Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 694 of 1013.
- CVE-2026-35038 signalk-server: Arbitrary Prototype Read via `from` Field Bypass
- CVE-2026-35037 Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata
- CVE-2026-35036 Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature
- CVE-2026-35035 CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS
- CVE-2026-35034 Jellyfin: Potential Application DoS from excessively large SyncPlay group names
- CVE-2026-35033 Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection
- CVE-2026-35032 Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner
- CVE-2026-35031 Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain
- CVE-2026-35030 LiteLLM has an authentication bypass via OIDC userinfo cache key collision
- CVE-2026-3503 Fault injection attack with ML-DSA and ML-KEM on ARM
- CVE-2026-35029 LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint
- CVE-2026-35025 ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR
- CVE-2026-35023 Wimi Teamwork On-Premises < 8.2.0 IDOR via preview.php
- CVE-2026-3502 TrueConf Client Download of Code Without Integrity Check
- CVE-2026-35019 NetComm NF20MESH < R6B032 Hardcoded AES Key Authentication Bypass
- CVE-2026-35018 NetComm NF20MESH < R6B032 Authenticated RCE via OS Command Injection
- CVE-2026-35016 Open ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query Parameter
- CVE-2026-35015 Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameter
- CVE-2026-35014 Open ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id Parameter
- CVE-2026-35013 Open ISES Tickets < 3.44.2 Reflected XSS via street_view.php thelat and thelng Parameters
- CVE-2026-35012 Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter
- CVE-2026-35011 Open ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call Parameter
- CVE-2026-35010 Open ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id Parameter
- CVE-2026-35009 Open ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameter
- CVE-2026-35008 Open ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameter
- CVE-2026-35007 Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter
- CVE-2026-35002 Agno < 2.3.24 field_type Eval Injection Arbitrary Code Execution
- CVE-2026-35001 OpenS100 S-102 Parser Integer Overflow Heap Buffer Overflow
- CVE-2026-35000 ChangeDetection.io < 0.54.7 SafeXPath3Parser Bypass Arbitrary File Read
- CVE-2026-34999 OpenViking 0.2.5 < 0.2.14 Bot Proxy Endpoints Allow Unauthenticated Access
- CVE-2026-34993 AIOHTTP Vulnerable to Deserialization of Untrusted Data
- CVE-2026-34992 Missing Encryption of Sensitive Data in antrea.io/antrea
- CVE-2026-34990 OpenPrinting CUPS: Local print admin token disclosure using temporary printers
- CVE-2026-3499 Cross-site request forgery in Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce
- CVE-2026-34989 CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
- CVE-2026-34988 Wasmtime leaks data between pooling allocator instances
- CVE-2026-34987 Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access
- CVE-2026-34986 Go JOSE affect by a panic in JWE decryption
- CVE-2026-34985 LORIS has incorrect access checks in media module
- CVE-2026-34984 External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine
- CVE-2026-34983 Wasmtime has a use-after-free bug after cloning `wasmtime::Linker`
- CVE-2026-34982 Vim modeline bypass via various options affects Vim < 9.2.0276
- CVE-2026-34981 whisperX REST API: SSRF in download_from_url() — URL validation happens after HTTP request, extension bypass via .mp3
- CVE-2026-34980 OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
- CVE-2026-3498 BlockArt Blocks <= 2.2.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'clientId' Block Attribute
- CVE-2026-34979 OpenPrinting CUPS: Heap overflow in `get_options()`
- CVE-2026-34978 Path traversal in cups
- CVE-2026-34977 Aperi'Solve Affected by Unauthenticated RCE via JPSeek Analyzer Command
- CVE-2026-34976 Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
- CVE-2026-34975 Other in plunk
- CVE-2026-34974 phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation
- CVE-2026-34973 phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure
- CVE-2026-34972 OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision
- CVE-2026-34971 Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift
- CVE-2026-34970 MantisBT Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked
- CVE-2026-3497 Memory corruption in openssh
- CVE-2026-34969 Nhost Leaks the Refresh Token via URL Query Parameter in OAuth Provider Callback
- CVE-2026-34968 Adminer before 5.4.3 Arbitrary File Deletion via SQLite Drop
- CVE-2026-34967 Adminer sql-log Plugin 5.3.0 through 5.4.2 Arbitrary File Write
- CVE-2026-34966 Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass
- CVE-2026-34965 Cockpit CMS Authenticated Remote Code Execution via Collections
- CVE-2026-34964 Adminer before 5.5.0 SSRF via PDO DSN Injection
- CVE-2026-34963 barebox EFI PE Loader Memory Safety Vulnerabilities
- CVE-2026-34962 barebox ext4 Directory Parsing Infinite Loop Denial of Service
- CVE-2026-34961 barebox ext4 Extent Parsing Out-of-Bounds Read
- CVE-2026-34960 barebox Out-of-Bounds Read in DHCP Option Parsing
- CVE-2026-3496 JetBooking <= 4.0.3 - Unauthenticated SQL Injection via 'check_in_date' Parameter
- CVE-2026-34959 Adminer before 5.5.0 Open Redirect via X-Forwarded-Prefix
- CVE-2026-34956 Openvswitch: open vswitch: denial of service via malformed ftp epasv command
- CVE-2026-34955 PraisonAI: Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox
- CVE-2026-34954 PraisonAI: SSRF in FileTools.download_file() via Unvalidated URL
- CVE-2026-34953 PraisonAI: Authentication Bypass in OAuthManager.validate_token()
- CVE-2026-34952 PraisonAI: Missing Authentication in WebSocket Gateway
- CVE-2026-34951 Reflected XSS in footer.php in Workbench Allows Attackers to Hijack Authenticated Sessions
- CVE-2026-34950 fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key
- CVE-2026-3495 Unescaped variables during error page composition
- CVE-2026-34949 Combodo iTop: Unauthenticated user can delete .readonly file
- CVE-2026-34948 Combodo iTop: Access control bypass via OQL joins
- CVE-2026-34947 Discourse: Staged user custom fields are exposed on public invite pages
- CVE-2026-34946 Wasmtime's host panics when Winch compiler executes `table.fill`
- CVE-2026-34945 Wasmtime leaks host data with 64-bit tables and Winch
- CVE-2026-34944 Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64
- CVE-2026-34943 Wasmtime panics when lifting `flags` component value
- CVE-2026-34942 Wasmtime panics when transcoding misaligned utf-16 strings
- CVE-2026-34941 Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding
- CVE-2026-34940 KubeAI: OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods
- CVE-2026-3494 MariaDB Server Audit Plugin Comment Handling Bypass
- CVE-2026-34939 PraisonAI: ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()
- CVE-2026-34938 PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code
- CVE-2026-34937 PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution
- CVE-2026-34936 PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback
- CVE-2026-34935 PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()
- CVE-2026-34934 PraisonAI: Second-Order SQL Injection in `get_all_user_threads`
- CVE-2026-34933 Avahi: Reachable assertion in `transport_flags_from_domain()` via conflicting publish flags crashes avahi-daemon
- CVE-2026-34932 hoppscotch: Stored XSS via mock server responses on backend origin
- CVE-2026-34931 hoppscotch: Improper loopback redirect_uri validation in device-login flow
- CVE-2026-34930 Privilege escalation in TrendAI Apex One
- CVE-2026-34929 Privilege escalation in TrendAI Apex One
- CVE-2026-34928 Privilege escalation in TrendAI Apex One
- CVE-2026-34927 Privilege escalation in TrendAI Apex One