Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 670 of 1013.
- CVE-2026-40288 PraisonAI: Critical RCE via `type: job` workflow YAML
- CVE-2026-40287 PraisonAI has RCE via Automatic tools.py Import
- CVE-2026-40286 WeGIA has Cross-Site Scripting in Controle de Contribuição
- CVE-2026-40285 WeGIA has SQL Injection via Session Variable Override in DespachoControle.php
- CVE-2026-40284 WeGIA has stored XSS in listar_despachos.php
- CVE-2026-40283 WeGIA has stored XSS in profile_paciente.php
- CVE-2026-40282 WeGIA has stored XSS in intercorrencia_visualizar.php
- CVE-2026-40281 Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values
- CVE-2026-40280 Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists
- CVE-2026-40279 BACnet Stack: Undefined-behavior signed left shift in `decode_signed32()`
- CVE-2026-40272 Vulnerability in the QNX libtraceparser Impacts QNX Software Development Platform
- CVE-2026-4027 FlexNet Manager Suite Attachment File Disclosure
- CVE-2026-40265 Note Mark has Broken Access Control on Asset Download
- CVE-2026-40264 OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation
- CVE-2026-40263 Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel
- CVE-2026-40262 Note Mark has Stored XSS via Unrestricted Asset Upload
- CVE-2026-40261 Composer has Command Injection via Malicious Perforce Reference
- CVE-2026-40260 pypdf: Manipulated XMP metadata entity declarations can exhaust RAM
- CVE-2026-4026 FlexNet Manager Suite Privilege Escalation Vulnerability
- CVE-2026-40259 SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API
- CVE-2026-40258 Gramps Web API has Zip Slip Path Traversal in Media Archive Import
- CVE-2026-40257 OP-TEE has SHA-3 accelerated finalize heap overflow
- CVE-2026-40256 Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision
- CVE-2026-40255 @adonisjs/http-server has an Open Redirect vulnerability
- CVE-2026-40254 FreeRDP: contains_dotdot() off-by-one allows drive channel path traversal via terminal ..
- CVE-2026-40253 openCryptoki: Memory safety vulnerabilities in BER/DER decoders in asn1.c
- CVE-2026-40252 Broken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPT
- CVE-2026-40251 Incus out-of-bounds panic in snapshot metadata handling allows denial of service
- CVE-2026-40250 OpenEXR has integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589)
- CVE-2026-4025 PrivateContent Free <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute
- CVE-2026-40249 free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors
- CVE-2026-40248 free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions
- CVE-2026-40247 free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions
- CVE-2026-40246 free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions
- CVE-2026-40245 Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication
- CVE-2026-40244 OpenEXR has integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589)
- CVE-2026-40243 Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation
- CVE-2026-40242 Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
- CVE-2026-4024 Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification
- CVE-2026-40230 Helpy 2.8.0 - Stored XSS in knowledgebase Doc body rendering
- CVE-2026-40229 Helpy 2.8.0 - Stored XSS in post author display via PostsHelper
- CVE-2026-40228 Other in systemd
- CVE-2026-40227 Denial of service in systemd
- CVE-2026-40226 Security feature bypass in systemd
- CVE-2026-40225 Privilege escalation in systemd
- CVE-2026-40224 Privilege escalation in systemd
- CVE-2026-40223 Denial of service in systemd
- CVE-2026-4022 Show Posts list <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2026-40217 LiteLLM has a sandbox escape in custom-code guardrail
- CVE-2026-40215 Use after free in OpenVPN
- CVE-2026-40214 OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer
- CVE-2026-40213 OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints
- CVE-2026-40212 Cross-site scripting in Skyline
- CVE-2026-40211 Denial of service via crafted DoH3 queries
- CVE-2026-40210 Out-of-bounds read in SetMacAddrAction
- CVE-2026-4021 Auth bypass in Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- CVE-2026-40209 Denial of service via IXFR queries
- CVE-2026-40208 Denial of service via DoH3 queries
- CVE-2026-40205 Auth bypass in OX Dovecot CE
- CVE-2026-40204 Other in OX Dovecot CE
- CVE-2026-40203 Information disclosure in OX Dovecot CE
- CVE-2026-40201 @diplodoc/search-extension allows stored XSS via Markdown file title
- CVE-2026-40200 Memory corruption in musl
- CVE-2026-4020 Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
- CVE-2026-40199 Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass
- CVE-2026-40198 Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass
- CVE-2026-40197 Incus nil-pointer dereference in custom volume import allows denial of service
- CVE-2026-40196 HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation
- CVE-2026-40195 Incus nil-pointer dereference in storage bucket import allows denial of service
- CVE-2026-40194 phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()
- CVE-2026-40193 Maddy Mail Server: LDAP Filter Injection via Unsanitized Username
- CVE-2026-40192 Pillow is vulnerable to a FITS GZIP decompression bomb
- CVE-2026-40191 ClearanceKit has a policy bypass via dual-path Endpoint Security events checking only source path
- CVE-2026-40190 LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`
- CVE-2026-4019 Missing authorization in Complianz – GDPR/CCPA Cookie Consent
- CVE-2026-40189 goshs has a file-based ACL authorization bypass in goshs state-changing routes
- CVE-2026-40188 goshs is Missing Write Protection for Parametric Data Values
- CVE-2026-40187 Authenticated RCE via Malicious eTemplate Upload in EGroupware
- CVE-2026-40186 ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
- CVE-2026-40185 Missing Authorization on Immich Trip Photo Routes in TREK
- CVE-2026-40184 Unauthenticated Access to Uploaded Files in TREK
- CVE-2026-40183 ImageMagick: Heap buffer overflow when encoding JXL image with a 16-bit float
- CVE-2026-40182 OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies
- CVE-2026-40181 React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
- CVE-2026-40180 Zip Slip Path Traversal in quarkus-openapi-generator ApicurioCodegenWrapper class
- CVE-2026-4018 Race condition in QNX OS for Medical
- CVE-2026-40179 Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer
- CVE-2026-40178 ajenti.plugin.core has a race conditions in 2FA
- CVE-2026-40177 Password bypass when 2FA is activated
- CVE-2026-40176 Composer is vulnerable to Command Injection via Malicious Perforce Repository
- CVE-2026-40175 Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
- CVE-2026-40174 Masa CMS CSRF in user address management allows unauthorized address changes
- CVE-2026-40173 Dgraph: Unauthenticated pprof endpoint leaks admin auth token
- CVE-2026-40172 authentik: Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser
- CVE-2026-40171 Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker
- CVE-2026-40170 ngtcp2 has a qlog transport parameter serialization stack buffer overflow
- CVE-2026-4017 Memory corruption in QNX OS for Medical
- CVE-2026-40169 ImageMagick: Heap buffer overflow (WRITE) in the YAML and JSON encoders
- CVE-2026-40168 Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream
- CVE-2026-40166 authentik: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/