Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 662 of 1013.
- CVE-2026-41150 Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
- CVE-2026-4115 PuTTY Ed25519 Signature ecc-ssh.c eddsa_verify signature verification
- CVE-2026-41149 Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection
- CVE-2026-41148 Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection
- CVE-2026-41147 NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class
- CVE-2026-41146 Uncontrolled resource consumption and loop with unreachable exit condition in facil.io and downstream iodine ruby gem
- CVE-2026-41145 MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads
- CVE-2026-41144 F´ (F Prime) has Integer Overflow in FileUplink
- CVE-2026-41143 YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()
- CVE-2026-41142 OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API
- CVE-2026-41141 EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup
- CVE-2026-41140 Poetry: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4
- CVE-2026-4114 Auth bypass in SMA1000
- CVE-2026-41139 Unsafe array index getter in mathjs
- CVE-2026-41138 Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.
- CVE-2026-41137 Flowise: Code Injection in CSVAgent leads to Authenticated RCE
- CVE-2026-41136 free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer
- CVE-2026-41135 free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service
- CVE-2026-41134 Kiota: Code Generation Literal Injection
- CVE-2026-41133 pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)
- CVE-2026-41132 CKAN: No certificate validation on STMP connection
- CVE-2026-41131 OpenFGA has Improper Policy Enforcement
- CVE-2026-41130 Craft CMS has a host header injection leading to SSRF via resource-js endpoint
- CVE-2026-4113 Information disclosure in SMA1000
- CVE-2026-41129 Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations
- CVE-2026-41128 Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
- CVE-2026-41127 BigBlueButton's missing authorization allows viewer to inject/overwrite captions
- CVE-2026-41126 BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL"
- CVE-2026-41125 SQL injection in blueplanet 100 NX3 M8
- CVE-2026-41124 Path traversal in PowerProtect Data Domain
- CVE-2026-41123 Missing authorization in PowerProtect Data Domain
- CVE-2026-41122 Cross-site scripting in PowerProtect Data Domain
- CVE-2026-41121 Privilege escalation in Device Management Agent
- CVE-2026-41120 Security feature bypass in Wyse Management Suite
- CVE-2026-4112 SQL injection in SMA1000
- CVE-2026-41119 Security feature bypass in Live Optics
- CVE-2026-41116 Path traversal in Inventory Collector Client
- CVE-2026-41115 Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API
- CVE-2026-41114 Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver
- CVE-2026-41113 Command injection in qmail
- CVE-2026-4111 Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive
- CVE-2026-41109 GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-41108 Windows DNS Client Elevation of Privilege Vulnerability
- CVE-2026-41107 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- CVE-2026-41106 Microsoft 365 Copilot Elevation of Privilege Vulnerability
- CVE-2026-41105 Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability
- CVE-2026-41104 Microsoft Planetary Computer Pro Information Disclosure Vulnerability
- CVE-2026-41103 Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability
- CVE-2026-41102 Microsoft PowerPoint for Android Spoofing Vulnerability
- CVE-2026-41101 Microsoft Word for Android Spoofing Vulnerability
- CVE-2026-41100 Microsoft 365 Copilot for Android Spoofing Vulnerability
- CVE-2026-4110 Ultimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_auctions_bids_list
- CVE-2026-41098 Azure Stack Edge Spoofing Vulnerability
- CVE-2026-41097 Secure Boot Security Feature Bypass Vulnerability
- CVE-2026-41096 Windows DNS Client Remote Code Execution Vulnerability
- CVE-2026-41095 Data Deduplication Elevation of Privilege Vulnerability
- CVE-2026-41094 Microsoft Data Formulator Remote Code Execution Vulnerability
- CVE-2026-41092 Microsoft Kinect Elevation of Privilege Vulnerability
- CVE-2026-41091 Microsoft Defender Link Following
- CVE-2026-41090 Microsoft Copilot Tampering Vulnerability
- CVE-2026-4109 Missing authorization in Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
- CVE-2026-41089 Windows Netlogon Remote Code Execution Vulnerability
- CVE-2026-41088 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-41087 Windows File Explorer Information Disclosure Vulnerability
- CVE-2026-41086 Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability
- CVE-2026-41085 Thermo Fisher Scientific Torrent Suite Dx through 5.14.2 has a privilege escalation vulnerability that may allow an authenticated user with
- CVE-2026-41084 Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation
- CVE-2026-41082 Path traversal in opam
- CVE-2026-41081 Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure
- CVE-2026-41080 Weak cryptography in libexpat
- CVE-2026-4108 Stored XSS Vulnerability
- CVE-2026-41079 OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users
- CVE-2026-41078 OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path
- CVE-2026-41076 RT: LDAP authentication bypass via empty password
- CVE-2026-41075 RT: SQL injection via entry_aggregator parameter in JSON search
- CVE-2026-41074 RT has broken CSRF protection for authenticated users
- CVE-2026-41073 RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps
- CVE-2026-41071 libheif: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count
- CVE-2026-41070 openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access
- CVE-2026-4107 Stored XSS Vulnerability
- CVE-2026-41069 libheif allows Out-of-bounds vector access leading to invalid dereference (DoS)
- CVE-2026-41068 Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)
- CVE-2026-41067 Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass
- CVE-2026-41066 lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files
- CVE-2026-41065 Tautulli Vulnerable to Unauthenticated/Authenticated Remote Code Execution via Newsletter Custom Template Directory
- CVE-2026-41064 AVideo has an incomplete fix for CVE-2026-33502 (Command Injection)
- CVE-2026-41063 WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS)
- CVE-2026-41062 WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters
- CVE-2026-41061 WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver
- CVE-2026-41060 AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL
- CVE-2026-4106 HT Mega < 3.0.7 – Unauthenticated PII Disclosure
- CVE-2026-41059 OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex
- CVE-2026-41058 AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo
- CVE-2026-41057 WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses
- CVE-2026-41056 WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover
- CVE-2026-41055 AVideo has an incomplete fix for CVE-2026-33039 (SSRF)
- CVE-2026-41054 Missing exit out of permission check in haveged could lead to root exploit
- CVE-2026-41053 Over-inclusive team membership expansion in GitHub App authentication provider for Rancher
- CVE-2026-41052 Rancher Privilege Escalation from Project Owner to Host
- CVE-2026-41051 csync2 uses insecure temporary directories when compiled with C99 or later