Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 652 of 1013.
- CVE-2026-42327 rust-openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs
- CVE-2026-42326 ImageMagick: Heap Buffer Over-Read in IPTC encoder
- CVE-2026-42324 Piwigo: Second-Order SQL Injection
- CVE-2026-42323 Piwigo: SQL Injection in Batch Manager
- CVE-2026-42322 Piwigo: Authenticated RCE via File Upload in Logo Upload Feature
- CVE-2026-42321 GLPI has stored XSS in asset locks
- CVE-2026-42320 GLPI vulnerable to arbitrary file access
- CVE-2026-4232 Tiandy Integrated Management Platform getAuthorityByUserId sql injection
- CVE-2026-42318 GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint
- CVE-2026-42317 GLPI vulnerable to arbitrary files deletion by technician
- CVE-2026-42316 KQL injection via kusto.tables.topics.mapping in kafka-sink-azure-kusto
- CVE-2026-42315 pyLoad: Path Traversal via Package Folder Name in set_package_data
- CVE-2026-42314 pyLoad: Path Traversal via Package Folder Name
- CVE-2026-42313 pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy
- CVE-2026-42312 pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification
- CVE-2026-42311 Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)
- CVE-2026-42310 Pillow: PDF Parsing Trailer Infinite Loop (DoS)
- CVE-2026-4231 vanna-ai vanna Endpoint __init__.py run_sql server-side request forgery
- CVE-2026-42309 Pillow: Heap buffer overflow with nested list coordinates
- CVE-2026-42308 Pillow: Integer overflow when processing fonts
- CVE-2026-42307 Vim: OS Command Injection in netrw
- CVE-2026-42306 Moby: Race condition in docker cp allows bind mount redirection to host path
- CVE-2026-42305 Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows
- CVE-2026-42304 Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
- CVE-2026-42303 Fides: Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection
- CVE-2026-42302 FastGPT: Unauthenticated Remote Code Execution (RCE) via code-server Misconfiguration in agent-sandbox
- CVE-2026-42301 Improper Input Validation leading to Improper Control of Generation of Code ('Code Injection') in pyp2spec
- CVE-2026-42300 DevGuard: Unauthenticated identity assertion via `X-Admin-Token` header
- CVE-2026-4230 vanna-ai vanna Endpoint __init__.py update_sql sql injection
- CVE-2026-42298 Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev
- CVE-2026-42297 Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
- CVE-2026-42296 Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure
- CVE-2026-42295 Argo Workflows: Exposure of artifact repository credentials
- CVE-2026-42294 Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
- CVE-2026-42291 SysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional
- CVE-2026-42290 protobufjs-cli: OS Command Injection
- CVE-2026-4229 vanna-ai vanna bigquery_vector.py remove_training_data sql injection
- CVE-2026-42289 ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation
- CVE-2026-42288 ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORD
- CVE-2026-42287 Emlog: SQL Injection Vulnerability in log_model.php within addLog() and updateLog() Functions
- CVE-2026-42286 Emlog: Cross-Site Request Forgery in Admin Functions
- CVE-2026-42285 GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)
- CVE-2026-42284 GitPython: Unsafe option check validates multi_options before shlex.split transforms it
- CVE-2026-42283 DevSpace UI Server WebSocket CheckOrigin does not validate source
- CVE-2026-42282 n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP mode
- CVE-2026-42281 MagicMirror²: Unauthenticated SSRF via /cors endpoint
- CVE-2026-42280 Improper Permission Checking in Auth.js SDK
- CVE-2026-4228 LB-LINK BL-WR9000 set_wifi sub_458754 command injection
- CVE-2026-42279 solidtime: Time entry update endpoint allows cross-organization modification of a known time-entry UUID
- CVE-2026-42278 UltraDAG: Smart Account Spending Policy Bypass via Pockets
- CVE-2026-42277 Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files
- CVE-2026-42276 Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions
- CVE-2026-42275 zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write
- CVE-2026-42274 Heimdall: Authorization bypass via path normalization mismatch
- CVE-2026-42273 Heimdall: Case-sensitive host matching may lead to policy bypass
- CVE-2026-42272 Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation
- CVE-2026-42271 BerriAI LiteLLM Command Injection
- CVE-2026-42270 countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception
- CVE-2026-4227 LB-LINK BL-WR9000 get_hidessid_cfg sub_44D844 buffer overflow
- CVE-2026-42269 countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion
- CVE-2026-42268 ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators
- CVE-2026-42267 Kimai: Formula Injection via tag names in XLSX export
- CVE-2026-42266 JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
- CVE-2026-42264 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking
- CVE-2026-42261 PromptHub: Authenticated SSRF via IPv6 filter bypass in `POST /api/skills/fetch-remote`
- CVE-2026-42260 open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`
- CVE-2026-4226 LB-LINK BL-WR9000 get_virtual_cfg sub_44E8D0 stack-based overflow
- CVE-2026-42259 Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)
- CVE-2026-42258 net-imap: Command Injection via unvalidated Symbol inputs
- CVE-2026-42257 net-imap: Command Injection via "raw" arguments to multiple commands
- CVE-2026-42256 net-imap: Denial of service via high iteration count for `SCRAM-*` authentication
- CVE-2026-42255 Denial of service in DnsServer
- CVE-2026-42254 Other in Hickory DNS
- CVE-2026-42253 Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties
- CVE-2026-42252 Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern
- CVE-2026-42251 Hard-coded credentials in KS-SOMED
- CVE-2026-42250 Off-by-One Leading to Out-of-Bounds Write in bzip2
- CVE-2026-4225 CMS Made Simple User Management listusers.php cross site scripting
- CVE-2026-42249 Remote Code Execution in Ollama via Update Mechanism
- CVE-2026-42248 Missing Signature Verification for Updates in Ollama
- CVE-2026-42246 net-imap vulnerable to STARTTLS stripping via invalid response timing
- CVE-2026-42245 net-imap: Quadratic complexity when reading response literals
- CVE-2026-42241 ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width
- CVE-2026-4224 Stack overflow parsing XML with deeply nested DTD content models
- CVE-2026-42239 Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover
- CVE-2026-42238 Unauthenticated Remote Code Execution via Backup Restore in nginx-ui
- CVE-2026-42237 n8n: SQL Injection in Snowflake and MySQL Nodes
- CVE-2026-42236 n8n: Unauthenticated Denial of Service via MCP Client Registration
- CVE-2026-42235 n8n: XSS via MCP OAuth client
- CVE-2026-42234 n8n: Python Task Runner Sandbox Escape
- CVE-2026-42233 n8n: SQL Injection in Oracle Database Node via Limit Field
- CVE-2026-42232 n8n: XML Node Prototype Pollution to RCE
- CVE-2026-42231 n8n: Prototype Pollution in XML Webhook Body Parser Leads to RCE
- CVE-2026-42230 n8n: Open Redirect in MCP OAuth Consent Flow
- CVE-2026-4223 itsourcecode Payroll Management System manage_employee.php sql injection
- CVE-2026-42229 n8n: SQL Injection in SeaTable Node
- CVE-2026-42228 n8n: Hijacking of Unauthenticated Chat Execution
- CVE-2026-42227 n8n: Public API Variables IDOR Allows Cross-Project Secret Disclosure
- CVE-2026-42226 n8n: Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay
- CVE-2026-42225 GnuTLS backend silently skips certificate chain verification when verify_peer is false