-2026-44205 Frappe: Stored Cross-Site Scripting (XSS) in User Profile through Image Upload
- CVE-2026-44204 Shelf: SQL Injection via sortBy Parameter
- CVE-2026-44203 OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)
- CVE-2026-44202 OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`
- CVE-2026-44201 Wagtail: Improper restriction handling on Documents and Images API
- CVE-2026-44200 Wagtail: Improper permission handling when copying pages
- CVE-2026-4420 Stored XSS via Page Creating functionality in Bludit
- CVE-2026-44199 Wagtail: Improper permission handling when deleting form submissions
- CVE-2026-44198 Wagtail: Improper permission handling when viewing page history
- CVE-2026-44197 Wagtail: Improper permission handling when comparing revisions
- CVE-2026-44196 Pingvin Share X: TOTP Authentication Bypass via Password-only Login