Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 653 of 1013.
- CVE-2026-42224 ipl/web is vulnerable to reflected XSS by malformed search requests
- CVE-2026-42223 nginx-ui: Settings API Exposes Protected Secrets
- CVE-2026-42222 nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover
- CVE-2026-42221 nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim
- CVE-2026-42220 Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback
- CVE-2026-4222 SSCMS download PathUtils.RemoveParentPath path traversal
- CVE-2026-42219 Frappe: Path Traversal via /backups Route
- CVE-2026-42218 XRDP is vulnerable to a server timing attack, leading to user enumeration
- CVE-2026-42217 OpenEXR: Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`)
- CVE-2026-42216 OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion
- CVE-2026-42215 GitPython: Command injection via Git options bypass
- CVE-2026-42214 Improper Control of Generation of Code ('Code Injection') in dail8859/NotepadNext
- CVE-2026-42213 SolidCAM-GPPL-IDE: Path traversal in `inc` directive enables file probing and NTLM-hash leak
- CVE-2026-42212 SolidCAM-GPPL-IDE: XML External Entity (XXE) and billion-laughs DoS in VMID parser
- CVE-2026-42211 React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
- CVE-2026-42210 Webmin 2FA requirement bypass
- CVE-2026-4221 Tiandy Easy7 Integrated Management Platform Endpoint uploadLedImage unrestricted upload
- CVE-2026-42209 FlashMQ: Division by zero crash when using non-default deferred retained message setting
- CVE-2026-42208 BerriAI LiteLLM SQL Injection
- CVE-2026-42207 Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts
- CVE-2026-42206 Roadiz OpenID Connect nonce generated but never validated — ID token replay attack
- CVE-2026-42205 Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources
- CVE-2026-42204 Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root
- CVE-2026-42203 LiteLLM: Server-Side Template Injection in /prompts/test endpoint
- CVE-2026-42202 nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields
- CVE-2026-42201 Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands
- CVE-2026-42200 Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE
- CVE-2026-4220 Technologies Integrated Management Platform SetWebpagePic.jsp unrestricted upload
- CVE-2026-42199 Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior
- CVE-2026-42198 pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS
- CVE-2026-42197 RELATE Vulnerable to Stored XSS via Unprivileged User Profile
- CVE-2026-42196 django-s3file: Relative path traversal
- CVE-2026-42195 Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host
- CVE-2026-42194 Incomplete fix for CVE-2026-32812: SSRF in admidio
- CVE-2026-42193 Plunk: SNS webhook forgery
- CVE-2026-42192 Plunk: Stored XSS in campaign view
- CVE-2026-42191 OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter
- CVE-2026-42190 RedwoodSDK: Same-site CSRF in in server actions
- CVE-2026-4219 INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App ae.index.apgcs BuildConfig.java hard-coded credentials
- CVE-2026-42189 Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive auth
- CVE-2026-42188 Geyser: Server-Side Request Forgery (SSRF) via Player Head Texture URL
- CVE-2026-42186 OpenBao's Namespace Deletion May Not Delete Data Properly
- CVE-2026-42185 People: Privilege Escalation via Missing Role Ceiling in Mail Domain Invitation
- CVE-2026-42184 Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands
- CVE-2026-42183 Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
- CVE-2026-42181 Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image
- CVE-2026-42180 Lemmy: SSRF in /api/v3/post via Webmention dispatch
- CVE-2026-4218 myAEDES App aedes.me.beta EngageBayUtils.java information disclosure
- CVE-2026-42177 linux-entra-sso: PRT SSO cookie can leak to attacker-controlled hosts when broad host permissions are granted
- CVE-2026-42176 Auth bypass in scoold
- CVE-2026-42175 requests-hardened: Server-Side Request Forgery (SSRF) in requests-hardened RFC 6598
- CVE-2026-42174 Kirby: User avatar creation, replacement and deletion are not gated by user update permissions
- CVE-2026-42172 Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access
- CVE-2026-42171 Privilege escalation in Nullsoft Scriptable Install System
- CVE-2026-42170 Gimp: gimp dds plug-in heap-based buffer overflow via bpp mismatch in load_layer() (ddsread.c)
- CVE-2026-4217 XREAL Nebula App ai.nreal.nebula.universal CloudStoragePlugin.java credentials storage
- CVE-2026-42169 Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)
- CVE-2026-42168 django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model.
