Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 711 of 1013.
- CVE-2026-33302 OpenEMR: zhAclCheck Ignores Explicit ACL Denies
- CVE-2026-33301 OpenEMR has arbitrary image file read via PDF generator
- CVE-2026-33300 Discourse: Hidden group names and access metadata are exposed to moderators through the `category-chatables` endpoint
- CVE-2026-3330 Form Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter
- CVE-2026-33299 OpenEMR has Stored XSS in patient encounter Eye Exam form answers
- CVE-2026-33298 llama.cpp has a Heap Buffer Overflow via Integer Overflow in GGUF Tensor Parsing
- CVE-2026-33297 AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php
- CVE-2026-33296 AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php
- CVE-2026-33295 AVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.php
- CVE-2026-33294 AVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources
- CVE-2026-33293 AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
- CVE-2026-33292 AVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos
- CVE-2026-33291 Discourse user can create Zendesk tickets even when it does not have access to topic
- CVE-2026-33290 Missing authorization in wp-graphql
- CVE-2026-3329 Nexus Repository Manager - Improper Restriction of Excessive Authentication Attempts
- CVE-2026-33289 SuiterCRM has LDAP Filter Injection in Authentication Module
- CVE-2026-33288 SuiteCRM has Authenticated SQL Injection in Authentication Module
- CVE-2026-33287 LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
- CVE-2026-33286 Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names
- CVE-2026-33285 LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
- CVE-2026-33284 GlobalLeaks has insufficient URL validation in user support API
- CVE-2026-33283 Ella Core panics on malformed ULNASTransport Message without a Request Type
- CVE-2026-33282 Ella Core panics on malformed NGAP Location Report
- CVE-2026-33281 Ella Core panics on invalid PDU Session IDs in NGAP messages
- CVE-2026-33280 Command injection in BUFFALO Wi-Fi router products
- CVE-2026-3328 Deserialization in Frontend Admin by DynamiApps
- CVE-2026-33278 Possible arbitrary code execution during DNSSEC validation
- CVE-2026-33277 Command injection in LogonTracer
- CVE-2026-33276 XSS in Unified Search via Unescaped Host/Service Names
- CVE-2026-33273 File upload in MATCHA INVOICE
- CVE-2026-33272 Red Lion Controls N-Tron 700 Series Authentication Bypass Using an Alternate Path or Channel
- CVE-2026-33271 Privilege escalation in Acronis True Image
- CVE-2026-3327 Authenticated DatoCMS Web Previews Plugin Iframe Injection
- CVE-2026-33268 Nanoleaf Lines unauthenticated firmware file store
- CVE-2026-33267 Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata
- CVE-2026-33266 Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt
- CVE-2026-33265 Information disclosure in LibreChat
- CVE-2026-33264 Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
- CVE-2026-33263 Denial of service in OX Dovecot CE
- CVE-2026-33262 Insufficient validation of cookie reply
- CVE-2026-33261 Null pointer accces in aggressive NSEC(3) cache
- CVE-2026-33260 Insufficient input validation of internal webserver
- CVE-2026-3326 XStore < 9.7.3 - Unauthenticated SQLi
- CVE-2026-33259 Concurrent modification of RPZ data can lead to denial of servce
- CVE-2026-33258 Crafted zones can cause increased resource usage
- CVE-2026-33257 Insufficient input validation of internal webserver
- CVE-2026-33256 Unbounded memory allocation by internal web server
- CVE-2026-33254 Resource exhaustion via DoQ/DoH3 connections
- CVE-2026-33253 Privilege escalation in SANUPS SOFTWARE
- CVE-2026-33252 MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion
- CVE-2026-33251 Discourse has a Hidden Solved topics permission bypass
- CVE-2026-33250 Crash when receiving specially-crafted packets
- CVE-2026-3325 SQL injection in MegaCMS by CRM Sistemas de Fidelización
- CVE-2026-33249 NATS: Message tracing can be redirected to arbitrary subject
- CVE-2026-33248 NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching
- CVE-2026-33247 NATS credentials are exposed in monitoring port via command-line argv
- CVE-2026-33246 NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers
- CVE-2026-33245 React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
- CVE-2026-33244 React Router has stored XSS via unescaped Location header in prerendered redirect HTML
- CVE-2026-33243 barebox: FIT Signature Verification Bypass Vulnerability
- CVE-2026-33242 Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass
- CVE-2026-33241 Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing
- CVE-2026-33240 Combodo iTop: Reflected XSS in foreign key search criteria
- CVE-2026-3324 Authentication Bypass
- CVE-2026-33238 AVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem Enumeration
- CVE-2026-33237 AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation
- CVE-2026-33236 NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite
- CVE-2026-33235 AutoGPT: Denial of Service (DoS) via Resource Exhaustion in text templating features
- CVE-2026-33234 AutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP server
- CVE-2026-33233 AutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries
- CVE-2026-33232 AutoGPT: Unauthenticated DoS via Disk Space Exhaustion
- CVE-2026-33231 NLTK has unauthenticated remote shutdown in nltk.app.wordnet_app
- CVE-2026-33230 nltk Vulnerable to Cross-site Scripting
- CVE-2026-3323 VEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices
- CVE-2026-33229 XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API
- CVE-2026-33228 flatted: Prototype Pollution via parse()
- CVE-2026-33227 Apache ActiveMQ: Improper validation and restriction of a classpath path name
- CVE-2026-33226 Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview
- CVE-2026-33223 NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing
- CVE-2026-33222 NATS JetStream has an authorization bypass through its Management API
- CVE-2026-33221 Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload
- CVE-2026-33220 Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository
- CVE-2026-3322 Privilege escalation via request replaying in Lobster_pro
- CVE-2026-33219 NATS is vulnerable to pre-auth DoS through WebSockets client service
- CVE-2026-33218 NATS has pre-auth server panic via leafnode handling
- CVE-2026-33217 NATS allows MQTT clients to bypass ACL checks
- CVE-2026-33216 NATS has MQTT plaintext password disclosure
- CVE-2026-33215 NATS is vulnerable to MQTT hijacking via Client ID
- CVE-2026-33214 Weblate has improper access control for the translation memory API
- CVE-2026-33213 Redash: Open redirect vulnerability in post-login redirect handling
- CVE-2026-33212 Weblate: Improper access control for pending tasks in API
- CVE-2026-33211 Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod
- CVE-2026-33210 Ruby JSON has a format string injection vulnerability
- CVE-2026-3321 Authorization Bypass in ON24 Q&A chat
- CVE-2026-33209 Avo has a XSS vulnerability on `return_to` param
- CVE-2026-33208 Roxy-WI Vulnerable to Authenticated Remote Code Execution via OS Command Injection in find-in-config Endpoint
- CVE-2026-33207 DataEase SQL Injection Vulnerability
- CVE-2026-33206 calibre has a path traversal vulnerability
- CVE-2026-33205 calibre has Server-Side Request Forgery in ebook viewer backend
- CVE-2026-33204 SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering