Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 667 of 1013.
- CVE-2026-40608 Next AI Draw.io: Unbounded HTTP Body — Denial of Service
- CVE-2026-40607 MantisBT is Vulnerable to Stored XSS Through its Saved-Filter Owner Column
- CVE-2026-40606 ProxyAuth Addon LDAP Injection in mitmproxy
- CVE-2026-40605 Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API
- CVE-2026-40604 Security feature bypass in clearancekit
- CVE-2026-40603 Chartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override
- CVE-2026-40602 hass-cli: Handling of user-supplied Jinja2 templates
- CVE-2026-40601 Chartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle
- CVE-2026-40600 Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id
- CVE-2026-4060 Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter
- CVE-2026-40599 ClearanceKit: Ad-hoc signed binaries can spoof Apple process identities in the global allowlist
- CVE-2026-40598 MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page
- CVE-2026-40597 MantisBT has a Content Security Policy bypass via attachments
- CVE-2026-40596 MantisBT is vulnerable to XSS and potential account takeover via user font family preference update
- CVE-2026-40595 Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks
- CVE-2026-40594 pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)
- CVE-2026-40593 ChurchCRM: Stored XSS in UserEditor.php via Login Name Field
- CVE-2026-40592 FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply
- CVE-2026-40591 FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification
- CVE-2026-40590 FreeScout's Customer AJAX Create Modifies Hidden Existing Customer
- CVE-2026-4059 ShopLentor <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute
- CVE-2026-40589 FreeScout has Customer Edit Cross-Mailbox Email Takeover
- CVE-2026-40588 blueprintUE: Authenticated Password Change Does Not Verify Current Password
- CVE-2026-40587 blueprintUE: Active Sessions Are Not Invalidated After Password Change or Reset
- CVE-2026-40586 blueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force Protection
- CVE-2026-40585 blueprintUE: Password Reset Tokens Have No Expiry Window
- CVE-2026-40584 RansomLook - Improper Filtering of Private Location Entries in API Endpoints Leads to Information Exposure
- CVE-2026-40583 UltraDAG: SmartOp Vote Path Triggers Fatal Supply Invariant Halt
- CVE-2026-40582 ChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account Lockout
- CVE-2026-40581 ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion
- CVE-2026-4058 Missing authorization in User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration
- CVE-2026-40576 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in excel-mcp-server
- CVE-2026-40575 OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing
- CVE-2026-40574 OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims
- CVE-2026-40572 NovumOS has Arbitrary Memory Mapping via Syscall 15 (MemoryMapRange)
- CVE-2026-40571 NamelessMC: Reactions on private or blocking profile posts can be modified without proper authorization
- CVE-2026-40570 FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII
- CVE-2026-4057 Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal
- CVE-2026-40569 FreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email Exfiltration
- CVE-2026-40568 FreeScout Vulnerable to XSS via Mailbox Signature Due to Incomplete HTML Sanitization
- CVE-2026-40567 FreeScout has HTML Injection in Outgoing Emails via Unsanitized Customer Name in Signature Variables
- CVE-2026-40566 FreeScout vulnerable to SSRF via IMAP/SMTP Connection Test Endpoints
- CVE-2026-40565 FreeScout has Stored XSS / CSS Injection via linkify() — Unescaped URL in Anchor href
- CVE-2026-40564 Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator
- CVE-2026-40563 Apache Atlas: Script injection allows access to unintended data
- CVE-2026-40562 Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence
- CVE-2026-40561 Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence
- CVE-2026-40560 Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence
- CVE-2026-4056 Missing authorization in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
- CVE-2026-40557 Apache Storm Prometheus Reporter vulnerable to Improper Certificate Validation via Global SSL Context Downgrade
- CVE-2026-40553 Stack-based buffer overflow in gawk
- CVE-2026-40552 Remote Code Execution in multiple BinSoft products
- CVE-2026-40551 Use of Client-Side Authentication in multiple BinSoft products
- CVE-2026-40550 Privilege Escalation in multiple BinSoft products
- CVE-2026-4055 Insufficient permission validation on cross-team playbook run creation
- CVE-2026-40549 Cross-Site Request Forgery in SOPlanning
- CVE-2026-40548 Unrestricted Upload of File with Dangerous Type in SOPlanning
- CVE-2026-40547 Path Traversal in SOPlanning
- CVE-2026-40546 Multiple SQL Injections in SOPlanning
- CVE-2026-40545 Reflected XSS in SOPlanning
- CVE-2026-40544 Stored XSS in SOPlanning
- CVE-2026-40543 Missing Authorization in SOPlanning
- CVE-2026-40542 Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification
- CVE-2026-40541 Cross-site scripting in Synology Chat Server
- CVE-2026-4054 Mattermost doesn't validate the response body of proxied images
- CVE-2026-40539 Security feature bypass in DiskStation Manager (DSM)
- CVE-2026-40538 Auth bypass in DiskStation Manager (DSM)
- CVE-2026-40537 Server-side request forgery in DiskStation Manager (DSM)
- CVE-2026-40536 Path traversal in DiskStation Manager (DSM)
- CVE-2026-40535 Path traversal in DiskStation Manager (DSM)
- CVE-2026-40534 Cross-site scripting in DiskStation Manager (DSM)
- CVE-2026-40533 Information disclosure in DiskStation Manager (DSM)
- CVE-2026-40532 Information disclosure in DiskStation Manager (DSM)
- CVE-2026-40531 Integer overflow in DiskStation Manager (DSM)
- CVE-2026-40530 Other in DiskStation Manager (DSM)
- CVE-2026-4053 post edit time limit is not enforced on some post update operations
- CVE-2026-40529 SQL injection in CMS ALAYA
- CVE-2026-40528 OpenSC < 0.27.0 Buffer Overrun in do_key_value() via profile.c
- CVE-2026-40527 radare2 Command Injection via DWARF Parameter Names
- CVE-2026-40526 Volmarg Personal Management System Path Traversal via get-file Endpoint
- CVE-2026-40525 OpenViking < 0.3.9 Authentication Bypass via VikingBot OpenAPI
- CVE-2026-40524 FrontAccounting < 2.4.20 SQL Injection via get_gl_transactions()
- CVE-2026-40523 FrontAccounting < 2.4.20 SQL Injection via reporting/rep710.php
- CVE-2026-40522 FrontAccounting < 2.4.20 SQL Injection via rep601.php
- CVE-2026-40521 FrontAccounting < 2.4.20 Path Traversal RCE via attachment upload
- CVE-2026-40520 FreePBX api module Command Injection via GraphQL
- CVE-2026-40519 Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins()
- CVE-2026-40518 ByteDance DeerFlow Path Traversal and Arbitrary File Write via Bootstrap Mode
- CVE-2026-40517 radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names
- CVE-2026-40516 OpenHarness SSRF via web_fetch and web_search
- CVE-2026-40515 OpenHarness Permission Bypass via grep and glob root argument
- CVE-2026-40514 SmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG
- CVE-2026-40510 OpenSC < 0.27.0-rc1 Stack Buffer Overflow via piv_process_history() in card-piv.c
- CVE-2026-4051 IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Server Post-Auth Remote Code Execution
- CVE-2026-40509 OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter
- CVE-2026-40508 OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler
- CVE-2026-40507 OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal
- CVE-2026-40506 OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php
- CVE-2026-40505 MuPDF < 1.27 mutool ANSI Injection via Metadata
- CVE-2026-40504 Creolabs Gravity < 0.9.6 Heap Buffer Overflow via gravity_vm_exec