Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 690 of 1013.
- CVE-2026-35470 OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals
- CVE-2026-3547 wolfSSL: out-of-bounds read (DoS) in ALPN parsing due to incomplete validation
- CVE-2026-35469 SpdyStream: DOS on CRI
- CVE-2026-35468 nimiq/core-rs-albatross: Panic in history index request handlers when a full node runs without the history index
- CVE-2026-35467 Private Key stored as extractable in browser IndexeDB
- CVE-2026-35466 Stored XSS via unsanitized input from remote service
- CVE-2026-35465 SecureDrop Client has path injection in read_gzip_header_filename()
- CVE-2026-35464 pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)
- CVE-2026-35463 pyLoad has Improper Neutralization of Special Elements used in an OS Command
- CVE-2026-35462 Papra Does Not Reject Expired API Keys
- CVE-2026-35461 Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL
- CVE-2026-35460 Papra has an HTML Injection in Transactional Emails via Unescaped User Display Name
- CVE-2026-3546 Missing authorization in e-shot
- CVE-2026-35459 pyLoad has SSRF fix bypass via HTTP redirect
- CVE-2026-35458 Gotenberg has a ReDoS via extraHttpHeaders scope feature
- CVE-2026-35457 libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
- CVE-2026-35455 immich has Stored XSS via OCR Text in 360° Panorama Viewer
- CVE-2026-35454 Code Extension Marketplace has a Zip Slip Path Traversal
- CVE-2026-35453 PhpSpreadsheet XSS via number format text substitution in HTML Writer
- CVE-2026-35452 WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php
- CVE-2026-35451 Twenty: Stored XSS via BlockNote FileBlock
- CVE-2026-35450 WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php
- CVE-2026-3545 Security feature bypass in Chrome
- CVE-2026-35449 WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php
- CVE-2026-35448 WWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php
- CVE-2026-35447 Missing authorization in Nameless
- CVE-2026-35446 LORIS has a path traversal in FilesDownloadHandler
- CVE-2026-35445 Winter: Authenticated backend users can bypass Users controller permission checks
- CVE-2026-35444 SDL_image has a heap buffer overflow READ via unchecked colormap index in XCF loader
- CVE-2026-35443 NamelessMC: Forum reactions bypass the "view own topics only" restriction
- CVE-2026-35442 Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
- CVE-2026-35441 Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits
- CVE-2026-35440 Microsoft Word Information Disclosure Vulnerability
- CVE-2026-3544 Memory corruption in Chrome
- CVE-2026-35439 Microsoft SharePoint Server Remote Code Execution Vulnerability
- CVE-2026-35438 Windows Admin Center Elevation of Privilege Vulnerability
- CVE-2026-35436 Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
- CVE-2026-35435 Azure AI Foundry Elevation of Privilege Vulnerability
- CVE-2026-35433 .NET Elevation of Privilege Vulnerability
- CVE-2026-35431 Microsoft Entra ID Entitlement Management Spoofing Vulnerability
- CVE-2026-35430 Azure Privileged Identity Management (PIM) Elevation of Privilege Vulnerability
- CVE-2026-3543 Memory corruption in Chrome
- CVE-2026-35429 Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
- CVE-2026-35428 Azure Cloud Shell Spoofing Vulnerability
- CVE-2026-35425 Azure API Management (APIM) Remote Code Execution Vulnerability
- CVE-2026-35424 Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability
- CVE-2026-35423 Windows 11 Telnet Client Information Disclosure Vulnerability
- CVE-2026-35422 Windows TCP/IP Driver Security Feature Bypass Vulnerability
- CVE-2026-35421 Windows GDI Remote Code Execution Vulnerability
- CVE-2026-35420 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-3542 Memory corruption in Chrome
- CVE-2026-35419 Windows DWM Core Library Information Disclosure Vulnerability
