Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 639 of 1013.
- CVE-2026-43652 Missing authorization in macOS
- CVE-2026-4365 LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion
- CVE-2026-43646 Apache Wicket: crafted URLs can bypass PackageResourceGuard
- CVE-2026-43644 podinfo 6.11.2 Reflected XSS via /echo Endpoint
- CVE-2026-43643 Softaculous Virtualizor Authorization Bypass via Billing Module Handler
- CVE-2026-43642 Softaculous Virtualizor PHP Object Injection via Billing Module Handler
- CVE-2026-43641 Softaculous Virtualizor OS Command Injection via Billing Module Handler
- CVE-2026-43640 Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key
- CVE-2026-4364 Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- CVE-2026-43639 Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients
- CVE-2026-43638 Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import
- CVE-2026-43637 Cornac < 2.6.0 Path Traversal via _extract_archive() in download.py
- CVE-2026-43634 HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header
- CVE-2026-43633 HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal
- CVE-2026-43632 llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints
- CVE-2026-43631 llama.cpp b7492–b9060 Use-After-Free RCE via llama-server
- CVE-2026-43630 llama.cpp b4882-b8487 Out-of-Bounds Read Information Disclosure
- CVE-2026-4363 Incorrect Authorization in GitLab
- CVE-2026-43629 llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore
- CVE-2026-43628 llama.cpp b3978–b9058 Integer Underflow via DRY Sampler
- CVE-2026-43627 llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function
- CVE-2026-43625 CodexBar < 0.32.0 Session Cookie Exposure via HTTP Redirect
- CVE-2026-43624 F5-TTS 1.1.20 Path Traversal via finetune_gradio.py create_data_project()
- CVE-2026-43623 microtar 0.1.0 Stack-Based Buffer Overflow via raw_to_header()
- CVE-2026-43622 llama.cpp b1886–b7445 Double Free via llama-android.cpp
- CVE-2026-43621 Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()
- CVE-2026-43620 Rsync < 3.4.3 Out-of-Bounds Array Read via recv_files()
- CVE-2026-4362 ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite
- CVE-2026-43619 Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls
- CVE-2026-43618 Rsync < 3.4.3 Integer Overflow Information Disclosure
- CVE-2026-43617 Rsync < 3.4.3 Authorization Bypass via Hostname Resolution
- CVE-2026-43616 Detect-It-Easy < 3.21 Path Traversal Arbitrary File Write
- CVE-2026-4361 Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter
- CVE-2026-43606 Weak cryptography in Vitis™ Libraries - Security Module
- CVE-2026-4360 Tarfile.extract() doesn't fully respect filter parameter
- CVE-2026-43598 Memory corruption in AMD Instinct™ MI210
- CVE-2026-4359 Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer
- CVE-2026-43585 OpenClaw < 2026.4.15 - Bearer Token Validation Bypass via Stale SecretRef Resolution
- CVE-2026-43584 OpenClaw < 2026.4.10 - Insufficient Environment Variable Denylist in Exec Policy
- CVE-2026-43583 OpenClaw 2026.4.10 < 2026.4.14 - Loss of Group Tool-Policy Context in Delivery Queue Recovery
- CVE-2026-43582 OpenClaw < 2026.4.10 - DNS Rebinding SSRF via Hostname Validation Bypass
- CVE-2026-43581 OpenClaw < 2026.4.10 - Chrome DevTools Protocol Exposure via Overly Broad CDP Relay Binding
- CVE-2026-43580 OpenClaw < 2026.4.10 - Incomplete Navigation Guard Coverage in Browser Interactions
- CVE-2026-4358 Memory safety issues in slot-based execution hash table spill
- CVE-2026-43579 OpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes
- CVE-2026-43578 OpenClaw: Heartbeat owner downgrade missed local async exec completion events
- CVE-2026-43577 OpenClaw < 2026.4.9 - Arbitrary File Read via Browser Interaction Routes
- CVE-2026-43576 OpenClaw < 2026.4.5 - Second-hop SSRF via CDP /json/version WebSocket URL
- CVE-2026-43575 OpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper Route
- CVE-2026-43574 OpenClaw < 2026.4.12 - Improper Authorization via Empty Approver Lists
- CVE-2026-43573 OpenClaw < 2026.4.10 - SSRF Policy Bypass in Existing-Session Browser Interaction Routes
