Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 673 of 1013.
- CVE-2026-39943 Directus exposes sensitive fields in revision history
- CVE-2026-39942 Directus has a Path Traversal and Broken Access Control in File Management API
- CVE-2026-39941 ChurchCRM has an XSS vulnerability
- CVE-2026-39940 ChurchCRM has an Open Redirect via the ‘linkBack’ URL Parameter in DonatedItemEditor.php
- CVE-2026-3994 rui314 mold Object File input-files.cc initialize_sections heap-based overflow
- CVE-2026-39938 Cacti: Unauthenticated RCE on Graph Image
- CVE-2026-39937 Global vanishing does not completely remove user email
- CVE-2026-39936 Stored XSS in Score due to usage of non-reserved data attributes
- CVE-2026-39935 XSS-via-i18n in localised wiki names
- CVE-2026-39934 Growth Experiments ReassignMenteesJob runs as an infinite loop
- CVE-2026-39933 Multiple XSS vulnerabilities in GlobalWatchlist
- CVE-2026-39932 OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection
- CVE-2026-39931 OpenEMR Authenticated SQL Injection via backup.php Import Feature
- CVE-2026-3993 itsourcecode Payroll Management System manage_employee_deductions.php cross site scripting
- CVE-2026-39929 Lakeside SysTrack Agent LsiAgent.exe Out-of-Bounds Read via UDP
- CVE-2026-39924 Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation
- CVE-2026-39923 Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset
- CVE-2026-39922 GeoNode SSRF via Service Registration
- CVE-2026-39921 GeoNode < 4.4.5, 5.0.2 SSRF via Document Upload
- CVE-2026-39920 BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE
- CVE-2026-3992 CodeGenieApp serverless-express Users Endpoint dynamodb.ts injection
- CVE-2026-39919 Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter
- CVE-2026-39918 Vvveb < 1.0.8.1 Code Injection via Installation Endpoint
- CVE-2026-39915 TIM Flow < 26.0.6 CRLF Injection via rt Parameter
- CVE-2026-39914 TIM Flow < 26.0.6 Unauthorized SQL Query Execution via Dashboard Export Endpoint
- CVE-2026-39912 v2board / Xboard Authentication Token Exposure via loginWithMailLink
- CVE-2026-39911 Hashgraph Guardian 3.5.1 Unsandboxed JavaScript Execution RCE
- CVE-2026-39910 STACKIT IaaS API Privilege Escalation via Service Account Attachment
- CVE-2026-3991 Elevation of Privileges in Symantec Data Loss Prevention Windows Endpoint
- CVE-2026-39908 OpenBullet2 0.3.2 NTLMv2 Hash Disclosure via UNC Path Proxy Source
- CVE-2026-39907 Unisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via WCF SOAP
- CVE-2026-39906 Unisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via .NET Remoting
- CVE-2026-39904 Gophish 0.12.1 Denial of Service via Office Document Upload
- CVE-2026-39903 Simple Machines Forum Authorization Bypass via AttachmentApprove.php
- CVE-2026-39902 Cacti: Authenticated RCE on Data Input
- CVE-2026-39901 monetr: Protected Transactions Deletable via PUT
- CVE-2026-39900 Cacti: Reflected XSS via tab parameter in auth_profile.php JavaScript context
- CVE-2026-3990 CesiumGS CesiumJS standalone.html cross site scripting
- CVE-2026-39899 Cacti: Path Traversal via filename parameter in package_import.php
- CVE-2026-39897 Cacti has a Reflected XSS Vulnerability via html_auth_footer
- CVE-2026-39894 Cacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formatting
- CVE-2026-39893 Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php
- CVE-2026-39892 cryptography has a buffer overflow if non-contiguous buffers were passed to APIs
- CVE-2026-39891 PraisonAI has a Template Injection in Agent Tool Definitions
- CVE-2026-39890 PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading
- CVE-2026-3989 CVE-2026-3989
- CVE-2026-39889 PraisonAI has Unauthenticated SSE Event Stream Exposes All Agent Activity in A2U Server
- CVE-2026-39888 PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
- CVE-2026-39886 OpenEXR has HTJ2K Signed Integer Overflow in ht_undo_impl()
- CVE-2026-39885 FrontMCP Affected by SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
