Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 710 of 1013.
- CVE-2026-33404 Pi-hole has a Stored XSS / HTML injection in the Network page/Dashboard
- CVE-2026-33403 Pi-hole has a Reflected XSS / HTML injection in taillog.js
- CVE-2026-33402 SAK-52311: Sakai site-manage group titles can contain XSS content
- CVE-2026-33401 Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php
- CVE-2026-33400 Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint
- CVE-2026-3340 Server-Side Request Forgery (SSRF) in Langflow URL Component
- CVE-2026-33399 Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840
- CVE-2026-33398 Authenticated users can read hidden forum posts through `/forum/get_quotes`
- CVE-2026-33397 Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass
- CVE-2026-33396 Command injection in oneuptime
- CVE-2026-33395 Discourse has stored click‑based XSS via Graphviz SVG javascript: links
- CVE-2026-33394 Discourse leaks PM post edits to moderators
- CVE-2026-33393 Discourse fixes loose hostname matching in spam host allowlist
- CVE-2026-33392 Code injection in YouTrack
- CVE-2026-33391 Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0
- CVE-2026-33390 Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0
- CVE-2026-3339 Keep Backup Daily <= 2.1.1 - Authenticated (Admin+) Limited Path Traversal via 'kbd_path' Parameter
- CVE-2026-33389 Security feature bypass in Arc
- CVE-2026-33388 Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0
- CVE-2026-33387 Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0
- CVE-2026-33386 XSS in QuickCMS
- CVE-2026-33385 Blind SQL Injection in Quick.CMS
- CVE-2026-33384 Session Fixation in QuickCMS
- CVE-2026-33382 Denial of service via unbounded request body size
- CVE-2026-33381 Users can generate Service Account tokens after permissions removal
- CVE-2026-33380 SQL Expressions Read File From Disk
- CVE-2026-3338 PKCS7_verify Signature Validation Bypass in AWS-LC
- CVE-2026-33378 Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro
- CVE-2026-33377 Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin
- CVE-2026-33376 Auth Proxy IPv6 whitelist bypass
- CVE-2026-33375 Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS
- CVE-2026-33374 Unbounded memory allocation in the Prometheus rule conversion API
- CVE-2026-33373 Cross-site request forgery in synacor:zimbra collaboration suite
- CVE-2026-33372 Cross-site request forgery in synacor:zimbra collaboration suite
- CVE-2026-33371 XML external entity in synacor:zimbra collaboration suite
- CVE-2026-33370 Cross-site scripting in synacor:zimbra collaboration suite
- CVE-2026-3337 Timing Side-Channel in AES-CCM Tag Verification in AWS-LC
- CVE-2026-33369 Other in synacor:zimbra collaboration suite
- CVE-2026-33368 Cross-site scripting in synacor:zimbra collaboration suite
- CVE-2026-33367 Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function
- CVE-2026-33366 Missing authorization in BUFFALO Wi-Fi router products
- CVE-2026-33362 Meari SDK hardcoded cryptographic keys
- CVE-2026-33361 Meari weak XOR obfuscation
- CVE-2026-3336 PKCS7_verify Certificate Chain Validation Bypass in AWS-LC
- CVE-2026-33359 Meari unauthenticated alert image access in cloud object storage
- CVE-2026-33357 Meari OpenAPI device status IDOR
- CVE-2026-33356 Meari MQTT broker missing per-device subscribe ACL
- CVE-2026-33355 Discourse filters whisper posts from private-posts feed
- CVE-2026-33354 AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`
- CVE-2026-33353 Soft Serve: Authenticated repo import can clone server-local private repositories
- CVE-2026-33352 AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)
- CVE-2026-33351 AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass
- CVE-2026-33350 LORIS has a SQL injection in MRI feedback popup
- CVE-2026-3335 Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload
- CVE-2026-33349 fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation
- CVE-2026-33348 OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3
- CVE-2026-33347 league/commonmark has an embed extension allowed_domains bypass
- CVE-2026-33346 OpenEMR has stored XSS in portal_payment.php via Unescaped table_args
- CVE-2026-33345 solidtime vulnerable to IDOR in private projects
- CVE-2026-33344 Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG
- CVE-2026-33343 etcd: Nested etcd transactions bypass RBAC authorization checks
- CVE-2026-33340 LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint
- CVE-2026-3334 CMS Commander <= 2.288 - Authenticated (Custom+) SQL Injection via 'or_blogname' Parameter
- CVE-2026-33337 Firebird has a buffer overflow when parsing corrupted slice packets
- CVE-2026-33336 Vikunja Desktop vulnerable to Remote Code Execution via same-window navigation
- CVE-2026-33335 Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal
- CVE-2026-33334 Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration
- CVE-2026-33333 Combodo iTop: Information disclosure in ajax.render.php
- CVE-2026-33332 NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
- CVE-2026-33331 oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
- CVE-2026-33330 FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback
- CVE-2026-3333 MinhNhut Link Gateway <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-33329 Path traversal in FileRise
- CVE-2026-33328 Possible integer overflow on 32-bit systems when reading GIF images
- CVE-2026-33327 Possible integer overflow leading to potential heap-based buffer overflow
- CVE-2026-33326 @keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany
- CVE-2026-33324 SQLBot prompt injection allows arbitrary SQL execution and remote code execution
- CVE-2026-33323 Parse Server: Email verification resend page leaks user existence
- CVE-2026-33322 MinIO: JWT Algorithm Confusion in OIDC Authentication
- CVE-2026-33321 OpenEMR has Out-of-Band Server-Side Request Forgery (OOB SSRF)
- CVE-2026-33320 Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
- CVE-2026-3332 Xhanch - My Advanced Settings <= 1.1.2 - Cross-Site Request Forgery to Settings Update
- CVE-2026-33319 AVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command
- CVE-2026-33318 Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers
- CVE-2026-33317 OP-TEE: PKCS#11 TA out-of-bounds read and memory disclosure
- CVE-2026-33316 Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement
- CVE-2026-33315 Vikunja has a 2FA Bypass via Caldav Basic Auth
- CVE-2026-33314 pyload-ng: Improper Authentication and Origin Validation Error
- CVE-2026-33313 Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments
- CVE-2026-33312 Read-only Vikunja users can delete project background images via broken object-level authorization
- CVE-2026-33311 @dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized Options
- CVE-2026-33310 Intake has a Command Injection via shell() Expansion in Parameter Defaults
- CVE-2026-3331 Lobot Slider Administrator <= 0.6.0 - Cross-Site Request Forgery to Settings Update
- CVE-2026-33309 Langflow has an Arbitrary File Write (RCE) via v2 API
- CVE-2026-33308 mod_gnutls missing key purpose check in client certificate verification
- CVE-2026-33307 mod_gnutils has stack-based buffer overflow caused by a long client certificate chain
- CVE-2026-33306 bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby
- CVE-2026-33305 OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor
- CVE-2026-33304 OpenEMR has Authorization Bypass in Dated Reminders Log
- CVE-2026-33303 OpenEMR Vulnerable to Stored XSS via Unescaped portal_login_username in Credential Print View