Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 689 of 1013.
- CVE-2026-35584 Missing authorization in freescout
- CVE-2026-35583 Emissary has a Path Traversal via Blacklist Bypass in Configuration API
- CVE-2026-35582 Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
- CVE-2026-35581 Emissary has a Command Injection via PLACE_NAME Configuration in Executrix
- CVE-2026-35580 Emissary has GitHub Actions Shell Injection via Workflow Inputs
- CVE-2026-3558 Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass Vulnerability
- CVE-2026-35579 CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports
- CVE-2026-35577 Missing Host Header Validation in Apollo MCP Server for Localhost Deployments
- CVE-2026-35576 ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.php
- CVE-2026-35575 ChurchCRM has Stored XSS in Group Name
- CVE-2026-35574 ChurchCRM has a Stored XSS in Person Profile - Add a Note
- CVE-2026-35573 ChurchCRM has a Path traversal leads to RCE
- CVE-2026-35572 SSRF via Referer header in ChurchCRM allows server-side HTTP/HTTPS requests to arbitrary hosts
- CVE-2026-35571 Emissary has Stored XSS via Navigation Template Link Injection
- CVE-2026-35570 OpenClaude has Sandbox Bypass via Early-Exit Logic Flaw that Allows Path Traversal
- CVE-2026-3557 Memory corruption in Hue Bridge
- CVE-2026-35569 ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
- CVE-2026-35568 MCP Java-SDK has a DNS Rebinding Vulnerability
- CVE-2026-35565 Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI
- CVE-2026-35563 Apache Directory LDAP API lacks server certificate verification for LDAP hostnames
- CVE-2026-35562 Allocation of resources without limits in parsing components in Amazon Athena ODBC driver
- CVE-2026-35561 Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driver
- CVE-2026-35560 Improper certificate validation in identity provider connection components in Amazon Athena ODBC driver
- CVE-2026-3556 Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-35559 Out-of-bounds write in query processing components in Amazon Athena ODBC driver
- CVE-2026-35558 Improper neutralization of special elements in authentication components in Amazon Athena ODBC driver
- CVE-2026-35556 Plaintext storage of a password in OpenPLC_V3
- CVE-2026-35555 Subnet Solutions PowerSYSTEM Center Incorrect Authorization
- CVE-2026-35554 Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
- CVE-2026-35553 Memory corruption in DRFEC.SYS
- CVE-2026-35552 In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an
- CVE-2026-3555 Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-35549 Denial of service in MariaDB
- CVE-2026-35548 Server-side request forgery in guardsix:logpoint
- CVE-2026-35547 Heap overflow in libnv
- CVE-2026-35546 Anviz Products Missing Authentication for Critical Function
- CVE-2026-35545 Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message
- CVE-2026-35544 Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages
- CVE-2026-35543 Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message
- CVE-2026-35542 Roundcube: Bypass of remote image blocking via crafted BODY background attribute
- CVE-2026-35541 Roundcube Webmail: Incorrect password comparison in the password plugin
- CVE-2026-35540 Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages
- CVE-2026-3554 Cross-site scripting in Sherk Custom Post Type Displays
- CVE-2026-35539 Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode
- CVE-2026-35538 Roundcube Webmail: Unsanitized IMAP SEARCH command arguments
- CVE-2026-35537 Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler
- CVE-2026-35536 Tornado has incomplete validation of cookie attributes
- CVE-2026-35535 Privilege escalation in Sudo
- CVE-2026-35534 ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection
- CVE-2026-35533 mise has a local settings bypass config trust checks
- CVE-2026-3553 Incorrect Authorization in GitLab
- CVE-2026-35527 Incus blind SSRF via image import preflight HEAD request
- CVE-2026-35526 Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions
- CVE-2026-35525 LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates
- CVE-2026-35523 Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol
- CVE-2026-35521 Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection
- CVE-2026-35520 Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection
- CVE-2026-3552 Missing authorization in SurfLink – Link Manager & Backup Restore
- CVE-2026-35519 Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection
- CVE-2026-35518 Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection
- CVE-2026-35517 Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection
- CVE-2026-35516 LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection
- CVE-2026-35515 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
- CVE-2026-35514 Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew
- CVE-2026-35512 xrdp: Heap buffer overflow in EGFX channel
- CVE-2026-3551 Cross-site scripting in Custom New User Notification
- CVE-2026-35508 Cross-site scripting in Shynet
- CVE-2026-35507 Other in Shynet
- CVE-2026-35506 Command injection in WRC-BE65QSD-B
- CVE-2026-35505 OFFIS DCMTK Toolkit Missing Release of Memory after Effective Lifetime
- CVE-2026-35504 Subnet Solutions PowerSYSTEM Center CRLF injection
- CVE-2026-35503 SenseLive X3050 Use of Hard-coded Credentials
- CVE-2026-35502 Deserialization in Intel(R) Extension for PyTorch
- CVE-2026-35501 Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.
- CVE-2026-3550 RockPress <= 1.0.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via AJAX Actions
- CVE-2026-35499 Command injection in Totolink
- CVE-2026-35496 Path traversal in CubeCart
- CVE-2026-35492 Kedro-Datasets has a path traversal vulnerability in PartitionedDataset allows arbitrary file write
- CVE-2026-35491 Pi-hole FTL: CLI API sessions can import Teleporter archives and modify configuration
- CVE-2026-35490 changedetection.io has an Authentication Bypass via Decorator Ordering
- CVE-2026-3549 ECH parsing heap buffer overflow
- CVE-2026-35489 Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/`
- CVE-2026-35488 Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users
- CVE-2026-35487 text-generation-webui has a Path Traversal in load_prompt() — .txt file read without authentication
- CVE-2026-35486 text-generation-webui has a SSRF in superbooga/superboogav2 extensions — no URL validation
- CVE-2026-35485 text-generation-webui has a Path Traversal in load_grammar() — arbitrary file read without authentication
- CVE-2026-35484 text-generation-webui has a Path Traversal in load_preset() — .yaml file read without authentication
- CVE-2026-35483 text-generation-webui has a Path Traversal in load_template() — .jinja/.yaml/.yml file read without authentication
- CVE-2026-35482 alf.io has an Authenticated RCE via Extension Script Sandbox Escape
- CVE-2026-35480 go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headers
- CVE-2026-3548 Buffer overflow in CRL number parsing in wolfSSL
- CVE-2026-35479 InvenTree Plugin Installation - Insufficient Permissions
- CVE-2026-35478 InvenTree has Arbitrary API Token Creation
- CVE-2026-35477 InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape
- CVE-2026-35476 InvenTree Affected by Privilege Escalation via API
- CVE-2026-35475 WeGIA - Open Redirect - backup redirection — Unvalidated $_GET['redirect']
- CVE-2026-35474 WeGIA - Open Redirect - atualizacao redirection - Unvalidated $_GET['redirect']
- CVE-2026-35473 WeGIA - Open Redirect - IentradaControle - listarId() - Unvalidated $_GET['nextPage']
- CVE-2026-35472 WeGIA - Open Redirect - EstoqueControle - listarTodos() - Unvalidated $_GET['nextPage']
- CVE-2026-35471 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs