Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 699 of 1013.
- CVE-2026-34539 iccDEV: HBO in CTiffImg::WriteLine()
- CVE-2026-34538 Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)
- CVE-2026-34537 iccDEV: UB in CIccOpDefEnvVar::Exec()
- CVE-2026-34536 iccDEV: SO in SIccCalcOp::ArgsUsed()
- CVE-2026-34535 iccDEV: SEGV in CIccTagArray::Cleanup()
- CVE-2026-34534 iccDEV: HBO in CIccMpeSpectralMatrix::Describe()
- CVE-2026-34533 iccDEV: UB in CIccCalculatorFunc::ApplySequence()
- CVE-2026-34532 Parse Server: Cloud function validator bypass via prototype chain traversal
- CVE-2026-34531 Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client
- CVE-2026-34530 File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection
- CVE-2026-3453 Missing authorization in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- CVE-2026-34529 File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file
- CVE-2026-34528 File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution
- CVE-2026-34527 Sandboxie-Plus EditPassword hash entropy reduced from 160 bits to 80 bits due to incorrect nibble extraction
- CVE-2026-34526 SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6
- CVE-2026-34525 AIOHTTP: Duplicate Host header accepted
- CVE-2026-34524 SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data root
- CVE-2026-34523 SillyTavern: Path traversal allows file existence oracle
- CVE-2026-34522 SillyTavern: Path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory
- CVE-2026-34520 AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass
- CVE-2026-3452 Concrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block.
- CVE-2026-34519 AIOHTTP: HTTP response splitting via \r in reason phrase
- CVE-2026-34518 AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect
- CVE-2026-34517 AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS
- CVE-2026-34516 AIOHTTP: Multipart Header Size Bypass
- CVE-2026-34515 AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
- CVE-2026-34514 AIOHTTP: CRLF injection in multipart part content type header construction
- CVE-2026-34513 AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector
- CVE-2026-34512 OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint
- CVE-2026-34511 OpenClaw < 2026.4.2 - PKCE Verifier Exposure via OAuth State Parameter
- CVE-2026-34510 OpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media Loaders
- CVE-2026-34507 OpenClaw < 2026.4.29 - Policy Bypass in QQBot Admin Commands via DM-only and allowFrom Checks
- CVE-2026-34506 OpenClaw < 2026.3.8 - Sender Allowlist Bypass in Microsoft Teams Plugin via Route Allowlist Configuration
- CVE-2026-34505 OpenClaw < 2026.3.12 - Webhook Rate Limiting Bypass via Pre-Authentication Secret Validation
- CVE-2026-34504 OpenClaw < 2026.3.28 - Server-Side Request Forgery via Unguarded Image Download in fal Provider
- CVE-2026-34503 OpenClaw < 2026.3.28 - Incomplete WebSocket Session Termination on Device Removal and Token Revocation
- CVE-2026-34502 Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client
- CVE-2026-34501 Apache Portable Runtime Utility: Heap buffer overflow in APR redis client
- CVE-2026-34500 Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
- CVE-2026-34499 Hardcoded credentials in ADVMS
- CVE-2026-34498 L4L
- CVE-2026-34497 FMS Employee Vulnerable to HTML Injection
- CVE-2026-34496 victor Web - Priviledge Escalation
- CVE-2026-34495 FMS Employee vulnerable to XSS
- CVE-2026-34494 Information disclosure in Neo Series MVP2
- CVE-2026-34493 Information disclosure in EasyIO FS32
- CVE-2026-34492 Airwall - Arbitrary file read
- CVE-2026-34491 Cross-site scripting in Metasys 14
- CVE-2026-34490 XAAP Android Data Stored in Unencrypted Database
- CVE-2026-3449 @tootallnate/once vulnerable to Incorrect Control Flow Scoping
- CVE-2026-34488 Other in IP Setting Software
- CVE-2026-34487 Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token
- CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data
- CVE-2026-34485 A CLI ACL Bypass vulnerability in Nokia 1830 Global Express (GX)
- CVE-2026-34484 A Shell Privilege Escalation vulnerability in Nokia 1830 Global Express (GX)
- CVE-2026-34483 Apache Tomcat: Incomplete escaping of JSON access logs
- CVE-2026-34481 Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout
- CVE-2026-34480 Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
- CVE-2026-34479 Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters
- CVE-2026-34478 Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility
- CVE-2026-34477 Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration
- CVE-2026-34476 Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server
- CVE-2026-34475 Security feature bypass in Varnish Cache
- CVE-2026-34474 Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6.
- CVE-2026-34473 Unauthenticated DoS in ZTE H8102E, H168N, H167A, H199A, H288A, H198A, H267A, H267N, H268A, H388X, H196A, H369A, H268N, H208N, H367N, H181A, and H196Q.
- CVE-2026-34472 Missing authorization in zte:zxhn h188a firmware
- CVE-2026-34464 Sandboxie-Plus NamedPipeServer OpenHandler stack overflow via unterminated server field
- CVE-2026-34463 MantisBT has Stored HTML Injection/XSS via Clone Issue Form
- CVE-2026-34462 Sandboxie-Plus ProcessServer boxname stack buffer overflows via unterminated wide string copy
- CVE-2026-34461 Sandboxie-Plus SbieIniServer RunSbieCtrl stack buffer overflow allows local privilege escalation
- CVE-2026-34460 NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping
- CVE-2026-3446 Base64 decoding stops at first padded quad by default
- CVE-2026-34459 Sandboxie-Plus sandbox escape via uninitialized memory leak and stack overflow in GetRawInputDeviceInfoSlave
- CVE-2026-34458 Sandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnly
- CVE-2026-34457 OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode
- CVE-2026-34456 Reviactyl: OAuth account takeover via auto-linking
- CVE-2026-34455 Hi.Events: SQL Injection via Unvalidated sort_by Query Parameter in Multiple Repository Classes
- CVE-2026-34454 OAuth2 Proxy: Session cookie not cleared when rendering sign-in page
- CVE-2026-34453 SiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmark
- CVE-2026-34452 Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox Escape
- CVE-2026-34451 Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories
- CVE-2026-34450 Claude SDK for Python: Insecure Default File Permissions in Local Filesystem Memory Tool
- CVE-2026-3445 Missing authorization in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- CVE-2026-34449 SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection
- CVE-2026-34448 SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client
- CVE-2026-34447 ONNX: External Data Symlink Traversal
- CVE-2026-34446 ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
- CVE-2026-34445 ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.
- CVE-2026-34444 Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr
- CVE-2026-34443 FreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask()
- CVE-2026-34442 FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout
- CVE-2026-34441 cpp-httplib: HTTP Request Smuggling via Unconsumed GET Request Body
- CVE-2026-34430 ByteDance DeerFlow LocalSandboxProvider Host Bash Escape
- CVE-2026-34429 Vvveb < 1.0.8.1 Stored XSS via Media Upload and Rename
- CVE-2026-34428 Vvveb < 1.0.8.1 SSRF via oEmbedProxy
- CVE-2026-34427 Vvveb < 1.0.8.1 Privilege Escalation via admin/user/save
- CVE-2026-34426 OpenClaw - Approval Bypass via Environment Variable Normalization
- CVE-2026-34425 OpenClaw - Shell-Bleed Protection Preflight Validation Bypass
- CVE-2026-34424 Smart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access Toolkit
- CVE-2026-3442 Binutils: gnu binutils: information disclosure or denial of service via out-of-bounds read in bfd linker