- CVE-2026-35418 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
- CVE-2026-35417 Windows Win32k Elevation of Privilege Vulnerability
- CVE-2026-35416 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-35415 Windows Storage Spaces Controller Elevation of Privilege Vulnerability
- CVE-2026-35414 Security feature bypass in OpenSSH
- CVE-2026-35413 Directus GraphQL Schema SDL Disclosure Setting
- CVE-2026-35412 Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite
- CVE-2026-35411 Directus is an Open Redirect in Admin 2FA Setup Page
- CVE-2026-35410 Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow
- CVE-2026-3541 Memory corruption in Chrome
- CVE-2026-35409 Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
- CVE-2026-35408 Directus is Missing Cross-Origin Opener Policy
- CVE-2026-35407 Saleor has Cross-Account Email Change via Unbound Confirmation Token
- CVE-2026-35406 Aardvark-dns has incorrect error handling for malformed tcp packets
- CVE-2026-35405 libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers
- CVE-2026-35404 Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter
- CVE-2026-35403 LORIS has potential cross-site scripting in survey_accounts module
- CVE-2026-35402 mcp-neo4j-cypher: SSRF and Data Modification via read_only Mode Bypass Through CALL Procedures
- CVE-2026-35401 Saleor has a resource exhaustion vulnerability in GraphQL queries
- CVE-2026-35400 LORIS incorrectly trusts user input in publication module
- CVE-2026-3540 Memory corruption in Chrome
- CVE-2026-35399 WeGIA has Stored XSS in backup file names
- CVE-2026-35398 WeGIA - Open Redirect - OrigemControle - listarTodos() & listarId_Nome() - Unvalidated $_GET['nextPage']
- CVE-2026-35397 jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix
- CVE-2026-35396 WeGIA - Open Redirect - IsaidaControle - listarId() - Unvalidated $_GET['nextPage']
- CVE-2026-35395 WeGIA has a SQL Injection in DespachoDAO.php via id_memorando parameter
- CVE-2026-35394 Mobile Next has Arbitrary Android Intent Execution via mobile_open_url
- CVE-2026-35393 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload
- CVE-2026-35392 goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload
- CVE-2026-35391 Security feature bypass in webmail
- CVE-2026-35390 Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks
- CVE-2026-35389 Bulwark Webmail S/MIME signature verification accepted self-signed certificates
- CVE-2026-35388 Other in OpenSSH
- CVE-2026-35387 Weak cryptography in OpenSSH
- CVE-2026-35386 Command injection in OpenSSH
- CVE-2026-35385 Misconfiguration in OpenSSH
- CVE-2026-35383 Bentley Systems iTwin Platform exposed access token
- CVE-2026-35381 uutils coreutils cut Local Logic Error and Data Integrity Issue in Output Filtering
- CVE-2026-35380 uutils coreutils cut Local Logic Error and Data Integrity Issue in Delimiter Parsing
- CVE-2026-3538 Integer overflow in Chrome
- CVE-2026-35379 uutils coreutils tr Local Logic Error and Data Integrity Issue in Character Class Handling
- CVE-2026-35378 uutils coreutils expr Local Denial of Service via Eager Evaluation of Parenthesized Subexpressions
- CVE-2026-35377 uutils coreutils env Local Denial of Service via Improper Handling of Backslashes in Split-String Mode
- CVE-2026-35376 uutils coreutils chcon Security Bypass and Mandatory Access Control (MAC) Inconsistency via TOCTOU Race Condition
- CVE-2026-35375 uutils coreutils split Local Data Integrity Issue via Lossy Filename Encoding
- CVE-2026-35374 uutils coreutils split Arbitrary File Truncation via Time-of-Check to Time-of-Use (TOCTOU) Race Condition
- CVE-2026-35373 uutils coreutils ln Local Denial of Service via Improper Handling of Non-UTF-8 Filenames
- CVE-2026-35372 uutils coreutils ln Security Bypass via Improper Handling of the --no-dereference Flag