Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 704 of 1013.
- CVE-2026-33999 Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling
- CVE-2026-33997 Moby: Off-by-one error in plugin privilege validation
- CVE-2026-33996 LibJWT has NULL/bounds validation in JWK octet and RSA PSS parsing
- CVE-2026-33995 FreeRDP: Possible double free in kerberos_AcceptSecurityContext
- CVE-2026-33994 Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521
- CVE-2026-33993 Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()
- CVE-2026-33992 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration
- CVE-2026-33991 WeGIA has SQL Injection in deletar_tag.php
- CVE-2026-33990 Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)
- CVE-2026-3399 Tenda F453 httpd GstDhcpSetSer fromGstDhcpSetSer buffer overflow
- CVE-2026-33989 @mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools
- CVE-2026-33987 FreeRDP: Persistent Cache bmpSize Desync - Heap OOB Write
- CVE-2026-33986 FreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB Write
- CVE-2026-33985 FreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB Read
- CVE-2026-33984 FreeRDP: ClearCodec resize_vbar_entry() Heap OOB Write
- CVE-2026-33983 FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS
- CVE-2026-33982 FreeRDP: Persistent Cache Allocator Mismatch - Heap OOB Read
- CVE-2026-33981 Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
- CVE-2026-33980 Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries
- CVE-2026-3398 Tenda F453 httpd AdvSetWan fromAdvSetWan buffer overflow
- CVE-2026-33979 Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)
- CVE-2026-33978 Notesnook: Stored XSS in mobile share editor via unescaped web clip title metadata
- CVE-2026-33977 FreeRDP: DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331)
- CVE-2026-33976 Notesnook vulnerable to RCE via stored XSS in Web Clipper rendering
- CVE-2026-33975 twenty-server SSRF protection bypass via IPv4-mapped IPv6 address normalization
- CVE-2026-33970 Null dereference in Exynos 850 firmware
- CVE-2026-33968 Race condition in Exynos 1330 firmware
- CVE-2026-33967 Memory corruption in Exynos 1330 firmware
- CVE-2026-33966 Information disclosure in Exynos 1330 firmware
- CVE-2026-33964 Memory corruption in Exynos 1580 firmware
- CVE-2026-33963 Memory corruption in Exynos 1330 firmware
- CVE-2026-33962 Memory corruption in Exynos 850 firmware
- CVE-2026-33960 Memory corruption in Exynos 1330 firmware
- CVE-2026-3396 WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection
- CVE-2026-33957 Memory corruption in Exynos 1580 firmware
- CVE-2026-33956 Memory corruption in Exynos 1330 firmware
- CVE-2026-33955 Notesnook vulnerable to RCE via stored XSS in Note History diff viewer
- CVE-2026-33954 LinkAce discloses private notesto unauthorized authenticated users via the web link detail page
- CVE-2026-33953 LinkAce's SSRF protection can be bypassed via internal hostname resolution in LinkAce
- CVE-2026-33952 FreeRDP: DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checks
- CVE-2026-33951 signalk-server: Unauthenticated Source Priorities Manipulation
- CVE-2026-33950 signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity
- CVE-2026-3395 MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection
- CVE-2026-33949 @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files
- CVE-2026-33948 jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input
- CVE-2026-33947 jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted()
- CVE-2026-33946 MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
- CVE-2026-33945 Abitrary file write through systemd-creds option
- CVE-2026-33943 Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
- CVE-2026-33942 Saloon has insecure deserialization in AccessTokenAuthenticator (object injection / RCE)
- CVE-2026-33941 Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
- CVE-2026-33940 Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
- CVE-2026-3394 jarikomppa soloud WAV File soloud_wav.cpp loadwav memory corruption
- CVE-2026-33939 Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
- CVE-2026-33938 Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
- CVE-2026-33937 Handlebars.js has JavaScript Injection via AST Type Confusion
- CVE-2026-33936 python-ecdsa: Denial of Service via improper DER length validation in crafted private keys
- CVE-2026-33935 MyTube has Unauthenticated Account Lockout via Shared Login Attempt State
- CVE-2026-33934 OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures
- CVE-2026-33933 Reflected XSS via Unescaped contextName Parameter in Custom Template Editor
- CVE-2026-33932 OpenEMR has Stored XSS in CCDA Preview via Unsanitized linkHtml Attributes
- CVE-2026-33931 OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access
- CVE-2026-33930 Apache Traffic Server: Buffer overflow via Host field that has a long string value
- CVE-2026-3393 jarikomppa soloud Audio File soloud_wav.cpp loadflac heap-based overflow
- CVE-2026-33929 Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
- CVE-2026-33924 Authenticated RCE in update functionality in Guardian/CMC before 26.4.0
- CVE-2026-33923 Update bundle signature bypass in Guardian/CMC before 26.4.0
- CVE-2026-33922 Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0
- CVE-2026-33921 Npcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0
- CVE-2026-33920 Cross-site request forgery in the Guardian/CMC login before 26.3.0
- CVE-2026-3392 FascinatedBox lily lily_emitter.c eval_tree null pointer dereference
- CVE-2026-33918 OpenEMR Missing Authorization on Claim File Download Endpoint
- CVE-2026-33917 OpenEMR has SQL Injection in CAMOS Form
- CVE-2026-33916 Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
- CVE-2026-33915 OpenEMR Missing ACL Checks on Insurance Company API Routes
- CVE-2026-33914 OpenEMR has SQL Injection in PostCalendar Category Delete
- CVE-2026-33913 OpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Files
- CVE-2026-33912 OpenEMR has reflected XSS in ajax_download.php via reportID parameter
- CVE-2026-33911 OpenEMR vulnerable to reflected XSS in graphs.php via title parameter
- CVE-2026-33910 OpenEMR has a SQL Injection Vulnerability in patient selection
- CVE-2026-3391 FascinatedBox lily lily_emitter.c clear_storages out-of-bounds
- CVE-2026-33909 OpenEMR Vulnerable to SQL Injection via Unsanitized Variables in MedEx Recall/Reminder Processing
- CVE-2026-33908 ImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()
- CVE-2026-33907 Ella Core Panics during NAS Authentication Response/Failure with missing IEs
- CVE-2026-33906 Ella Core has Privilege Escalation via Database Restore by NetworkManager role
- CVE-2026-33905 ImageMagick has an Out-of-Bounds read via -sample operation
- CVE-2026-33904 Ella Core has a Denial of Service via SCTP connection cleanup deadlock
- CVE-2026-33903 Ella Core panics when processing a crafted NGAP LocationReport message
- CVE-2026-33902 ImageMagick: Stack Overflow via Recursive FX Expression Parsing
- CVE-2026-33901 ImageMagick has a Heap Buffer Overflow via MVG decoder
- CVE-2026-33900 ImageMagick has a Heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit builds
- CVE-2026-3390 FascinatedBox lily Error Reporting lily_build_error.c patch_line_end out-of-bounds
- CVE-2026-33899 ImageMagick: Heap BufferOverflow write of single zero byte when parsing XML
- CVE-2026-33898 Local Incus UI web server vulnerable to nuthentication bypass
- CVE-2026-33897 Incus vulnerable to arbitrary file read and write through pongo templates
- CVE-2026-33896 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
- CVE-2026-33895 Forge has signature forgery in Ed25519 due to missing S > L check
- CVE-2026-33894 Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
- CVE-2026-33893 Hardcoded credentials in Teamcenter V2312
- CVE-2026-33892 Auth bypass in Industrial Edge Management Pro V1