- CVE-2026-42167 SQL injection in ProFTPD
- CVE-2026-42164 Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows
- CVE-2026-42163 Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under
- CVE-2026-42162 Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an
- CVE-2026-42160 Missing authorization in dataspace-portal
- CVE-2026-4216 i-SENS SmartLog App air.SmartLog.android hard-coded credentials
- CVE-2026-42159 Flowsint: Stored XSS in description of node
- CVE-2026-42158 Flowsint: Broken Access Control allows modification of investigation metadata from any user
- CVE-2026-42157 Flowsint: Stored XSS on map node marker in map page
- CVE-2026-42156 Flowsint: Cypher query injection in node type on node creation
- CVE-2026-42155 Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs
- CVE-2026-42154 Prometheus: remote read endpoint allows denial of service via crafted snappy payload
- CVE-2026-42153 Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container
- CVE-2026-42151 Prometheus Azure AD remote write OAuth client secret exposed via config API
- CVE-2026-42150 wlc: print_html outputs API data without HTML escaping, enabling stored XSS
- CVE-2026-4215 FlowCI flow-core-x SMTP Host ConfigServiceImpl.java save server-side request forgery
- CVE-2026-42148 Coolify: Command Injection via Unescaped Version String in Docker Build
- CVE-2026-42147 Coolify: SSRF via S3 Storage Endpoint in testConnection()
- CVE-2026-42146 CImg Library: Uncontrolled memory allocation via nb_colors field in _load_bmp
- CVE-2026-42145 Coolify: File Upload Without Type or Size Validation in Database Backup Restore
- CVE-2026-42144 CImg Library: Integer overflow in PNM size check bypasses memory guard (_load_pnm)
- CVE-2026-42143 Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers
- CVE-2026-42142 TypeBot has Authorization Bypass in Google Sheets `getSheets` Endpoint that Allows Cross-Workspace Credential Access
- CVE-2026-42141 Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality
- CVE-2026-42140 Server-Side Request Forgery (SSRF) in PlantUML Macro via 'server' parameter
- CVE-2026-4214 D-Link DNS-1550-04 app_mgr.cgi UPnP_AV_Server_Path_Setting stack-based overflow
- CVE-2026-42138 Dify Vulnerable to Stored XSS via SVG-file upload
- CVE-2026-42137 Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API
- CVE-2026-4213 D-Link DNS-1550-04 gui_mgr.cgi cgi_myfavorite_verify stack-based overflow
- CVE-2026-42129 Path traversal in the Loki data source plugin
- CVE-2026-42127 Pre-authentication denial of service in the public dashboard query endpoint
- CVE-2026-4212 D-Link DNS-1550-04 download_mgr.cgi Downloads_Schedule_Info stack-based overflow
- CVE-2026-4211 D-Link DNS-1550-04 local_backup_mgr.cgi Local_Backup_Info stack-based overflow
- CVE-2026-42100 DoS in Sparx Pro Cloud Server
- CVE-2026-4210 D-Link DNS-1550-04 time_machine.cgi cgi_tm_set_share command injection
- CVE-2026-42099 Race Condition in Sparx Pro Cloud Server
- CVE-2026-42098 Authorization Bypass in Sparx Enterprise Architect
- CVE-2026-42097 Authentication Bypass in Sparx Pro Cloud Server
- CVE-2026-42096 Broken Access Control in Sparx Pro Cloud Server
- CVE-2026-42095 Missing authorization in Arianna
- CVE-2026-42093 Redash: SQL Injection via Query Results parameterized query substitution
- CVE-2026-42092 Global Settings Publication Exposes Sensitive Configuration to Any Authenticated User in Titra