Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 709 of 1013.
- CVE-2026-33496 Ory Oathkeeper has an authentication bypass by cache key confusion
- CVE-2026-33495 Ory Oathkeeper has an authentication bypass by usage of untrusted header
- CVE-2026-33494 Ory Oathkeeper has a path traversal authorization bypass
- CVE-2026-33493 AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter
- CVE-2026-33492 AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration
- CVE-2026-33491 Zen-C has Stack-Based Buffer Overflow in Identifier Mangling
- CVE-2026-33490 h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
- CVE-2026-3349 MinhNhut Link Gateway <= 3.6.1 - Reflected Cross-Site Scripting via 'url' Parameter
- CVE-2026-33489 CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison
- CVE-2026-33488 AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin
- CVE-2026-33487 goxmldsig has validateSignature Loop Variable Capture Signature Bypass
- CVE-2026-33486 Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents
- CVE-2026-33485 AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter
- CVE-2026-33484 Langflow has Unauthenticated IDOR on Image Downloads
- CVE-2026-33483 AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php
- CVE-2026-33482 AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()
- CVE-2026-33481 Syft improper temporary file cleanup
- CVE-2026-33480 AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy
- CVE-2026-3348 MinhNhut Link Gateway <= 3.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting via Plugin Settings
- CVE-2026-33479 AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin
- CVE-2026-33478 AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
- CVE-2026-33477 FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content
- CVE-2026-33476 SiYuan has an Unauthenticated Arbitrary File Read via Path Traversal
- CVE-2026-33475 Langflow GitHub Actions Shell Injection
- CVE-2026-33474 Vikunja Affected by DoS via Image Preview Generation
- CVE-2026-33473 Vikunja has TOTP Reuse During Validity Window
- CVE-2026-33472 Cryptomator Hub OAuth token exchange HTTP downgrade via getAuthority() scheme confusion (CVE-2026-32303 bypass)
- CVE-2026-33471 nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation
- CVE-2026-33470 Missing authorization in frigate
- CVE-2026-3347 Multi Functional Flexi Lightbox <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via 'message' Parameter
- CVE-2026-33469 Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw
- CVE-2026-33468 Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings
- CVE-2026-33467 Improper Verification of Cryptographic Signature in Elastic Package Registry Leading to Package Integrity Bypass
- CVE-2026-33466 Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write
- CVE-2026-33465 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-33464 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
- CVE-2026-33463 Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File Access
- CVE-2026-33462 Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts
- CVE-2026-33461 Incorrect Authorization in Kibana Fleet Leading to Information Disclosure
- CVE-2026-33460 Incorrect Authorization in Kibana Fleet Leading to Information Disclosure
- CVE-2026-3346 Stored Cross-Site Scripting (XSS) in Langflow Markdown Rendering via rehypeRaw
- CVE-2026-33459 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
- CVE-2026-33458 Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure
- CVE-2026-33457 Potential livestatus injection in prediction graph page
- CVE-2026-33456 Potential livestatus injection in notification test
- CVE-2026-33455 Livestatus injection in monitoring quicksearch
- CVE-2026-33454 Apache Camel's Camel-Mail component is vulnerable to Camel message header injection
- CVE-2026-33453 Apache camel-coap allows header injection that can lead to remote code execution
- CVE-2026-33452 Buffer overflow in Windows clients prior to 14.50
- CVE-2026-33451 Arbitrary read/write vulnerability in Windows clients prior to 14.50
- CVE-2026-33450 Out of bounds read in Secure Access MacOS clients prior to 14.50
- CVE-2026-3345 Path Traversal and Arbitrary File Write Vulnerability in IBM Langflow Desktop API v2 File Upload Endpoint
- CVE-2026-33449 Message handler buffer overflow in clients prior to 14.50
- CVE-2026-33448 Format string vulnerability in MacOS clients prior to 14.50
- CVE-2026-33447 Memory corruption in Secure Access
- CVE-2026-33446 Buffer overflow in client authentication prior to version 14.50
- CVE-2026-33445 Memory management vulnerability in Secure Access servers
- CVE-2026-33444 Memory management vulnerability in Secure Access servers
- CVE-2026-33443 Memory management error in Secure Access servers prior to 14.55
- CVE-2026-33442 Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.
