Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 657 of 1013.
- CVE-2026-41691 i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns
- CVE-2026-41690 Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters
- CVE-2026-4169 Tecnick TCExam XML Export tce_xml_users.php F_xml_export_users cross site scripting
- CVE-2026-41689 Server-side request forgery in Wallos
- CVE-2026-41688 Incomplete fix for CVE-2026-33399: SSRF in Wallos
- CVE-2026-41687 Wallos: SSRF CGNAT Bypass in subscription/payments Logo URL — is_cgnat_ip() Not Used in Inline Checks
- CVE-2026-41686 Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool
- CVE-2026-41685 Incus: Unbounded binary import disk exhaustion
- CVE-2026-41684 Incus: Nil Dereferences on Restore via Malformed YAML
- CVE-2026-41683 HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header
- CVE-2026-41682 pupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion
- CVE-2026-41681 rust-openssl: MdCtxRef::digest_final() writes past caller buffer with no length check
- CVE-2026-41680 Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer
- CVE-2026-4168 Tecnick TCExam Group tce_edit_group.php cross site scripting
- CVE-2026-41679 Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
- CVE-2026-41678 rust-openssl: Incorrect bounds assertion in aes key wrap
- CVE-2026-41677 rust-openssl: Out-of-bounds read in PEM password callback when user callback returns an oversized length
- CVE-2026-41676 rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1
- CVE-2026-41675 xmldom: XML node injection through unvalidated processing instruction serialization
- CVE-2026-41674 xmldom: XML injection through unvalidated DocumentType serialization
- CVE-2026-41673 xmldom: Denial of service via uncontrolled recursion in XML serialization
- CVE-2026-41672 xmldom: XML node injection through unvalidated comment serialization
- CVE-2026-41671 Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation
- CVE-2026-41670 Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest
- CVE-2026-4167 Belkin F9K1122 formReboot stack-based overflow
- CVE-2026-41669 Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed
- CVE-2026-41667 Integer overflow in ONE
- CVE-2026-41666 Integer overflow in ONE
- CVE-2026-41665 Integer overflow in ONE
- CVE-2026-41664 Integer overflow in ONE
- CVE-2026-41663 Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send
- CVE-2026-41662 Admidio: Missing Minimum Administrator Check in Role Membership Removal
- CVE-2026-41661 Admidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion
- CVE-2026-41660 Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP
- CVE-2026-4166 Wavlink WL-NU516U1 login.cgi sub_404F68 cross site scripting
- CVE-2026-41659 Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment
- CVE-2026-41658 Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items
- CVE-2026-41657 Admidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts_data.php
- CVE-2026-41656 Admidio: Path Traversal via Unvalidated `name` Parameter in Document Add Mode Enables Arbitrary Server File Read
- CVE-2026-41655 Admidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database Credentials
- CVE-2026-41654 Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
- CVE-2026-41653 BentoPDF: Stored XSS via Markdown Editor Leading to Persistent File Exfiltration
- CVE-2026-41651 PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root
- CVE-2026-41650 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
- CVE-2026-4165 Worksuite HR, CRM and Project Management create cross site scripting
- CVE-2026-41649 Outline has IDOR in document share creation that allows unauthorized access to private documents across workspaces
- CVE-2026-41648 Incus: Unbounded YAML Metadata Decode via Parsing
- CVE-2026-41647 Incus: Nil-Pointer Dereference via S3 Bucket Import
- CVE-2026-41646 Nuclei: Local File Read via require() Module Loader Bypass
- CVE-2026-41645 Nuclei: Environment variable disclosure via Response-Derived DSL Expressions
- CVE-2026-41644 monetr is vulnerable to server-side request forgery in Lunch Flow link creation and refresh
- CVE-2026-41643 GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE
- CVE-2026-41642 GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute
- CVE-2026-41641 NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call
- CVE-2026-41640 NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading
- CVE-2026-4164 Wavlink WL-WN578W2 POST Request wireless.cgi GuestWifi command injection
- CVE-2026-41637 Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries
- CVE-2026-41636 Apache Thrift: Node.js skip() recursion
- CVE-2026-41635 Apache MINA vulnerable to Deserialization of Untrusted Data
- CVE-2026-4163 Wavlink WL-WN579A3 POST Request wireless.cgi GuestWifi command injection
- CVE-2026-4162 Gravity SMTP <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Uninstall
- CVE-2026-41615 Microsoft Authenticator Information Disclosure Vulnerability
- CVE-2026-41614 M365 Copilot for Desktop Spoofing Vulnerability
- CVE-2026-41613 Visual Studio Code Elevation of Privilege Vulnerability
- CVE-2026-41612 Visual Studio Code Information Disclosure Vulnerability
- CVE-2026-41611 Visual Studio Code Remote Code Execution Vulnerability
- CVE-2026-41610 Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-4161 Review Map by RevuKangaroo <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
- CVE-2026-41608 Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport
- CVE-2026-41607 Apache Thrift: C++ JSON OOB read
- CVE-2026-41606 Apache Thrift: c_glib dispatch stack overflow
- CVE-2026-41605 Apache Thrift: Swift Compact Protocol integer overflow
- CVE-2026-41604 Apache Thrift: Swift Range crash in skip()
- CVE-2026-41602 Apache Thrift: Go TFramedTransport uint32 overflow
- CVE-2026-4160 Missing authorization in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- CVE-2026-41591 Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping
- CVE-2026-4159 wc_PKCS7_DecodeEnvelopedData 1 byte out-of-bounds read
- CVE-2026-41589 Wish has SCP Path Traversal that allows arbitrary file read/write
- CVE-2026-41588 RELATE: Timing Attack Vulnerability in course/auth.py — check_sign_in_key()
- CVE-2026-41587 CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution
- CVE-2026-41586 ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE
- CVE-2026-41585 ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients
- CVE-2026-41584 ZEBRA: rk Identity Point Panic in Transaction Verification
- CVE-2026-41583 ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling
- CVE-2026-41582 countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files
- CVE-2026-41581 Frappe Vulnerable to Possible SQL Injection via get_blog_list
- CVE-2026-41580 Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author)
- CVE-2026-4158 KeePassXC OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
- CVE-2026-41579 runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations
- CVE-2026-41577 authentik: SAML source does not validate Conditions, timing, or audience on assertions
- CVE-2026-41576 Ajax30/BraveCMS-2.0: Stored HTML Injection in Contact Email via nl2br() and Unescaped Blade Template
- CVE-2026-41575 th30d4y/IP: DOM-Based Cross-Site Scripting (XSS) Vulnerability
- CVE-2026-41574 Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass
- CVE-2026-41573 OpenAM LDAP Injection via `_queryId` Parameter
- CVE-2026-41572 Note Mark: Unauthenticated read of notes and assets in soft-deleted public books
- CVE-2026-41571 Note Mark: OIDC-registered users authenticated by submitting password "null"
- CVE-2026-41570 PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
- CVE-2026-4157 ChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability
- CVE-2026-41569 authentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints
- CVE-2026-41568 Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap