Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 707 of 1013.
- CVE-2026-33690 AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()
- CVE-2026-3369 Cross-site scripting in Better Find and Replace – AI-Powered Suggestions
- CVE-2026-33689 xrdp: Pre-authentication out-of-bounds reads in channel parsers
- CVE-2026-33688 AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint
- CVE-2026-33687 Sharp has Unrestricted File Upload via Client-Controlled Validation Rules
- CVE-2026-33686 Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil
- CVE-2026-33685 AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data
- CVE-2026-33684 AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions
- CVE-2026-33683 AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field
- CVE-2026-33682 Streamlit on Windows has Unauthenticated SSRF Vulnerability (NTLM Credential Exposure)
- CVE-2026-33681 AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name
- CVE-2026-33680 Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation
- CVE-2026-3368 Injection Guard <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via Query Parameter Name
- CVE-2026-33679 Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections
- CVE-2026-33678 Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion
- CVE-2026-33677 Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API
- CVE-2026-33676 Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read
- CVE-2026-33675 Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources
- CVE-2026-33674 PrestaShop: Improper Use of Validation Framework
- CVE-2026-33673 PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables
- CVE-2026-33672 Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
- CVE-2026-33671 Picomatch has a ReDoS vulnerability via extglob quantifiers
- CVE-2026-33670 SiYuan has directory traversal within its publishing service
- CVE-2026-3367 Cross-site scripting in Lockme calendars integration
- CVE-2026-33669 SiYuan has Arbitrary Document Reading within the Publishing Service
- CVE-2026-33668 Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect
- CVE-2026-33667 OpenProject: 2FA OTP Verification Missing Rate Limiting
- CVE-2026-33666 Zserio: Integer Overflow in BitStreamReader on 32-bit platforms
- CVE-2026-33665 n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover
- CVE-2026-33664 Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields
- CVE-2026-33663 n8n Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition
- CVE-2026-33662 OP-TEE: RSASSA EMSA- PKCS1-v1_5 underflow in emsa_pkcs1_v1_5_encode()
- CVE-2026-33661 WeChat Pay callback signature verification bypassed when Host header is localhost
- CVE-2026-33660 n8n Has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode
- CVE-2026-3366 InfoSphere Optim Test Data Fabrication is affected by Arbitrary File Read
- CVE-2026-33659 EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access
- CVE-2026-33658 Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
- CVE-2026-33657 EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field
- CVE-2026-33656 Path traversal in espocrm
- CVE-2026-33655 New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs
- CVE-2026-33654 Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling
- CVE-2026-33653 Uploady Vulnerable to Stored Cross-Site Scripting (XSS)
- CVE-2026-33651 AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()
- CVE-2026-33650 AVideo's Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion
- CVE-2026-33649 AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification
- CVE-2026-33648 AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path
- CVE-2026-33647 AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload
- CVE-2026-33646 mise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)
- CVE-2026-33645 Fireshare has Path Traversal Arbitrary File Write in `/api/uploadChunked`
- CVE-2026-33644 Server-side request forgery in Lychee
- CVE-2026-33643 SQL injection in schemahero:schemahero
- CVE-2026-33642 Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check
- CVE-2026-33641 Glances Vulnerable to Command Injection via Dynamic Configuration Values
- CVE-2026-33640 Outline has a rate limit bypass that allows brute force of email login OTP
- CVE-2026-33639 InvoicePlane permits DDL injection through tax_rate_decimal_places
- CVE-2026-33638 Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint
- CVE-2026-33637 Faraday: Protocol-relative URI objects still bypass host scoping (possible incomplete fix for GHSA-33mh-2634-fwr2)
- CVE-2026-33636 LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64
- CVE-2026-33635 iCalendar has ICS injection via unsanitized URI property values
- CVE-2026-33634 Aquasecurity Trivy Embedded Malicious Code
- CVE-2026-33633 Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler
- CVE-2026-33632 ClearanceKit: opfilter policy bypass via exchangedata and clone operations
- CVE-2026-33631 ClearanceKit: opfilter policy bypass via non-open file operations
- CVE-2026-33630 Use after free in c-ares
- CVE-2026-33628 Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items
- CVE-2026-33627 Parse Server: Auth data exposed via /users/me endpoint
- CVE-2026-33626 LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
- CVE-2026-33625 LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
- CVE-2026-33624 Parse Server: MFA recovery code single-use bypass via concurrent requests
- CVE-2026-33623 PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution
- CVE-2026-33622 A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution
- CVE-2026-33621 PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token
- CVE-2026-33620 PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems
- CVE-2026-3362 Short Comment Filter <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Minimum Count' Setting
- CVE-2026-33619 PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl
- CVE-2026-33618 Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings
- CVE-2026-33617 MB connect line mbCONNECT24 vulnerable to an unauthenticated information disclosure in the data24 Endpoint
- CVE-2026-33616 MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the mb24api Endpoint
- CVE-2026-33615 MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the setinfo Endpoint
- CVE-2026-33614 MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the getinfo endpoint
- CVE-2026-33613 MB connect line mbCONNECT24 vulnerable to RCE in generateSrpArray
- CVE-2026-33612 ZoneToCache can poison the cache
- CVE-2026-33611 Insufficient validation of HTTPS and SVCB records
- CVE-2026-33610 Possible file descriptor exhaustion in forward-dnsupdate
- CVE-2026-3361 WP Store Locator <= 2.2.261 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsl_address' Post Meta
- CVE-2026-33609 LDAP DN injection
- CVE-2026-33608 Incomplete domain name sanitization during
- CVE-2026-33607 Denial of service in OX Dovecot CE
- CVE-2026-33606 Other in OX Dovecot CE
- CVE-2026-33605 Denial of service in OX Dovecot CE
- CVE-2026-33604 Security feature bypass in OX Dovecot CE
- CVE-2026-33603 Security feature bypass in OX Dovecot Pro
- CVE-2026-33602 Off-by-one access when processing crafted UDP responses
- CVE-2026-33601 Insufficient validation of zonemd record
- CVE-2026-33600 Null pointer dereference in RPZ transfer
- CVE-2026-3360 Missing authorization in Tutor LMS – eLearning and online course solution
- CVE-2026-33599 Out-of-bounds read in service discovery
- CVE-2026-33598 Out-of-bounds read in cache inspection via Lua
- CVE-2026-33597 PRSD detection denial of service
- CVE-2026-33596 TCP backend stream ID overflow