Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 708 of 1013.
- CVE-2026-33595 DoQ/DoH3 excessive memory allocation
- CVE-2026-33594 Outgoing DoH excessive memory allocation
- CVE-2026-33593 Denial of service via crafted DNSCrypt query
- CVE-2026-33592 FindServers Memory Exhaustion in open62541
- CVE-2026-33591 Authentication bypass on WaptServer
- CVE-2026-33590 Insecure default permissions in Portainer CE
- CVE-2026-3359 SQL injection in Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
- CVE-2026-33589 Arbitrary File Read via Local File Inclusion (LFI)
- CVE-2026-33588 Arbitrary File Write Through Path Traversal
- CVE-2026-33587 Remote Code Execution (RCE) via Server-Side Template Injection (SSTI)
- CVE-2026-33586 Authenticated SMTP Sender Address Forgery
- CVE-2026-33585 Arqit SKA-Platform Improper Handling of Parameters Vulnerability
- CVE-2026-33584 Arqit SKA-Platform Enables Access to Debug Information
- CVE-2026-33583 Arqit SKA-Platform Vulnerable to Key Exposure
- CVE-2026-33582 Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error
- CVE-2026-33581 OpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl Parameters
- CVE-2026-33580 OpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret Authentication
- CVE-2026-3358 Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment
- CVE-2026-33579 OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval
- CVE-2026-33578 OpenClaw < 2026.3.28 - Sender Policy Allowlist Bypass via Policy Downgrade in Google Chat and Zalouser Extensions
- CVE-2026-33577 OpenClaw < 2026.3.28 - Insufficient Scope Validation in node.pair.approve
- CVE-2026-33576 OpenClaw < 2026.3.28 - Unauthorized Media Download via Zalo Channel
- CVE-2026-33575 OpenClaw < 2026.3.12 - Long-lived Credential Exposure in Pairing Setup Codes
- CVE-2026-33574 OpenClaw < 2026.3.8 - Path Traversal via Tools Root Rebinding in Skills Download
- CVE-2026-33573 OpenClaw < 2026.3.11 - Workspace Boundary Bypass via Agent RPC Parameters
- CVE-2026-33572 OpenClaw < 2026.2.17 - Insufficient File Permissions in Session Transcript Files
- CVE-2026-33570 Subnet Solutions PowerSYSTEM Center Incorrect Authorization
- CVE-2026-3357 IBM Langflow Desktop FAISS Vector Store Remote Code Execution via malicious Pickle file
- CVE-2026-33569 Anviz Products Cleartext Transmission of Sensitive Information
- CVE-2026-33568 Command injection in Totolink
- CVE-2026-33566 Code injection in LogonTracer
- CVE-2026-33565 kernel_linux_common_modules has a Race Condition vulnerability
- CVE-2026-33560 Daktronics Controller Firmware Unrestricted Upload of File with Dangerous Type
- CVE-2026-3356 Missing Authentication for Critical Function vulnerability in Anritsu Remote Spectrum Monitor
- CVE-2026-33559 Cross-site scripting in OpenStreetMap
- CVE-2026-33558 Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output
- CVE-2026-33557 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication
- CVE-2026-33555 Other in HAProxy
- CVE-2026-33554 Memory corruption in FreeIPMI
- CVE-2026-33553 Northern.tech CFEngine Enterprise 3.24.3 before 3.24.4 and 3.27.0 before 3.27.1 allows XSS.
- CVE-2026-33552 Northern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Control.
