Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 672 of 1013.
- CVE-2026-40050 CrowdStrike LogScale Unauthenticated Path Traversal
- CVE-2026-4005 Cross-site scripting in Coachific Shortcode
- CVE-2026-40048 Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager
- CVE-2026-40047 Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer
- CVE-2026-40046 Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT vulnerable to Integer Overflow or Wraparound
- CVE-2026-40045 OpenClaw < 2026.4.2 - Cleartext Credential Transmission via Unencrypted WebSocket Gateway Endpoints
- CVE-2026-40044 Pachno 1.0.6 FileCache Deserialization Remote Code Execution
- CVE-2026-40043 Pachno 1.0.6 Authentication Bypass via runSwitchUser()
- CVE-2026-40042 Pachno 1.0.6 Wiki TextParser XML External Entity Injection
- CVE-2026-40041 Pachno 1.0.6 Cross-Site Request Forgery via State-Changing Endpoints
- CVE-2026-40040 Pachno 1.0.6 Unrestricted File Upload Remote Code Execution
- CVE-2026-4004 Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'task_id' Parameter
- CVE-2026-40039 Pachno 1.0.6 Open Redirection via return_to Parameter
- CVE-2026-40038 Pachno 1.0.6 Stored Cross-Site Scripting via Multiple Parameters
- CVE-2026-40037 OpenClaw < 2026.4.8 - Unsafe Request Body Replay via fetchWithSsrFGuard Cross-Origin Redirects
- CVE-2026-40036 Unfurl < 2026.04 - Denial of Service via Unbounded zlib Decompression
- CVE-2026-40035 Unfurl - Werkzeug Debugger Exposure via String Config Parsing
- CVE-2026-40034 gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule
- CVE-2026-40033 FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass
- CVE-2026-40032 UAC < 3.3.0-rc1 Command Injection via Placeholder Substitution
- CVE-2026-40031 MemProcFS < 5.17 DLL/Shared Library Hijacking
- CVE-2026-40030 parseusbs < 1.9 Command Injection via Volume Path Argument
- CVE-2026-4003 Missing authorization in Users manager – PN
- CVE-2026-40029 parseusbs < 1.9 Command Injection via Crafted LNK Filename
- CVE-2026-40028 Hayabusa < 3.8.0 XSS via JSON Log Import
- CVE-2026-40027 ALEAPP NQ Vault Artifact Parser Path Traversal
- CVE-2026-40026 Sleuth Kit ISO9660 SUSP Extension Reference Out-of-Bounds Read
- CVE-2026-40025 Sleuth Kit APFS Keybag Parser Out-of-Bounds Read
- CVE-2026-40024 Sleuth Kit tsk_recover Path Traversal
- CVE-2026-40023 Other in Apache Log4cxx
- CVE-2026-40022 Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime
- CVE-2026-40021 Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
- CVE-2026-40020 Missing authorization in OX Dovecot Pro
- CVE-2026-4002 Petje.af <= 2.1.8 - Cross-Site Request Forgery to Account Deletion via 'petjeaf_disconnect' AJAX Action
- CVE-2026-40019 Denial of service in OX Dovecot CE
- CVE-2026-40018 SQL injection in OX Dovecot CE
- CVE-2026-40017 Denial of service in OX Dovecot CE
- CVE-2026-40016 Denial of service in OX Dovecot Pro
- CVE-2026-40015 Memory corruption in OX Dovecot CE
- CVE-2026-40014 Denial of service in OX Dovecot CE
- CVE-2026-40013 Memory corruption in OX Dovecot CE
- CVE-2026-40012 Information about ECS zero scoped answers might leak to clients that use a specific ECS
- CVE-2026-40011 Prometheus denial of service via crafted DNS queries
- CVE-2026-40010 Apache Wicket: possible session fixation using AuthenticatedWebSession
- CVE-2026-4001 Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula
- CVE-2026-40009 Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor
- CVE-2026-40008 Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC
- CVE-2026-40007 Denial of service in Apache IoTDB
- CVE-2026-40006 Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver
- CVE-2026-40005 Apache IoTDB: Path Traversal in Pipe File Transfer Receiver
- CVE-2026-40004 openssl.cnf Privilege Escalation Vulnerability in ZTE Cloud PC Client uSmartview