- CVE-2026-39884 MCP Server Kubernetes has Argument Injection in its port_forward tool via space-splitting
- CVE-2026-39883 opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking
- CVE-2026-39882 OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies
- CVE-2026-39881 Vim Ex command injection in Vims NetBeans integration
- CVE-2026-39880 Remnawave Backend has a race condition in HWID device limit allows bypassing max devices
- CVE-2026-3988 Inefficient Algorithmic Complexity in GitLab
- CVE-2026-39879 SQL injection in syslog-ng SQL destionation driver
- CVE-2026-39878 Chamilo stored XSS via user registration leads to admin account takeover
- CVE-2026-39877 Memory corruption in iOS and iPadOS
- CVE-2026-39875 Privilege escalation in macOS
- CVE-2026-39874 Privilege escalation in macOS
- CVE-2026-39873 Memory corruption in macOS
- CVE-2026-39872 Use after free in Safari
- CVE-2026-39871 Information disclosure in macOS
- CVE-2026-39870 Memory corruption in macOS
- CVE-2026-3987 WatchGuard Firebox Arbitrary File Write vis Path Traversal in Fireware Web UI
- CVE-2026-39869 Memory corruption in iOS and iPadOS
- CVE-2026-39868 Memory corruption in iOS and iPadOS
- CVE-2026-39866 Lawnchair vulnerable to Command Injection via unquoted workflow dispatch input in release_update.yml
- CVE-2026-39865 Axios HTTP/2 Session Cleanup State Corruption Vulnerability
- CVE-2026-39864 Kamailio Auth: Processing Vulnerability For Additional Authenticated User Identity Checks
- CVE-2026-39863 Kamailio Core: TCP Data Processing Vulnerability
- CVE-2026-39862 Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link
- CVE-2026-39861 Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace
- CVE-2026-39860 Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination
- CVE-2026-3986 Calculated Fields Form <= 5.4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings
- CVE-2026-39859 LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read
- CVE-2026-39858 Traefik: Forwarded alias spoofing top pre-auth decision bypass
- CVE-2026-39857 Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions
- CVE-2026-39856 osslsigncode has an Out-of-Bounds Read via Unvalidated Section Bounds in PE Page Hash Calculation
- CVE-2026-39855 osslsigncode has an Integer Underflow in PE Page Hash Calculation Can Cause Out-of-Bounds Read
- CVE-2026-39853 osslsigncode has a Stack Buffer Overflow via Unbounded Digest Copy During Signature Verification
- CVE-2026-39852 Quarkus authorization bypass via semicolon path normalization inconsistency
- CVE-2026-39851 Saleor has a user enumeration vulnerability due to different error messages
- CVE-2026-39850 Yii 2: Local file inclusion via view parameter name collision
- CVE-2026-3985 SQL injection in Creative Mail – Easier WordPress & WooCommerce Email Marketing
- CVE-2026-39849 Pi-hole FTL remote code execution via newline injection in dns.interface configuration
- CVE-2026-39848 Dockyard's Unauthenticated Cron Endpoint in Dockyard Enables Container Enumeration and Database Manipulation
- CVE-2026-39847 Emmett has a path traversal in internal assets handler
- CVE-2026-39846 SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions
- CVE-2026-39845 Weblate: SSRF via the webhook add-on using unprotected fetch_url()
- CVE-2026-39844 NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization
- CVE-2026-39843 Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching
- CVE-2026-39842 OpenRemote is Vulnerable to Expression Injection
- CVE-2026-39841 Stored XSS through list fields on Cargo's page values and Special:CargoTables
- CVE-2026-39840 CSS injection in multiple Cargo display formats
- CVE-2026-3984 Campcodes Division Regional Athletic Meet Game Result Matrix System save_up_athlete.php cross site scripting
- CVE-2026-39839 Stored XSS through URLs in Cargo's map format
- CVE-2026-39838 ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS
- CVE-2026-39837 Stored XSS through the dynamic table format in Cargo