Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 636 of 1013.
- CVE-2026-43944 electerm: dangerous code can be run through links or command line
- CVE-2026-43943 electerm: RCE via malicious SSH server filename in openFileWithEditor
- CVE-2026-43942 electerm: Full process.env exposed to renderer via window.pre.env in electerm
- CVE-2026-43941 Unvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link click
- CVE-2026-43940 electerm: Path traversal in electerm runWidget leads to arbitrary code execution
- CVE-2026-4394 Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field
- CVE-2026-43939 YAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread Viewers
- CVE-2026-43938 YAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header
- CVE-2026-43937 YAF.NET: Pre-Handler Authorization Bypass on Admin Pages Enabling Blind SQL Execution via `/Admin/RunSql`
- CVE-2026-43936 e107: Server-Side Request Forgery (SSRF) in the remote file fetcher
- CVE-2026-43935 e107: Host Header Injection in e107 password reset enables phishing
- CVE-2026-43934 e107: Broken Access Control in e107 comment edit allows cross-user comment modification
- CVE-2026-43930 Parse Server: MFA SMS one-time password accepted twice under concurrent login
- CVE-2026-4393 Automated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-030
- CVE-2026-43929 ssrfcheck: Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs
- CVE-2026-43928 FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment
- CVE-2026-43927 FOSSBilling has race condition in cart checkout that bypasses promo code usage limits
- CVE-2026-43926 FOSSBilling's password reset confirmation endpoint lacks rate limiting
- CVE-2026-43925 FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code use
- CVE-2026-43924 FOSSBilling has an open redirect via administrator-configured redirect targets
- CVE-2026-43921 FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization
- CVE-2026-43920 FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution
- CVE-2026-4392 TeamSpeak 3 Server clientek Handshake assertion
- CVE-2026-43918 Auth bypass in FOSSBilling
- CVE-2026-43917 Dokploy: Cross-Organization IDOR - Multiple tRPC endpoints missing activeOrganizationId validation
- CVE-2026-43916 pam_authnft: Heap buffer overflow in NETLINK_SOCK_DIAG reply walker
- CVE-2026-43915 Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN username
- CVE-2026-43914 Vaultwarden: Brute-force protection bypass vulnerability
- CVE-2026-43913 Vaultwarden: Unconfirmed Owner Can Purge Entire Organization Vault
- CVE-2026-43912 Vaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization
- CVE-2026-43911 Vaultwarden: Refresh tokens not invalidated on security stamp rotation
- CVE-2026-43910 Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor
- CVE-2026-4391 TeamSpeak 3 Server ECC Key heap-based overflow
- CVE-2026-43909 OpenImageIO: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoder
- CVE-2026-43908 OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder
- CVE-2026-43907 Integer overflow in OpenImageIO
- CVE-2026-43906 OpenImageIO: HEIF Heap overflow
- CVE-2026-43905 OpenImageIO: JPEG2000 (OpenJPH) signed integer overflow in buffer allocation
- CVE-2026-43904 OpenImageIO: Softimage PIC RLE decoder heap buffer overflow — longCount not clamped to image width
- CVE-2026-43903 OpenImageIO: SGI RLE decoder heap buffer overflow OIIO_DASSERT bounds checks are no-ops in release builds
- CVE-2026-43901 Wireshark MCP: Arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured
- CVE-2026-43900 DeepChat: Persistent DOM XSS via HTML Entity Encoding in `<antArtifact>` SVG Rendering (Bypass of `svgSanitizer.ts`)
- CVE-2026-4390 TeamSpeak 3 Server Connection State Management process_resend_queue use after free
- CVE-2026-43899 Code injection in deepchat
- CVE-2026-43898 SandboxJS: Sandbox escape via Function.caller leakage of internal call op
- CVE-2026-43897 Link Preview JS: vunerable to IPv6 and internal loopback attacks
- CVE-2026-43896 jq: Stack Overflow in Recursive Object Merge
- CVE-2026-43895 Security feature bypass in jq
- CVE-2026-43894 jq: Wild stack write via signed-integer overflow in decNumber D2U() macro
- CVE-2026-43893 exiftool-vendored: Argument injection via newline characters in tag names
- CVE-2026-43892 AntSword: Incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection
- CVE-2026-43891 changedetection.io: Arbitrary Local File Read via crafted backup restore
- CVE-2026-43890 Missing authorization in outline
- CVE-2026-4389 Cross-site scripting in DSGVO snippet for Leaflet Map and its Extensions
- CVE-2026-43889 Outline: Unauthorized Document Publication via Mixed collectionId+documentId Share
- CVE-2026-43888 Outline: Zip Extraction Path Escape via PATH_MAX Truncation in Collection Import
- CVE-2026-43887 Outline: Stored XSS via Comment Mentions
- CVE-2026-43886 Outline: OAuth Scope Validation Logic Error Allows Privilege Escalation to Wildcard API Access
- CVE-2026-43885 WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization
- CVE-2026-43884 WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()
- CVE-2026-43883 AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements
- CVE-2026-43882 WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing
- CVE-2026-43881 AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction
- CVE-2026-43880 AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address
- CVE-2026-4388 Form Maker by 10Web <= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box
- CVE-2026-43879 AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass
- CVE-2026-43878 Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal
- CVE-2026-43877 AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content
- CVE-2026-43876 AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers
- CVE-2026-43875 WWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account Takeover
- CVE-2026-43874 AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass
- CVE-2026-43873 AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server
- CVE-2026-43872 actual-server has a path traversal vulnerability
- CVE-2026-43871 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit
- CVE-2026-43870 Apache Thrift: Node.js web_server.js multi-vulnerability
- CVE-2026-4387 Unencrypted storage of authentication state in StrongDM Desktop Application state.kv file
- CVE-2026-43869 Apache Thrift: TSSLTransportFactory.java hostname verification
- CVE-2026-43868 Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern
- CVE-2026-43867 Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter
- CVE-2026-43866 Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder
- CVE-2026-43865 Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution
- CVE-2026-43864 Null dereference in mutt
- CVE-2026-43863 Denial of service in mutt
- CVE-2026-43862 Security feature bypass in mutt
- CVE-2026-43861 Other in mutt
- CVE-2026-43860 Weak cryptography in mutt
- CVE-2026-43859 Memory corruption in mutt
- CVE-2026-43858 Memory corruption in ADAM-3600
- CVE-2026-43857 Code injection in ADAM-3600
- CVE-2026-43856 Memory corruption in ADAM-3600
- CVE-2026-43855 Memory corruption in ADAM-3600
- CVE-2026-43854 Information disclosure in ADAM-3600
- CVE-2026-43853 Denial of service in ADAM-3600
- CVE-2026-43852 Path traversal in ADAM-3600
- CVE-2026-43851 Path traversal in ADAM-3600
- CVE-2026-43850 Command injection in ADAM-3600
- CVE-2026-43849 Memory corruption in ADAM-3600
- CVE-2026-43848 Denial of service in ADAM-3600
- CVE-2026-43847 Auth bypass in ADAM-3600
- CVE-2026-43846 Memory corruption in ADAM-3600