- CVE-2026-40003 USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM
- CVE-2026-40002 Missing authorization in Red Magic 11 Pro (NX809J)
- CVE-2026-40001 Local privilege escalation vulnerability in ZTE PROCESS Guard service of the cloud computer client
- CVE-2026-40000 Path Traversal Vulnerability in ZTE Blade A75 5G
- CVE-2026-39999 Apache APISIX: JWT Algorithm Confusion allows authentication bypass
- CVE-2026-39998 Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup
- CVE-2026-39997 Unauthenticated Remote Input Injection in QNAP HD Station's remotepad
- CVE-2026-39993 Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter
- CVE-2026-39991 Stored Cross-Site Scripting (XSS) in Note Station file upload functionality
- CVE-2026-3999 Broken access control vulnerability affecting ID Server
- CVE-2026-39989 SSRF in QNAP Download Station
- CVE-2026-39987 Marimo Remote Code Execution
- CVE-2026-39985 LORIS has an open redirect field on login
- CVE-2026-39984 Sigstore Timestamp Authority has Improper Certificate Validation in verifier
- CVE-2026-39983 FTP Command Injection via CRLF in basic-ftp
- CVE-2026-39981 AGiXT has a Path Traversal in safe_join()
- CVE-2026-39980 OpenCTI affected by RCE via notifier template
- CVE-2026-3998 WM JqMath <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
- CVE-2026-39979 jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers
- CVE-2026-39977 flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files
- CVE-2026-39976 Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens
- CVE-2026-39975 Combodo iTop: Remote code execution using external auth variable value
- CVE-2026-39974 n8n-MCP has an Authenticated SSRF via instance-URL header in multi-tenant HTTP mode
- CVE-2026-39973 Apktool: Path Traversal to Arbitrary File Write
- CVE-2026-39972 Mercure has a Topic Selector Cache Key Collision
- CVE-2026-39971 Serendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOST
- CVE-2026-39970 TypeBot: Stored Cross-Site Scripting (XSS) via SVG File Upload On Profile Picture Form
- CVE-2026-3997 Text Toggle <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
- CVE-2026-39969 TypeBot: WhatsApp Webhook Endpoint Missing Signature Verification
- CVE-2026-39968 TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint
- CVE-2026-39967 TypeBot: Cross-Typebot Result Data Access via Missing typebotId Filter
- CVE-2026-39966 Missing authorization in typebot.io
- CVE-2026-39965 TypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code Blocks
- CVE-2026-39964 TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers
- CVE-2026-39963 Serendipity: Host Header Injection enables authentication cookie scoping to an attacker-controlled domain
- CVE-2026-39962 LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable
- CVE-2026-39961 Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource
- CVE-2026-39960 MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Values
- CVE-2026-3996 WP Games Embed <= 0.1beta - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-39959 Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service
- CVE-2026-39958 oma-topic: name Field in Topic Manifests (topic.json) May Allow CRLF Injection
- CVE-2026-39957 Missing authorization in Lychee
- CVE-2026-39956 jq: Missing runtime type checks for _strindices lead to crash and limited memory disclosure
- CVE-2026-39955 Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php
- CVE-2026-39951 Cacti: Stored SQL Injection via graph_name_regexp in Reports feature
- CVE-2026-3995 OPEN-BRAIN <= 0.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting
- CVE-2026-39948 Cacti has SQL Injection via rfilter parameter in RLIKE clauses
- CVE-2026-39946 OpenBao allows SQL Injection in PostgreSQL database secrets engine
- CVE-2026-39944 Ceph: CephX AES Authentication error