Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 661 of 1013.
- CVE-2026-41257 jq: Signed-int overflow in `stack_reallocate` (jq VM stack)
- CVE-2026-41256 jq: Embedded NUL truncates top-level jq programs loaded with -f
- CVE-2026-41255 CKAN: CSRF exemption primed by anonymous requests
- CVE-2026-41254 Integer overflow in little cms color engine
- CVE-2026-41253 Code injection in iTerm2
- CVE-2026-41252 xrdp: lib_palette_update Heap Buffer Overflow & RCE
- CVE-2026-41250 XSS in taiga-front
- CVE-2026-4125 WPMK Block <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-41249 CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration
- CVE-2026-41248 Official Clerk JavaScript SDKs: Middleware-based route protection bypass
- CVE-2026-41247 elFinder: Command injection in resize background color parameter when using ImageMagick CLI
- CVE-2026-41246 Contour: Lua code injection via Cookie Path Rewrite Policy
- CVE-2026-41245 Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix
- CVE-2026-41244 Mojic: Observable Timing Discrepancy in HMAC Verification
- CVE-2026-41243 OpenLearn's pending forum posts remain publicly readable by direct ID when moderation mode is enabled
- CVE-2026-41242 protobufjs has an arbitrary code execution issue
- CVE-2026-41241 pretalx: Stored cross-site scripting in organiser search typeahead
- CVE-2026-41240 DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
- CVE-2026-4124 Missing authorization in Ziggeo
- CVE-2026-41239 DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
- CVE-2026-41238 DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
- CVE-2026-41237 Froxlor has an incomplete fix for CVE-2026-30932
- CVE-2026-41236 Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path
- CVE-2026-41235 Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement
- CVE-2026-41234 Froxlor: BIND Zone File Injection via TXT Record Content
- CVE-2026-41233 Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()
- CVE-2026-41232 Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email Spoofing
- CVE-2026-41231 Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron
- CVE-2026-41230 Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()
- CVE-2026-4123 Missing authorization in RW Elephant Rental Inventory
- CVE-2026-41229 Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)
- CVE-2026-41228 Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution
- CVE-2026-41227 BIG-IP HTTP/2 Layer 7 Dos Protection vulnerability
- CVE-2026-41226 Open redirect in Multiple MFPs which implement Ricoh Web Image Monitor
- CVE-2026-41225 iControl REST vulnerability
- CVE-2026-41223 Memory corruption in Totolink
- CVE-2026-41222 Memory corruption in Totolink
- CVE-2026-41220 Memory corruption in Acronis Cyber Protect Cloud Agent
- CVE-2026-41219 BIG-IP QKView vulnerability
- CVE-2026-41218 BIG-IP PEM iRules vulnerability
- CVE-2026-41217 BIG-IP tmsh vulnerability
- CVE-2026-41216 Memory corruption in vtk
- CVE-2026-41213 @node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes
- CVE-2026-41211 `vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME`
- CVE-2026-41210 Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted seq_parameter_set_id
- CVE-2026-4121 Kcaptcha <= 1.0.1 - Cross-Site Request Forgery to Settings Update
- CVE-2026-41208 Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution
- CVE-2026-41207 netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures
- CVE-2026-41206 PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code
- CVE-2026-41205 Mako: Path traversal via double-slash URI prefix in TemplateLookup
- CVE-2026-41203 ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE
- CVE-2026-41202 ci4ms Backup::restore is vulnerable to Zip Slip leading to RCE
- CVE-2026-41201 CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2
- CVE-2026-41200 STIG Manager has reflected XSS vulnerability in the Web App
- CVE-2026-4120 Info Cards <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
- CVE-2026-41197 Brillig: Heap corruption in foreign call results with nested tuple arrays
- CVE-2026-41196 Luanti has a mod security sandbox escape
- CVE-2026-41195 mosparo: Rule package source URL stored SSRF enables internal HTTP probing
- CVE-2026-41194 FreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFable
- CVE-2026-41193 FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE
- CVE-2026-41192 FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments
- CVE-2026-41191 FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes
- CVE-2026-41190 FreeScout has assigned-only visibility bypass via save_draft that allows hidden conversation draft injection
- CVE-2026-4119 Missing authorization in Create DB Tables
- CVE-2026-41189 FreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threads
- CVE-2026-41187 Calico Tier Authorization Bypass via DeleteCollection
- CVE-2026-41186 Unauthenticated Go pprof exposure in Calico debug server
- CVE-2026-41185 ServiceAccount token disclosure via Azure IPAM CNI plugin logs
- CVE-2026-41184 ServiceAccount token disclosure via install-cni container logs
- CVE-2026-41183 FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations
- CVE-2026-41182 LangSmith SDK: Streaming token events bypass output redaction
- CVE-2026-41181 Traefik: Errors middleware forwards Authorization and Cookie headers to separate error page service
- CVE-2026-41180 PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart
- CVE-2026-4118 Call To Action Plugin <= 3.1.3 - Cross-Site Request Forgery via Settings Update
- CVE-2026-41179 RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
- CVE-2026-41178 OpenTelemetry-Go's baggage parsing no longer caps raw header length
- CVE-2026-41177 Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction
- CVE-2026-41176 Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
- CVE-2026-41175 Statamic: Unsafe method invocation via query value resolution allows data destruction
- CVE-2026-41174 Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding
- CVE-2026-41173 Unbounded HTTP response body read in OpenTelemetry.Sampler.AWS
- CVE-2026-41172 Squidex vulnerable to Server-Side Request Forgery (SSRF) via URL-based asset upload (/api/apps/{app}/assets)
- CVE-2026-41171 SSRF via Jint Scripting Engine HTTP Functions Due to Missing SSRF Protection on "Jint" HttpClient
- CVE-2026-41170 Squidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External Requests
- CVE-2026-4117 CalJ <= 1.5 - Authenticated (Subscriber+) Arbitrary Settings Modification via 'save-obtained-key' Action
- CVE-2026-41168 pypdf has possible long runtimes for wrong size values in cross-reference and object streams
- CVE-2026-41167 Jellystat has SQL Injection that leads to to Remote Code Execution
- CVE-2026-41166 OpenRemote has Improper Access Control via updateUserRealmRoles function
- CVE-2026-41164 nuts-node: JWT type confusion in v1 access token introspection allows VP replay as access token
- CVE-2026-41163 bubblewrap vulnerable to privilege escalation in setuid mode via ptrace
- CVE-2026-41161 Username Enumeration via Timing Attack
- CVE-2026-41160 EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes
- CVE-2026-4116 Auth bypass in SMA1000
- CVE-2026-41159 Mermaid: Improper sanitization of configuration leads to CSS injection
- CVE-2026-41158 GPU DDK - Backed sparse PMRs are not handled by deferred free mechanism after shrink
- CVE-2026-41157 GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D
- CVE-2026-41156 GPU DDK - kernel<->fw CCB contains SYNC_PRIMITIVE_BLOCK firmware address without holding reference
- CVE-2026-41155 GPU DDK - SharedSecMem mapped into all GPU virtual address spaces
- CVE-2026-41154 GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse
- CVE-2026-41153 Command injection in Junie