Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 664 of 1013.
- CVE-2026-40947 Other in libfido2
- CVE-2026-40946 Oxia: OIDC token audience validation bypass via SkipClientIDCheck
- CVE-2026-40945 Oxia: Bearer token exposed in debug log messages on authentication failure
- CVE-2026-40944 Oxia: TLS CA certificate chain validation fails with multi-certificate PEM bundles
- CVE-2026-40943 Oxia: Server crash via race condition in session heartbeat handling
- CVE-2026-40942 DSF: Inverted Time Comparison in OIDC JWKS and Token Cache
- CVE-2026-40941 Cacti: Package Import Signature Validation Bypass Allows Self-Signed Packages
- CVE-2026-4094 Missing authorization in FOX – Currency Switcher Professional for WooCommerce
- CVE-2026-40939 DSF: Missing Session Timeout for OIDC Sessions
- CVE-2026-40938 Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE
- CVE-2026-40937 RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks
- CVE-2026-40935 WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure
- CVE-2026-40934 jupyter-server authentication cookies remain valid after password reset due to static cookie secret
- CVE-2026-40933 Flowise: Authenticated RCE Via MCP Adapters
- CVE-2026-40931 Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing
- CVE-2026-40930 LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body
- CVE-2026-4093 Stored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels)
- CVE-2026-40929 WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators
- CVE-2026-40928 WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion
- CVE-2026-40927 Docmost: XSS in Comments with JavaScript URI
- CVE-2026-40926 WWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script)
- CVE-2026-40925 WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
- CVE-2026-40924 Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion
- CVE-2026-40923 Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check
- CVE-2026-40922 SiYuan has incomplete fix for CVE-2026-33066: XSS
- CVE-2026-40920 Apache Ranger: Privilege Escalation via URL Parameter
- CVE-2026-4092 Arbitrary File Write via Path Traversal in Google clasp leading to RCE
- CVE-2026-40919 Gimp: gimp: denial of service via specially crafted seattle filmworks file
- CVE-2026-40918 Gimp: gimp: denial of service via crafted pvr image file
- CVE-2026-40917 Gimp: gimp: application crashes or information disclosure via crafted icns image files
- CVE-2026-40916 Gimp: gimp: denial of service due to stack buffer overflow in tim image loader
- CVE-2026-40915 Gimp: gimp: heap buffer overflow due to integer overflow in fits image loader
- CVE-2026-40914 Apache Artemis has an Incorrect Authorization issue
- CVE-2026-40912 Traefik: StripPrefixRegex auth bypass via Path/RawPath desync
- CVE-2026-40911 WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
- CVE-2026-40910 frp: Authentication bypass in frp HTTP vhost routing when routeByHTTPUser is used for access control
- CVE-2026-4091 OPEN-BRAIN <= 0.5.0 - Cross-Site Request Forgery
- CVE-2026-40909 WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)
- CVE-2026-40908 WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version
- CVE-2026-40907 WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens
- CVE-2026-40906 Electric: SQL Injection via ORDER BY Parameter in Shape API
- CVE-2026-40905 LinkAce: Password Reset Poisoning via X-Forwarded-Host Header Injection Leading to Account Takeover
- CVE-2026-40904 Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks
- CVE-2026-40903 Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistence
- CVE-2026-40902 PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
- CVE-2026-40901 DataEase: Quartz Deserialization → Remote Code Execution
- CVE-2026-40900 DataEase has SQL Injection via Stacked Queries
- CVE-2026-4090 Inquiry cart <= 3.4.2 - Cross-Site Request Forgery via Settings Form
- CVE-2026-40899 DataEase has an Arbitrary File Read Vulnerability
- CVE-2026-40898 quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion
- CVE-2026-40897 Math.js: Unsafe object property setter in mathjs
- CVE-2026-40896 OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup
- CVE-2026-40895 follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets
- CVE-2026-40894 OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
- CVE-2026-40893 Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move
- CVE-2026-40892 PJSIP: Stack buffer overflow in pjsip_auth_create_digest2()
- CVE-2026-40891 OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling
- CVE-2026-40890 github.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRenderer
- CVE-2026-4089 Twittee Text Tweet <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
- CVE-2026-40889 Frappe HR has Improper Access Control on Files
- CVE-2026-40888 Frappe HR vulnerable to Improper Access Control
- CVE-2026-40887 @vendure/core has a SQL Injection vulnerability
- CVE-2026-40886 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller
- CVE-2026-40885 goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access
- CVE-2026-40884 goshs: Empty-username SFTP password authentication bypass in goshs
- CVE-2026-40883 goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation
- CVE-2026-40882 OpenRemote has XXE in Velbus Asset Import
- CVE-2026-40881 Zebra: addr/addrv2 Deserialization Resource Exhaustion
- CVE-2026-40880 Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks
- CVE-2026-4088 Switch CTA Box <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2026-40879 Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)
- CVE-2026-40878 mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping
- CVE-2026-40877 Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences
- CVE-2026-40876 SFTP root escape via prefix-based path validation in goshs
- CVE-2026-40875 mailcow: dockerized vulnerable to stored XSS in user login history real_rip
- CVE-2026-40874 mailcow: dockerized missing authorization on Forwarding Hosts delete action
- CVE-2026-40873 mailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames
- CVE-2026-40872 mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field
- CVE-2026-40871 mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API
- CVE-2026-40870 Decidim's comments API allows access to all commentable resources
- CVE-2026-4087 Pre* Party Resource Hints <= 1.8.20 - Authenticated (Subscriber+) SQL Injection via 'hint_ids' Parameter
- CVE-2026-40869 Decidim amendments can be accepted or rejected by anyone
- CVE-2026-40868 kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token
- CVE-2026-40867 Horilla: Unauthorized Helpdesk Attachment Access via Attachment ID Manipulation
- CVE-2026-40866 Horilla: Unauthorized Document Overwrite via File Upload Endpoint
- CVE-2026-40865 Horilla: Insecure Direct Object Reference at `/employee/view-file/<int:id>
- CVE-2026-40864 JupyterHub: Cross-origin form POSTs bypass XSRF
- CVE-2026-40863 PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
- CVE-2026-40861 Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler
- CVE-2026-40860 Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp
- CVE-2026-4086 WP Random Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode Attribute
- CVE-2026-40859 Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled
- CVE-2026-40858 Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository
- CVE-2026-40857 CSRF token bypass in T-Mobile 5G Box IDU routers
- CVE-2026-40856 Config disclosure in T-Mobile 5G Box IDU routers
- CVE-2026-40855 Command Injection in T-Mobile 5G Box IDU router via ping functionality
- CVE-2026-40854 Session auth bypass via cookie value in T-Mobile 5G Box IDU routers
- CVE-2026-40852 Command injection via malicious configuration
- CVE-2026-40851 Command injection via USB
- CVE-2026-40850 Unauthenticated SQLi in getAccountData function