- CVE-2026-33440 Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads
- CVE-2026-3344 WatchGuard Firebox System Integrity Check Bypass
- CVE-2026-33439 Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM
- CVE-2026-33438 Stirling-PDF vulnerable to DoS via add-watermark
- CVE-2026-33437 Stirling PDF: Stored XSS in Info Summary
- CVE-2026-33436 Stirling-PDF: Reflected XSS through crafted filename in file upload functionality
- CVE-2026-33435 Weblate: Remote code execution during backup restoration
- CVE-2026-33434 Wazuh: Rate Limit Bypass via /events Endpoint
- CVE-2026-33433 Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField
- CVE-2026-33432 Roxy-WI has Pre-Authentication LDAP Injection that Leads to Authentication Bypass
- CVE-2026-33431 Roxy-WI Vulnerable to Authenticated Arbitrary File Read via Path Traversal in Config Version Viewer
- CVE-2026-33430 Briefcase: Windows MSI Installer Privilege Escalation via Insecure Directory Permissions
- CVE-2026-3343 WatchGuard Firebox Reflected Cross-Site-Scripting (XSS) Vulnerability in Fireware Web UI
- CVE-2026-33429 Parse Server: Protected field change detection oracle via LiveQuery watch parameter
- CVE-2026-33428 Discourse Allows Unauthorized Access to Deleted Posts Index via Group Membership
- CVE-2026-33427 Discourse Authorization Page Displays Unvalidated Redirect Domain
- CVE-2026-33426 Discourse users can edit or synonymize hidden tags they can't see
- CVE-2026-33425 Discourse has inferable private group membership or existence via exclude_groups parameter
- CVE-2026-33424 PM access granted through invites after access revocation
- CVE-2026-33423 Discourse staff can modify any user's group notification level
- CVE-2026-33422 Discourse exposes ip_address of flagged user
- CVE-2026-33421 Parse Server: LiveQuery bypasses CLP pointer permission enforcement
- CVE-2026-33420 Vaultwarden missing authorization check allows Manager-role users to enumerate all collections
- CVE-2026-3342 WatchGuard Firebox Out of Bounds Write Vulnerability
- CVE-2026-33419 MinIO: LDAP login brute-force via user enumeration and missing rate limit
- CVE-2026-33418 @dicebear/converter ensureSize() Vulnerable to SVG Dimension Capping Bypass via XML Comment Injection
- CVE-2026-33417 Wallos: Password Reset Tokens Never Expire
- CVE-2026-33416 LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`
- CVE-2026-33415 Discourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content Exposure
- CVE-2026-33414 PowerShell Command Injection in Podman HyperV Machine
- CVE-2026-33413 etcd: Authorization bypasses in multiple APIs
- CVE-2026-33412 Vim affected by Command injection via newline in glob()
- CVE-2026-33411 Discourse's solved topic stream has potential stored XSS in topic title
- CVE-2026-33410 Discourse hardens chat DM channel creation and expansion
- CVE-2026-3341 IBM Langflow Desktop 1.0.0 - 1.9.2 DNS Rebinding Bypasses SSRF Protection Allowing Access to Internal Services
- CVE-2026-33409 Parse Server: Auth provider validation bypass on login via partial authData
- CVE-2026-33408 Discourse has Improper Authorization in "Post Edits" Report For Moderators
- CVE-2026-33407 Wallos: SSRF via HTTP Proxy Environment Variable
- CVE-2026-33406 Pi-hole has a Stored HTML attribute injection
- CVE-2026-33405 Pi-hole has a Stored HTML Injection in queries.js