Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 713 of 1013.
- CVE-2026-33096 HTTP.sys Denial of Service Vulnerability
- CVE-2026-33095 Microsoft Word Remote Code Execution Vulnerability
- CVE-2026-33093 Anviz Products Missing Authorization
- CVE-2026-33092 Privilege escalation in Acronis True Image
- CVE-2026-3309 Code injection in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- CVE-2026-33088 SQL injection in Movable Type
- CVE-2026-33084 DataEase has SQL Injection through its getFieldEnumObj Endpoint
- CVE-2026-33083 DataEase has SQL Injection in Order By Clause
- CVE-2026-33082 DataEase: SQL Injection in v2 Dataset Export
- CVE-2026-33081 PinchTab has Blind SSRF via browser-side redirect bypass in /download URL validation
- CVE-2026-33080 Filament: Unvalidated Range and Values summarizer values can be used for XSS
- CVE-2026-3308 CVE-2026-3308
- CVE-2026-33079 Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles
- CVE-2026-33078 Roxy-WI has SQL Injection in haproxy_section_save Endpoint via Unsanitized server_ip Parameter
- CVE-2026-33077 Roxy-WI has an arbitrary file read vulnerability
- CVE-2026-33076 Roxy-WI vulnerable to path traversal and arbitrary file writing
- CVE-2026-33075 FastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.yml
- CVE-2026-33074 Discourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptions
- CVE-2026-33073 discourse-subscriptions plugin leaking stripe API key in multisite environment
- CVE-2026-33072 FileRise: Default Encryption Key Enables Token Forgery and Config Decryption
- CVE-2026-33071 FileRise: WebDAV upload path bypasses filename validation enforced by regular uploads
- CVE-2026-33070 FileRise has Unauthenticated Share Link Deletion
- CVE-2026-3307 Missing authorization in Enterprise Server
- CVE-2026-33069 PJSIP has an Out-of-bounds Read in SIP multipart parsing
- CVE-2026-33068 Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File
- CVE-2026-33067 SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata
- CVE-2026-33066 SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering
- CVE-2026-33065 free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request
- CVE-2026-33064 free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference
- CVE-2026-33063 free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface Conversion
- CVE-2026-33062 free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter
- CVE-2026-33061 Jexactyl has Stored DOM Cross-Site Scripting (XSS) via unescaped JSON in Blade template
- CVE-2026-33060 CKAN MCP Server: SSRF via base_url allows access to internal networks
- CVE-2026-3306 Missing authorization in Enterprise Server
- CVE-2026-33058 Kanboard has Authenticated SQL Injection in Project Permissions Handler
- CVE-2026-33057 Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py
- CVE-2026-33056 tar-rs: unpack_in can chmod arbitrary directories by following symlinks
- CVE-2026-33055 tar-rs incorrectly ignores PAX size headers if header size is nonzero
- CVE-2026-33054 Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion
- CVE-2026-33053 Langflow has Missing Ownership Verification in API Key Deletion (IDOR)
- CVE-2026-33052 MantisBT: Authorization Bypass in Global Profile Creation
- CVE-2026-33051 Craft CMS Vulnerable to Stored XSS in Revision Context Menu
- CVE-2026-33047 Combodo iTop: Object can be locked by a user without write permissions
- CVE-2026-33046 Indico discloses local files resulting in Remote Code Execution through LaTeX injection
- CVE-2026-33045 Home Assistant has stored XSS in history-graphs
- CVE-2026-33044 Home Assistant has stored XSS in Map-card through malicious device name
- CVE-2026-33043 AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS
- CVE-2026-33042 Parse Server affected by empty authData bypassing credential requirement on signup
- CVE-2026-33041 AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php
- CVE-2026-33040 libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow
- CVE-2026-3304 Multer vulnerable to Denial of Service via incomplete cleanup
- CVE-2026-33039 AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy
- CVE-2026-33038 AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments
- CVE-2026-33037 WWBN AVideo has predictable default admin credentials in official Docker deployment path
- CVE-2026-33036 fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
- CVE-2026-33035 Unauthenticated Reflected XSS via innerHTML in AVideo
- CVE-2026-33034 Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass
- CVE-2026-33033 Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload
- CVE-2026-33032 Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover
- CVE-2026-33031 Nginx-UI: Disabled users retain full API access through previously issued bearer tokens
- CVE-2026-33030 Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys
- CVE-2026-3303 IBM Concert Software Permissive Cross-domain Security Policy
- CVE-2026-33029 Nginx UI: DoS via Negative Integer Input in Logrotate Interval
- CVE-2026-33028 Nginx UI: Race Condition Leads to Persistent Data Corruption and Service Collapse
- CVE-2026-33027 Nginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory
- CVE-2026-33026 nginx-ui Backup Restore Allows Tampering with Encrypted Backups
- CVE-2026-33025 AVideo-Encoder is Vulnerable to Authenticated SQL Injection via ORDER BY Clause
- CVE-2026-33024 AVideo-Encoder has Unauthenticated Blind Server-Side Request Forgery via Public Thumbnail Generator
- CVE-2026-33023 libsixel: Use-after-free in load_with_gdkpixbuf()
- CVE-2026-33022 Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun
- CVE-2026-33021 libsixel: Use-after-free in sixel_encoder_encode_bytes()
- CVE-2026-33020 libsixel: Integer Overflow in write_png_to_file() leads to Heap-based Buffer Overflow
- CVE-2026-3302 SourceCodester Doctor Appointment System Sign Up register.php cross site scripting
- CVE-2026-33019 libsixel: Integer overflow leads to Out-of-bounds Read in img2sixel
- CVE-2026-33018 libsixel: Use-After-Free in load_gif()
- CVE-2026-33017 Langflow Code Injection
- CVE-2026-33015 EVerest has RemoteStop Bypass via BCB Toggle Session Restart
- CVE-2026-33014 EVerest has Delayed Authorization Response Bypasses Termination After RemoteStop
- CVE-2026-33013 Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices
- CVE-2026-33012 Micronaut Framework vulnerable to a Denial of Service in HTML error response caching
- CVE-2026-33011 Nest Fastify HEAD Request Middleware Bypass
- CVE-2026-33010 mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft
- CVE-2026-3301 Totolink N300RH Web Management cstecgi.cgi setWebWlanIdx os command injection
- CVE-2026-33009 EVerest: MQTT Switch-Phases Command Data Race Causing Charger State Corruptio
- CVE-2026-33007 Apache HTTP Server: mod_authn_socache crash
- CVE-2026-33006 Apache HTTP Server: mod_auth_digest timing attack
- CVE-2026-33005 Apache OpenMeetings: Insufficient checks in FileWebService
- CVE-2026-33004 Jenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form
- CVE-2026-33003 Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files
- CVE-2026-33002 Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation
- CVE-2026-33001 Jenkins has a link following vulnerability allows arbitrary file creation
- CVE-2026-33000 Command injection in UniFi OS Server
- CVE-2026-3300 Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field
- CVE-2026-32999 Code injection in Comet Backup
- CVE-2026-32998 Code injection in Service Provider Console
- CVE-2026-32997 Path traversal in Backup and Replication
- CVE-2026-32996 Privilege escalation in Backup and Replication
- CVE-2026-32995 Missing authorization in Rocket.Chat
- CVE-2026-32994 Missing authorization in Rocket.Chat
- CVE-2026-32993 Other in WP Squared