Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 635 of 1013.
- CVE-2026-4406 Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter
- CVE-2026-44059 Non-reentrant privilege toggle
- CVE-2026-44058 Authentication bypass via admin auth user
- CVE-2026-44057 Dead bounds check in Spotlight RPC unmarshaller
- CVE-2026-44056 Stack buffer overflow in desktop.c
- CVE-2026-44055 Bitwise OR logic bug enables shell injection
- CVE-2026-44054 Predictable afpd session token
- CVE-2026-44053 Weak cryptography in DHCAST128 UAM
- CVE-2026-44052 LDAP simple-bind password exposure in log output
- CVE-2026-44051 Arbitrary file read via attacker-controlled symlink creation
- CVE-2026-44050 Heap buffer overflow in CNID daemon comm_rcv()
- CVE-2026-4405 IBM Concert Software Use of Web Browser Cache Containing Sensitive Information
- CVE-2026-44049 Out-of-bounds write in convert_charset() null termination
- CVE-2026-44048 Stack buffer overflow via UCS-2 type confusion in convert_charset()
- CVE-2026-44047 SQL injection in MySQL CNID backend
- CVE-2026-44046 Apache APISIX: wolf-rbac plugin Identity Spoofing
- CVE-2026-44042 UltraVNC repeater wi_uudecode off-by-one in base64 decode boundary check
- CVE-2026-44041 UltraVNC vncWc2Mb calls wcslen() before validating that the wide string is NUL-terminated
- CVE-2026-44040 UltraVNC vncauth.c uses time-seeded libc rand() to generate VNC authentication challenge bytes
- CVE-2026-4404 Use of hard coded credentials in GoHarbor Harbor
- CVE-2026-44038 Global buffer out-of-bounds read in DCMTK JPEG Huffman decoding
- CVE-2026-44037 Uncontrolled recursion in DCMTK JSON reader allows denial of service
- CVE-2026-44036 Uncontrolled recursion in DCMTK xml2dcm allows denial of service
- CVE-2026-44035 Uncontrolled recursion in DCMTK DICOMDIR parsing allows denial of service
- CVE-2026-44034 Heap out-of-bounds read in DCMTK RLE decodeFrame()
- CVE-2026-44033 Uncontrolled recursion in the DCMTK bundled XML parser allows denial of service
- CVE-2026-44031 Uncontrolled recursion in the DCMTK DICOM dataset parser allows unauthenticated remote denial of service
- CVE-2026-44029 Path traversal in Nix
- CVE-2026-44028 Memory corruption in Lix
- CVE-2026-44025 Fluentd: Exposure of Sensitive Information via Monitor Agent API
- CVE-2026-44024 Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder
- CVE-2026-44023 Docling Core has unsafe remote filename resolution
- CVE-2026-44022 Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands
- CVE-2026-44020 Docling: Unsafe XML Entity Expansion in USPTO Patent Backend
- CVE-2026-44019 Docling Core has insufficient validation of image reference URIs
- CVE-2026-44018 Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
- CVE-2026-44017 Docling: Unsafe Zip Extraction in EasyOCR Model Download
- CVE-2026-44016 Docling: Unsafe Playwright-based HTML Rendering
- CVE-2026-44015 Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services
- CVE-2026-44012 Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
- CVE-2026-44011 Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior
- CVE-2026-44010 Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
- CVE-2026-4401 Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling
- CVE-2026-44009 vm2: Sandbox Breakout Through Null Proto Exception
- CVE-2026-44008 vm2: Snabox breakout via `neutralizeArraySpeciesBatch`
- CVE-2026-44007 vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution
- CVE-2026-44006 vm2: Sandbox Escape
- CVE-2026-44005 vm2: Sandbox escape
- CVE-2026-44004 vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)
- CVE-2026-44003 vm2: Transformer Fast-Path Bypass Exposes Internal State Variable
- CVE-2026-44002 vm2: Host File Path Disclosure via Stack Trace Information Leak
- CVE-2026-44001 vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
- CVE-2026-44000 vm2: sandbox boundary bypass via host Promise resolution preserving host object identity
- CVE-2026-4400 Multiple vulnerabilities in 1millionbot Millie chatbot
- CVE-2026-43999 vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape
- CVE-2026-43998 vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape
- CVE-2026-43997 vm2: Sandbox Escape
- CVE-2026-43996 Integer overflow in OpenImageIO
- CVE-2026-43995 Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)
- CVE-2026-43994 Coturn: Stack buffer overflow in decode_oauth_token_gcm()
- CVE-2026-43993 JunoClaw: SSRF in WAVS computeDataVerify allows cloud-metadata and internal-service access
- CVE-2026-43992 JunoClaw: MCP write tools exposed raw BIP-39 mnemonic as a tool-call parameter
- CVE-2026-43991 JunoClaw: plugin-shell shell-injection bypass via substring blocklist
- CVE-2026-43990 JunoClaw: plugin-shell shell-metacharacter injection via shell wrapper
- CVE-2026-4399 Multiple vulnerabilities in 1millionbot Millie chatbot
- CVE-2026-43989 JunoClaw: upload_wasm accepted arbitrary filesystem paths without validation
- CVE-2026-43988 Vanetza: Remote Denial of Service via Uncaught Exception in ASN.1/OER Parsing
- CVE-2026-43986 Tautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay
- CVE-2026-43985 Taultulli has CSRF in /configUpdate via missing anti-CSRF and method restriction that allows admin credential takeover
- CVE-2026-43984 Tautulli has stored XSS in logFile via guest-controlled log_js_errors input
- CVE-2026-43983 Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions
- CVE-2026-43982 Algernon: Path traversal file write via savein()
- CVE-2026-43981 Algernon: Race Condition in handle() shared LState
- CVE-2026-43980 Malla: Stored XSS via Meshtastic node names in multiple frontend pages
- CVE-2026-4398 Authorization Bypass Through User-Controlled Key in GitLab
- CVE-2026-43979 Local Deep Research: HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)
- CVE-2026-43978 wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers
- CVE-2026-43977 wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API
- CVE-2026-43976 wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
- CVE-2026-43975 Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager
- CVE-2026-43974 gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM
- CVE-2026-43973 gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion
- CVE-2026-43972 gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection
- CVE-2026-43971 Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1
- CVE-2026-43970 Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame
- CVE-2026-43969 Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
- CVE-2026-43968 CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1
- CVE-2026-43967 Quadratic fragment-name uniqueness check causes denial of service in absinthe
- CVE-2026-43966 HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
- CVE-2026-43965 Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion
- CVE-2026-43964 Memory corruption in Postfix
- CVE-2026-43961 Code injection in Red Hat Enterprise Linux 10
- CVE-2026-4396 Security feature bypass in Hub Reporting Service
- CVE-2026-43958 Rrdtool: rrdtool: stack buffer overflow allows local code execution or denial of service
- CVE-2026-43951 Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash
- CVE-2026-4395 Heap-based buffer overflow in wc_ecc_import_x963_ex KCAPI path
- CVE-2026-43948 wger: cross-tenant password reset and plaintext disclosure via gym=None bypass
- CVE-2026-43947 FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass
- CVE-2026-43946 FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
- CVE-2026-43945 FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection