Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 649 of 1013.
- CVE-2026-42618 Memory corruption in tuxera:ntfs-3g
- CVE-2026-42617 Memory corruption in tuxera:ntfs-3g
- CVE-2026-42616 Memory corruption in tuxera:ntfs-3g
- CVE-2026-42615 CyberChef has a Cross-site Scripting issue
- CVE-2026-42613 Grav: Privilege Escalation via Missing Server-Side Validation of groups/access
- CVE-2026-42612 Grav: Publisher-Level Stored XSS via Unquoted Event Attributes
- CVE-2026-42611 Grav: Stored XSS via Tag Injection
- CVE-2026-42610 Grav: Sensitive Information Disclosure via Accounts Service Bypass
- CVE-2026-4261 Privilege escalation in Expire Users
- CVE-2026-42609 Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic
- CVE-2026-42608 Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.
- CVE-2026-42607 Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
- CVE-2026-42606 AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass
- CVE-2026-42605 AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload
- CVE-2026-42604 Actual has an OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config`
- CVE-2026-42603 OWASP BLT: pre-commit-fix.yaml executes untrusted fork code via pull_request_target
- CVE-2026-42602 azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay
- CVE-2026-42601 ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView
- CVE-2026-42600 MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint
- CVE-2026-42599 Cross-site scripting via spread attributes in Svelte SSR
- CVE-2026-42598 Pode: Directory Traversal is possible on Static Routes
- CVE-2026-42597 Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme
- CVE-2026-42596 Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook
- CVE-2026-42595 Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass
- CVE-2026-42594 Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine
- CVE-2026-42593 Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes
- CVE-2026-42592 Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes
- CVE-2026-42591 Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8
- CVE-2026-42590 Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklist
- CVE-2026-4259 Ultimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_manage_auctions
- CVE-2026-42589 Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection
- CVE-2026-42588 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector
- CVE-2026-42587 Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS
- CVE-2026-42586 Netty: CRLF Injection in Netty Redis Codec Encoder
- CVE-2026-42585 Netty: HTTP Request Smuggling due to malformed Transfer-Encoding
- CVE-2026-42584 Netty: HttpClientCodec response desynchronization
- CVE-2026-42583 Netty: Lz4FrameDecoder resource exhaustion
- CVE-2026-42582 Netty: HTTP/3 QPACK literal unbounded allocation
- CVE-2026-42581 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
- CVE-2026-42580 Netty: HTTP Request Smuggling due to incorrect chunk size parsing
- CVE-2026-4258 sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey
- CVE-2026-42579 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)
- CVE-2026-42578 Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
- CVE-2026-42577 Netty: epoll transport denial of service via RST on half-closed TCP connection
- CVE-2026-42576 apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery
- CVE-2026-42575 apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)
- CVE-2026-42574 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
- CVE-2026-42573 Svelte: XSS via DOM Clobbering of Internal Framework State
- CVE-2026-42572 Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds`
- CVE-2026-42571 Privilege Escalation Attack affecting Pelican Web UI
- CVE-2026-42570 Svelte devalue: DoS via sparse array deserialization
- CVE-2026-4257 Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
- CVE-2026-42569 phpvms: /importer authorization bypass causing full database wipe
- CVE-2026-42568 Yamcs Vulnerable to LDAP Injection in LdapAuthModule
- CVE-2026-42567 Svelte: ReDoS in `<svelte:element>` Tag Validation
- CVE-2026-42566 Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure
- CVE-2026-42565 @workos/authkit-session: Open Redirect via state-derived redirect target
- CVE-2026-42564 jotty·page: Unauthenticated Path Traversal leads to sensitive file disclosure and session-token reuse impact
- CVE-2026-42563 Dulwich Vulnerable to Command Injection via Merge Driver Path
- CVE-2026-42562 Plainpad: Privilege Escalation via Writable Admin Field in Profile Update (Access Control)
- CVE-2026-42561 Python-Multipart: Denial of Service via unbounded multipart part headers
- CVE-2026-42560 auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation
- CVE-2026-4256 LDAP Injection in PEAKUP's PassGate
- CVE-2026-42559 RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport
- CVE-2026-42558 Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet
- CVE-2026-42557 jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content
- CVE-2026-42556 Postiz stored XSS in public preview page
- CVE-2026-42555 Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users
- CVE-2026-42554 Fiber: XSS in AutoFormat Content Negotiation
- CVE-2026-42553 Cinny: Access token disclosure via invalidated emoji pack avatar URL in service worker
- CVE-2026-42552 Flight: Sensitive information disclosure via default error handler in flightphp/core
- CVE-2026-42551 Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core
- CVE-2026-42550 Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
- CVE-2026-4255 DLL Injection Privilege Escalation
- CVE-2026-42549 Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root
- CVE-2026-42548 Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp()
- CVE-2026-42547 IRIS Alerts Can be Falsely Attributed to Customers
- CVE-2026-42546 OP-TEE has missing OPTEE_MSG_ATTR_TYPE_MASK in cleanup_shm_refs() leaks mobj references
- CVE-2026-42545 Granian: DoS via WSGI response header panic
- CVE-2026-42544 Granian: Unauthenticated DoS via WebSocket subprotocol header panic
- CVE-2026-42543 IRIS has a Cross-Site Request Forgery (CSRF) issue
- CVE-2026-42542 TDengine has an integer underflow in uvConnMayGetUserInfo() allows unauthenticated remote crash (DoS)
- CVE-2026-42541 Kubewarden: RBAC Reconnaissance via unchecked can_i host capability call
- CVE-2026-42540 IRIS has a Mass Assignment issue
- CVE-2026-4254 Tenda AC8 HTTP Endpoint SysToolChangePwd doSystemCmd stack-based overflow
- CVE-2026-42539 IRIS has an Excessive Data Exposure issue
- CVE-2026-42538 IRIS has an Insecure File Upload
- CVE-2026-42537 Apache Ranger: Remote Code Execution via JDBC URL Injection
- CVE-2026-42536 Apache HTTP Server: mod_xml2enc heap overflow
- CVE-2026-42535 Apache HTTP Server: mod_dav_fs protected directory access
- CVE-2026-42534 Jostle logic bypass degrades resolution performance
- CVE-2026-42533 NGINX Map directive and Regex matching vulnerability
- CVE-2026-42532 Path traversal in visidata
- CVE-2026-42530 NGINX Open-Source ngx_http_v3_module vulnerability
- CVE-2026-4253 Tenda AC8 Web UploadCfg route_set_user_policy_rule os command injection
- CVE-2026-42528 Apache HTTP Server: mod_dav shared lock overflow
- CVE-2026-42527 Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure
- CVE-2026-42526 Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends
- CVE-2026-42525 Jenkins Microsoft Entra ID (previously Azure AD) Plugin has an open redirect vulnerability
- CVE-2026-42524 Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file