- CVE-2026-43572 OpenClaw 2026.4.10 < 2026.4.14 - Missing Sender Authorization in Microsoft Teams SSO Invoke Handler
- CVE-2026-43571 OpenClaw < 2026.4.10 - Untrusted Workspace Plugin Shadow Resolution in Channel Setup
- CVE-2026-43570 OpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path Handling
- CVE-2026-4357 Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload
- CVE-2026-43569 OpenClaw < 2026.4.9 - Untrusted Provider Plugin Auto-enablement via Workspace Provider Auth
- CVE-2026-43568 OpenClaw 2026.4.5 through 2026.4.9 - Privilege Escalation via Memory Dreaming Configuration in /dreaming Endpoint
- CVE-2026-43567 OpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter
- CVE-2026-43566 OpenClaw 2026.4.7 < 2026.4.14 - Privilege Escalation via Untrusted Webhook Wake Events
- CVE-2026-4356 itsourcecode University Management System add_result.php cross site scripting
- CVE-2026-4355 Portabilis i-Educar Endpoint educar_servidor_curso_lst.php cross site scripting
- CVE-2026-4354 TRENDnet TEW-824DRU Web apply_sec.cgi sub_420A78 cross site scripting
- CVE-2026-43535 OpenClaw < 2026.4.14 - Authorization Context Reuse in Collect-Mode Queue Batches
- CVE-2026-43534 OpenClaw < 2026.4.10 - Unsanitized External Input in Agent Hook Events
- CVE-2026-43533 OpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media Tags
- CVE-2026-43532 OpenClaw 2026.4.7 < 2026.4.10 - Sandbox Media Normalization Bypass via Discord Event Cover Image
- CVE-2026-43531 OpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env File
- CVE-2026-43530 OpenClaw 2026.2.23 < 2026.4.12 - Weakened Exec Approval Binding via busybox and toybox Applet Execution
- CVE-2026-4353 CI HUB Connector <= 1.2.106 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
- CVE-2026-43529 OpenClaw < 2026.4.10 - Time-of-Check-Time-of-Use (TOCTOU) Race Condition in exec Script Preflight Validator
- CVE-2026-43528 OpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig Aliases
- CVE-2026-43527 OpenClaw < 2026.4.14 - Server-Side Request Forgery via Private Network Navigation
- CVE-2026-43526 OpenClaw < 2026.4.12 - Server-Side Request Forgery via QQBot Reply Media URL Handling
- CVE-2026-4352 JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter
- CVE-2026-43515 Apache Tomcat: Security constraints not correctly applied
- CVE-2026-43514 Apache Tomcat: AJP secret compared in non-constant time
- CVE-2026-43513 Apache Tomcat: LockOutRealm treats user names as case-sensitive
- CVE-2026-43512 Apache Tomcat: Digest authenticator will authenticate any unknown user
- CVE-2026-43510 CISA manage.get.gov insecure portfolio administrative privileges
- CVE-2026-4351 Perfmatters <= 2.5.9 - Authenticated (Subscriber+) Arbitrary File Overwrite via 'snippets' Parameter
- CVE-2026-43507 Denial of service in Prosody
- CVE-2026-43506 Denial of service in Prosody
- CVE-2026-43505 Security feature bypass in Prosody
- CVE-2026-43504 Security feature bypass in Prosody
- CVE-2026-43503 net: skbuff: propagate shared-frag marker through frag-transfer helpers
- CVE-2026-43502 net/rds: handle zerocopy send cleanup before the message is queued
- CVE-2026-43501 ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
- CVE-2026-43500 rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
- CVE-2026-4350 Perfmatters <= 2.5.9.1 - Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' Parameter
- CVE-2026-43499 rtmutex: Use waiter::task instead of current in remove_waiter()
- CVE-2026-43498 accel/ivpu: Disallow re-exporting imported GEM objects
- CVE-2026-43497 fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
- CVE-2026-43496 net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked
- CVE-2026-43495 net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler
- CVE-2026-43494 net/rds: reset op_nents when zerocopy page pin fails
- CVE-2026-43493 crypto: pcrypt - Fix handling of MAY_BACKLOG requests
- CVE-2026-43492 lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
- CVE-2026-43491 net: qrtr: ns: Limit the maximum server registration per node
- CVE-2026-43490 ksmbd: validate inherited ACE SID length
- CVE-2026-4349 Duende IdentityServer4 Token Renewal Endpoint authorize improper authentication