- CVE-2026-33551 OpenStack Keystone: Restricted application credentials can create EC2 credentials
- CVE-2026-33550 Weak cryptography in SOGo
- CVE-2026-3355 Customer Reviews for WooCommerce <= 5.101.0 - Reflected Cross-Site Scripting via 'crsearch'
- CVE-2026-33549 Privilege escalation in SPIP
- CVE-2026-33548 MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline
- CVE-2026-33545 MobSF has SQL Injection in its SQLite Database Viewer Utils
- CVE-2026-33544 Tinyauth has OAuth account confusion via shared mutable state on singleton service instances
- CVE-2026-33543 FOSSBilling: Authentication bypass allows unauthenticated administrator creation
- CVE-2026-33542 Incus does not verify combined fingerprint when downloading images from simplestreams servers
- CVE-2026-33541 TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service
- CVE-2026-33540 Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm
- CVE-2026-3354 Wikilookup <= 1.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Popup Width' Setting
- CVE-2026-33539 Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter
- CVE-2026-33538 Parse Server: Denial of service via unindexed database query for unconfigured auth providers
- CVE-2026-33537 Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked
- CVE-2026-33536 ImageMagick has an Out-of-bounds Write via InterpretImageFilename
- CVE-2026-33535 ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction
- CVE-2026-33534 EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation
- CVE-2026-33533 Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard
- CVE-2026-33532 yaml is vulnerable to Stack Overflow via deeply nested YAML collections
- CVE-2026-33531 InvenTree has Path Traversal In Report Templates
- CVE-2026-33530 InvenTree Vulnerable to ORM Filter Injection
- CVE-2026-3353 Comment SPAM Wiper <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting
- CVE-2026-33529 Zoraxy: Authenticated Path Traversal in Config Import leads to RCE
- CVE-2026-33528 GoDoxy has a Path Traversal Vulnerability in its File API
- CVE-2026-33527 Parse Server: Session update endpoint allows overwriting server-generated session fields
- CVE-2026-33526 Squid vulnerable to Denial of Service in ICP Request handling
- CVE-2026-33525 Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting
- CVE-2026-33524 Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization
- CVE-2026-33523 Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line
- CVE-2026-33522 BUG-000182936 - ArcGIS Server has a security vulnerability.
- CVE-2026-33521 BUG-000186514 - ArcGIS Server has a security vulnerability.
- CVE-2026-33520 BUG-000185167 - ArcGIS Server has a security vulnerability.
- CVE-2026-3352 Easy PHP Settings <= 1.0.4 - Authenticated (Administrator+) PHP Code Injection via 'wp_memory_limit' Setting
- CVE-2026-33519 Incorrect privilege assignment in Portal for ArcGIS
- CVE-2026-33518 Incorrect privilege assignment in Portal for ArcGIS
- CVE-2026-33517 MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation
- CVE-2026-33516 xrdp: Pre-authentication out-of-bounds reads in RDP capability and channel parsers
- CVE-2026-33515 Squid has issues in ICP message handling
- CVE-2026-33514 Discourse: Information Disclosure in Form Template API Due to Missing Authorization
- CVE-2026-33513 AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)
- CVE-2026-33512 AVideo has an unauthenticated decrypt oracle leaking any ciphertext
- CVE-2026-33511 pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad
- CVE-2026-33510 DOM-Based XSS in Homarr /auth/login Redirect
- CVE-2026-3351 Authorization Bypass in LXD GET /1.0/certificates Endpoint
- CVE-2026-33509 pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration
- CVE-2026-33508 Parse Server: LiveQuery subscription query depth bypass
- CVE-2026-33507 AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload
- CVE-2026-33506 DOM-Based XSS in Ory Polis Login Page
- CVE-2026-33505 Ory Keto has a SQL injection via forged pagination tokens
- CVE-2026-33504 Ory Hydra has a SQL injection via forged pagination tokens
- CVE-2026-33503 Ory Kratos has a SQL injection via forged pagination tokens
- CVE-2026-33502 AVideo has Unauthenticated SSRF via plugin/Live/test.php
- CVE-2026-33501 AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin
- CVE-2026-33500 AVideo Vulnerable to Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization
- CVE-2026-3350 Image Alt Text Manager <= 1.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Title
- CVE-2026-33499 AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php
- CVE-2026-33498 Parse Server: Query condition depth bypass via pre-validation transform pipeline
- CVE-2026-33497 Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading